> For the complete documentation index, see [llms.txt](https://mrm8brh.gitbook.io/splunk/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://mrm8brh.gitbook.io/splunk/integrations/fortigate.md).

# FortiGate

### Install FortiGate Add-on for Splunk

[FortiGate Add-on for Splunk](https://splunkbase.splunk.com/app/2846)

* You can install FortiGate Add-on for Splunk on search head, indexer, forwarder or single instance Splunk server.

### Install FortiGate Application for Splunk

[FortiGate Application for Splunk](https://splunkbase.splunk.com/app/2800)

* Download and install the App
* Settings, Data models, Fortinet FOS Log, accelrate
* `/opt/splunk/bin/splunk restart`
* Search & Reporting App, index=fortigate, Check for sourcetype feild (fortigate\_traffic, fortigate\_utm, fortigate\_event)
* Enterprise Security -> Security Domains

[Fortinet-Splunk-Deployment-Guide](https://www.fortinet.com/content/dam/fortinet/assets/alliances/Fortinet-Splunk-Deployment-Guide.pdf) [Technical Tip: How to configure syslog on FortiGate](https://community.fortinet.com/t5/FortiGate/Technical-Tip-Change-Source-IP-for-SYSLOG/ta-p/230218)

FortiGate Firewall Side

```
config log syslogd2 setting
    set status enable
    set server "Syslog IP"
    set port "5514"
    set mode "udp"
    set source-ip "Forti Mgmt IP"
end
```