---
title: "Integrate Fortinet FortiGate with Red Canary"
slug: "integrate-fortinet-fortigate-with-red-canary"
updated: 2026-09-09T16:09:35Z
published: 2026-09-09T16:09:35Z
canonical: "docs.redcanary.com/integrate-fortinet-fortigate-with-red-canary"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.redcanary.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Integrate Fortinet FortiGate with Zscaler MDR

> [!NOTE]
> **Note:** Zscaler MDR is now Zscaler MDR. Please bear with us while we update the naming in our third-party integrations.

Integrating Fortinet FortiGate with Zscaler MDR enhances threat detection and response capabilities by combining advanced firewall protection with expert threat hunting. To integrate Fortinet FortiGate with Zscaler MDR, follow the procedure below from beginning to end.

## **Prerequisites**

Before you connect Fortinet FortiGate to Zscaler MDR, make sure the following configuration requirement is met:

- Make sure that you have [OpenSSL (version 3.1 or higher)](https://www.openssl.org/source/) installed.
- Confirm that your configured DNS can resolve our collector.

For example, Fortinet FortiGuard labels our collector as **Category: Meaningless Content** which may be configured to be ignored by customers config.

## **Step 1: Zscaler MDR–Create your Zscaler MDR generated URL**

Create a Zscaler MDR provided-URL to send Fortinet FortiGate alerts for ingestion.

1. In the Zscaler MDR portal, click **Integrations**, then click **Add Integration**.

![Add a new Red Canary integration](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/integrations-main.png?sv=2026-02-06&spr=https&st=2026-11-04T15%3A02%3A52Z&se=2026-11-04T16%3A02%3A52Z&sr=c&sp=r&sig=AEuERHU%2FdVRhlL3rS6SpZhVLPpQCdkFAAZINtsoQzYM%3D)
2. Type and then select Fortinet FortiGate (NGFW).

![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/fortinet.png?sv=2026-02-06&spr=https&st=2026-11-04T15%3A02%3A52Z&se=2026-11-04T16%3A02%3A52Z&sr=c&sp=r&sig=AEuERHU%2FdVRhlL3rS6SpZhVLPpQCdkFAAZINtsoQzYM%3D)
3. Click **Configure**.
4. Enter a name for your external alert source.
5. Select a display category.
6. From the Ingest Format/Method dropdown, select **Fortinet FortiGate via Syslog**.
7. Click **Save Configuration**.
8. Click **Edit Configuration**.
9. Click **Activate**.
10. After a few minutes, Zscaler MDR will generate a URL (Collector ID) that you will use to input into your Fortinet FortiGate account.

**Example**: prod1-use2-1234567.prod1.collectors.redcanary.io

![New.png](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/8087828402455.png?sv=2026-02-06&spr=https&st=2026-11-04T15%3A02%3A52Z&se=2026-11-04T16%3A02%3A52Z&sr=c&sp=r&sig=AEuERHU%2FdVRhlL3rS6SpZhVLPpQCdkFAAZINtsoQzYM%3D)

## **Step 2: Command Line–Generate passphrase keys and TLS certificates**

Generate the necessary keys and Transport Layer Security (TLS) certificates that are used to configure the FortiGate platform to send Syslog events to Zscaler MDR.

> **Note**: Use PowerShell for Windows machines, and Linux or Terminal for Mac OS. The commands below are Linux-based. For the below commands you should be running OpenSSL version 3.1 or later.

1. Open your native terminal.
2. Copy and run the command below to Generate Private Key for root CA:
  1. openssl genrsa -out rootCA.key 4096
3. Copy and run the command below to Generating the Public Key for Signing Certificates:
  1. openssl req -x509 -new -nodes -key rootCA.key -sha256 -days 3650 -out rootCA.pem
  2. Enter the values requested.

> [!NOTE]
> **Note:** You can leave all of these values at default if you want. The only entry that you NEED to enter is the CN.
  3. Enter an identifier when prompted for a Common Name (CN).

Example: `RedCanaryCA`
4. Copy and run the command below to Generate Private Key:
  1. openssl genrsa -out server.key 2048
5. Create Server Config File. This file will get generated in the same file location that you are generating your Certificate files (i.e., whatever directory you’re in while running the openssl commands).

> [!NOTE]
> **Note:** This config file describes the certificate request the certificate authority will then sign.
  1. Enter: vi server.cnf.
    1. ```plaintext
Enter: vi server.cnf. 

## Inside the server.cnf please enter the following lines: 

[req]
default_bits = 2048
prompt = no
default_md = sha256
req_extensions = req_ext
distinguished_name = dn
[dn]
CN = #{COLLECTOR_FQDN} ###NOTE:this should be the collector FQDN - do not use the brackets
[req_ext]
subjectAltName = @alt_names
keyUsage = critical, digitalSignature, keyAgreement
extendedKeyUsage = serverAuth, clientAuth
[alt_names]
DNS.1 = #{COLLECTOR_FQDN}. ###NOTE:this should be the collector FQDN - do not use the brackets
```
6. Generating Certificate Signing Request by running the below command:
  1. openssl req -new -key server.key -out server.csr -config server.cnf
7. Copy and run the below command below to create a Zscaler MDR client certificate using the CA Private key and CA Certificate from Steps [2.2.a](https://redcanary.document360.io/docs/integrate-fortinet-fortigate-with-red-canary#h_01GCHJGAG7PKAM9EN3MJBRCV9S:~:text=openssl%20genrsa%20%2Dout%20rootCA.key%204096) and [2.3.a](https://redcanary.document360.io/docs/integrate-fortinet-fortigate-with-red-canary#h_01GCHJGAG7PKAM9EN3MJBRCV9S:~:text=openssl%20req%20%2Dx509%20%2Dnew%20%2Dnodes%20%2Dkey%20rootCA.key%20%2Dsha256%20%2Ddays%203650%20%2Dout%20rootCA.pem):
  1. openssl x509 -req -in server.csr -CA rootCA.pem -CAkey rootCA.key -CAcreateserial -out server.crt -days 365 -sha256 -extfile server.cnf -extensions req_ext

> **Note**: You may want to increase the Expire Days by using the -days flag in the above command. Currently it's set to 365 days. If you used an ls command in the directory, you should have the following files:
> 
> - **rootCA.key**
> - **rootCA.pem**
> - **rootCA.srl**
> - **server.crt**
> - **server.key**

## **Step 3: Fortinet FortiGate–Import certificates to Fortinet FortiGate**

1. From your Fortinet FortiGate dashboard, click **System**.
2. Click **Certificates**.
3. Click **Create/Import**, and then click **CA Certificate**.
4. Click **File**.
5. Upload the **rootCA.pem** from Step [2.3.a](https://redcanary.document360.io/docs/integrate-fortinet-fortigate-with-red-canary#h_01GCHJGAG7PKAM9EN3MJBRCV9S:~:text=openssl%20req%20%2Dx509%20%2Dnew%20%2Dnodes%20%2Dkey%20rootCA.key%20%2Dsha256%20%2Ddays%203650%20%2Dout%20rootCA.pem).
6. Click **OK**. The new CA Certificate will be located under the Remote CA Certificate section.
7. Click **Create/Import**, and then click **Certificate**.
8. Click **Import Certificate**, and then click **Certificate**.
9. Upload the **server.key** file from [Step 2.4.a](https://redcanary.document360.io/docs/integrate-fortinet-fortigate-with-red-canary#h_01GCHJGAG7PKAM9EN3MJBRCV9S:~:text=openssl%20genrsa%20%2Dout%20server.key%202048)
10. Upload the **server.crt** file from [Step 2.7.a](https://redcanary.document360.io/docs/integrate-fortinet-fortigate-with-red-canary#h_01GCHJGAG7PKAM9EN3MJBRCV9S:~:text=openssl%20x509%20%2Dreq%20%2Din%20server.csr%20%2DCA%20rootCA.pem%20%2DCAkey%20rootCA.key%20%2DCAcreateserial%20%2Dout%20server.crt%20%2Ddays%20365%20%2Dsha256%20%2Dextfile%20server.cnf%20%2Dextensions%20req_ext)
11. Enter a Certificate Name (Example: `RedCanaryCert` ).

> **Note**: This name **needs** to match the name you give when you configure your Secure Syslog settings, specifically, the `set certificate` command. See step [4.3](https://redcanary.document360.io/docs/integrate-fortinet-fortigate-with-red-canary#step-4-fortinet-fortigate%E2%80%93configure-fortinet-fortigate-for-secure-syslog:~:text=Type%20out%20the%20following%20lines%3A) below.
12. Click **Create,** then **OK**.

![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/19812535890071.png?sv=2026-02-06&spr=https&st=2026-11-04T15%3A02%3A52Z&se=2026-11-04T16%3A02%3A52Z&sr=c&sp=r&sig=AEuERHU%2FdVRhlL3rS6SpZhVLPpQCdkFAAZINtsoQzYM%3D)

The new certificate will be located under the Local Certificate list.

## **Step 4: Fortinet FortiGate–Configure Fortinet FortiGate for secure syslog**

1. From your Fortinet FortiGate dashboard, click the CLI Console icon ( **>_**).
2. Enter `config log syslogd setting` in the Command Line Interface (CLI).
3. Type out the following lines:

> [!NOTE]
> **Note**: Do not copy and paste the lines as this will cause an encoding issue:

`set status enable`

`set server “InsertYourCollectorID.collectors.redcanary.io”`

`set mode reliable`

`set facility alert `

`set format cef `

`set priority default` `set enc-algorithm high `

`set ssl-min-proto-version TLSv1-2`

`set certificate RedCanaryCert`

> [!NOTE]
> **Note**: The name you enter here **needs** to match the "Certificate Name" you entered on Step [3.11](https://redcanary.document360.io/docs/integrate-fortinet-fortigate-with-red-canary#h_01GCHJGAG7PKAM9EN3MJBRCV9S:~:text=Enter%20a%20Certificate%20Name.).

`set port [Port visible on Alert Source configuration modal`

`end`

> **Note**: If you run into "Command fail. Return code 61," further commands will fail, and you will need to close and rerun the CLI console again.
4. Press the **Enter** key.

> **Note**: You may get a warning that the port has changed after entering the `enc-algorithm high` command. Make sure to set up the port value after you enter `enc-algorithm high`, as seen in the order above.

## **Step 5: Zscaler MDR–Upload Custom Certificates to Zscaler MDR**

Connect your custom certificates to Zscaler MDR in order to start receiving Fortinet FortiGate alerts.

1. In the Zscaler MDR portal, click **Integrations**. ![Add a new Red Canary integration](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/integrations-main.png?sv=2026-02-06&spr=https&st=2026-11-04T15%3A02%3A52Z&se=2026-11-04T16%3A02%3A52Z&sr=c&sp=r&sig=AEuERHU%2FdVRhlL3rS6SpZhVLPpQCdkFAAZINtsoQzYM%3D)
2. Scroll down, and then select your third-party security source.
3. Click **Edit Configuration**.
4. Select **Use custom TLS server certificate for ingest over TLS?**
5. Upload the certificates from [Step 2](https://redcanary.document360.io/docs/integrate-fortinet-fortigate-with-red-canary#step-2-command-line%E2%80%93generate-passphrase-keys-and-tls-certificates:~:text=Generate%20the%20necessary%20keys%20and%20Transport%20Layer%20Security%20(TLS)%20certificates%20that%20are%20used%20to%20configure%20the%20Fortigate%20platform%20to%20send%20syslogs%20to%20Red%20Canary.):
  1. Upload the **server.crt** file to the first upload section “Upload a certificate file (PEM or DER)”.
  2. Upload the **server.key file** to the second upload section “Upload the corresponding private key”.
  3. Upload the **rootCA.pem** file to the last upload location “Upload the CA certificate corresponding to your certificate (PEM or DER)”.
6. Click **Save Configuration**.

> **Note**: Please confirm that your configured DNS can resolve our collector.

For example, Fortinet FortiGuard labels our collector as “Category: Meaningless Content” which may be configured to be ignored by customer's config.

## **Step 6: Fortinet FortiGate–Run a Test to Ensure Zscaler MDR is Receiving Your Syslog Data**

1. From your Fortinet FortiGate command line, enter the following command: `diag log test `
2. This should generate a number of different test logs. This will be enough to get some data sent to Zscaler MDR.

![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/19813134375447.png?sv=2026-02-06&spr=https&st=2026-11-04T15%3A02%3A52Z&se=2026-11-04T16%3A02%3A52Z&sr=c&sp=r&sig=AEuERHU%2FdVRhlL3rS6SpZhVLPpQCdkFAAZINtsoQzYM%3D)