Community
- Command Central
- MVP Program
- Monthly Mission
- Blogs
- Groups
- Events
- Media Vault
Products
- Observability
- Network Management
- Application Management
- IT Security
- IT Service Management
- System Management
- Database Management
Content Exchange
- SolarWinds Platform
- Server & Application Monitor
- Database Performance Analyzer
- Server Configuration Monitor
- Network Performance Monitor
- Network Configuration Manager
- SQL Sentry
- Web Help Desk
Free Tools & Trials
Store

Health status in Fortigate Firewall ?

mbilgrav

Hi,
I am starting to monitor fortigate firewall, from FortiNet, on NPM 2020.2.5
Running newer version 6.4.8

Unlike Cisco NPM has not out of the box support for healtmonitoring, like PSU, FAN's Optics etc

Is this on the roadmap for NPM ?

What do you do about monitoring environment status / hw health on your fortigates ?

Find more posts tagged with

fortigate

fortinet

Accepted answers

All comments

marlief22

Hi there,

NPM can in fact monitor the firewall hardware, but the Fortigate Application that runs on it is a different beast unfortunately.

I have developed a few PowerShell scripts that allow me to SSH to the device, run a command, and then parse the results.

You can use something like Posh-SSH: powershellmagazine.com/.../

I think for the time being this will be the only way to really pull that kind of stuff through.

Hope that helps.

Kind regards,

Marlie Fancourt | SolarWinds Pre-Sales Manager

Prosperon Networks | SolarWinds Partner since 2006

If this helps answer your question please mark my answer as confirmed to help other users, thank you!

sja

This is the supported list :-)

https://support.solarwinds.com/SuccessCenter/s/article/Hardware-health-OIDS?language=en_US

1.You can make a feature request ...(will take years)

2.You can make a support ticket and ask your fortigate rep. to contact solarwinds PM..

about that OOB visibility that Cisco & Juniper has and not fortigate firewalls..

mbilgrav

Hiya M.

Thanks for taking your time and reply to my question.

I am curious to know how you monitor the fortigate 2601F hardware using NPM - please do tell more.

I can't find any health monitoring other than CPU/RAM.

I need to know about PSU, FANs, HA Status , and this by means of polling - not reply on the box itselfs to be able to sent TRAPs, syslog etc

mbilgrav

Thanks Sja ;-)

Indeed a short and somewhta sad list ...
Believe me, if grunt about this to whomever ask for my opinion around Fortigates & Orions :-)
This will just be one of many tales to tell.

marlief22

Hi there,

Here are the scripts I'm using (Data removed for security):

HA Status

Get-Module SSHSessions
New-SshSession -ComputerName $IPAddress -Credential (Get-Credential $null)
$result = Invoke-SshCommand -ComputerName $IPAddress -Command 'get sys ha status' -Quiet
$text = $result.result
$regex = '(HA Health Status: OK)'

if ($text | Select-String -Pattern $regex -Quiet)
{
    Write-host "Message.HAStatus`: OK"
    write-host "Statistic.HAstatus`: 1"
}
else{
    Write-host "Message.HAStatus`: Not OK"
    write-host "Statistic.HAstatus`: 0"
}

Days until license expiry

Get-Module SSHSessions
New-SshSession -ComputerName $IPAddress -Credential (Get-Credential $null)
$result = Invoke-SshCommand -ComputerName $IPAddress -Command 'diag autoupdate versions' -Quiet
$text = $result.result

$regex = '(.*)\n---------\nVersion: \d+\.\d+\nContract Expiry Date: (.*)'
$i = 0

foreach ($match in ($text | Select-String -Pattern $regex -AllMatches).Matches)
{

$Name = $match.groups[1].value
$date = if ($match.groups[2].value -ne "n/a")
{
[datetime]$match.groups[2].value
}
Else
{
Continue
}

$days = [math]::Ceiling((([datetime]$date)-(Get-Date)).TotalDays)
Write-host "Message.$i`: $Name"
write-host "Statistic.$i`: $days"

$i++
}

Hopefully that helps you get started!

Kind regards,

Marlie Fancourt | SolarWinds Pre-Sales Manager

Prosperon Networks | SolarWinds Partner since 2006

If this helps answer your question please mark my answer as confirmed to help other users, thank you!

sja

Please vote :-)

https://thwack.solarwinds.com/product-forums/network-performance-monitor-npm/i/feature-requests/fortigate-hardware-health-support

stuartd

Hi Martin and welcome to the painful experience that is trying to monitor kit that isn't Cisco or Juniper via SolarWinds.

This, i.e. Fortigate hardware monitoring is the next thing on my plate to investigate at work. @marlief22's approach is an interesting one if you are a Powershell guru - which I am not. I can occasionally merge other people's scrips together but whilst I can look at the code for HA failover for example, and work out what it is doing (just); I can't begin to work out how I'd then utilise that in SolarWinds.

The traditional approach, and one that SolarWInds would point you at, is to use UnDPs.

So, as an example, we have created a UnDP for HA State failover [caveat: I know this works where you have a management IP for each device in the HA setup - but haven't tested it against an HA setup where they share a management IP] and we have put it into an alert.

So, we created the UnDP using the OID of: 1.3.6.1.4.1.12356.101.3.2.1.1.4 - you'll need to create the UnDP yourself and test it against your Forti's to ensure it sees the right results. Results are 1, 2 or 3 where 1 = Active, 2=Passive and 3 = not used/configured.

Once you have the UnDP working you will need to add it to an alert and manipulate that way. I found someone that could help me on this as my S(W)QL skills are rudimentary at best. But you need to create an alert based on Custom SWQL Alert (Advanced) that looks like this:

The top section is hardcoded but the bottom code section is:

INNER JOIN
(
SELECT
CustomPollerAssignmentID
, Count(DISTINCT RawStatus) AS Statuses
FROM Orion.NPM.CustomPollerStatistics
where
Datetime>Addminute(-30,GETUTCDATE())
GROUP BY CustomPollerAssignmentID
) AS History
ON CustomPollerAssignmentOnNode.CustomPollerAssignmentID=History.CustomPollerAssignmentID

WHERE
CustomPollerAssignmentOnNode.CustomPollername='Fortigate_HA_State_Change'
AND History.Statuses>1

Essentially what the code is doing is looking at the HA State every poll cycle (ours is 2mins) and says if it has changed from it's last poll then alert.

As to fans, etc then you will need to find all the relevant OIDs, build the UnDPs for them and build them into an alert. Not all need be as complicated as the HA State one though.

The problem I've had with a rudimentary search is that I can't yet find relevant OIDs for the various hardware features that are common across all models of Fortinet devices.

Hope this helps?

mbilgrav

Hiya @Stuartd
Thanks alot for your fine reply.
And you're rihgt the HA will only work when each member has a mgmt-ip.
My setup doesnt, so the OID will always be "1", both in failed and normal mode
however, i tested this today:

These two OID change when in a failover scenarios:
.1.3.6.1.4.1.12356.101.13.2.1.1.16.1 = STRING: "F000FTK00000015" # This changes to the sn of the ACTIVE DEVICE!
.1.3.6.1.4.1.12356.101.13.2.1.1.16.2 = STRING: "F000FTK00000015"

and if you configure Prio on the units (my Primary has Prio=250, and my secondary has prio=128)
.1.3.6.1.4.1.12356.101.13.1.3.0 = INTEGER: 250 # This changes to 128 during FO, so its the PRIO of the ACTIVE DEVICE

So doing a similar alert based on the S/N of the primary unit changes, or the Prio isnt 250, seems like best approach

I just wonder as the webUI can show "Role"=Primary or secondary, why this isnt in a OID! it would be so simply if so.

Looking at hardware I found these OIDs:
.1.3.6.1.4.1.12356.101.4.3.2.1.2.64 = STRING: "Fan 1" (RPM?)
.1.3.6.1.4.1.12356.101.4.3.2.1.2.65 = STRING: "Fan 2" (RPM?)
.1.3.6.1.4.1.12356.101.4.3.2.1.2.66 = STRING: "Fan 3" (RPM?)
.1.3.6.1.4.1.12356.101.4.3.2.1.2.67 = STRING: "PS1 VIN" (Volt ac)
.1.3.6.1.4.1.12356.101.4.3.2.1.2.68 = STRING: "PS1 VOUT_12V" (Volt DC)
.1.3.6.1.4.1.12356.101.4.3.2.1.2.69 = STRING: "PS1 Temp 1" (deg Cel)
.1.3.6.1.4.1.12356.101.4.3.2.1.2.70 = STRING: "PS1 Temp 2" (deg Cel)
.1.3.6.1.4.1.12356.101.4.3.2.1.2.71 = STRING: "PS1 Temp 3" (deg Cel)
.1.3.6.1.4.1.12356.101.4.3.2.1.2.72 = STRING: "PS1 Fan 1" (RPM?)
.1.3.6.1.4.1.12356.101.4.3.2.1.2.73 = STRING: "PS1 Status" (0=ok or 1= ?)
.1.3.6.1.4.1.12356.101.4.3.2.1.2.74 = STRING: "PS2 VIN" (Volt ac)
.1.3.6.1.4.1.12356.101.4.3.2.1.2.75 = STRING: "PS2 VOUT_12V" (Volt DC)
.1.3.6.1.4.1.12356.101.4.3.2.1.2.76 = STRING: "PS2 Temp 1" (deg Cel)
.1.3.6.1.4.1.12356.101.4.3.2.1.2.77 = STRING: "PS2 Temp 2" (deg Cel)
.1.3.6.1.4.1.12356.101.4.3.2.1.2.78 = STRING: "PS2 Temp 3" (deg Cel)
.1.3.6.1.4.1.12356.101.4.3.2.1.2.79 = STRING: "PS2 Fan 1" (RPM?)
.1.3.6.1.4.1.12356.101.4.3.2.1.2.80 = STRING: "PS2 Status" (0=ok or 1= ?)

and there is a table with statuse, and from what I can see there is a chance that f.ex PS2 stauts =0, so if thgis changes from = there is a issues.
I still need to test this, but it looks somewhat usefull.

I will post later with more findings ...

And some time back I discovered the cli for optical readings of SPF's in my FortiGate:
get system interface transceiver port31

show the Rx & Tx readings ...
To bad there isnt an alert-sensor just like cisco for this - but its a different story, as I dont think there is OID for this

stuartd

Good work @mbilgrav - I'm thinking, with a bit of alteration to my original shared code, you could possibly do a

WHERE CustomPollerAssignmentOnNode.CustomPollername='Serial.Number' AND History.Statuses>1

So I'm thinking you could create a UnDP to look at the Serial Number instead of the HA State - but the key would be in how to get SWQL to trigger if the value has changed . That was easy enough for HA where it flips from 1 to 2 but how to generically code in it flipping from one random serial to another.

So, maybe your find on the priority field is the way to go, only the end bit would be> AND 'HistoryStatuses' <250 -- at a guess. I'll have to see if I can get time to play our Forti's that share a Mgmt IP

stuartd

Also ...

[quote userid="242716" url="~/product-forums/network-performance-monitor-npm/f/forum/94373/health-status-in-fortigate-firewall/298831#298831"]I just wonder as the webUI can show "Role"=Primary or secondary, why this isnt in a OID! it would be so simply if so.[/quote]

I've not seen this - what part of the GUI are you seeing this from? Just the node properties page or have you added a widget to extract that info? If so, a share of the widget setup would be fab please?

stuartd

I've been talking to one of our Fortinet experts since I replied earlier.

He advises that the priority doesn't change when an HA event occurs. So FW01 remains 250 and FW02 remains as 128 (or whatever has been configured) even after the HA event.

However, the serial number OID does show a change in the order when an HA event occurs - I have personally seen that. So all we (you) need is a SWQL auto script up a query that identifies when that field has changed.

My query's original WHERE line, may be just that. The >1 may not literally mean if the result is greater than 1, it may mean "has changed from last time"

mbilgrav

So I am not gonna do SWQL in my alerts, as I think this is bad for perfomance.
I have created the UnDP, then goto "CustomPollerThresholds" and add the values and logic there, then goto an alert and create and add the alerts definition - This method will do for any OID we poll, so I will go ahead and create same style poller for the PSU and even Fans, Temp etc, if I want those to be monitored and/or alerted upon.

I hope you can make sense on this - It actually works, and scale

NB: I have added the Mgmt1 interface IP to Orions, as well as the inband IP's.
So This is working in a dedicate-to management Interface, so each unit has its own IP!
If we poll the "inband" IP of the insider interface f.ex, the alrts will have to be based un the Prio OID or SN, as meantion in other posts

The resulting Alert is then: (you can choose to sent email also etc)

mbilgrav

The really oly pain here is we need to do this for eash OID we want monitored ... like

.1.3.6.1.4.1.12356.101.4.3.2.1.2.73 = STRING: "PS1 Status" (0=ok or 1= ?)

.1.3.6.1.4.1.12356.101.4.3.2.1.2.80 = STRING: "PS2 Status" (0=ok or 1= ?)

and maybe one temp OID and one FAN

stuartd

Top work there @mbilgrav

When time allows I will try your approach on our air-gapped environment where we have HA Forti's only visible via a single IP.

I note your comment about not using SWQL but I can't agree. I don't have any hard evidence, but, AIUI, all poller logic is converted to SWQL/SQL anyway - just we get the nice point and click GUI.

And you've also taught me something as I'd never looked at the Custom Poller Thresholds options before.