1

Ciao,

we use Fortigate device since years and now we need to check bandwidth usage per protocol and this is is not possible. We made this test:

1) all policy Logging Options - Log all Sessions 2) forticloud enabled 3) two syslogd server setup (config syslogd filter all enabled) 4) from Internet computer executed FTP get versus a FTP server in our internal LAN (using VIP NAT). Transferred one file size 670.347.264 byte in about 50 minutes

Looking at the syslogd we found only six log records related to the traffic FTP and total sentbyte and rcvdbyte less then 400.000 byte. Forticloud top source IP traffic of the day show another host (not the ftp server) 2mb traffic. So there are no log of 600Mb traffic passed throgh fortigate in none place. We opened a ticket to Fortinet and they reply to us: "There is nothing wrong with what you observed. The session is defined by when it was initiated and when it was over, it does not give you the information what exactly you have been doing - uploading/downloading and how big was the file you transferred/downloaded. "

These means for us: log fields sentbyte and rcvdbyte generated by fortigate is not reliable and third part software like ManageEngine Firewall Analyzer using these fields could not be used for Fortigate traffic analysis. Even Forticloud report bandwidht usage statistics are unreliable because many traffic is missed.

Regards Luca

1
  • I saw that you have found an anwser to your issue, but you wanted to write it on my own answer by fully overwritting it. This is not the proper way to do things. Please, post your own new answer.
    – krisFR
    Mar 1, 2014 at 12:16

1 Answer 1

1

I am not really sure to get what exactly is your question (since i cannot find any ?) in your post, but from my understanding, i will suggest some clues.

To check bandwidth usage per protocol you may want to consider the NetFlow protocol.

This protocol is able to deeply analyse network traffic and report usage up to application layer.

As NetFlow is a Cisco protocol and we are talking about Fortinet, you can use an alternative to NetFlow called sFlow.

Since FortiOS 4.0MR2 Fortinet supports the sFlow protocol. It can be enabled on all interfaces or only unitary ones.

The problem with sFlow, in opposition to NetFlow, is that sFlow requires a polling interval so you may miss some traffic.

Here's a (very short) blog to illustrate what i am saying.

Also, as you are talking about a specific product (ManageEngine), here's a link that could be interesting.


Just a word about bandwidth usage only :

I have not enabled sFlow on my Fortigate units, but i have implemented bandwidth usage monitoring on each of my Fortigate interfaces, using SNMP and Cacti, following this document.

I have to say that results i get in my graphs are relevant. I don't have unreliable statistics you talk about.

I use OID : 1.3.6.1.2.1.2.2.1 (iso.org.dod.internet.mgmt.mib-2.interfaces.ifTable.ifEntry) to get statistics :

  • ifInOctets = 1.3.6.1.2.1.2.2.1.10
  • ifOutOctets = 1.3.6.1.2.1.2.2.1.16

Assuming an interface with index number 57 :

  • ifInOctets.57 = 1.3.6.1.2.1.2.2.1.10.57
  • ifOutOctets.57 = 1.3.6.1.2.1.2.2.1.16.57

Good luck !

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .