Fortinet Guide

From OpenNMS
Jump to navigation Jump to search
Tested for Versions
The instructions in this article have been tested against the following versions of OpenNMS.
Tested Against:
Version 1.12.8 tested by Fuhrmann
Version 1.12.9 tested by Fuhrmann
Version 14.0.0 tested by Fuhrmann
Version 15.0.0 tested by Fuhrmann
Version 16.0.0 tested by Fuhrmann
Version 17.0.0 tested by Fuhrmann

Monitoring Fortinet products - What's possible?

Fortinet products offer really good snmp support. They provide snmp data (eg. CPU, memory, MIB2 stuff et cetera) so OpenNMS is able to create data collections and almost all events can be send as snmp traps.

Fortinet requirements

Until firmware version 4 it was possible to configure snmp using the web ui. Since v5 you have to use the CLI. Fortinet provides a really good documentation to configure snmp.

Firmware 4 example:

Forti interface snmp.png

Forti snmp1.png

Forti snmp2.png

Maybe you have to add a firewall policy to allow your OpenNMS server access to your Fortinet.

OpenNMS requirements

SNMP data

Datacollection

Fortinet provides really useful snmp data. Since version 17 OpenNMS provides a new/revised datacollection. If you use an older version you have to add the datacollection configurations manually. You can get it here: https://github.com/OpenNMS/opennms/pull/296/files


Note.png Datacollection Hint

OpenNMS needs a restart to apply changes.


Graph definition

Since version 17 OpenNMS provides also the graph definitions. If you use an older version please add the graph definition manually. You can get them here: https://github.com/OpenNMS/opennms/pull/296/files

Example: Fortinet Graphs.png

Threshd package & thresholds

Example: Memory

/opt/opennms/etc/threshd-configuration.xml <syntaxhighlight lang="xml">

   <package name="TH-FN-MEMORY-H-70">
       <filter>categoryname == 'TH-FN-MEMORY-H-70' & nodeSysOID LIKE '.1.3.6.1.4.1.12356.%'</filter>
       <include-range begin="1.1.1.1" end="254.254.254.254"/>
       <include-range begin="::1" end="ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff"/>
       <service name="SNMP" interval="300000" user-defined="false" status="on">
           <parameter key="thresholding-group" value="TH-FN-MEMORY-H-70"/>
       </service>
   </package>

</syntaxhighlight>

/opt/opennms/etc/thresholds.xml <syntaxhighlight lang="xml">

   <group name="TH-FN-MEMORY-H-70" rrdRepository="/opt/opennms/share/rrd/snmp/">
       <threshold
           description="Memory (RAM) usage high 70.0 and rearmed 60.0"
           type="high" ds-type="node" value="70.0" rearm="60.0"
           trigger="5"
           triggeredUEI="uei.opennms.org/threshold/fortinet/memory/high/warning/exceeded"
           rearmedUEI="uei.opennms.org/threshold/fortinet/memory/high/warning/rearmed"
           filterOperator="or" ds-name="fgSysMemUsage"/>
   </group>

</syntaxhighlight> Further threshold templates can be found here.

Threshold notifications

Example: Memory <syntaxhighlight lang="xml">

   <notification name="TH-FN-MEMORY HIGH WARNING notification"
       status="on" writeable="yes">
       <uei>uei.opennms.org/threshold/fortinet/memory/high/warning/exceeded</uei>
       <rule>catincFortinet</rule>
       <destinationPath>admin-normal</destinationPath>
       <text-message>%logmsg%</text-message>
       <subject>[TH][HIGH] #%noticeid%: %nodelabel% - FORTINET-MEMORY %parm[ds]% exceeded.</subject>
       <numeric-message>[HIGH] - (%parm[ds]% %parm[threshold]%/%parm[value]%) exceeded.</numeric-message>
   </notification>

</syntaxhighlight> Futher Fortinet threshold notifications can be found here.

Traps

Event defintions

OpenNMS provides a lot trap definitions for various Fortinet products.

uei.opennms.org/vendor/fortinet/traps/fortigate/fgFmTrapConfChange
uei.opennms.org/vendor/fortinet/traps/fortigate/fgFmTrapDeployComplete
uei.opennms.org/vendor/fortinet/traps/fortigate/fgFmTrapDeployInProgress
uei.opennms.org/vendor/fortinet/traps/fortigate/fgFmTrapIfChange
uei.opennms.org/vendor/fortinet/traps/fortigate/fgTrapAvBypass
uei.opennms.org/vendor/fortinet/traps/fortigate/fgTrapAvEnterConserve
uei.opennms.org/vendor/fortinet/traps/fortigate/fgTrapAvFragmented
uei.opennms.org/vendor/fortinet/traps/fortigate/fgTrapAvOversizeBlock
uei.opennms.org/vendor/fortinet/traps/fortigate/fgTrapAvOversizePass
uei.opennms.org/vendor/fortinet/traps/fortigate/fgTrapAvOversize
uei.opennms.org/vendor/fortinet/traps/fortigate/fgTrapAvPattern
uei.opennms.org/vendor/fortinet/traps/fortigate/fgTrapAvVirus
uei.opennms.org/vendor/fortinet/traps/fortigate/fgTrapConfChange
uei.opennms.org/vendor/fortinet/traps/fortigate/fgTrapDeployComplete
uei.opennms.org/vendor/fortinet/traps/fortigate/fgTrapDeployInProgress
uei.opennms.org/vendor/fortinet/traps/fortigate/fgTrapFazDisconnect
uei.opennms.org/vendor/fortinet/traps/fortigate/fgTrapFcSwDown
uei.opennms.org/vendor/fortinet/traps/fortigate/fgTrapFcSwUp
uei.opennms.org/vendor/fortinet/traps/fortigate/fgTrapHaHBFail
uei.opennms.org/vendor/fortinet/traps/fortigate/fgTrapHaMemberDown
uei.opennms.org/vendor/fortinet/traps/fortigate/fgTrapHaMemberUp
uei.opennms.org/vendor/fortinet/traps/fortigate/fgTrapHaStateChange
uei.opennms.org/vendor/fortinet/traps/fortigate/fgTrapHaSwitch
uei.opennms.org/vendor/fortinet/traps/fortigate/fgTrapIfChange
uei.opennms.org/vendor/fortinet/traps/fortigate/fgTrapIpsAnomaly
uei.opennms.org/vendor/fortinet/traps/fortigate/fgTrapIpsFailOpen
uei.opennms.org/vendor/fortinet/traps/fortigate/fgTrapIpsPkgUpdate
uei.opennms.org/vendor/fortinet/traps/fortigate/fgTrapIpsSignature
uei.opennms.org/vendor/fortinet/traps/fortigate/fgTrapServerLoadBalanceRealServerDown
uei.opennms.org/vendor/fortinet/traps/fortigate/fgTrapVpnTunDown
uei.opennms.org/vendor/fortinet/traps/fortigate/fgTrapVpnTunUp
uei.opennms.org/vendor/fortinet/traps/fortigate/fgTrapWcApDown
uei.opennms.org/vendor/fortinet/traps/fortigate/fgTrapWcApUp
uei.opennms.org/vendor/fortinet/traps/fortimail/fmlTrapCpuHighThreshold
uei.opennms.org/vendor/fortinet/traps/fortimail/fmlTrapHAEvent
uei.opennms.org/vendor/fortinet/traps/fortimail/fmlTrapIpChange
uei.opennms.org/vendor/fortinet/traps/fortimail/fmlTrapLogDiskHighThreshold
uei.opennms.org/vendor/fortinet/traps/fortimail/fmlTrapMailAvThresholdEvent
uei.opennms.org/vendor/fortinet/traps/fortimail/fmlTrapMailDeferredQueueHighThreshold
uei.opennms.org/vendor/fortinet/traps/fortimail/fmlTrapMailDiskHighThreshold
uei.opennms.org/vendor/fortinet/traps/fortimail/fmlTrapMemLowThreshold
uei.opennms.org/vendor/fortinet/traps/fortimail/fmlTrapPSUFailureEvent
uei.opennms.org/vendor/fortinet/traps/fortimail/fmlTrapRAIDEvent
uei.opennms.org/vendor/fortinet/traps/fortimail/fmlTrapRemoteStorage
uei.opennms.org/vendor/fortinet/traps/fortimail/fmlTrapSpamThresholdEvent
uei.opennms.org/vendor/fortinet/traps/fortimail/fmlTrapSystemEvent
uei.opennms.org/vendor/fortinet/traps/fortimanager-analyzer/fmTrapCpuThresholdExcludeNice
uei.opennms.org/vendor/fortinet/traps/fortimanager-analyzer/fmTrapHASwitch
uei.opennms.org/vendor/fortinet/traps/fortimanager-analyzer/fmTrapLicDevQuotaThreshold
uei.opennms.org/vendor/fortinet/traps/fortimanager-analyzer/fmTrapLicGbDayThreshold
uei.opennms.org/vendor/fortinet/traps/fortimanager-analyzer/fmTrapLogAlert
uei.opennms.org/vendor/fortinet/traps/fortimanager-analyzer/fmTrapLogDataRateThreshold
uei.opennms.org/vendor/fortinet/traps/fortimanager-analyzer/fmTrapLogRateThreshold
uei.opennms.org/vendor/fortinet/traps/fortimanager-analyzer/fmTrapRAIDStatusChange
uei.opennms.org/vendor/fortinet/traps/fortinet-core/fnTrapAmcIfBypassMode
uei.opennms.org/vendor/fortinet/traps/fortinet-core/fnTrapCpuThreshold
uei.opennms.org/vendor/fortinet/traps/fortinet-core/fnTrapFanFailure
uei.opennms.org/vendor/fortinet/traps/fortinet-core/fnTrapIpChange
uei.opennms.org/vendor/fortinet/traps/fortinet-core/fnTrapLogDiskThreshold
uei.opennms.org/vendor/fortinet/traps/fortinet-core/fnTrapMemThreshold
uei.opennms.org/vendor/fortinet/traps/fortinet-core/fnTrapPowerSupplyFailure
uei.opennms.org/vendor/fortinet/traps/fortinet-core/fnTrapTempHigh
uei.opennms.org/vendor/fortinet/traps/fortinet-core/fnTrapTest
uei.opennms.org/vendor/fortinet/traps/fortinet-core/fnTrapVoltageOutOfRange
uei.opennms.org/vendor/fortinet/traps/fortirecorder/frcTrapCameraEvent
uei.opennms.org/vendor/fortinet/traps/fortirecorder/frcTrapRemoteStorage
uei.opennms.org/vendor/fortinet/traps/fortirecorder/frcTrapSystemEvent
uei.opennms.org/vendor/fortinet/traps/fortirecorder/frcTrapVideoDiskHighThreshold
uei.opennms.org/vendor/fortinet/traps/fortivoice/fvTrapHAEvent
uei.opennms.org/vendor/fortinet/traps/fortivoice/fvTrapStorageDiskHighThreshold
uei.opennms.org/vendor/fortinet/traps/fortivoice/fvTrapSystemEvent


Since version 17 OpenNMS provides all Fortinet trap definitions out of the box. If you are using an older OpenNMS you have to add the event definitions manually. You can download them here. Don't forget to delete the current Fortinet event file Fortinet.events.xml and include the new ones into /opt/opennms/etc/eventconf.xml. Just reload the event configuration or restart OpenNMS to apply the new events.

Warning.png Firmware mismatch!

For FortiCore and FortiGate event files there are two version based on the firmware you are using.

As the result, received traps should look like these:

Fortinet eventExamples.png

Trap notifications

Depending on your environment maybe every event needs a notification.

Example:

/opt/opennms/etc/notifications.xml <syntaxhighlight lang="xml"> <notification name="TRAP - FortiNet - PowerSuppyFailure" status="on" writeable="yes">

 <uei>uei.opennms.org/vendor/fortinet/traps/fortinet-core/fnTrapPowerSupplyFailure</uei>
 <rule>(IPADDR IPLIKE *.*.*.*)</rule>
 <destinationPath>admin</destinationPath>
 <text-message>%logmsg%</text-message>
 <subject>Notice #%noticeid%: Power supply failure on node %nodelabel%.</subject>
 <numeric-message>111-%noticeid%</numeric-message>

</notification> </syntaxhighlight>

Further trap notification templates can be found here

Links

Fortinet Thresholds
Fortinet Threshold Notifications
Fortinet Trap Notifications
Fortinet Support Portal