fortigate_exporter

Prometheus exporter for FortiGate® firewalls.

NOTE: This is not an official Fortinet product, it is developed fully independently by professionals and hobbyists alike.

Supported Metrics
Usage
Known Issues
Missing Metrics?

Supported Metrics

Right now the exporter supports a quite limited set of metrics, but it is very easy to add! Open an issue if your favorite metric is missing.

For example PromQL usage, see EXAMPLES.

Supported metrics right now as follows.

Global:

System/Status
- fortigate_version_info
System/Time/Clock
- fortigate_time_seconds
System/Resource/Usage
- fortigate_cpu_usage_ratio
- fortigate_memory_usage_ratio
- fortigate_current_sessions
License/Status
- fortigate_license_vdom_usage
- fortigate_license_vdom_max

Per-VDOM:

System/VDOMResources
- fortigate_vdom_cpu_usage_ratio
- fortigate_vdom_memory_usage_ratio
- fortigate_vdom_current_sessions
Firewall/Policies
- fortigate_policy_active_sessions
- fortigate_policy_bytes_total
- fortigate_policy_hit_count_total
- fortigate_policy_packets_total
System/Interface
- fortigate_interface_link_up
- fortigate_interface_speed_bps
- fortigate_interface_transmit_packets_total
- fortigate_interface_receive_packets_total
- fortigate_interface_transmit_bytes_total
- fortigate_interface_receive_bytes_total
- fortigate_interface_transmit_errors_total
- fortigate_interface_receive_errors_total
User/Fsso
- fortigate_user_fsso_info
VPN/Ssl/Connections
- fortigate_vpn_connections
- fortigate_vpn_users
VPN/Ssl/Stats
- fortigate_vpn_ssl_users
- fortigate_vpn_ssl_tunnels
- fortigate_vpn_ssl_connections
VPN/IPSec
- fortigate_ipsec_tunnel_receive_bytes_total
- fortigate_ipsec_tunnel_transmit_bytes_total
- fortigate_ipsec_tunnel_up
Wifi/APStatus
- fortigate_wifi_access_points
- fortigate_wifi_fabric_clients
- fortigate_wifi_fabric_max_allowed_clients
Log/Fortianalyzer/Status
- fortigate_log_fortianalyzer_registration_info
- fortigate_log_fortianalyzer_logs_received
Log/Fortianalyzer/Queue
- fortigate_log_fortianalyzer_queue_connections
- fortigate_log_fortianalyzer_queue_logs
Log/DiskUsage
- fortigate_log_disk_used_bytes
- fortigate_log_disk_total_bytes

Per-HA-Member and VDOM:

System/HAStatistics
- fortigate_ha_member_info
- fortigate_ha_member_cpu_usage_ratio
- fortigate_ha_member_memory_usage_ratio
- fortigate_ha_member_network_usage_ratio
- fortigate_ha_member_sessions
- fortigate_ha_member_packets_total
- fortigate_ha_member_virus_events_total
- fortigate_ha_member_bytes_total
- fortigate_ha_member_ips_events_total

Per-Link and VDOM:

System/LinkMonitor
- fortigate_link_status
- fortigate_link_latency_seconds
- fortigate_link_latency_jitter_seconds
- fortigate_link_packet_loss_ratio
- fortigate_link_packet_sent_total
- fortigate_link_packet_received_total
- fortigate_link_active_sessions
- fortigate_link_bandwidth_tx_byte_per_second
- fortigate_link_bandwidth_rx_byte_per_second
- fortigate_link_status_change_time_seconds

Per-SDWAN and VDOM:

VirtualWAN/HealthCheck
- fortigate_virtual_wan_status
- fortigate_virtual_wan_latency_seconds
- fortigate_virtual_wan_latency_jitter_seconds
- fortigate_virtual_wan_packet_loss_ratio
- fortigate_virtual_wan_packet_sent_total
- fortigate_virtual_wan_packet_received_total
- fortigate_virtual_wan_active_sessions
- fortigate_virtual_wan_bandwidth_tx_byte_per_second
- fortigate_virtual_wan_bandwidth_rx_byte_per_second
- fortigate_virtual_wan_status_change_time_seconds

Per-BGP-Neighbor and VDOM:

BGP/Neighbors/IPv4
- fortigate_bgp_neighbor_ipv4_info
BGP/Neighbors/IPv6
- fortigate_bgp_neighbor_ipv6_info
BGP/NeighborPaths/IPv4
- fortigate_bgp_neighbor_ipv4_paths
- fortigate_bgp_neighbor_ipv4_best_paths
BGP/NeighborPaths/IPv6
- fortigate_bgp_neighbor_ipv6_paths
- fortigate_bgp_neighbor_ipv6_best_paths

Per-VirtualServer and VDOM:

Firewall/LoadBalance
- fortigate_lb_virtual_server_info

Per-RealServer for each VirtualServer and VDOM:

Firewall/LoadBalance
- fortigate_lb_real_server_info
- fortigate_lb_real_server_mode
- fortigate_lb_real_server_status
- fortigate_lb_real_server_active_sessions
- fortigate_lb_real_server_rtt_seconds
- fortigate_lb_real_server_processed_bytes_total

Per-Certificate:

System/AvailableCertificates
- fortigate_certificate_info
- fortigate_certificate_valid_from_seconds
- fortigate_certificate_valid_to_seconds
- fortigate_certificate_cmdb_references

Per-VDOM and Wifi-Client:

Wifi/Clients
- fortigate_wifi_client_info
- fortigate_wifi_client_data_rate_bps
- fortigate_wifi_client_bandwidth_rx_bps
- fortigate_wifi_client_bandwidth_tx_bps
- fortigate_wifi_client_signal_strength_dBm
- fortigate_wifi_client_signal_noise_dBm
- fortigate_wifi_client_tx_discard_ratio
- fortigate_wifi_client_tx_retries_ratio

Per-VDOM and managed access point:

Wifi/ManagedAP
- fortigate_wifi_managed_ap_info
- fortigate_wifi_managed_ap_join_time_seconds
- fortigate_wifi_managed_ap_cpu_usage_ratio
- fortigate_wifi_managed_ap_memory_free_bytes
- fortigate_wifi_managed_ap_memory_bytes_total

Per-VDOM, managed access point and radio:

Wifi/ManagedAP
- fortigate_wifi_managed_ap_radio_info
- fortigate_wifi_managed_ap_radio_client_count
- fortigate_wifi_managed_ap_radio_operating_tx_power_ratio
- fortigate_wifi_managed_ap_radio_operating_channel_utilization_ratio
- fortigate_wifi_managed_ap_radio_bandwidth_rx_bps
- fortigate_wifi_managed_ap_radio_rx_bytes_total
- fortigate_wifi_managed_ap_radio_tx_bytes_total
- fortigate_wifi_managed_ap_radio_interfering_aps
- fortigate_wifi_managed_ap_radio_tx_power_ratio
- fortigate_wifi_managed_ap_radio_tx_discard_ratio
- fortigate_wifi_managed_ap_radio_tx_retries_ratio

Per-VDOM, managed access point and interface:

Wifi/ManagedAP
- fortigate_wifi_managed_ap_interface_rx_bytes_total
- fortigate_wifi_managed_ap_interface_tx_bytes_total
- fortigate_wifi_managed_ap_interface_rx_packets_total
- fortigate_wifi_managed_ap_interface_tx_packets_total
- fortigate_wifi_managed_ap_interface_rx_errors_total
- fortigate_wifi_managed_ap_interface_tx_errors_total
- fortigate_wifi_managed_ap_interface_rx_dropped_packets_total
- fortigate_wifi_managed_ap_interface_tx_dropped_packets_total

Usage

Example:

$ ./fortigate_exporter -auth-file ~/fortigate-key.yaml
# or
$ docker run -d -p 9710:9710 -v /path/to/fortigate-key.yaml:/config/fortigate-key.yaml quay.io/bluecmd/fortigate_exporter:master

Where fortigate-key.yaml contains pairs of FortiGate targets and API keys in the following format:

"https://my-fortigate":
  token: api-key-goes-here
"https://my-other-fortigate:8443":
  token: api-key-goes-here

NOTE: Currently only token authentication is supported. FortiGate does not allow usage of tokens on non-HTTPS connections, which means that currently you need HTTPS to be configured properly.

You can select which probes you want to run on a per target basis.

Probes can be included or excluded under the optional probes section by defining include and/or exclude lists.
Each probe name, that can be run by the fortigate exporter, is compared to the include/exclude lists.
Inclusion/exclusion of a probe is based on a prefix match, therefore lists must contains entries starting with a probe name to be included/excluded.
Prefix match is case sensitive.
include list is evaluated before exclude list, therefore exclude list can exclude a previously included probe.

Example:

"https://my-fortigate":
  token: api-key-goes-here
  probes:
    include:
      - System
      - VPN
      - Firewall/Policies
      # Include only probes with name starting with: System or VPN + probe: Firewall/Policies
      # Other probes are excluded because there were not explictly included
"https://my-other-fortigate:8443":
  token: api-key-goes-here
  probes:
    exclude:
      - Wifi
      - Firewall/LoadBalance
      # Exclude probes with name starting with: Wifi + probe: Firewall/LoadBalance
      # All other probes are included by default because include list is empty
"https://my-other-orther-fortigate:8443":
  token: api-key-goes-here
  probes:
    include:
      - System
      - Firewall
    exclude:
      - System/LinkMonitor
      # Inlcude probes with name starting with: System and Firewall
      # Then exclude probe: System/LinkMonitor

Special cases:

If probes isn't set or is empty, all probes will be run against the target.
If include list is empty, by default, all probes will be selected to be run against the target.
If include contains an entry - '', then all probes are included (equivalent to not defining include)
If exclude contains an entry - '', then all probes are excluded (equivalent to not defining the target)

To probe a FortiGate, do something like curl 'localhost:9710/probe?target=https://my-fortigate'

Available CLI parameters

flag	default value	description
-auth-file	fortigate-key.yaml	path to the location of the key file
-listen	:9710	address to listen for incoming requests
-scrape-timeout	30	timeout in seconds
-https-timeout	10	timeout in seconds for establishment of HTTPS connections
-insecure	not set	allows to turn off security validation of TLS certificates
-extra-ca-certs	(none)	comma-separated files containing extra PEMs to trust for TLS connections in addition to the system trust store
-max-bgp-paths	10000	Sets maximum amount of BGP paths to fetch, value is per IP stack version (IPv4 & IPv6)
-max-vpn-users	0	Sets maximum amount of VPN users to fetch (0 eq. none by default)

FortiGate Configuration

Read permission is enough for Fortigate exporter purpose. To improve security, limit permissions to required ones only (least privilege principle).

probe name	permission	API URL
Default Global	any	api/v2/monitor/system/status
BGP/NeighborPaths/IPv4	netgrp.route-cfg	api/v2/monitor/router/bgp/paths
BGP/NeighborPaths/IPv6	netgrp.route-cfg	api/v2/monitor/router/bgp/paths6
BGP/Neighbors/IPv4	netgrp.route-cfg	api/v2/monitor/router/bgp/neighbors
BGP/Neighbors/IPv6	netgrp.route-cfg	api/v2/monitor/router/bgp/neighbors6
Firewall/LoadBalance	fwgrp.others	api/v2/monitor/firewall/load-balance
Firewall/Policies	fwgrp.policy	api/v2/monitor/firewall/policy/select api/v2/monitor/firewall/policy6/select api/v2/cmdb/firewall/policy api/v2/cmdb/firewall/policy6
License/Status	any	api/v2/monitor/license/status/select
Log/Fortianalyzer/Status	loggrp.config	api/v2/monitor/log/fortianalyzer
Log/Fortianalyzer/Queue	loggrp.config	api/v2/monitor/log/fortianalyzer-queue
Log/DiskUsage	loggrp.config	api/v2/monitor/log/current-disk-usage
System/AvailableCertificates	any	api/v2/monitor/system/available-certificates
System/HAStatistics	sysgrp.cfg	api/v2/monitor/system/ha-statistics api/v2/cmdb/system/ha
System/Interface	netgrp.cfg	api/v2/monitor/system/interface/select
System/LinkMonitor	sysgrp.cfg	api/v2/monitor/system/link-monitor
System/Resource/Usage	sysgrp.cfg	api/v2/monitor/system/resource/usage
System/Status	any	api/v2/monitor/system/status
System/Time/Clock	sysgrp.cfg	api/v2/monitor/system/time
System/VDOMResources	sysgrp.cfg	api/v2/monitor/system/resource/usage
User/Fsso	authgrp	api/v2/monitor/user/fsso
VPN/IPSec	vpngrp	api/v2/monitor/vpn/ipsec
VPN/Ssl/Connections	vpngrp	api/v2/monitor/vpn/ssl
VPN/Ssl/Stats	vpngrp	api/v2/monitor/vpn/ssl/stats
VirtualWAN/HealthCheck	netgrp.cfg	api/v2/monitor/virtual-wan/health-check
Wifi/APStatus	wifi	api/v2/monitor/wifi/ap_status
Wifi/Clients	wifi	api/v2/monitor/wifi/client
Wifi/ManagedAP	wifi	api/v2/monitor/wifi/managed_ap

If you omit to grant some of these permissions you will receive log messages warning about 403 errors and relevant metrics will be unavailable, but other metrics will still work. If you do not need some probes to be run, do not grant permission for them and use include/exclude feature (see Usage section).

The following example Admin Profile describes the permissions that needs to be granted to the monitor user in order for all metrics to be available.

config system accprofile
    edit "monitor"
        # global scope will fail on non multi-VDOM firewall
        set scope global
        set authgrp read
        # As of FortiOS 6.2.1 it seems `fwgrp-permissions.other` is removed,
        # use 'fwgrp read' to get load balance servers metrics
        set fwgrp custom
        set loggrp custom
        set netgrp custom
        set sysgrp custom
        set vpngrp read
        set wifi read
        # will fail for most recent FortiOS
        set system-diagnostics disable
        config fwgrp-permission
            set policy read
            set others read
        end
        config netgrp-permission
            set cfg read
            set route-cfg read
        end
        config loggrp-permission
            set config read
        end
        config sysgrp-permission
            set cfg read
        end
    next
end

Prometheus Configuration

An example configuration for Prometheus looks something like this:

  - job_name: 'fortigate_exporter'
    metrics_path: /probe
    static_configs:
      - targets:
        - https://my-fortigate
        - https://my-other-fortigate:8443
    relabel_configs:
      - source_labels: [__address__]
        target_label: __param_target
      - source_labels: [__param_target]
        target_label: instance
        # Drop the https:// and port (if specified) for the 'instance=' label
        regex: '(?:.+)(?::\/\/)([^:]*).*'
      - target_label: __address__
        replacement: '[::1]:9710'

Docker

You can either use the automatic builds on quay.io or build yourself like this:

docker build -t fortigate_exporter .
docker run -d -p 9710:9710 -v /path/to/fortigate-key.yaml:/config/fortigate-key.yaml fortigate_exporter

docker-compose

prometheus_fortigate_exporter:
  build: ./
  ports:
    - 9710:9710
  volumes:
    - /path/to/fortigate-key.yaml:/config/fortigate-key.yaml
  # Applying multiple parameters
  command: ["-auth-file", "/config/fortigate-key.yaml", "-insecure"]
  restart: unless-stopped

Known Issues

This is a collection of known issues that for some reason cannot be fixed, but might be possible to work around.

Probing causing httpsd memory leak in FortiOS 6.2.x (Workaround)

Missing Metrics?

Please file an issue describing what metrics you'd like to see. Include as much details as possible please, e.g. how the perfect Prometheus metric would look for your use-case.

An alternative to using this exporter is to use generic SNMP polling, e.g. using a Prometheus SNMP exporter (official, alternative). Note that there are limitations (e.g. 1) in what FortiGate supports querying via SNMP.

Legal

Fortinet®, and FortiGate® are registered trademarks of Fortinet, Inc.

This is not an official Fortinet product.

Name		Name	Last commit message	Last commit date
Latest commit History 123 Commits
.github/workflows		.github/workflows
internal		internal
pkg		pkg
.gitignore		.gitignore
.releaserc.yml		.releaserc.yml
Dockerfile		Dockerfile
EXAMPLES.md		EXAMPLES.md
LICENSE		LICENSE
Makefile		Makefile
README.md		README.md
docker-compose.yml		docker-compose.yml
fortigate_exporter.go		fortigate_exporter.go
go.mod		go.mod
go.sum		go.sum
renovate.json		renovate.json

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Repository files navigation

fortigate_exporter

Supported Metrics

Usage

Available CLI parameters

FortiGate Configuration

Prometheus Configuration

Docker

docker-compose

Known Issues

Missing Metrics?

Legal

About

Releases

Packages

Languages

License

solipsist01/fortigate_exporter

Folders and files

Latest commit

History

Repository files navigation

fortigate_exporter

Supported Metrics

Usage

Available CLI parameters

FortiGate Configuration

Prometheus Configuration

Docker

docker-compose

Known Issues

Missing Metrics?

Legal

About

Resources

License

Stars

Watchers

Forks

Releases

Packages 0

Languages

Packages