
# FortiGate by SNMP

## Overview

This template is designed for the effortless deployment of FortiGate monitoring by Zabbix via SNMP and doesn't require any external scripts.

## Requirements

Zabbix version: 7.0 and higher.

## Tested versions

This template has been tested on:
- FortiGate v7.2.5

## Configuration

> Zabbix should be configured according to the instructions in the [Templates out of the box](https://www.zabbix.com/documentation/7.0/manual/config/templates_out_of_the_box) section.

## Setup

Refer to the vendor documentation.

### Macros used

|Name|Description|Default|
|----|-----------|-------|
|{$CPU.UTIL.CRIT}|
Threshold of CPU utilization for Warning trigger in %.
|`90`|
|{$ICMP_LOSS_WARN}|
Threshold of ICMP packet loss for Warning trigger in %.
|`20`|
|{$ICMP_RESPONSE_TIME_WARN}|
Threshold of average ICMP response time for Warning trigger in seconds.
|`0.15`|
|{$SNMP.TIMEOUT}|
The time interval for SNMP availability trigger.
|`5m`|
|{$MEMORY.UTIL.MAX}|
Threshold of memory utilization for trigger in %.
|`90`|
|{$DISK.FREE.WARN}|
Threshold of disk free space for Warning trigger in %.
|`20`|
|{$DISK.FREE.CRIT}|
Threshold of disk free space for Critical trigger in %.
|`10`|
|{$VPN.NAME.MATCHES}|
Used in VPN tunnel discovery. Can be overridden on the host or linked template level.
|`.*`|
|{$VPN.NAME.NOT_MATCHES}|
Used in VPN tunnel discovery. Can be overridden on the host or linked template level.
|`CHANGE_IF_NEEDED`|
|{$VPN.STATE.CONTROL}|
Used in "Tunnel down" trigger. Can be used with interface name as context.
|`1`|
|{$HA.MEMBER.SN.MATCHES}|
Used in HA member discovery. Can be overridden on the host or linked template level.
|`.*`|
|{$HA.MEMBER.SN.NOT_MATCHES}|
Used in HA member discovery. Can be overridden on the host or linked template level.
|`CHANGE_IF_NEEDED`|
|{$IF.ERRORS.WARN}|
Threshold of error packet rate for Warning trigger. Can be used with interface name as context.
|`2`|
|{$IF.UTIL.MAX}|
Threshold of interface bandwidth utilization for Warning trigger in %. Can be used with interface name as context.
|`95`|
|{$IFCONTROL}|
Macro for operational state of interface for "Link down" trigger. Can be used with interface name as context.
|`1`|
|{$NET.IF.IFADMINSTATUS.MATCHES}|
Used in Network interface discovery. Can be overridden on the host or linked template level.
|`.*`|
|{$NET.IF.IFADMINSTATUS.NOT_MATCHES}|
Used in Network interface discovery. Can be overridden on the host or linked template level.
|`^2$`|
|{$NET.IF.IFDESCR.MATCHES}|
Used in Network interface discovery. Can be overridden on the host or linked template level.
|`.*`|
|{$NET.IF.IFDESCR.NOT_MATCHES}|
Used in Network interface discovery. Can be overridden on the host or linked template level.
|`CHANGE_IF_NEEDED`|
|{$NET.IF.IFNAME.MATCHES}|
Used in Network interface discovery. Can be overridden on the host or linked template level.
|`.*`|
|{$NET.IF.IFNAME.NOT_MATCHES}|
Used in Network interface discovery. Can be overridden on the host or linked template level.
|`(^[Ll]o[0-9.]*$)`|
|{$NET.IF.IFOPERSTATUS.MATCHES}|
Used in Network interface discovery. Can be overridden on the host or linked template level.
|`.*`|
|{$NET.IF.IFOPERSTATUS.NOT_MATCHES}|
Used in Network interface discovery. Can be overridden on the host or linked template level.
|`^6$`|
|{$NET.IF.IFTYPE.MATCHES}|
Used in Network interface discovery. Can be overridden on the host or linked template level.
|`.*`|
|{$NET.IF.IFTYPE.NOT_MATCHES}|
Used in Network interface discovery. Can be overridden on the host or linked template level.
|`CHANGE_IF_NEEDED`|
|{$NET.IF.IFALIAS.MATCHES}|
Used in Network interface discovery. Can be overridden on the host or linked template level.
|`.*`|
|{$NET.IF.IFALIAS.NOT_MATCHES}|
Used in Network interface discovery. Can be overridden on the host or linked template level.
|`CHANGE_IF_NEEDED`|
|{$SDWAN.HEALTH.NAME.MATCHES}|
Used in SD-WAN health-check discovery. Can be overridden on the host or linked template level.
|`.*`|
|{$SDWAN.HEALTH.NAME.NOT_MATCHES}|
Used in SD-WAN health-check discovery. Can be overridden on the host or linked template level.
|`CHANGE_IF_NEEDED`|
|{$SDWAN.HEALTH.IF.CONTROL}|
Used in "Health check state is dead" trigger. Can be used with health check name as context.
|`1`|
|{$SDWAN.HEALTH.IF.LOSS.WARN}|
Threshold of packet loss for Warning trigger in %. Can be used with health check name as context.
|`20`|
|{$WC.NAME.MATCHES}|
Used in Wireless discovery. Can be overridden on the host or linked template level.
|`.*`|
|{$WC.NAME.NOT_MATCHES}|
Used in Wireless discovery. Can be overridden on the host or linked template level.
|`CHANGE_IF_NEEDED`|
|{$WC.STATE.CONTROL}|
Used in "Connection down" trigger. Can be used with interface name as context.
|`1`|
|{$WC.UPDATE.CONTROL}|
Used in "Receiving firmware update" trigger. Can be used with interface name as context.
|`1`|
|{$WC.CPU.UTIL.CRIT}|
Threshold of WTP CPU utilization for Warning trigger in %. Can be used with interface name as context.
|`90`|
|{$WC.MEMORY.UTIL.MAX}|
Threshold of WTP memory utilization for trigger in %. Can be used with interface name as context.
|`90`|
|{$VDOM.NAME.MATCHES}|
Used in Virtual domain discovery. Can be overridden on the host or linked template level.
|`.*`|
|{$VDOM.NAME.NOT_MATCHES}|
Used in Virtual domain discovery. Can be overridden on the host or linked template level.
|`CHANGE_IF_NEEDED`|

### Items

|Name|Description|Type|Key and additional info|
|----|-----------|----|-----------------------|
|Firmware version|
MIB: FORTINET-FORTIGATE-MIB

Firmware version of the device.
|SNMP agent|system.hw.firmware
**Preprocessing**

- 
Discard unchanged with heartbeat: `1d`

|
|Hardware model name|
MIB: ENTITY-MIB

Model of the device.
|SNMP agent|system.hw.model
**Preprocessing**

- 
Discard unchanged with heartbeat: `1d`

|
|Hardware serial number|
MIB: ENTITY-MIB

Serial number of the device.
|SNMP agent|system.hw.serialnumber
**Preprocessing**

- 
Discard unchanged with heartbeat: `1d`

|
|System contact details|
MIB: SNMPv2-MIB

Name and contact information of the contact person for the node. If not provided, the value is a zero-length string.
|SNMP agent|system.contact[sysContact.0]
**Preprocessing**

- 
Discard unchanged with heartbeat: `12h`

|
|System description|
MIB: SNMPv2-MIB

A textual description of the entity. This value should include the full name and version identification of the system's hardware type, software operating system, and networking software.
|SNMP agent|system.descr[sysDescr.0]
**Preprocessing**

- 
Discard unchanged with heartbeat: `12h`

|
|System location|
MIB: SNMPv2-MIB

Physical location of the node (e.g., `equipment room`, `3rd floor`). If not provided, the value is a zero-length string.
|SNMP agent|system.location[sysLocation.0]
**Preprocessing**

- 
Discard unchanged with heartbeat: `12h`

|
|System name|
MIB: SNMPv2-MIB

An administratively-assigned name for the node (the node's fully-qualified domain name). If not provided, the value is a zero-length string.
|SNMP agent|system.name
**Preprocessing**

- 
Discard unchanged with heartbeat: `12h`

|
|System object ID|
MIB: SNMPv2-MIB

The vendor's authoritative identification of the entity as part of the vendor's SMI enterprises subtree with the prefix 1.3.6.1.4.1 (e.g., a vendor with the identifier 1.3.6.1.4.1.4242 might assign a system object with the OID 1.3.6.1.4.1.4242.1.1).
|SNMP agent|system.objectid[sysObjectID.0]
**Preprocessing**

- 
Discard unchanged with heartbeat: `12h`

|
|System uptime|
MIB: FORTINET-FORTIGATE-MIB

Time since the network management portion of the system was last re-initialized.
|SNMP agent|system.uptime[fgSysUpTime.0]
**Preprocessing**

- 
Custom multiplier: `0.01`

|
|Number of CPUs|
MIB: FORTINET-FORTIGATE-MIB

Number of processors.
|SNMP agent|system.cpu.num
**Preprocessing**

- 
Discard unchanged with heartbeat: `1d`

|
|CPU utilization|
MIB: FORTINET-FORTIGATE-MIB

CPU utilization in %.
|SNMP agent|system.cpu.util[fgSysCpuUsage.0]|
|ICMP ping|
Host accessibility by ICMP.

0 - ICMP ping failed.

1 - ICMP ping successful.
|Simple check|icmpping|
|ICMP loss|
Percentage of lost packets.
|Simple check|icmppingloss|
|ICMP response time|
ICMP ping response time (in seconds).
|Simple check|icmppingsec|
|SNMP agent availability|
Availability of SNMP checks on the host. The value of this item corresponds to availability icons in the host list.

Possible values:

0 - not available

1 - available

2 - unknown
|Zabbix internal|zabbix[host,snmp,available]|
|SNMP walk network interfaces|
Used for discovering interfaces from IF-MIB.
|SNMP agent|net.if.walk|
|SNMP walk CPU|
Used for discovering CPU from FORTINET-FORTIGATE-MIB.
|SNMP agent|system.cpu.walk|
|SNMP walk VPN tunnels|
Used for discovering VPN tunnels from FORTINET-FORTIGATE-MIB.
|SNMP agent|vpn.tunnel.walk|
|SNMP walk HA members|
Used for discovering HA members from FORTINET-FORTIGATE-MIB.
|SNMP agent|ha.members.walk|
|SNMP walk SD-WAN health-checks|
Used for discovering SD-WAN health-checks from FORTINET-FORTIGATE-MIB.
|SNMP agent|sdwan_health.walk|
|SNMP walk wireless AP|
Used for discovering wireless access points from FORTINET-FORTIGATE-MIB.
|SNMP agent|wireless.ap.walk|
|SNMP walk hardware sensors|
Used for discovering hardware sensors from FORTINET-FORTIGATE-MIB.
|SNMP agent|hw.sensor.walk|
|SNMP walk virtual domain|
Used for discovering virtual domains from FORTINET-FORTIGATE-MIB.
|SNMP agent|vdom.walk|
|Total memory|
MIB: FORTINET-FORTIGATE-MIB

Total physical memory (RAM) installed.
|SNMP agent|vm.memory.total[fgSysMemCapacity.0]
**Preprocessing**

- 
Custom multiplier: `1000`

|
|Memory utilization|
Current memory utilization (percentage).
|SNMP agent|vm.memory.util[memoryUsedPercentage.0]|
|Used memory|
MIB: FORTINET-FORTIGATE-MIB

Physical memory (RAM) used calculated based on memory utilization percentage.
|Calculated|vm.memory.used[fgSysMemUsage.0]|
|Available memory|
Total memory available for utilization.
|Calculated|vm.memory.available[fgSysMemFree.0]|
|IPv4 Active sessions|
MIB: FORTINET-FORTIGATE-MIB

Number of active sessions on the device.
|SNMP agent|net.ipv4.sessions[fgSysSesCount.0]|
|SNMP traps (fallback)|
Used for collecting all SNMP traps unmatched by other `snmptrap` items.
|SNMP trap|snmptrap.fallback|
|Total disk space|
Total hard disk capacity.
|SNMP agent|vfs.fs.total[fgSysDiskCapacity.0]
**Preprocessing**

- 
Custom multiplier: `1048576`

- 
Discard unchanged with heartbeat: `1d`

|
|Used disk space|
Current hard disk usage.
|SNMP agent|vfs.fs.used[fgSysDiskUsage.0]
**Preprocessing**

- 
Custom multiplier: `1048576`

|
|Free disk space|
Free hard disk capacity.
|Calculated|vfs.fs.free|
|Free disk percentage|
Free disk space, expressed in %.
|Calculated|vfs.fs.pfree|
|Active IPsec VPN tunnels|
MIB: FORTINET-FORTIGATE-MIB

Number of IPsec VPN tunnels with at least one SA.
|SNMP agent|vpn.tunnel.active[fgVpnTunnelUpCount.0]
**Preprocessing**

- 
Discard unchanged with heartbeat: `1h`

|
|Active SSL VPN users|
MIB: FORTINET-FORTIGATE-MIB

Current number of users logged in through SSL-VPN tunnels in the virtual domain.
|SNMP agent|vpn.users.count[fgVpnSslStatsLoginUsers.0]
**Preprocessing**

- 
Discard unchanged with heartbeat: `1h`

|
|SSL VPN state|
MIB: FORTINET-FORTIGATE-MIB

Used to determine whether SSL-VPN is enabled on this virtual domain.
|SNMP agent|vpn.ssl.state[fgVpnSslState.0]
**Preprocessing**

- 
Discard unchanged with heartbeat: `1h`

|
|Blocked intrusions|
MIB: FORTINET-FORTIGATE-MIB

Number of intrusions blocked per second.
|SNMP agent|ips.blocked[fgIpsIntrusionsBlocked.0]
**Preprocessing**

- Change per second
|
|Total detected intrusions|
MIB: FORTINET-FORTIGATE-MIB

Total number of intrusions detected per second.
|SNMP agent|ips.detected.total[fgIpsIntrusionsDetected.0]
**Preprocessing**

- Change per second
|
|Detected critical intrusions|
MIB: FORTINET-FORTIGATE-MIB

Number of critical severity intrusions detected per second.
|SNMP agent|ips.detected.crit[fgIpsCritSevDetections.0]
**Preprocessing**

- Change per second
|
|Detected high intrusions|
MIB: FORTINET-FORTIGATE-MIB

Number of high severity intrusions detected per second.
|SNMP agent|ips.detected.high[fgIpsHighSevDetections.0]
**Preprocessing**

- Change per second
|
|Detected medium intrusions|
MIB: FORTINET-FORTIGATE-MIB

Number of medium severity intrusions detected per second.
|SNMP agent|ips.detected.med[fgIpsMedSevDetections.0]
**Preprocessing**

- Change per second
|
|Detected low intrusions|
MIB: FORTINET-FORTIGATE-MIB

Number of low severity intrusions detected per second.
|SNMP agent|ips.detected.low[fgIpsLowSevDetections.0]
**Preprocessing**

- Change per second
|
|Detected info intrusions|
MIB: FORTINET-FORTIGATE-MIB

Number of info severity intrusions detected per second.
|SNMP agent|ips.detected.info[fgIpsInfoSevDetections.0]
**Preprocessing**

- Change per second
|
|Detected anomaly based intrusions|
MIB: FORTINET-FORTIGATE-MIB

Number of intrusions detected as anomalies per second.
|SNMP agent|ips.detected.anomaly[fgIpsAnomalyDetections.0]
**Preprocessing**

- Change per second
|
|Detected signature based intrusions|
MIB: FORTINET-FORTIGATE-MIB

Number of intrusions detected by signature per second.
|SNMP agent|ips.detected.sign[fgIpsSignatureDetections.0]
**Preprocessing**

- Change per second
|
|IPS database version|
MIB: FORTINET-FORTIGATE-MIB

IPS signature database version installed on the device.
|SNMP agent|ips.database.version[fgSysVersionIps.0]
**Preprocessing**

- 
Discard unchanged with heartbeat: `6h`

|
|HA mode|
MIB: FORTINET-FORTIGATE-MIB

High-availability mode (Standalone, A-A or A-P).
|SNMP agent|ha.mode[fgHaSystemMode.0]
**Preprocessing**

- 
Discard unchanged with heartbeat: `1d`

|
|HA cluster group ID|
MIB: FORTINET-FORTIGATE-MIB

HA cluster group ID device is configured for.
|SNMP agent|ha.cluster.group_id[fgHaGroupId.0]
**Preprocessing**

- 
Discard unchanged with heartbeat: `1d`

|
|HA cluster group name|
MIB: FORTINET-FORTIGATE-MIB

HA cluster group name.
|SNMP agent|ha.cluster.group_name[fgHaGroupName.0]
**Preprocessing**

- 
Discard unchanged with heartbeat: `1d`

|
|HA cluster priority|
MIB: FORTINET-FORTIGATE-MIB

HA clustering priority of the device (default = 128).
|SNMP agent|ha.cluster.priority[fgHaPriority.0]
**Preprocessing**

- 
Discard unchanged with heartbeat: `1d`

|
|HA cluster primary override|
MIB: FORTINET-FORTIGATE-MIB

Status of the primary override flag.
|SNMP agent|ha.cluster.override[fgHaOverride.0]
**Preprocessing**

- 
Discard unchanged with heartbeat: `1d`

|
|HA config sync|
MIB: FORTINET-FORTIGATE-MIB

Configuration of an automatic configuration synchronization (enabled or disabled).
|SNMP agent|ha.auto.sync[fgHaAutoSync.0]
**Preprocessing**

- 
Discard unchanged with heartbeat: `1d`

|
|HA load-balancing schedule|
MIB: FORTINET-FORTIGATE-MIB

Load-balancing schedule of cluster (in A-A mode).
|SNMP agent|ha.schedule[fgHaSchedule.0]
**Preprocessing**

- 
Discard unchanged with heartbeat: `1d`

|

### Triggers

|Name|Description|Expression|Severity|Dependencies and additional info|
|----|-----------|----------|--------|--------------------------------|
|FortiGate: Device has been replaced|
Device serial number has changed. Acknowledge to close the problem manually.
|`last(/FortiGate by SNMP/system.hw.serialnumber,#1)<>last(/FortiGate by SNMP/system.hw.serialnumber,#2) and length(last(/FortiGate by SNMP/system.hw.serialnumber))>0`|Info|**Manual close**: Yes|
|FortiGate: System name has changed|
The name of the system has changed. Acknowledge to close the problem manually.
|`last(/FortiGate by SNMP/system.name,#1)<>last(/FortiGate by SNMP/system.name,#2) and length(last(/FortiGate by SNMP/system.name))>0`|Info|**Manual close**: Yes|
|FortiGate: Device has been restarted|
Uptime is less than 10 minutes.
|`last(/FortiGate by SNMP/system.uptime[fgSysUpTime.0])<10m`|Info|**Manual close**: Yes|
|FortiGate: High CPU utilization|
The CPU utilization is too high. The system might be slow to respond.
|`min(/FortiGate by SNMP/system.cpu.util[fgSysCpuUsage.0],5m)>{$CPU.UTIL.CRIT}`|Warning||
|FortiGate: Unavailable by ICMP ping|
Last three attempts returned timeout. Please check device connectivity.
|`max(/FortiGate by SNMP/icmpping,#3)=0`|High||
|FortiGate: High ICMP ping loss|
ICMP ping loss detected.
|`min(/FortiGate by SNMP/icmppingloss,5m)>{$ICMP_LOSS_WARN} and min(/FortiGate by SNMP/icmppingloss,5m)<100`|Warning|**Depends on**:

- FortiGate: Unavailable by ICMP ping
|
|FortiGate: High ICMP ping response time|
Average ICMP response time is too high.
|`avg(/FortiGate by SNMP/icmppingsec,5m)>{$ICMP_RESPONSE_TIME_WARN}`|Warning|**Depends on**:

- FortiGate: Unavailable by ICMP ping
- FortiGate: High ICMP ping loss
|
|FortiGate: No SNMP data collection|
SNMP is not available for polling. Please check device connectivity and SNMP settings.
|`max(/FortiGate by SNMP/zabbix[host,snmp,available],{$SNMP.TIMEOUT})=0`|Warning|**Depends on**:

- FortiGate: Unavailable by ICMP ping
|
|FortiGate: High memory utilization|
The system is running out of free memory.
|`min(/FortiGate by SNMP/vm.memory.util[memoryUsedPercentage.0],5m)>{$MEMORY.UTIL.MAX}`|Average||
|FortiGate: Free disk space is too low|
Available disk space is too low.
|`last(/FortiGate by SNMP/vfs.fs.pfree)<{$DISK.FREE.CRIT}`|High||
|FortiGate: Free disk space is low|
Available disk space is not enough.
|`last(/FortiGate by SNMP/vfs.fs.pfree)<{$DISK.FREE.WARN}`|Warning|**Depends on**:

- FortiGate: Free disk space is too low
|

### LLD rule CPU discovery

|Name|Description|Type|Key and additional info|
|----|-----------|----|-----------------------|
|CPU discovery|
Used for discovering CPUs from FORTINET-FORTIGATE-MIB.
|Dependent item|cpu.discovery
**Preprocessing**

- 
SNMP walk to JSON

⛔️Custom on fail: Discard value

- 
Discard unchanged with heartbeat: `1h`

|

### Item prototypes for CPU discovery

|Name|Description|Type|Key and additional info|
|----|-----------|----|-----------------------|
|CPU Core {#CPU.ID}: Average usage over 1min|
MIB: FORTINET-FORTIGATE-MIB

The processor's CPU usage in %, expressed as an average calculated over the last minute.

(Only valid for processor types that support this statistic.)
|Dependent item|system.cpu.usage[fgProcessorUsage.{#SNMPINDEX}]
**Preprocessing**

- 
SNMP walk value: `1.3.6.1.4.1.12356.101.4.4.2.1.2.{#SNMPINDEX}`

|
|CPU Core {#CPU.ID}: Average user usage over 1min|
MIB: FORTINET-FORTIGATE-MIB

The processor's CPU user space usage, expressed as an average calculated over the last minute.

(Only valid for processor types that support this statistic.)
|Dependent item|system.cpu.usage[fgProcessorUserUsage.{#SNMPINDEX}]
**Preprocessing**

- 
SNMP walk value: `1.3.6.1.4.1.12356.101.4.4.2.1.9.{#SNMPINDEX}`

|
|CPU Core {#CPU.ID}: Average system usage over 1min|
MIB: FORTINET-FORTIGATE-MIB

The processor's CPU system space usage, expressed as an average calculated over the last minute.

(Only valid for processor types that support this statistic.)
|Dependent item|system.cpu.usage[fgProcessorSysUsage.{#SNMPINDEX}]
**Preprocessing**

- 
SNMP walk value: `1.3.6.1.4.1.12356.101.4.4.2.1.10.{#SNMPINDEX}`

|

### LLD rule VPN tunnel discovery

|Name|Description|Type|Key and additional info|
|----|-----------|----|-----------------------|
|VPN tunnel discovery|
Used for discovering VPN tunnels from FORTINET-FORTIGATE-MIB.
|Dependent item|vpn.tunnel.discovery
**Preprocessing**

- 
SNMP walk to JSON

⛔️Custom on fail: Discard value

- 
Discard unchanged with heartbeat: `1h`

|

### Item prototypes for VPN tunnel discovery

|Name|Description|Type|Key and additional info|
|----|-----------|----|-----------------------|
|VPN {#VPN.NAME}: Tunnel Status|
MIB: FORTINET-FORTIGATE-MIB

Current status of tunnel (up or down).
|Dependent item|vpn.tunnel.status[fgVpnTunEntStatus.{#SNMPINDEX}]
**Preprocessing**

- 
SNMP walk value: `1.3.6.1.4.1.12356.101.12.2.2.1.20.{#SNMPINDEX}`

|

### Trigger prototypes for VPN tunnel discovery

|Name|Description|Expression|Severity|Dependencies and additional info|
|----|-----------|----------|--------|--------------------------------|
|FortiGate: VPN {#VPN.NAME}: Tunnel down|
This trigger expression works as follows:
1. It can be triggered if the current tunnel state is down.
2. `{$VPN.STATE.CONTROL}=1` - a user can redefine the context macro to "0", marking this notification as not important. No new trigger will be fired if this tunnel is down.
|`{$VPN.STATE.CONTROL:"{#VPN.NAME}"}=1 and last(/FortiGate by SNMP/vpn.tunnel.status[fgVpnTunEntStatus.{#SNMPINDEX}])=1 and (last(/FortiGate by SNMP/vpn.tunnel.status[fgVpnTunEntStatus.{#SNMPINDEX}],#1)<>last(/FortiGate by SNMP/vpn.tunnel.status[fgVpnTunEntStatus.{#SNMPINDEX}],#2))`|Average|**Manual close**: Yes|

### LLD rule Network interface discovery

|Name|Description|Type|Key and additional info|
|----|-----------|----|-----------------------|
|Network interface discovery|
Used for discovering interfaces from IF-MIB.
|Dependent item|net.if.discovery
**Preprocessing**

- 
SNMP walk to JSON

⛔️Custom on fail: Discard value

- 
Discard unchanged with heartbeat: `1h`

|

### Item prototypes for Network interface discovery

|Name|Description|Type|Key and additional info|
|----|-----------|----|-----------------------|
|Interface {#IFNAME}({#IFALIAS}): Operational status|
MIB: IF-MIB

The current operational state of the interface.

- The `testing(3)` state indicates that no operational packets can be passed.

- If `ifAdminStatus` is `down(2)`, then `ifOperStatus` should be `down(2)`.

- If `ifAdminStatus` is changed to `up(1)`, then `ifOperStatus` should change to `up(1)` if the interface is ready to transmit and receive network traffic.

- It should change to `dormant(5)` if the interface is waiting for external actions (such as a serial line waiting for an incoming connection).

- It should remain in the `down(2)` state if and only if there is a fault that prevents it from going to the `up(1)` state.

- It should remain in the `notPresent(6)` state if the interface has missing (typically, hardware) components.
|Dependent item|net.if.status[ifOperStatus.{#SNMPINDEX}]
**Preprocessing**

- 
SNMP walk value: `1.3.6.1.2.1.2.2.1.8.{#SNMPINDEX}`

|
|Interface {#IFNAME}({#IFALIAS}): Bits received|
MIB: IF-MIB

The total number of octets received on the interface, including framing characters. This object is a 64-bit version of `ifInOctets`.

Discontinuities in the value of this counter can occur at re-initialization of the management system and at other times as indicated by the value of `ifCounterDiscontinuityTime`.
|Dependent item|net.if.in[ifHCInOctets.{#SNMPINDEX}]
**Preprocessing**

- 
SNMP walk value: `1.3.6.1.2.1.31.1.1.1.6.{#SNMPINDEX}`

- Change per second
- 
Custom multiplier: `8`

|
|Interface {#IFNAME}({#IFALIAS}): Bits sent|
MIB: IF-MIB

The total number of octets transmitted out of the interface, including framing characters. This object is a 64-bit version of `ifOutOctets`.

Discontinuities in the value of this counter can occur at re-initialization of the management system and at other times as indicated by the value of `ifCounterDiscontinuityTime`.
|Dependent item|net.if.out[ifHCOutOctets.{#SNMPINDEX}]
**Preprocessing**

- 
SNMP walk value: `1.3.6.1.2.1.31.1.1.1.10.{#SNMPINDEX}`

- Change per second
- 
Custom multiplier: `8`

|
|Interface {#IFNAME}({#IFALIAS}): Inbound packets with errors|
MIB: IF-MIB

For packet-oriented interfaces - the number of inbound packets that contained errors preventing them from being deliverable to a higher-layer protocol.

For character-oriented or fixed-length interfaces - the number of inbound transmission units that contained errors preventing them from being deliverable to a higher-layer protocol.

Discontinuities in the value of this counter can occur at re-initialization of the management system and at other times as indicated by the value of `ifCounterDiscontinuityTime`.
|Dependent item|net.if.in.errors[ifInErrors.{#SNMPINDEX}]
**Preprocessing**

- 
SNMP walk value: `1.3.6.1.2.1.2.2.1.14.{#SNMPINDEX}`

- Change per second
|
|Interface {#IFNAME}({#IFALIAS}): Outbound packets with errors|
MIB: IF-MIB

For packet-oriented interfaces - the number of outbound packets that contained errors preventing them from being deliverable to a higher-layer protocol.

For character-oriented or fixed-length interfaces - the number of outbound transmission units that contained errors preventing them from being deliverable to a higher-layer protocol.

Discontinuities in the value of this counter can occur at re-initialization of the management system and at other times as indicated by the value of `ifCounterDiscontinuityTime`.
|Dependent item|net.if.out.errors[ifOutErrors.{#SNMPINDEX}]
**Preprocessing**

- 
SNMP walk value: `1.3.6.1.2.1.2.2.1.20.{#SNMPINDEX}`

- Change per second
|
|Interface {#IFNAME}({#IFALIAS}): Outbound packets discarded|
MIB: IF-MIB

The number of outbound packets which were chosen to be discarded even though no errors had been detected to prevent their being deliverable to a higher-layer protocol.

One possible reason for discarding such a packet could be to free up buffer space.

Discontinuities in the value of this counter can occur at re-initialization of the management system and at other times as indicated by the value of `ifCounterDiscontinuityTime`.
|Dependent item|net.if.out.discards[ifOutDiscards.{#SNMPINDEX}]
**Preprocessing**

- 
SNMP walk value: `1.3.6.1.2.1.2.2.1.19.{#SNMPINDEX}`

- Change per second
|
|Interface {#IFNAME}({#IFALIAS}): Inbound packets discarded|
MIB: IF-MIB

The number of inbound packets which were chosen to be discarded even though no errors had been detected to prevent their being deliverable to a higher-layer protocol.

One possible reason for discarding such a packet could be to free up buffer space.

Discontinuities in the value of this counter can occur at re-initialization of the management system and at other times as indicated by the value of `ifCounterDiscontinuityTime`.
|Dependent item|net.if.in.discards[ifInDiscards.{#SNMPINDEX}]
**Preprocessing**

- 
SNMP walk value: `1.3.6.1.2.1.2.2.1.13.{#SNMPINDEX}`

- Change per second
|
|Interface {#IFNAME}({#IFALIAS}): Interface type|
MIB: IF-MIB

The type of interface.

Additional values for `ifType` are assigned by the Internet Assigned Numbers Authority (IANA) through updating the syntax of the IANAifType textual convention.
|Dependent item|net.if.type[ifType.{#SNMPINDEX}]
**Preprocessing**

- 
SNMP walk value: `1.3.6.1.2.1.2.2.1.3.{#SNMPINDEX}`

- 
Discard unchanged with heartbeat: `1d`

|
|Interface {#IFNAME}({#IFALIAS}): Speed|
MIB: IF-MIB

An estimate of the interface's current bandwidth in units of 1,000,000 bits per second.

If this object reports a value of `n`, then the speed of the interface is somewhere in the range of `n-500,000` to `n+499,999`.

For interfaces which do not vary in bandwidth or for those where no accurate estimation can be made, this object should contain the nominal bandwidth.

For a sub-layer which has no concept of bandwidth, this object should be zero.
|Dependent item|net.if.speed[ifHighSpeed.{#SNMPINDEX}]
**Preprocessing**

- 
SNMP walk value: `1.3.6.1.2.1.31.1.1.1.15.{#SNMPINDEX}`

- 
Custom multiplier: `1000000`

- 
Discard unchanged with heartbeat: `1h`

|

### Trigger prototypes for Network interface discovery

|Name|Description|Expression|Severity|Dependencies and additional info|
|----|-----------|----------|--------|--------------------------------|
|FortiGate: Interface {#IFNAME}({#IFALIAS}): Link down|
This trigger expression works as follows:
1. It can be triggered if the operations status is down.
2. `{$IFCONTROL:"{#IFNAME}"}=1` - a user can redefine the context macro to "0", marking this interface as not important. No new trigger will be fired if this interface is down.
3. `{TEMPLATE_NAME:METRIC.diff()}=1` - the trigger fires only if the operational status was up to "1" sometime before.

WARNING: if closed manually - it will not fire again on the next poll, because of `.diff`.
|`{$IFCONTROL:"{#IFNAME}"}=1 and last(/FortiGate by SNMP/net.if.status[ifOperStatus.{#SNMPINDEX}])=2 and (last(/FortiGate by SNMP/net.if.status[ifOperStatus.{#SNMPINDEX}],#1)<>last(/FortiGate by SNMP/net.if.status[ifOperStatus.{#SNMPINDEX}],#2))`|Average|**Manual close**: Yes|
|FortiGate: Interface {#IFNAME}({#IFALIAS}): High bandwidth usage|
The utilization of the network interface is close to its estimated maximum bandwidth.
|`(avg(/FortiGate by SNMP/net.if.in[ifHCInOctets.{#SNMPINDEX}],15m)>({$IF.UTIL.MAX:"{#IFNAME}"}/100)*last(/FortiGate by SNMP/net.if.speed[ifHighSpeed.{#SNMPINDEX}]) or avg(/FortiGate by SNMP/net.if.out[ifHCOutOctets.{#SNMPINDEX}],15m)>({$IF.UTIL.MAX:"{#IFNAME}"}/100)*last(/FortiGate by SNMP/net.if.speed[ifHighSpeed.{#SNMPINDEX}])) and last(/FortiGate by SNMP/net.if.speed[ifHighSpeed.{#SNMPINDEX}])>0`|Warning|**Manual close**: Yes
**Depends on**:

- FortiGate: Interface {#IFNAME}({#IFALIAS}): Link down
|
|FortiGate: Interface {#IFNAME}({#IFALIAS}): High error rate|
The trigger recovers when it is below 80% of the `{$IF.ERRORS.WARN:"{#IFNAME}"}` threshold.
|`min(/FortiGate by SNMP/net.if.in.errors[ifInErrors.{#SNMPINDEX}],5m)>{$IF.ERRORS.WARN:"{#IFNAME}"} or min(/FortiGate by SNMP/net.if.out.errors[ifOutErrors.{#SNMPINDEX}],5m)>{$IF.ERRORS.WARN:"{#IFNAME}"}`|Warning|**Manual close**: Yes
**Depends on**:

- FortiGate: Interface {#IFNAME}({#IFALIAS}): Link down
|
|FortiGate: Interface {#IFNAME}({#IFALIAS}): Ethernet has changed to lower speed than it was before|
This Ethernet connection has transitioned down from its known maximum speed. This might be a sign of autonegotiation issues. Acknowledge to close the problem manually.
|`change(/FortiGate by SNMP/net.if.speed[ifHighSpeed.{#SNMPINDEX}])<0 and last(/FortiGate by SNMP/net.if.speed[ifHighSpeed.{#SNMPINDEX}])>0 and ( last(/FortiGate by SNMP/net.if.type[ifType.{#SNMPINDEX}])=6 or last(/FortiGate by SNMP/net.if.type[ifType.{#SNMPINDEX}])=7 or last(/FortiGate by SNMP/net.if.type[ifType.{#SNMPINDEX}])=11 or last(/FortiGate by SNMP/net.if.type[ifType.{#SNMPINDEX}])=62 or last(/FortiGate by SNMP/net.if.type[ifType.{#SNMPINDEX}])=69 or last(/FortiGate by SNMP/net.if.type[ifType.{#SNMPINDEX}])=117 ) and (last(/FortiGate by SNMP/net.if.status[ifOperStatus.{#SNMPINDEX}])<>2)`|Info|**Manual close**: Yes
**Depends on**:

- FortiGate: Interface {#IFNAME}({#IFALIAS}): Link down
|

### LLD rule HA member discovery

|Name|Description|Type|Key and additional info|
|----|-----------|----|-----------------------|
|HA member discovery|
Used for discovering HA members from FORTINET-FORTIGATE-MIB.
|Dependent item|ha.discovery
**Preprocessing**

- 
SNMP walk to JSON

⛔️Custom on fail: Discard value

- 
Discard unchanged with heartbeat: `1h`

|

### Item prototypes for HA member discovery

|Name|Description|Type|Key and additional info|
|----|-----------|----|-----------------------|
|HA {#HA.ID}: Serial number|
MIB: FORTINET-FORTIGATE-MIB

Serial number of the HA cluster member.
|Dependent item|ha.serialnumber[fgHaStatsSerial.{#SNMPINDEX}]
**Preprocessing**

- 
SNMP walk value: `1.3.6.1.4.1.12356.101.13.2.1.1.2.{#SNMPINDEX}`

- 
Discard unchanged with heartbeat: `1d`

|
|HA {#HA.ID}: CPU usage|
MIB: FORTINET-FORTIGATE-MIB

CPU usage of the specified cluster member (percentage).
|Dependent item|ha.cpu.usage[fgHaStatsCpuUsage.{#SNMPINDEX}]
**Preprocessing**

- 
SNMP walk value: `1.3.6.1.4.1.12356.101.13.2.1.1.3.{#SNMPINDEX}`

|
|HA {#HA.ID}: Memory usage|
MIB: FORTINET-FORTIGATE-MIB

Memory usage of the specified cluster member (percentage).
|Dependent item|ha.mem.usage[fgHaStatsMemUsage.{#SNMPINDEX}]
**Preprocessing**

- 
SNMP walk value: `1.3.6.1.4.1.12356.101.13.2.1.1.4.{#SNMPINDEX}`

|
|HA {#HA.ID}: Network bandwidth usage|
MIB: FORTINET-FORTIGATE-MIB

Network bandwidth usage of the specified cluster member (bps).
|Dependent item|ha.net.usage[fgHaStatsNetUsage.{#SNMPINDEX}]
**Preprocessing**

- 
SNMP walk value: `1.3.6.1.4.1.12356.101.13.2.1.1.5.{#SNMPINDEX}`

- 
Custom multiplier: `1024`

|
|HA {#HA.ID}: Session count|
MIB: FORTINET-FORTIGATE-MIB

Current session count of the specified cluster member.
|Dependent item|ha.session.count[fgHaStatsSesCount.{#SNMPINDEX}]
**Preprocessing**

- 
SNMP walk value: `1.3.6.1.4.1.12356.101.13.2.1.1.6.{#SNMPINDEX}`

|
|HA {#HA.ID}: Packets processed|
MIB: FORTINET-FORTIGATE-MIB

Number of packets processed by the specified cluster member per second.
|Dependent item|ha.packets.rate[fgHaStatsPktCount.{#SNMPINDEX}]
**Preprocessing**

- 
SNMP walk value: `1.3.6.1.4.1.12356.101.13.2.1.1.7.{#SNMPINDEX}`

- Change per second
|
|HA {#HA.ID}: Bytes processed|
MIB: FORTINET-FORTIGATE-MIB

Number of bytes processed by the specified cluster member per second.
|Dependent item|ha.bytes.rate[fgHaStatsByteCount.{#SNMPINDEX}]
**Preprocessing**

- 
SNMP walk value: `1.3.6.1.4.1.12356.101.13.2.1.1.8.{#SNMPINDEX}`

- Change per second
|
|HA {#HA.ID}: IPS events|
MIB: FORTINET-FORTIGATE-MIB

Number of IDS/IPS events triggered on the specified cluster member per second.
|Dependent item|ha.ips.events[fgHaStatsIdsCount.{#SNMPINDEX}]
**Preprocessing**

- 
SNMP walk value: `1.3.6.1.4.1.12356.101.13.2.1.1.9.{#SNMPINDEX}`

- Change per second
|
|HA {#HA.ID}: Anti-virus events|
MIB: FORTINET-FORTIGATE-MIB

Number of anti-virus events triggered on the specified cluster member per second.
|Dependent item|ha.av.events[fgHaStatsAvCount.{#SNMPINDEX}]
**Preprocessing**

- 
SNMP walk value: `1.3.6.1.4.1.12356.101.13.2.1.1.10.{#SNMPINDEX}`

- Change per second
|
|HA {#HA.ID}: Hostname|
MIB: FORTINET-FORTIGATE-MIB

Host name of the specified cluster member.
|Dependent item|ha.hostname[fgHaStatsHostname.{#SNMPINDEX}]
**Preprocessing**

- 
SNMP walk value: `1.3.6.1.4.1.12356.101.13.2.1.1.11.{#SNMPINDEX}`

- 
Discard unchanged with heartbeat: `1d`

|
|HA {#HA.ID}: Sync status|
MIB: FORTINET-FORTIGATE-MIB

Current HA sync status.
|Dependent item|ha.sync.status[fgHaStatsSyncStatus.{#SNMPINDEX}]
**Preprocessing**

- 
SNMP walk value: `1.3.6.1.4.1.12356.101.13.2.1.1.12.{#SNMPINDEX}`

|
|HA {#HA.ID}: Global checksum|
MIB: FORTINET-FORTIGATE-MIB

Current HA global checksum value.
|Dependent item|ha.checksum.global[fgHaStatsGlobalChecksum.{#SNMPINDEX}]
**Preprocessing**

- 
SNMP walk value: `1.3.6.1.4.1.12356.101.13.2.1.1.15.{#SNMPINDEX}`

- 
Discard unchanged with heartbeat: `1d`

|
|HA {#HA.ID}: Primary serial number|
MIB: FORTINET-FORTIGATE-MIB

Serial number of the primary HA member during the last sync attempt (successful or not).
|Dependent item|ha.primary.serialnumber[fgHaStatsMasterSerial.{#SNMPINDEX}]
**Preprocessing**

- 
SNMP walk value: `1.3.6.1.4.1.12356.101.13.2.1.1.16.{#SNMPINDEX}`

- 
Discard unchanged with heartbeat: `6h`

|

### LLD rule Hardware sensors discovery

|Name|Description|Type|Key and additional info|
|----|-----------|----|-----------------------|
|Hardware sensors discovery|
Used for discovering hardware sensors from FORTINET-FORTIGATE-MIB.
|Dependent item|hw.sensor.discovery
**Preprocessing**

- 
SNMP walk to JSON

⛔️Custom on fail: Discard value

- 
Discard unchanged with heartbeat: `1h`

|

### Item prototypes for Hardware sensors discovery

|Name|Description|Type|Key and additional info|
|----|-----------|----|-----------------------|
|Sensor {#SENSOR.NAME}: Value|
MIB: FORTINET-FORTIGATE-MIB

A string representation of the value of the sensor. Because sensors can present data in different formats, string representation is the most general format. Interpretation of the value (units of measure, for example) is dependent on the individual sensor.
|Dependent item|hw.sensor.value[fgHwSensorEntValue.{#SENSOR.ID}]
**Preprocessing**

- 
SNMP walk value: `1.3.6.1.4.1.12356.101.4.3.2.1.3.{#SENSOR.ID}`

- 
Discard unchanged with heartbeat: `1h`

|
|Sensor {#SENSOR.NAME}: Alarm status|
MIB: FORTINET-FORTIGATE-MIB

If the sensor has an alarm threshold and has exceeded it, this will indicate its status. Not all sensors have alarms.
|Dependent item|hw.sensor.status[fgHwSensorEntAlarmStatus.{#SENSOR.ID}]
**Preprocessing**

- 
SNMP walk value: `1.3.6.1.4.1.12356.101.4.3.2.1.4.{#SENSOR.ID}`

|

### LLD rule SoC3 discovery

|Name|Description|Type|Key and additional info|
|----|-----------|----|-----------------------|
|SoC3 discovery|
Used for discovering SoC3 NP6Lite processors from FORTINET-FORTIGATE-MIB.
|Dependent item|soc3.discovery
**Preprocessing**

- 
SNMP walk to JSON

⛔️Custom on fail: Discard value

- 
Discard unchanged with heartbeat: `1h`

|

### Item prototypes for SoC3 discovery

|Name|Description|Type|Key and additional info|
|----|-----------|----|-----------------------|
|SoC3 {#CPU.ID}: Packets dropped|
MIB: FORTINET-FORTIGATE-MIB

The total number of packets dropped by this processor (only valid for processor types that support this statistic).
|Dependent item|soc3.np6lite.pkt.dropped[fgProcessorPktDroppedCount.{#CPU.ID}]
**Preprocessing**

- 
SNMP walk value: `1.3.6.1.4.1.12356.101.4.4.2.1.8.{#SNMPINDEX}`

- Change per second
|
|SoC3 {#CPU.ID}: Packets received|
MIB: FORTINET-FORTIGATE-MIB

The total number of packets received by this processor (only valid for processor types that support this statistic).
|Dependent item|soc3.np6lite.pkt.received[fgProcessorPktRxCount.{#CPU.ID}]
**Preprocessing**

- 
SNMP walk value: `1.3.6.1.4.1.12356.101.4.4.2.1.6.{#SNMPINDEX}`

- Change per second
|
|SoC3 {#CPU.ID}: Packets transmitted|
MIB: FORTINET-FORTIGATE-MIB

The total number of packets transmitted by this processor (only valid for processor types that support this statistic).
|Dependent item|soc3.np6lite.pkt.transmitted[fgProcessorPktRxCount.{#CPU.ID}]
**Preprocessing**

- 
SNMP walk value: `1.3.6.1.4.1.12356.101.4.4.2.1.7.{#SNMPINDEX}`

- Change per second
|

### LLD rule SD-WAN health-check discovery

|Name|Description|Type|Key and additional info|
|----|-----------|----|-----------------------|
|SD-WAN health-check discovery|
Used for discovering SD-WAN health-check from FORTINET-FORTIGATE-MIB.
|Dependent item|sdwan_health.discovery
**Preprocessing**

- 
SNMP walk to JSON

⛔️Custom on fail: Discard value

- 
Discard unchanged with heartbeat: `1h`

|

### Item prototypes for SD-WAN health-check discovery

|Name|Description|Type|Key and additional info|
|----|-----------|----|-----------------------|
|SD-WAN [{#HNAME}]:[{#IFNAME}]: Health check state|
MIB: FORTINET-FORTIGATE-MIB

Health check state on a specific member link.
|Dependent item|sdwan_health.state[fgVWLHealthCheckLinkState.{#SNMPINDEX}]
**Preprocessing**

- 
SNMP walk value: `1.3.6.1.4.1.12356.101.4.9.2.1.4.{#SNMPINDEX}`

|
|SD-WAN [{#HNAME}]:[{#IFNAME}]: Latency|
MIB: FORTINET-FORTIGATE-MIB

The average latency of a health check on a specific member link in a float number within the last 30 probes.
|Dependent item|sdwan_health.latency[fgVWLHealthCheckLinkLatency.{#SNMPINDEX}]
**Preprocessing**

- 
SNMP walk value: `1.3.6.1.4.1.12356.101.4.9.2.1.5.{#SNMPINDEX}`

|
|SD-WAN [{#HNAME}]:[{#IFNAME}]: Jitter|
MIB: FORTINET-FORTIGATE-MIB

The average jitter of a health check on a specific member link in a float number within the last 30 probes.
|Dependent item|sdwan_health.jitter[fgVWLHealthCheckLinkJitter.{#SNMPINDEX}]
**Preprocessing**

- 
SNMP walk value: `1.3.6.1.4.1.12356.101.4.9.2.1.6.{#SNMPINDEX}`

|
|SD-WAN [{#HNAME}]:[{#IFNAME}]: Packets loss|
MIB: FORTINET-FORTIGATE-MIB

The packet loss percentage of a health check on a specific member link in a float number within the last 30 probes.
|Dependent item|sdwan_health.loss[fgVWLHealthCheckLinkPacketLoss.{#SNMPINDEX}]
**Preprocessing**

- 
SNMP walk value: `1.3.6.1.4.1.12356.101.4.9.2.1.9.{#SNMPINDEX}`

|
|SD-WAN [{#HNAME}]:[{#IFNAME}]: Packets sent per second|
MIB: FORTINET-FORTIGATE-MIB

Number of packets sent by a health check on a specific member link per second.
|Dependent item|sdwan_health.sent[fgVWLHealthCheckLinkPacketSend.{#SNMPINDEX}]
**Preprocessing**

- 
SNMP walk value: `1.3.6.1.4.1.12356.101.4.9.2.1.7.{#SNMPINDEX}`

- Change per second
|
|SD-WAN [{#HNAME}]:[{#IFNAME}]: Packets received per second|
MIB: FORTINET-FORTIGATE-MIB

Number of packets received by a health check on a specific member link per second.
|Dependent item|sdwan_health.received[fgVWLHealthCheckLinkPacketRecv.{#SNMPINDEX}]
**Preprocessing**

- 
SNMP walk value: `1.3.6.1.4.1.12356.101.4.9.2.1.8.{#SNMPINDEX}`

- Change per second
|

### Trigger prototypes for SD-WAN health-check discovery

|Name|Description|Expression|Severity|Dependencies and additional info|
|----|-----------|----------|--------|--------------------------------|
|FortiGate: SD-WAN [{#HNAME}]:[{#IFNAME}]: Health check state is dead|
This trigger expression works as follows:
1. It can be triggered if the health check state is dead.
2. `{$SDWAN.HEALTH.IF.CONTROL:"{#HNAME}"}=1` - a user can redefine the context macro to "0", marking this health check as not important. No new trigger will be fired if this health check is dead.
3. `{TEMPLATE_NAME:METRIC.diff()}=1` - the trigger fires only if the health check state was up to "1" sometime before.

WARNING: If closed manually, it will not fire again on the next poll because of `diff`.
|`{$SDWAN.HEALTH.IF.CONTROL:"{#HNAME}"}=1 and last(/FortiGate by SNMP/sdwan_health.state[fgVWLHealthCheckLinkState.{#SNMPINDEX}])=1 and (last(/FortiGate by SNMP/sdwan_health.state[fgVWLHealthCheckLinkState.{#SNMPINDEX}],#1)<>last(/FortiGate by SNMP/sdwan_health.state[fgVWLHealthCheckLinkState.{#SNMPINDEX}],#2))`|Average|**Manual close**: Yes|
|FortiGate: SD-WAN [{#HNAME}]:[{#IFNAME}]: High packets loss|
High level of packet loss detected.
|`min(/FortiGate by SNMP/sdwan_health.loss[fgVWLHealthCheckLinkPacketLoss.{#SNMPINDEX}],5m)>{$SDWAN.HEALTH.IF.LOSS.WARN:"{#HNAME}"}`|Warning||

### LLD rule Wireless discovery

|Name|Description|Type|Key and additional info|
|----|-----------|----|-----------------------|
|Wireless discovery|
Used for discovering wireless access points from FORTINET-FORTIGATE-MIB.
|Dependent item|wireless.discovery
**Preprocessing**

- 
SNMP walk to JSON

⛔️Custom on fail: Discard value

- 
Discard unchanged with heartbeat: `1h`

|

### Item prototypes for Wireless discovery

|Name|Description|Type|Key and additional info|
|----|-----------|----|-----------------------|
|WTP {#WC.NAME}: Administrative status|
MIB: FORTINET-FORTIGATE-MIB

Represents the administrative status of this wireless termination point (WTP).

The following enumerated values are supported:

`discovered(1)` - This WTP was discovered though discovery or join request messages.

`disable(2)` - Controller is configured to not provide service to this WTP.

`enable(3)` - Controller is configured to provide service to this WTP.

`other(0)` - The administration state of the WTP is unknown.
|Dependent item|wc.admin.status[fgWcWtpConfigWtpAdmin.{#SNMPINDEX}]
**Preprocessing**

- 
SNMP walk value: `1.3.6.1.4.1.12356.101.14.4.3.1.2.{#SNMPINDEX}`

|
|WTP {#WC.NAME}: Location|
MIB: FORTINET-FORTIGATE-MIB

Represents the location of this WTP.
|Dependent item|wc.location[fgWcWtpConfigWtpLocation.{#SNMPINDEX}]
**Preprocessing**

- 
SNMP walk value: `1.3.6.1.4.1.12356.101.14.4.3.1.4.{#SNMPINDEX}`

- 
Discard unchanged with heartbeat: `1h`

|
|WTP {#WC.NAME}: Profile name|
MIB: FORTINET-FORTIGATE-MIB

Represents the profile configured for this WTP.
|Dependent item|wc.profile[fgWcWtpConfigWtpProfile.{#SNMPINDEX}]
**Preprocessing**

- 
SNMP walk value: `1.3.6.1.4.1.12356.101.14.4.3.1.5.{#SNMPINDEX}`

- 
Discard unchanged with heartbeat: `1h`

|
|WTP {#WC.NAME}: Radio enabled|
MIB: FORTINET-FORTIGATE-MIB

Whether radio is enabled for this WTP.
|Dependent item|wc.radio.enabled[fgWcWtpConfigRadioEnable.{#SNMPINDEX}]
**Preprocessing**

- 
SNMP walk value: `1.3.6.1.4.1.12356.101.14.4.3.1.6.{#SNMPINDEX}`

- 
Discard unchanged with heartbeat: `1h`

|
|WTP {#WC.NAME}: Radio ATPC status|
MIB: FORTINET-FORTIGATE-MIB

Whether radio automatic TX power control is enabled on this WTP.
|Dependent item|wc.radio.atpc.status[fgWcWtpConfigRadioAutoTxPowerControl.{#SNMPINDEX}]
**Preprocessing**

- 
SNMP walk value: `1.3.6.1.4.1.12356.101.14.4.3.1.7.{#SNMPINDEX}`

- 
Discard unchanged with heartbeat: `1h`

|
|WTP {#WC.NAME}: Radio ATPC low limit|
MIB: FORTINET-FORTIGATE-MIB

Represents the low limit of radio automatic TX power control configured for this WTP, in dBm.
|Dependent item|wc.radio.atpc.low_limit[fgWcWtpConfigRadioAutoTxPowerLow.{#SNMPINDEX}]
**Preprocessing**

- 
SNMP walk value: `1.3.6.1.4.1.12356.101.14.4.3.1.8.{#SNMPINDEX}`

- 
Discard unchanged with heartbeat: `10m`

|
|WTP {#WC.NAME}: Radio ATPC high limit|
MIB: FORTINET-FORTIGATE-MIB

Represents the high limit of radio automatic TX power control configured for this WTP, in dBm.
|Dependent item|wc.radio.atpc.high_limit[fgWcWtpConfigRadioAutoTxPowerHigh.{#SNMPINDEX}]
**Preprocessing**

- 
SNMP walk value: `1.3.6.1.4.1.12356.101.14.4.3.1.9.{#SNMPINDEX}`

- 
Discard unchanged with heartbeat: `10m`

|
|WTP {#WC.NAME}: Radio TX power level|
MIB: FORTINET-FORTIGATE-MIB

Represents the radio TX power setting configured for this WTP, expressed in %.
|Dependent item|wc.radio.power_level[fgWcWtpConfigRadioTxPowerLevel.{#SNMPINDEX}]
**Preprocessing**

- 
SNMP walk value: `1.3.6.1.4.1.12356.101.14.4.3.1.10.{#SNMPINDEX}`

- 
Discard unchanged with heartbeat: `10m`

|
|WTP {#WC.NAME}: Radio band|
MIB: FORTINET-FORTIGATE-MIB

Represents the radio band configured for this WTP.
|Dependent item|wc.radio.band[fgWcWtpConfigRadioBand.{#SNMPINDEX}]
**Preprocessing**

- 
SNMP walk value: `1.3.6.1.4.1.12356.101.14.4.3.1.11.{#SNMPINDEX}`

- 
Discard unchanged with heartbeat: `1h`

|
|WTP {#WC.NAME}: Background scan|
MIB: FORTINET-FORTIGATE-MIB

Whether background scan is enabled on this WTP.
|Dependent item|wc.background.scan[fgWcWtpConfigRadioApScan.{#SNMPINDEX}]
**Preprocessing**

- 
SNMP walk value: `1.3.6.1.4.1.12356.101.14.4.3.1.12.{#SNMPINDEX}`

|
|WTP {#WC.NAME}: All VAPs selected|
MIB: FORTINET-FORTIGATE-MIB

Whether all wireless virtual access points (VAP) are selected for this WTP.
|Dependent item|wc.vaps.all[fgWcWtpConfigVapAll.{#SNMPINDEX}]
**Preprocessing**

- 
SNMP walk value: `1.3.6.1.4.1.12356.101.14.4.3.1.13.{#SNMPINDEX}`

|
|WTP {#WC.NAME}: VAPs list|
MIB: FORTINET-FORTIGATE-MIB

Represents a list of wireless virtual access points (VAP) configured for this WTP.
|Dependent item|wc.vaps.list[fgWcWtpConfigVaps.{#SNMPINDEX}]
**Preprocessing**

- 
SNMP walk value: `1.3.6.1.4.1.12356.101.14.4.3.1.14.{#SNMPINDEX}`

- 
Discard unchanged with heartbeat: `1h`

|
|WTP {#WC.NAME}: IP Address type|
MIB: FORTINET-FORTIGATE-MIB

Represents the IP address type of a WTP.
|Dependent item|wc.ip.type[fgWcWtpSessionWtpIpAddressType.{#SNMPINDEX}]
**Preprocessing**

- 
SNMP walk value: `1.3.6.1.4.1.12356.101.14.4.4.1.2.{#SNMPINDEX}`

- 
Discard unchanged with heartbeat: `1h`

|
|WTP {#WC.NAME}: IP Address|
MIB: FORTINET-FORTIGATE-MIB

Represents the IP address of a WTP that corresponds to the IP address in the IP packet header.
|Dependent item|wc.ip.addr[fgWcWtpSessionWtpIpAddress.{#SNMPINDEX}]
**Preprocessing**

- 
SNMP walk value: `1.3.6.1.4.1.12356.101.14.4.4.1.3.{#SNMPINDEX}`

- 
Discard unchanged with heartbeat: `1h`

|
|WTP {#WC.NAME}: Local IP Address type|
MIB: FORTINET-FORTIGATE-MIB

Represents the local IP address type of a WTP.
|Dependent item|wc.local_ip.type[fgWcWtpSessionWtpLocalIpAddressType.{#SNMPINDEX}]
**Preprocessing**

- 
SNMP walk value: `1.3.6.1.4.1.12356.101.14.4.4.1.4.{#SNMPINDEX}`

- 
Discard unchanged with heartbeat: `1h`

|
|WTP {#WC.NAME}: Local IP Address|
MIB: FORTINET-FORTIGATE-MIB

Represents the local IP address of a WTP and models the CAPWAP Local IPv4 Address or CAPWAP Local IPv6 Address fields [RFC5415].

If a Network Address Translation (NAT) device is present between the WTP and access controller (AC), the value of `fgWcWtpWtpLocalIpAddress` will be different from the value of `fgWcWtpWtpIpAddress`.
|Dependent item|wc.local_ip.addr[fgWcWtpSessionWtpLocalIpAddress.{#SNMPINDEX}]
**Preprocessing**

- 
SNMP walk value: `1.3.6.1.4.1.12356.101.14.4.4.1.5.{#SNMPINDEX}`

- 
Discard unchanged with heartbeat: `1h`

|
|WTP {#WC.NAME}: Base MAC Address|
MIB: FORTINET-FORTIGATE-MIB

Represents the WTP's Base MAC Address, which MAY be assigned to the primary Ethernet interface.

The instance of the object corresponds to the Base MAC Address sub-element in the CAPWAP protocol [RFC5415].
|Dependent item|wc.base.mac[fgWcWtpSessionWtpBaseMacAddress.{#SNMPINDEX}]
**Preprocessing**

- 
SNMP walk value: `1.3.6.1.4.1.12356.101.14.4.4.1.6.{#SNMPINDEX}`

- 
Discard unchanged with heartbeat: `1h`

|
|WTP {#WC.NAME}: Connection status|
MIB: FORTINET-FORTIGATE-MIB

Represents the connection status of a WTP to the AC.

The following enumerated values are supported:

`offLine(1)` - The WTP is not connected.

`onLine(2)` - The WTP is connected.

`downloadingImage(3)` - The WTP is downloading software image from the AC on joining.

`connectedImage(4)` - The AC is pushing a software image to the connected WTP.

`other(0)` - The WTP connection status is unknown.
|Dependent item|wc.conn.status[fgWcWtpSessionConnectionState.{#SNMPINDEX}]
**Preprocessing**

- 
SNMP walk value: `1.3.6.1.4.1.12356.101.14.4.4.1.7.{#SNMPINDEX}`

|
|WTP {#WC.NAME}: Uptime|
MIB: FORTINET-FORTIGATE-MIB

Represents the time since the WTP has booted.
|Dependent item|wc.uptime[fgWcWtpSessionWtpUpTime.{#SNMPINDEX}]
**Preprocessing**

- 
SNMP walk value: `1.3.6.1.4.1.12356.101.14.4.4.1.8.{#SNMPINDEX}`

- 
Custom multiplier: `0.01`

|
|WTP {#WC.NAME}: Daemon uptime|
MIB: FORTINET-FORTIGATE-MIB

Represents the time since the WTP daemon has been started.
|Dependent item|wc.daemon.uptime[fgWcWtpSessionWtpDaemonUpTime.{#SNMPINDEX}]
**Preprocessing**

- 
SNMP walk value: `1.3.6.1.4.1.12356.101.14.4.4.1.9.{#SNMPINDEX}`

- 
Custom multiplier: `0.01`

|
|WTP {#WC.NAME}: Session uptime|
MIB: FORTINET-FORTIGATE-MIB

Represents the time since the WTP has been connected to the AC.
|Dependent item|wc.session.uptime[fgWcWtpSessionWtpSessionUpTime.{#SNMPINDEX}]
**Preprocessing**

- 
SNMP walk value: `1.3.6.1.4.1.12356.101.14.4.4.1.10.{#SNMPINDEX}`

- 
Custom multiplier: `0.01`

|
|WTP {#WC.NAME}: Model number|
MIB: FORTINET-FORTIGATE-MIB

Represents the model number of a WTP.
|Dependent item|wc.model[fgWcWtpSessionWtpModelNumber.{#SNMPINDEX}]
**Preprocessing**

- 
SNMP walk value: `1.3.6.1.4.1.12356.101.14.4.4.1.12.{#SNMPINDEX}`

- 
Discard unchanged with heartbeat: `1h`

|
|WTP {#WC.NAME}: Hardware version|
MIB: FORTINET-FORTIGATE-MIB

Represents the hardware version of a WTP.
|Dependent item|wc.hardware.version[fgWcWtpSessionWtpHwVersion.{#SNMPINDEX}]
**Preprocessing**

- 
SNMP walk value: `1.3.6.1.4.1.12356.101.14.4.4.1.13.{#SNMPINDEX}`

- 
Discard unchanged with heartbeat: `1d`

|
|WTP {#WC.NAME}: Software version|
MIB: FORTINET-FORTIGATE-MIB

Represents the software version of a WTP.
|Dependent item|wc.software.version[fgWcWtpSessionWtpSwVersion.{#SNMPINDEX}]
**Preprocessing**

- 
SNMP walk value: `1.3.6.1.4.1.12356.101.14.4.4.1.14.{#SNMPINDEX}`

- 
Discard unchanged with heartbeat: `1d`

|
|WTP {#WC.NAME}: Bootloader version|
MIB: FORTINET-FORTIGATE-MIB

Represents the boot loader version of a WTP.
|Dependent item|wc.boot.version[fgWcWtpSessionWtpBootVersion.{#SNMPINDEX}]
**Preprocessing**

- 
SNMP walk value: `1.3.6.1.4.1.12356.101.14.4.4.1.15.{#SNMPINDEX}`

- 
Discard unchanged with heartbeat: `1d`

|
|WTP {#WC.NAME}: Region code|
MIB: FORTINET-FORTIGATE-MIB

Represents the region code programmed for this WTP.
|Dependent item|wc.region_code[fgWcWtpSessionWtpRegionCode.{#SNMPINDEX}]
**Preprocessing**

- 
SNMP walk value: `1.3.6.1.4.1.12356.101.14.4.4.1.16.{#SNMPINDEX}`

- 
Discard unchanged with heartbeat: `1h`

|
|WTP {#WC.NAME}: Connected clients|
MIB: FORTINET-FORTIGATE-MIB

Represents the number of clients currently connected to this WTP.
|Dependent item|wc.clients.num[fgWcWtpSessionWtpStationCount.{#SNMPINDEX}]
**Preprocessing**

- 
SNMP walk value: `1.3.6.1.4.1.12356.101.14.4.4.1.17.{#SNMPINDEX}`

|
|WTP {#WC.NAME}: Bits received|
MIB: FORTINET-FORTIGATE-MIB

Represents the number of bits received by this WTP per second.
|Dependent item|wc.rate.in[fgWcWtpSessionWtpByteRxCount.{#SNMPINDEX}]
**Preprocessing**

- 
SNMP walk value: `1.3.6.1.4.1.12356.101.14.4.4.1.18.{#SNMPINDEX}`

- Change per second
- 
Custom multiplier: `8`

|
|WTP {#WC.NAME}: Bits sent|
MIB: FORTINET-FORTIGATE-MIB

Represents the number of bits transmitted by this WTP per second.
|Dependent item|wc.rate.out[fgWcWtpSessionWtpByteTxCount.{#SNMPINDEX}]
**Preprocessing**

- 
SNMP walk value: `1.3.6.1.4.1.12356.101.14.4.4.1.19.{#SNMPINDEX}`

- Change per second
- 
Custom multiplier: `8`

|
|WTP {#WC.NAME}: CPU usage|
MIB: FORTINET-FORTIGATE-MIB

Represents the current CPU usage of a WTP (percentage).
|Dependent item|wc.cpu.usage[fgWcWtpSessionWtpCpuUsage.{#SNMPINDEX}]
**Preprocessing**

- 
SNMP walk value: `1.3.6.1.4.1.12356.101.14.4.4.1.20.{#SNMPINDEX}`

|
|WTP {#WC.NAME}: Memory usage|
MIB: FORTINET-FORTIGATE-MIB

Represents the current memory usage of a WTP (percentage).
|Dependent item|wc.mem.usage[fgWcWtpSessionWtpMemoryUsage.{#SNMPINDEX}]
**Preprocessing**

- 
SNMP walk value: `1.3.6.1.4.1.12356.101.14.4.4.1.21.{#SNMPINDEX}`

|
|WTP {#WC.NAME}: Memory capacity|
MIB: FORTINET-FORTIGATE-MIB

Represents the total physical memory (RAM) installed.
|Dependent item|wc.mem.size[fgWcWtpSessionWtpMemoryCapacity.{#SNMPINDEX}]
**Preprocessing**

- 
SNMP walk value: `1.3.6.1.4.1.12356.101.14.4.4.1.22.{#SNMPINDEX}`

- 
Discard unchanged with heartbeat: `1h`

- 
Custom multiplier: `1024`

|

### Trigger prototypes for Wireless discovery

|Name|Description|Expression|Severity|Dependencies and additional info|
|----|-----------|----------|--------|--------------------------------|
|FortiGate: WTP {#WC.NAME}: Connection is down|
This trigger expression works as follows:
1. It can be triggered if the current connection status is `offLine`.
2. `{$WC.STATE.CONTROL}=1` - a user can redefine the context macro to "0", marking this notification as not important. No new trigger will be fired if this connection is down.
|`{$WC.STATE.CONTROL:"{#WC.NAME}"}=1 and last(/FortiGate by SNMP/wc.conn.status[fgWcWtpSessionConnectionState.{#SNMPINDEX}])=1 and (last(/FortiGate by SNMP/wc.conn.status[fgWcWtpSessionConnectionState.{#SNMPINDEX}],#1)<>last(/FortiGate by SNMP/wc.conn.status[fgWcWtpSessionConnectionState.{#SNMPINDEX}],#2))`|High|**Manual close**: Yes|
|FortiGate: WTP {#WC.NAME}: Receiving firmware update|
This trigger expression works as follows:
1. It can be triggered if the current connection status is `downloadingImage`.
2. `{$WC.UPDATE.CONTROL}=1` - a user can redefine the context macro to "0", marking this notification as not important. No new trigger will be fired if the status is `downloadingImage`.
|`{$WC.UPDATE.CONTROL:"{#WC.NAME}"}=1 and last(/FortiGate by SNMP/wc.conn.status[fgWcWtpSessionConnectionState.{#SNMPINDEX}])=3 and (last(/FortiGate by SNMP/wc.conn.status[fgWcWtpSessionConnectionState.{#SNMPINDEX}],#1)<>last(/FortiGate by SNMP/wc.conn.status[fgWcWtpSessionConnectionState.{#SNMPINDEX}],#2))`|Info|**Manual close**: Yes|
|FortiGate: WTP {#WC.NAME}: Sending firmware update|
This trigger expression works as follows:
1. It can be triggered if the current connection status is `connectedImage`.
2. `{$WC.UPDATE.CONTROL}=1` - a user can redefine the context macro to "0", marking this notification as not important. No new trigger will be fired if the status is `connectedImage`.
|`{$WC.UPDATE.CONTROL:"{#WC.NAME}"}=1 and last(/FortiGate by SNMP/wc.conn.status[fgWcWtpSessionConnectionState.{#SNMPINDEX}])=4 and (last(/FortiGate by SNMP/wc.conn.status[fgWcWtpSessionConnectionState.{#SNMPINDEX}],#1)<>last(/FortiGate by SNMP/wc.conn.status[fgWcWtpSessionConnectionState.{#SNMPINDEX}],#2))`|Info|**Manual close**: Yes|
|FortiGate: WTP {#WC.NAME}: Session has been restarted|
Uptime is less than 10 minutes.
|`last(/FortiGate by SNMP/wc.session.uptime[fgWcWtpSessionWtpSessionUpTime.{#SNMPINDEX}])<10m`|Info|**Manual close**: Yes|
|FortiGate: WTP {#WC.NAME}: High CPU utilization|
The CPU utilization is too high.
|`min(/FortiGate by SNMP/wc.cpu.usage[fgWcWtpSessionWtpCpuUsage.{#SNMPINDEX}],5m)>{$WC.CPU.UTIL.CRIT:"{#WC.NAME}"}`|Warning||
|FortiGate: WTP {#WC.NAME}: High memory utilization|
The WTP is running out of free memory.
|`min(/FortiGate by SNMP/wc.mem.usage[fgWcWtpSessionWtpMemoryUsage.{#SNMPINDEX}],5m)>{$WC.MEMORY.UTIL.MAX:"{#WC.NAME}"}`|Warning||

### LLD rule Virtual domain discovery

|Name|Description|Type|Key and additional info|
|----|-----------|----|-----------------------|
|Virtual domain discovery|
Used for discovering virtual domains from FORTINET-FORTIGATE-MIB.
|Dependent item|vdom.discovery
**Preprocessing**

- 
SNMP walk to JSON

⛔️Custom on fail: Discard value

- 
Discard unchanged with heartbeat: `1h`

|

### Item prototypes for Virtual domain discovery

|Name|Description|Type|Key and additional info|
|----|-----------|----|-----------------------|
|VDOM {#VDOM.NAME}: Operation mode|
MIB: FORTINET-FORTIGATE-MIB

Operation mode of the virtual domain (NAT or Transparent).
|Dependent item|vdom.op_mode[fgVdEntOpMode.{#SNMPINDEX}]
**Preprocessing**

- 
SNMP walk value: `1.3.6.1.4.1.12356.101.3.2.1.1.3.{#SNMPINDEX}`

|
|VDOM {#VDOM.NAME}: HA member state|
MIB: FORTINET-FORTIGATE-MIB

HA cluster member state of the virtual domain on this device.
|Dependent item|vdom.ha.state[fgVdEntHaState.{#SNMPINDEX}]
**Preprocessing**

- 
SNMP walk value: `1.3.6.1.4.1.12356.101.3.2.1.1.4.{#SNMPINDEX}`

|
|VDOM {#VDOM.NAME}: CPU usage|
MIB: FORTINET-FORTIGATE-MIB

CPU usage of the virtual domain (percentage).
|Dependent item|vdom.cpu.usage[fgVdEntCpuUsage.{#SNMPINDEX}]
**Preprocessing**

- 
SNMP walk value: `1.3.6.1.4.1.12356.101.3.2.1.1.5.{#SNMPINDEX}`

|
|VDOM {#VDOM.NAME}: Memory usage|
MIB: FORTINET-FORTIGATE-MIB

Memory usage of the virtual domain (percentage).
|Dependent item|vdom.mem.usage[fgVdEntCpuUsage.{#SNMPINDEX}]
**Preprocessing**

- 
SNMP walk value: `1.3.6.1.4.1.12356.101.3.2.1.1.6.{#SNMPINDEX}`

|
|VDOM {#VDOM.NAME}: Active sessions|
MIB: FORTINET-FORTIGATE-MIB

Number of active sessions on the virtual domain.
|Dependent item|vdom.sessions[fgVdEntSesCount.{#SNMPINDEX}]
**Preprocessing**

- 
SNMP walk value: `1.3.6.1.4.1.12356.101.3.2.1.1.7.{#SNMPINDEX}`

|
|VDOM {#VDOM.NAME}: Sessions rate|
MIB: FORTINET-FORTIGATE-MIB

The session setup rate on the virtual domain per second.
|Dependent item|vdom.sessions.rate[fgVdEntSesRate.{#SNMPINDEX}]
**Preprocessing**

- 
SNMP walk value: `1.3.6.1.4.1.12356.101.3.2.1.1.8.{#SNMPINDEX}`

|

## Feedback

Please report any issues with the template at [`https://support.zabbix.com`](https://support.zabbix.com)

You can also provide feedback, discuss the template, or ask for help at [`ZABBIX forums`](https://www.zabbix.com/forum/zabbix-suggestions-and-feedback)

