Technical Tip: How to generate an event when an FGFM tunnel remains down beyond a specified duration

Description

This article describes how to configure an event handler for an event when an FGFM tunnel remains down beyond a specified duration and send a notification.

Scope

FortiAnalyzer.

Solution

Create a mail server from System Settings -> Advanced -> Mail server, as explained here: Mail Server.

Create a notification profile from Incidents & Event -> Event Handlers -> Notification Profiles as explained here: Creating notification profiles.

Go to Incident & Events -> Event Handlers and create a new event handler. Name a handler, for example, FortiGate FGFM Tunnel Fluctuation.

Select Correlation as the Event Handler type, and set Threshold Duration to 30m (30 minutes as an example).

Correlation sequence -> Select '+' to add a new rule -> Name: FGFMTunnelDown. Configure all the details below in the rule and select OK to save the config.

Define event conditions. Do not edit the settings in this config

Add another rule with Name: FGFMTunnelUp. Configure all the details below in the rule and select OK to save the config.

Define Event Conditions. Do not edit the setting on this config.

The above configuration indicates that the event should be generated if the FGFM tunnel does not come up after 30 minutes. Specify the duration based on the requirement.

Correlation criteria: Configure the correlation criteria to ensure that the FGFM tunnel down and FGFM tunnel up events belong to the same FortiGate device before the correlation event is generated.

Map the notification profile created earlier under Handler Settings. Use a customised notification message if preferred; enter the desired message in the Use Custom Message field.

Enable the newly created event handler.