Technical Tip: Automation stitch configuration for inbound and outbound bandwidth rate exceeded event (FIPS-CC mode only)

This article describes how to create an Automation Stitch that triggers when inbound and/or outbound bandwidth rates are exceeded.

Important note before beginning:

While this article discusses Automation Stitches primarily, it is dependent on two particular System Event log entries:

• 20220 - LOGID_EVENT_SHAPER_OUTBOUND_MAXED_OUT (aka 'Outbound bandwidth rate exceeded').
• 20221 - LOGID_EVENT_SHAPER_INBOUND_MAXED_OUT (aka 'Inbound bandwidth rate exceeded').

It is critical to point out that these event logs are only ever generated when the FortiGate is running in FIPS-CC mode, as this feature was implemented solely to meet an NDcPP requirement for FIPS-CC certification. Note that this feature is available when running FIPS-CC mode on GA firmware as well as on the FIPS Certified/CVE-Patched firmware.

Currently, there is no dedicated trigger for a system event that reports bandwidth exceedance and sends an email alert without the FIPS-CC option being enabled on FortiGates. These features are exclusive to FortiMonitor and FortiAnalizer.

What this ultimately means is that these logs will not be generated on regular FortiGates running standard firmware, and so this Automation Stitch will not trigger for non-FIPS-mode FortiGates. Additionally, FIPS-CC mode on the FortiGate is not generally recommended to be enabled unless there is a specific business requirement to meet FIPS regulations, as it imposes a number of restrictions on the FortiGate's behavior to meet these regulations (see also: Federal Information Processing Standards).

Implementation:

The steps to configure this Automation Stitch are as follows:

1. Create a new Automation Stitch: Go to Security Fabric -> Automation and select 'Create New'.
2. Assign a name, then select Trigger ‘FortiOS Event Log’ and Event as ‘Inbound bandwidth rate exceeded’ or ‘Outbound bandwidth rate exceeded’.

3. Set the Action as 'Email' and specify the email address that should receive the email. Set the Email body to '%%logid%%', which is a variable that includes the contents of the event log.
   
   

4. On the network interface to be monitored, go into the CLI and set the outbandwidth and inbandwidth limits (measured in Kbps):

config system interface

    edit port1

        set inbandwidth <0-80000000 in kbps>

        set outbandwidth <0-80000000 in kbps>

    next

end

Note: To configure estimated bandwidth for internal or LAN ports in the GUI, follow the steps outlined in Technical Tip: Estimated bandwidth monitoring for internal or LAN ports.

When the bandwidth crossing the interface exceeds the configured outbandwidth or inbandwidth, an event log will be generated, which triggers the Automation Stitch to send an email containing the log's contents to the configured email address. Note that an Email server needs to be configured under System -> Advanced before an alert email can be sent when the Automation stitch is triggered.

Technical Tip: How to configure alert email settings

To test an automation stitch:

On the FortiGate GUI, go to Security Fabric -> Automation, 'right-click' on the dedicated automation stitch and select 'Test Automation Stitch'. To test the automation stitch from the CLI, use the following command: diagnose automation test <stitch-name> <log>