Troubleshooting Tip: Firewall Policy Hit Count does not work in FortiManager

Description

This article describes an issue where the firewall policy hitcount is not working in FortiManager and provides a step-by-step solution to resolve the problem. The issue is related to the timeout of waiting for the hitcount response from FortiGate, which can be resolved by modifying the relevant global setting in FortiManager.

Scope

FortiManager, FortiGate.

Solution

Note: The 'Hit Count' will not get auto-refreshed and requires the Admin to use the 'Refresh Now' button in Hit Count column or 'Refresh Hit Counts' in the Tools drop-down to get the latest 'Hit count' and 'Last Used' information from the FortiGate.

This behavior has changed as of v6.4.7 an onwards. See Policy hit count.

To resolve the firewall policy Hit Count showing empty issue in the FortiManager, access the FortiManager CLI and execute the commands below:

config system global
    set hitcount-response-timeout <60 - 300 seconds>
end 

The default timeout is set to 60 seconds. On some occasions, the response might take more than that, and the value must be increased to address this issue. It is recommended to gradually start increasing the timeout by 5 to 10 seconds every time and verify whether this resolves this issue.

Note that this command was introduced in FortiManager versions 7.4.7 and 7.6.4.

Note: 

FortiManager can store the Last Used timestamp so it is not lost when the hit count is reset on a managed device. This feature is disabled by default.

When enabled, FortiManager:

• Ignores blank or older timestamps received from devices.

• Updates the value only if the new timestamp is more recent.

config system global
    set save-last-hit-in-adomdb enable
end

Related article:
Policy hit count