Technical Tip: Automation stitch configuration for inbound and outbound bandwidth rate exceeded event (FIPS-CC mode only)

[kvimaladevi]

Description	This article describes how to create an Automation Stitch that triggers when inbound and/or outbound bandwidth rates are exceeded.
Scope	FortiGate, Automation Stitch, FIPS-CC Mode.
Solution	Important note before beginning: While this article discusses Automation Stitches primarily, it is dependent on two particular System Event log entries: 20220 - LOGID_EVENT_SHAPER_OUTBOUND_MAXED_OUT (aka 'Outbound bandwidth rate exceeded'). 20221 - LOGID_EVENT_SHAPER_INBOUND_MAXED_OUT (aka 'Inbound bandwidth rate exceeded'). It is critical to point out that these event logs are only ever generated when the FortiGate is running in FIPS-CC mode, as this feature was implemented solely to meet an NDcPP requirement for FIPS-CC certification. Note that this feature is available when running FIPS-CC mode on GA firmware as well as on the FIPS Certified/CVE-Patched firmware. What this ultimately means is that these logs will not be generated on regular FortiGates running standard firmware, and so this Automation Stitch will not trigger for non-FIPS-mode FortiGates. Additionally, FIPS-CC mode on the FortiGate is not generally recommended to be enabled unless there is a specific business requirement to meet FIPS regulations, as it imposes a number of restrictions on the FortiGate's behavior to meet these regulations (see also: Fortinet - Federal Information Processing Standards). Implementation: The steps to configure this Automation Stitch are as follows: Create a new Automation Stitch: Go to Security Fabric -> Automation and select 'Create New'. Assign a name, then select Trigger ‘FortiOS Event Log’ and Event as ‘Inbound bandwidth rate exceeded’ or ‘Outbound bandwidth rate exceeded’. Set the Action as 'Email' and specify the email address that should receive the email. Set the Email body to '%%logid%%', which is a variable that includes the contents of the event log. On the network interface to be monitored, go into the CLI and set the outbandwidth and inbandwidth limits (measured in Kbps): config system interface     edit port1         set inbandwidth <0-80000000 in kbps>         set outbandwidth <0-80000000 in kbps>     next end When the bandwidth crossing the interface exceeds the configured outbandwidth or inbandwidth, an event log will be generated, which triggers the Automation Stitch to send an email containing the log's contents to the configured email address. Note that an Email server needs to be configured under System -> Advanced before an alert email can be sent when the Automation stitch is triggered.