Description
This article describes how to troubleshoot bandwidth issues and detect which host is consuming the most bandwidth.
Solution
To observe the logs on the device, verify if the below settings are enabled.
Only if the logs are visible in the device, the bandwidth can be detected.
1) For any hardware model, make sure logging is enabled.
It can be either logging in memory/disk or in a remote logging server like Forticloud/syslog/fortianalyzer.
2) Ensure that logging is enabled on firewall policies by navigating as below:
Firewall -> Policy -> Edit the policy, and enable 'All Sessions' under Logging Options -> Log Allowed Traffic
3) Check the log severity (CLI Only), it should be in 'Information': [example shown for disk usage]
#config log disk filter
set severity information
end
Once the above points are verified, the bandwidth in the “Fortiview” section of the firewall can be checked.
To display the source Information :
FortiView -> Sources
Here all the User/IP information will be display. click on 'Bandwidth', Fortigate will sort the sources from Higher bandwidth usage user to lower.
In order to verify more details about the user like the applications used, destinations reached, websites visited etc, double 'click' on that particular source, it will drill down the details.
In the above screenshot, are visible the applications used by user 172.31.137.71 and the number of bytes and sessions formed.
Note: Enable WebFilter, Application control in the policy to get these details in FortiView.
That particular source can be banned, by doing a right click on the source and selecting the 'Ban IP', or drilldown the source and select the 'Ban IP'.
The below commands can be used from CLI to clear the sessions:
# diag sys session filter src x.x.x.x
# diag sys session clear
x.x.x.x is the source IP for which the session need to be cleared.
Same thing can be also done for destination ip e.g.:
# diag sys session filter dst x.x.x.x
# diag sys session clear
x.x.x.x is the destination IP for which the session need to be cleared.
Related Document:
https://docs.fortinet.com/document/fortigate/6.4.5/administration-guide/133721/fortiview
