FortiAnalyzer: Chart for WAN network utilization for all devices

[VS1]

Does anyone have a chart or template or custom report they are willing to share that graphs (in and out bandwidth utilization) on each of the WAN interfaces of each of the Fortigates?

The closest to what I am after would be the Chart: Interface Utilization Device List

1) Is there a way to filter just on WAN interfaces?

2) Is there was way to remove all graphs except for the utilization sent and received?

Using FAZ 7.4.2

[jasonhong]

Hi,

I assume you are referring to the Throughput Utilization Billing by Device and Interface Report in FortiAnalyzer.

1) Is there a way to filter just on WAN interfaces?

> Yes, you can set the necessary filter by editing the Report > Settings > Filters. Refer to below sample screenshot.

2) Is there was way to remove all graphs except for the utilization sent and received?

> Yes, you can include/exclude specific charts by editing the Report > Editor
https://docs.fortinet.com/document/fortianalyzer/7.4.2/administration-guide/759107/reports-editor-ta...

[VS1]

Yes, I want to use that chart from Throughput Utilization Billing by Device and Interface Report in FortiAnalyzer.

1) Doesn't work for me. Report still shows all ports (can see internal and wan2 even though only wan1 is in the filter). Had also tried SrcIntf and DstIntf filters. All lowercase like in the report.

2) When I view or edit the Chart (Interface Utilization Device List), its type is Table and real data shows no data. Had cloned it and looks and works the same but the output in the report is not a table but multiple graphs. Where can I find the graphs defined?

[jasonhong]

1) You can identify the correct log field attribute/value by verify on the log details in Log View. Once the correct log field attribute and value has been verify from the log details, you can input the same log field attribute & value in the report filter and re-generate the report.

2) You can edit the report chart by navigating to Reports > Report Definitions > All Report > Search for Throughput Utilization Billing by Device and Interface Report > Right click & Edit Report > Editor

[VS1]

1) If I filter Log View on intf, it doesn't recognize that term so cannot find any entries but I can filter on: dstintf= "wan1(wan)" or dstintfrole="wan" and it returns logs.

Tried updating the report to filter on those (tried one then the other) and it still shows internal ports aswell as wan1 and wan2. But I think that may be correct because you could have traffic that has src of lan and dst of wan so it will show up. So I tried to filter just on role="wan" but still getting graphs for all ports. Tried Role not equal to lan and report shows no matching data. So I think the problem is that the traffic traverses between wan to and from lan which is why there are lan graphs showing up. Any idea on how get the report to only show wan interfaces?

2) In your picture, it is the one below the selected chart that is the Chart of interest (Interface Utilization Device List) which shows multiple graphs. If I delete everything except that one chart, it contains multiple graphs but I only want the graphs: "Interface Received Throughput Over Time" and "Interface Sent Throughput Over Time". How do I delete all the other graphs out of that chart?

[vraev]

Hi,

Some features are only available in 7.4.2 FAZ/FGT
https://docs.fortinet.com/document/fortianalyzer/7.4.3/administration-guide/410508/sd-wan-summary
Best,

[VS1]

Does not have what I require. What I want is a network utilization graph (bandwidth in and out) for each wan interface of all my devices.

[vraev]

Hi,

Sample logs by log type
https://docs.fortinet.com/document/fortigate/7.4.3/administration-guide/986892/sample-logs-by-log-ty...

Event Logs > SD-WAN Events
Log configuration requirements
config log eventfilter
set event enable
set sdwan enable
end

Best,

[balding-eagle]

I've been trying to find out a solution for this simple ask for a few months, but it seems like Fortinet nudge people to use SNMP by not providing this sort of reporting natively.

For now I still use the "SNMP Traffic" sensor in PRTG with a SNMPv3 template in FMG.

Feels like a real waste not to use the data that already exists in FAZ to provide such a simple report.

I get that Fortinet is a security company, but this is basic stuff in the ISP world where I come from.

This is not a new ask, so I wonder what is taking so long to provide some working solution.

I'm no FAZ pro, but it looks like a simple dataset + charts combo, which seems pretty basic as these things go.

If monthly reporting is not needed, then the "Interface Bandwidth" widget in FMG can kind of work for this, provided the feature is enabled on each WAN interface.

It only goes back for one week, but it's better than nothing, I suppose.

[mikemn]

This is a major gap in my eyes as well. Fortinets response to me is to buy the Fortimonitor product, but I find that to be a poor response. FAZ is a lot of things but useful at network reporting is not really one of them.