FortiExtender - Notification when offline

[jsauer]

Question... Is there anything which will alert me when a FortiExtender is "offline" or unable to be connected to?

We have had a couple of instances lately where our FortiExtenders were needed, but weren't connecting to either the Fortigate or the cellular provider. Unfortunately, we weren't aware of this as there are no notifications when the Extender cannot connect to either. Is it possible to set something up that will let me know if the Extender can't connect to the cellular providers, or if the Fortigate cannot connect to the Extender?

[scitlak]

Hi, 

You may download the FORTINET-FORTIEXTENDER-MIB.mib and try to monitor your FortiExtender by SNMP monitoring tool.

FORTINET-FORTIEXTENDER-MIB.mib has many OIDs give information about Modem status like below.

1.3.6.1.4.1.12356.121.21.3.1.1.2

ffext info modem status modem

Thanks

[Sx11]

I notice there are mutliple event logs in FGT realted to FortiExtender that might be helpful:

**    Cellular disconnected
       action: cellular_disconnected
       meta data: SN, IMEI, ICCID, IMSI, PhoneNumber, Carrier, plan,service
Event log: date=2019-02-20 time=10:33:57 logid="0111046407" type="event" subtype="fortiextender" level="warning" vd="root" eventtime=1550687636 logdesc="Remote FortiExtender warning activity" sn="FX04DN4N16002352" ip=11.11.11.2 action="Cellular Disconnected" imei="359376060442770" imsi="N/A" iccid="N/A" phonenumber="N/A" carrier="N/A" plan="N/A" apn="N/A" service="LTE" msg="FX04DN4N16002352 STATE: sim with imsi: in slot:2 on
carrier:N/A disconnected"

https://docs.fortinet.com/document/fortigate/6.2.0/new-features/456831/event-log-subtype-for-fortiex...

Using a FortiAnalyzer/FortiSIEM or any other SIEM solution can use the event to trigger an alert.