Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
New Contributor

How to know ISP drops



Is there a way to know when any Internet connecion stopped working with the default settings?

Can I do anything to know this?

I have FortiOS 6.2.2 in this Fortigate 60E, there is one SD-WAN with 1 performance sla for each wan, I can see if the wan is up or down in real time but I dont know how to check the history





Contributor II

Good question. In addition to keeping history of the ISP outage, I would like to know how to receive a notification when this happens. Does anyone know how this can be accomplished?


this might require FAZ under event trigger.

Fortigate Newbie

Fortigate Newbie

In FortiCloud, FortiGate Cloud GLOBAL, there is an option under Analysis / Event Management, to turn of a notification for Interface Down. Would this notify if the ISP was down?


The problem with interface down is there is rarely a situation where that happens. Normally the interface is up, indication just a physical connection, but the traffic doesn't get out. Interface down doesn't help in that scenario.


If you setup a link monitor you could accomplish this. If you are already using SDWAN you should have determined a link monitor anyways, in which case you simply need to create an Automation Stitch.. if you aren't using SDWAN already you can manually create a link monitor.


config system link-monitor

edit 1

set srcintf wan1

set server  -- or whatever it is you want to use to determine an outage

set update-static-route disable  -- disable if you only have 1 WAN, enable is used to failover to secondary



This will allow you to generate a log entry when the targets defined in the server part are unreachable. You can then create an automation stitch(under Security Fabric > Automation) to email you when this event is triggered. Though, obviously you would only get the email after the fact if you don't have a secondary line.




Do you know which event we need to monitor?


I am showing 3 possibilities


interface link status change <-- i dont think this one applies as we are not shutting down the interface


link monitor sla information


and link monitor status.  <-- I assume this is the entry that I am monitoring.

New Contributor

Thanks brycemd for your answer this seems useful, I need more time to test this



Top Kudoed Authors