Traffic analyze - bandwidth saturation - OS 5.0.7

[cedsicuritalia]

Hi, i have a problem with traffic analyze in fortigate os 5.0.7. I've two places connected in mpls with two fortigate 300C in HA in the first place, two 311B in the second,  both with 5.0.7.

Sometimes i have bandwith saturation between these two  offices but i never find what is the problem: i mean, i cannot identify if there is a pc, a switch, or any other hardware that creates this saturation. 

If i uses policy monitor i can see there is the policy with highest session open or ordered by packet or byte....but not immediately o easy to identify.

The question is: is it possibile with this os or with something else connected to fortinet to create or manage a traffic analisys ?

Because many times i don't understand in time what or who has created the saturation and at the and, while looking to logs, the problems ends without a precise resolution about what happened.

Thanks 

Gianluca

[Dave_Hall]

Hi Gianluca.

Welcome to the forums.

The default system dashboard does come with some "Top Sessions" widgets that you an reconfigure to provide the information you are looking for.  (I have mine set to show "sort by Bytes".) 

But if you are looking for something that gives bandwidth usage per IP, you will need to add it via the CLI.  (Replace <admin user ID> with your actual admin id.)

config system admin
edit "<admin user ID>"
config dashboard-tabs
edit 10
set columns 1
set name "Top users"
next
end
config dashboard
edit 0
set widget-type per-ip-usage
set tab-id 10
set column 1
next
end
next
end

[cedsicuritalia]

Hi, thank you very much your suggestion is really usefull. I've another question if i can: is it possible, if exists, to enable another widget to create a per-ip-usage but divided per -interface? Because here I see this list for all interfaces, but my problem is that we use 9 different interfaces in our fortigate, and it should be easier to identify problem if divided per interface.

Thank you

Gianluca

[Dave_Hall]

As far as I am aware for the "per-IP bandwith" widget there is no option to define source interface.  On the Top sessions widget you are suppose to be able to drill down to the IP sessions themselves by right-clicking on an IP and choose "Show Matching Sessions", but it never worked for me (on Firefox 33.1.1 or IE11.0.14). I was only able to drill down by using the policy monitor.

[cedsicuritalia]

Thanks you for answer. I'll check next time.

Gianluca