check_fortigate.pl: fortigate,fortimail, fortianalyzer

To allow AuthNoPriv I needed to delete any references to $priv_password and $priv_prot in get_snmp_session_v3().
Also needed to update the USM.pm perl module file to allow SHA-256 to work. See : https://github.com/Napsty/scripts/blob/master/perl-net-snmp-sha2/USM.pm

Other than, works pretty good.

Got the script to work with snmpv3 with sha256 and aes128. Only thing to do to get sha256 working is download the new USM.pm file from https://github.com/Napsty/scripts/tree/master/perl-net-snmp-sha2 and copy it to /usr/share/perl5/Net/SNMP/Security/ directory. I did use libnet-snmp-perl instead of cpan install Net::SNMP since cpan didn't give me all the files for SNMP.

It was working fine but I noticed that it is now showing "0" for sessions and memory. Maybe because it's a newer firmware. Has anyone gone through the same problem?
Thanks

this is really good and working fine.

we used to have a sonicwall plugin which would check specific vpn tunnels if they are active/down.

is it possible in this plugin too? i just find that it can only show the status of all vpn tunnels configure in that firewall.

thanks.

If anybody is having issues with "UNKNOWN: session get request failed" then this may help...

First off, the script expects a dir to exist /usr/local/nagios/var/spool/FortiSerial so create that on your Nagios host and make sure perms are the same as the other folders in the spool dir (or pass your own location to the script with -p or --path /my/path)

Secondly, running the commands check_fortigate_xyz wasn't working for me, so I created a check_fortigate_blank command (Configure > Commands > Copy check_fortigate_CPU > edit the copy) and set the command line to $USER1$/check_fortigate.pl -H $HOSTADDRESS$ $ARG1$

You can then use this command in services by entering all the required variable for the SNMP auth, eg. for SNMP v3 into the ARG1 field, eg.

--snmp_version 3 --username blah --privprotocol blah --privpassword blah --authpassword blah --authprotocol blah --type blah

You can see the variables by running ./check_fortigate.pl -h

Hello folks,

I am facing the problem "UNKNOWN: session get request failed"
Has anyone had the same problem and was able to solve it?

Thanks in advance!

Hello

I have 3 different fortigate

In two of them models 200B and 600C the plugins work perfectly for me

But on model 501E I get the following error UNKNOWN: session get request failed

The SNMP configuration is activated in all 3 fortigate the same, with the IP of my nagios server, with the SNMP events cpu-high mem-low fm-if-change activated, I also have the protocol v1 and v2c port 161 enable activated

Could someone help me, this is driving me crazy

Thank you

MayraAltamirano, if you are already in the plugins directory, make sure to run your plugin as such:

./check_fortigate.pl -H 192.168.200.254 -C public -T cluster

or run it with:

/full/path/to/the/check_fortigate.pl -H 192.168.200.254 -C public -T cluster

Hope this helps.

Hello!
Firts of all I'm sorry for my bad english.
I'm a Nagios Newbie and I want to install the plugin check_fortigate.pl, I already install perl and every time I tried to prove the command

check_fortigate.pl -H 192.168.200.254 -C public -T cluster
The server says: check_fortigate.pl: command not found

So I don't know how to make it works.
Any help will be great!

Thanks!
Regards from México!

Works well

It's very usefull and works well.

My only problem, it's that, I can't find in the documentation if we check with -T ses the active session or the session per sec. (I presume that it's the session but I have some big doubt).

First of all a Great PLugin, which lets you monitor your Fortigate Device. Works with Fortigate 600D (5.4.8). To make it work with Fortimanager (5.6.2) all you have to do is change ( /^(FL|FAZ)/ to ( /^(FL|FAZ|FMG)/ otherwise it will not work for Fortimanager. Unforntunalty the disk check is not working for Fortigate, because it's not defined in the oids and I wasn't able to get the right oid. For the error from mugundan28 all you have to do is to provide the right permissions to /var/spool/nagios/ramdisk/FortiSerial, a chown nagios:nagios did the trick for me.

I am trying to monitor fortigate disk but it will through the error like "CRITICAL: Error writing on /var/spool/nagios/ramdisk/FortiSerial directory, permission denied" the command I am running is ./check_fortigate.pl -H fortigate_firewall -C community -T disk

Hi all,

is this plugin compatible with FortiOS v5.4?
Thanks.

Kind regards,
Martin

Hi all!!

First of all, thank you for such great job.

Second, sorry for my english :)

Third, I think that there may be a little problem with the phase 2 selectors of the VPN, it seems that the plugin shows as 'disconnected VPN' two of my phase 2 selectors, so it is show wrong information.

$return_string = OK, but there are two phase2 down, the $return_state is CRITICAL.

Thank you in advance.

+1 for VPN exclusion list!!

Regards and keep on!!.
Juanma.

Hello highfeeling,

I had the same problem until I activated the SNMP Administrative Access on the interface.
After resolving that, that I had a problem with "error writing on /path_to_nagios_plugins/FortiSerial directory, permission denied", which I resolved creating the directory in the specified path.

Thank you for this great Plugin!

Could somebody help me with the follow problem?
We have some IPsec VPNs, which are down most of the time.
Therefor the “check_fortigate_vpn_IPSEC” returns a Critical Status.
1) Is it possible to define VPN as an exception?
2) Is it possible to change the number of the VPN connections that must be down before that status is critical?
3) Is there a way to monitor only some IPSec VPN Connections?

Thank You

Hi,

i've got some problems with the following unknown error:

UNKNOWN: session get request failed

regards

Hi,

I am facing a strange problem. If I run the snmpwalk command against the fortinet firwall(300c) with Firmware Version 5.2.1 I am able to get the values but I am getting "session get request failed" when I try to run this plugin. I have rechecked SNMP is configured properly on the Fortigate firewall.

What could be the reason for this issue. I am running Nagios 3.5.x on Centos 7 64-bit Os.

snmpwalk -c SNMP-TESTs -v 2c 172.31.5.6
SNMPv2-MIB::sysDescr.0 = STRING: trafic
sysObjectID.0 = OID: fgt300C
SNMPv2-MIB::sysContact.0 = STRING: [email protected]
SNMPv2-MIB::sysName.0 = STRING: [email protected]
SNMPv2-MIB::sysLocation.0 = STRING: xxxxxx
SNMPv2-MIB::sysServices.0 = INTEGER: 78
SNMPv2-MIB::sysORLastChange.0 = Timeticks: (0) 0:00:00.00

Firmware Version
fgSysVersion.0 = STRING: v5.2.1,build0618,140915 (GA)


./check_fortigate.pl -C SNMP -v 2c -H 172.31.5.6
UNKNOWN: session get request failed


Thanks & Regards

Ankush Grover

It's really helpful plugin. Please update description :) Probably you forgot about -U "username" variable.
Maybe in next release you try add bandwith monitoring? :)
Best Regards,
Rafal

Hi all!

Can I use it with snmp v3 with authentication?


thx!

This works great! Thank you so much for this plugin. Made this account just to say so and to also assist other users in the future that are new to Nagios such as myself.

the 255 out of bounds messages is because you are not creating an _SNMP_COMMUNITY variable in the host definition. e.g.:

define host{
use generic-switch ; Inherit default values from a template
host_name FG80CXXXXXXX ; The name we're giving to this host
alias Fortigate Firewall ; A longer name associated with the host
_SNMP_COMMUNITY public
address 192.168.1.1 ; IP address of the host
}

And then to check IPSEC VPN:
define service{
use generic-service
host_name FG80CXXXXXXXXX
service_description IPSec VPN Status
check_command check_fortigate_vpn!ipsec
contact_groups twilio_sms_alert
}

Thnak you for your plugin! It is just what I was looking for.

However, there is a problem: as stated before, it workes perfectly well when executed manually, but fails when it is run by Nagios. I disabled EPN and the error message changed. Now it reads as:

"Return code of 255 is out of bounds"

And here is what I have in my logs:

"Warning: Return code of 255 for check of service 'CPU load' on host 'FG-XXX'was out of bounds."

It would be really-really nice to make this work!

The problem is the ePN (Embedded Perlinterpreter for Nagios)

If you enable Debugging in Nagios, you get the following error:

---
HOST: somehost, SERVICE: CPU, CHECK TYPE: Active, OPTIONS: 0, SCHEDULED: Yes, RESCHEDULE: Yes, EXITED OK: No, RETURN CODE: 3, OUTPUT: **ePN failed to compile /some/dir/plugins/check_fortigate.pl: "String found where operator expected at (eval 17) line 94, near "case "cpu""" at /usr/lib/nagios3/p1.pl line 250.

---

The workaround is to disable the ePN by inserting the following String an the second line in the check_fortigate.pl-script

---
# nagios: -epn
---

I'm having the same problem here...
-> all manual checks works (tried with root and non-root users)
-> nagios checks returns critical status with this output: "Service check did not exit properly"

I checked the Serial folder, was Ok! with all permissions granted (for testing purposes)

Hello Risker,

First Thank you for your contribution it will help me a lot at work.

Man, im heaving a hard time to use this

Manually it works perfect well as u can see it below:

OK: Fortigate Dinamica (Master: FGT80CXXXXXXXXX): IPSEC Tunnels: Configured/Active: 1/1 |'ActiveSSL-VPN'=0 'ActiveIPSEC'=1

I already declared the command at commands.cfg like this:

define command {
command_name check_fortigate_cpu
command_line $USER1$/check_fortigate.pl -H $HOSTADDRESS$ -C $ARG1$ -T cpu
}

and use the check like this

check_fortigate_cpu!public

but i receive this at nagios webportal

(Service check did not exit properly)

Do you have any ideias about how to fix this?

Thanks in advance.

Allan Lago

Hi risker,

your plugin smells good ! Many thanks !

But when I try to implement the commands in Nagios, I got the following : "(Service check did not exit properly)"

When I launch the script manually, I got the following :

OK: (Master: XXXXXX) CPU is okay: noSuchObject%|'cpu'=noSuchObject%;80;90

Any idea please ?

Seb