Disk Space Control

Disk space of the FortiWAN Reports is being consumed by increasing report database. Once the disk space is used up, Reports will fail to continue log processing. Disk Space Control monitors the disk space status of Reports and triggers actions (purge and alert) according to user-defined conditions. Click Settings > Disk Space Control to enter the Disk Space Control settings page.

Purge old data from database

The Purge function is triggered by two conditions, day duration and percentage of free disk space. It will purge the old data from database when any of the two conditions is satisfied. This function purges data from database without data backup. Please refer section of Reports Database Utility in Advanced Functions for more information about database backup (See “Reports Database Tool”).

Days         :         Enter the number of days for the duration. When database data exceeds the day duration, Reports keeps the latest data of the day duration in database and purges the earlier data. Leave the field empty if you want disable the condition.

Send Alerts

The alert function is triggered by two conditions, day duration and percentage of free disk space. It will alert administrator via email when any of the two conditions is satisfied. Settings > Email Server must be configured to ensure the notification (See “Reports Email Server”).

Note that system schedules condition check for database purge and sending alerts at 04:00 A.M. everyday. You are suggested to set a looser condition for sending alerts than database purge so that you get the alert earlier before the data being purged, if you need to backup the data (via Reports database tool) in advance.

Mail To

e-mail address         :         Enter the email address for system delivers alerts and notifications to. Settings > Email Server must be configured to ensure the notification (See “Reports Email Server”).

Disk Space Status

Current usage of disk space is displayed here for reference. A pie chart of disk space usage is generated based on free space, database used and other used. Moving the mouse over the three parts of the chart displays the correspondent amount of space.

Scheduled Emails

You may have get some report emails scheduled (see Report Email). Go to Reports > Settings > Scheduled Emails, then you can edit or delete the schedules.

Edit a scheduled report email

Reports Settings

The Settings here is used to simply manage the Reports on database, disk space and the SMTP server used to email reports. Click the listed settings and you can further configure them:

Reports    :   Enable/disable Reports (See “Reports”).

“Database Data Utility”)

Please note that this function is only available for the users log-in as administrator permission.

Reports

FortiWAN Reports works by parsing and analyzing the various system logs. Before using the FortiWAN Reports, you have to enable it by specifying the way and the events to push system logs to Reports. You will be redirected to Log > Reports to complete the necessary settings to enable the FortiWAN Reports (See “Log > Reports”).

IP Annotation

IP annotation helps users to recognize IP addresses shown in Reports by predefined notes. An annotation icon will appear next to the IP address listed in a report page. Users can read the content of the annotation through clicking the icon. Click Settings > IP Annotation to enter the IP Annotation settings page.

Search IP Annotations

The search function for IP annotations is on the right upper corner of the page.

List the IP Annotations

All IP annotations are displayed in the table on the center of the page.

IP address    :   List the IP address of an annotation.

Note    :    Lists the annotation content of the IP address.

Action         :         Click Edit to edit the content of an IP annotation. The edit interface is the same as what for adding a new annotation (See below). Click Delete to delete an IP annotation.

Add a New IP Annotation

Click the New Note button on the left upper corner to enter the page for adding a new IP annotation.

IP address    :   Enter the IP address for the IP annotation.

Note Content    :    Enter the annotation content.

Save    :   Click to save the configuration and complete adding an IP annotation.

Dashboard Page Refresh Time

Reports dashboard displays instant hardware states and information of FortiWAN (See “Dashboard”). The refresh interval keeps your dashboard in sync with the latest data, however frequent page refresh might cause high CPU usage especially when FortiWAN is processing large traffic flow. Please select the appropriate fresh interval for your system. The options are refreshing dashboard every 5 sec, 15 sec, 20 sec and 30 sec, or Do not refresh the dashboard.

Email Server

Individual reports (See “Report Email”) and system alerts (See “Disk Space Control”) can be sent to users via email. It is necessary to configure the email server first to deliver the report and alert emails to users. Note that configuration here is the same as the configuration made in the tab “Email” of every report page (See “Report Email”).You can maintain the unique configuration of mail server for Reports via Settings > Email Server or the “Email” function of every report page. The mail servers used for Reports, log push (See “Log Control”) and notifications (See “Notification”) could be different. Click Settings > Email Server to enter the Email Server settings page.

Reports Database Tool

FortiWAN’s Reports stores database in the built-in hard disk (HDD) for long-term analysis and reports. As the data increases, storage consumption increases. The Reports database tool (DB tool) is an application running on your local computer to manage remote FortiWAN Reports database. Note that the DB tool must be ran on a host that can access FortiWAN Web UI. Please contact Fortinet CSS to get the tool and install it following the instructions below.

A Web-based Reports database management tool providing limited functions similar to the Reports database tool is available, see Database Data Utility.

Installation Procedures

Step 1: Click the installation file (such as FWN-dbtool-4.0.0-B20150303.exe) to run the installer. Select the language of your choice.

Step 2: Read the System Requirements.

Step 3: Click ‘Next’ to begin the setup.

Step 4: Read the License Agreement carefully. Click the ‘I Agree’ button to accept the agreement and begin the installation process. Otherwise, please click ‘Cancel’.

Step 5: Choose a destination folder for setup and click ‘Next’.

Step 6: Choose a Start Menu folder (or check ‘Do not create shortcuts’ to ignore it). Click ‘Install’ and then the installation process will begin.

Step 7: Click ‘Finish’ to complete Reports DB Tool setup.

Start DB Tool

To perform the database tool, please go to: Start > Programs > FWN-dbtool, and DB Tool utility is available for selection.

DB Tool: Tool to manage report data from the Reports database.

Fortinet: Link to Fortinet web site.

Uninstall: Uninstalls DB Tool.

Setting

The first time when you use the DB tool, please go to Setting to specify the database to be managed.

The DB tool can be used to backup, restore and delete data from FortiWAN’s Reports database.

Backup

Restore

Delete

Note that although operations that Backup and Restore data of the current date (today) are allowed, it might cause damages the report data since FortiWAN Reports is receiving and processing the data for today. Backup and Restore are strongly recommend to be used for data before today.

Custom Filter

Reports offers 6 fixed reports of bandwidth usage by default; In Class, Out Class, WAN, Service, Internal IP, and External IP. Usually, administrators will need to check drilled-in information for particular target regularly. As discussed previously, Drill-in function can be used to obtain more report specifics, while Filter helps to directly obtain more traffic data of a specific target. In order to quickly perform a query based on a specific filter without going through those tedious steps over again, Custom Filter allows users to apply their own filters based on particular requirements for query on bandwidth usage reports.

Click Filter above every Bandwidth Usage report to see an extended block for further settings.

Add new condition:

• A Filter can be composed of multiple conditions. Click Add new condition and select an option from the drop-down menu to start setting your filter: In Class, Out Class, WAN, Service, Internal IP, External IP, Internal Group and External Group.

Conditions:

• There are two actions for options while setting the condition:
• Including: Extract only those records that fulfill the specified criterion.
• Excluding: Extract those records that not fulfill the specified criterion.
• Configurations for report categories:
• In Class: Enter the Inbound Class name you want to query (include or exclude) in the input field. l Out Class: Enter the Outbound Class name you want to query (include or exclude) in the input field. l WAN: Enter the WAN number you want to query (include or exclude) in the input field.
• Service: Enter the Service you want to query (include or exclude) in the input field. Click on the arrow next to the input field to see more Service options. Predefined L4 and L3 protocols are available. Entering a single or a range of port number is also allowed.
• Internal IP: Enter the Internal IP address you want to query (include or exclude) in the input field.
• External IP: Enter the External IP address you want to query (include or exclude) in the input field.
• Delete: Delete the extended block of condition settings in the filter.

Cancel:

Click Cancel to close the extended block of filter settings.

Apply:

Click Apply to start the query based on the filter conditions defined. The result is presented in the report area. Note both the result and filter conditions will not be saved in user profile. When the page moves to other report categories, the filter conditions will be invalid.

Example

Check out the Internal IP report first, and create and apply a customer filter, for example, with the conditions

WAN = 1 and Service = HTTPS(TCP@443). The query result of traffic statistics that are associated with the Service HTTPS(TCP@443) and passed through FortiWAN via WAN1 will then be displayed by Services accordingly. As illustrated below, the block marked in blue indicates the query subject of current report:

Continuing the example described above, apply the custom filter: Service=HTTPS(TCP@443), WAN=1 and Internal IP=10.12.106.17 in the Traffic Rate report, and the query result will show the corresponding traffic statistics by traffic rate as follows (the block marked in blue indicates the query subject of current report):

Note: Saved custom filters are kept in user account profile. Users can edit and delete custom filters from their account profile. Please refer to section of Customer Filters in Account Settings for more information.

Export

All reports generated by Reports can be exported as PDF or CSV format. By clicking Export button on the upper side of any report page, PDF and CSV are displayed for options.

Report Email

All reports generated by Reports can be sent to users via email. Reports saved in PDF or CSV format can be sent out as email attachments.

Note: Prior to creating emails, you must first configure an email server used to transfer report emails to Reports. You can set the email server through Reports > Settings > Email Server, or the email function on every report page.

Click the Email button on the right upper corner of any report page to configure email settings to current report page. For example, in the settings dialog below, you are currently in Traffic Rate report (see the header “Email : Traffic Rate” on the setting dialog), then you can:

• Send Traffic Rate through email immediately l Configure the email server used to transfer report emails l Set Traffic Rate email scheduled
• Add Traffic Rate to an existing scheduled report email

The Email function is also available for custom-filter reports and drill-in reports. No matter which report page you’re at, you can always click the Email button on that page to determine when you want to send the current report through email.

Send now

Click the Send now tab on the setting dialog. This feature requires a email server configured first.

Email Server

Click the Email Server tab on the setting dialog. You can also set the email server through Reports > Settings > Email Server. Both ways directs to one Reports to one email server.

Schedule

Click the Schedule tab on the setting dialog to set the report email scheduled. This feature requires a email server configured first.

Add to existing

Click the Add to existing tab on the setting dialog to list the schedule. By clicking the button “Add to this” on the right upper corner of every schedule item, you can add current report category to one of the scheduled report emails. You can edit the schedule through Reports > Settings > Scheduled Emails.

Advanced Functions of Reports

Reports provides advanced functions beyond the basic reports to give an accurate analysis. Drill In and Custom Filter are the functions about querying the reports with complex conditions. It delivers only the data that a user needs from large data sets. Export and Report Email are the functions about documentations and delivering of the on-line reports. The details of the advanced functions are described as follows.

Drill In

There are 7 different query conditions for Bandwidth Usage, including In Class, Out Class, WAN, Service, Internal IP, External IP and Traffic Rate. In every Bandwidth Usage report, analysis can be further drilled-in to include more traffic data statistics; in other words, Reports allows traffic to be queried based on combination of multiple conditions. For example, select Service as the query subject from the menu in the category area, and the Service report will be displayed accordingly, as shown below:

Service=All

Go to Reports > Service, you can have an overall service report which gives the traffic statistics of all the service usages (query result is as shown below).

The HTTPS(TCP@443) service can be further drilled in to query which WAN link of FortiWAN are utilizing this service by clicking the Drill In magnifier icon in the row of HTTPS(TCP@443) listed in the table and select WAN (query result is as shown below):

Service=HTTPS(TCP@443) & WAN=All

As indicated in the blue box (shown in the figure above), this page presents the data of HTTPS(TCP@443) traffic in the WAN report, In the statistics table, the WAN link 1 can be further drilled in to query what internal IP addresses are included by clicking the Drill In magnifier icon in the row of WAN 1 listed in the table and select Internal IP (query result is as shown below):

Service=HTTPS(TCP@443) & WAN=1 & Internal IP=All

As indicated in the blue box (shown in the figure above), this page presents the data of Internal IP report that includes the traffic of WAN 1 (WAN) using HTTPS(TCP@443) (Service), The IP address: 10.12.106.17 can be further drilled in to query what External IP addresses it is connected to by clicking the Drill In magnifier icon in the row of 10.12.106.17 IP listed in the table and select External IP (query result is as shown below):

Service=HTTPS(TCP@443) & WAN=1 & Internal IP=10.12.106.17 & External IP=All

As indicated in the blue box (shown in the figure above), this page presents the data of External IP report that includes the traffic of WAN 1 (WAN) at internal IP=10.12.106.17 (Internal IP) using HTTPS(TCP@443) (Service).

From the example illustrated above, administrators can easily query the traffic flow based on combination of various conditions needed, while analysis can be drilled in to more details for better review. In the upper section of the report page, you’ll see a summary of the query conditions used in the existing report (highlighted in blue as shown in the image above), making it clear for administrators to keep track of the query details.

Service=HTTPS(TCP@443) & WAN=1 & Internal IP=10.12.106.17 & Traffic Rate=All

Continuing the example described above, the query submitted returns a result that the IP address: 10.12.106.17 via WAN 1 is connecting to External IP addresses, via the HTTPS(TCP@443) service. You can change the last Drill In condition (External IP) to a different one (such as traffic rate of bandwidth usage) using the same filter: WAN=1, Internal IP=10.12.106.17 and Service=HTTPS(TCP@443), by selecting Traffic Rate from the drop-down menu of External IP (as shown below):

The report presented by Traffic Rate using the same filter: Service=HTTP(TCP@443), WAN=1 and Internal IP=10.12.106.17 is illustrated as follows.

As illustrated in the example above, Reports offers two kinds of advanced query: you can either keep drilling in with different conditions to get a report with more specific details, or change query condition at any Drill In level; in other words, network flow data can be queried either vertically or horizontally.

Function Status

This report category is the function to monitor the status of FortiWAN’s major functions for a long period. Long term statistics of function status is helpful to administrators. This category can further be divided into Connection Limit, Firewall, Virtual Server and Multihoming.

Connection Limit

To prevent network congestion, FortiWAN’s Connection Limit function limits the number of connections from each source IP. A Connection Limit event means the number of connections from a given source IP has exceeded the limit (See “Connection Limit”). Reports produces a summary report for Connection Limit events.

Create a report for a specific day or over a range of dates (See “Create a Report”).

Export reports and send reports through email (See “Export and Email”). Statistics Table

• List the Source IP generating the most accesses while connections exceeding the limit, sorted by the volume of Drops in declining order.
• Source IP: The IP address generating connections exceeding the limit. l Drops: The counts of denied access (try to construct new connection) while the connections exceeding the limit.

Firewall

Firewall is the most popular tool to control network access and deny illegal access. FortiWAN’s Firewall function limits network access by service, source IP and/or destination IP. A Firewall event means that network access has been denied according to the Firewall rules (See “Firewall”). Reports produces a summary report for Firewall events.

Create a report for a specific day or over a range of dates (See “Create a Report”).

Export reports and send reports through email (See “Export and Email”).

Function Status

Statistics Table

• Lists the Service, Source IP and Destination IP of denied network access, sorted by the volume of Drops in declining order.
• Service: The Service of denied access. l Source IP: The Source IP address of denied access. l Destination IP: The Destination IP address of denied access. l Drops: The counts of denied access.

Virtual Server

FortiWAN’s Virtual Server function the linking of multiple servers in an internal (or private) network to external network (public) IP addresses. It is usually used to share multiple servers with single public IP addresses – a simple server load balancing application (See “Virtual Server & Server Load Balancing”). Reports produces a summary and detailed report for Virtual Server.

Create a report for a specific day or over a range of dates (See “Create a Report”).

Export reports and send reports through email (See “Export and Email”). Statistics Table

• Lists the Virtual Server IP (Service) and count of access, sorted by the Server IP (default). l WAN IP: the public IP address for external users to access the virtual server. l WAN Service: the service for external users to access the virtual server. l Server IP: the IP address of the Virtual Server. l Server Service: the service ran on the virtual server. l Requests: the count of accessing this Server Service ran on the Virtual Server IP from the WAN IP address.
• Note: Select “WAN IP”, “WAN Service”, “Server IP” and “Server Service” as primary sorting via clicking on the column title. A “▲” or “▼” is shown aside the column header while the column is selected as primary sorting, e.g. Server IP ▲. The sorting order will be switched by clicking on the same column header.

Multihoming

FortiWAN’s Multihoming function performs load balancing and fault tolerance between WAN links for inbound traffic. Users from the public network are told dynamically by FortiWAN the best available WAN link to access in order to reach specific resources on the internal network (See “Inbound Load Balancing and Failover (Multihoming)”). Reports produces a summary and detailed report for Multihoming.

Create a report for a specific day or over a range of dates (See “Create a Report”).

Export reports and send reports through email (See “Export and Email”). Statistics Table

• Lists the Domain Name and the count of the number of times this domain was accessed, sorted by the FQDN

(default).

• FQDN: the domain name configured on FortiWAN. Select “FQDN” as primary sorting via clicking on the column title “FQDN”.
• WAN: which WAN links this FQDN was accessed through. Select “WAN” as primary sorting via clicking on the column title “WAN”.
• WAN IP: the WAN IP address in this FQDN accessed through the WAN link. Select “WAN IP” as primary sorting via clicking on the column title “WAN IP”.
• Access: the counts of accessing this domain by external users via the WAN IP address.
• Note: Select “FQDN”, “WAN” and “WAN IP” as primary sorting via clicking on the column title. A “▲” or “▼” is shown aside the column header while the column is selected as primary sorting, e.g. FQDN ▲. The sorting order will be switched by clicking on the same column header.