Export and Email

All reports generated by FortiWAN can be exported in PDF format to your local computer; just simply click the Export button on the upper side of any report page, and select PDF.

All reports generated by FortiWAN can be sent to users via email. Reports saved in PDF format can be sent out as email attachments. Click the Email button on the right upper corner of any report page to edit settings of the report email. In the settings dialog, you may send current report through email immediately or arrange a scheduled email for it. No matter which report page you’re at, you can always click the Email button on that page to send the current report through email, or the Schedule button to get the report email scheduled (see Report Email).

Create a Report

Report’s reporting function is calendar-based (in the upper right portion of the UI screen). Reporting can be done for a specific day, by highlighting that date in the calendar. Reporting can be done over a range of dates by specifying the start date and the end date on the Calendar.

Enable Reports

Please complete the necessary setting to enable FortiWAN Reports via Log > Reports (See “Enable Reports”) or Reports > Settings > Reports (See “Settings > Reports”), or data is unavailable for Reports.

Select a Report Type

On the left of the main page is the Category Area where you can select a report type.

Specify a Date or Date Range

At the upper right corner of the Display Area exists a date selector where you can specify a single date or date range. Click on the magnifier icon next to the date selector to start with date selection.

l Time between 00:00 to 23:59 (of a selected date) l Days from start to end if Date Range specified (max 90 days)

Single Date

Start date:

• Click on the field under “Start date” to call up a calendar for further selection.
• Select a date from the calendar, and reports will be generated on the selected date from 00:00 to 23:59. The selected date is highlighted in white, while the other dates are displayed in gray, and today’s date is circled in yellow.
• Click the right or left arrow to go to the next or previous month. l Click Apply to complete date selection, and reports will then be generated accordingly. l Choose a different report type from the Category Area to generate reports on the same date selected if needed.

Date Range

To select a date range:

Export and Email

• Click the checkbox between Start date and the End date, and then Start time, End date and End time will become available for selection (as shown below):
• Put a Start date and End date by clicking the input field and selecting from the calendar. l Input the Start time and End time in the format of HH:MM. Note that the duration cannot exceed 90 days. l Click Apply to complete date range selection and start generating reports.
• Choose a different report type from the Category Area to generate reports on the same date range selected if needed.

Reports

Reports is the built-in monitoring and traffic pattern analysis tool for instant status of WAN connections and traffic statistics analysis. MIS personnel can perform offline and more detailed analysis of the data to gain insight into user traffic patterns for better network design and management policy definition. However, FortiWAN generates large volumes of raw activity logs during the process of monitoring its functions. For long-term or trend analysis, Reports is an online companion tool that greatly simplifies the analysis of the data. Reports Features l Provides historical detail and reporting over longer periods of time (See “Create a Report”).

l Provides more fine-grained subcategories of analysis and reports (See “Advanced Functions of Reports: Drill in”). l Provides customized filters on reports (See “Advanced Functions of Reports: Custom Filter”). l Provides instant email of reports in PDF formats (See “Advanced Functions of Reports: Report Email”). l Reports can be saved in PDF format (See “Advanced Functions of Reports: Export”). l Supports user-select report date range (See “Create a Report”). l Supports user-specified backup of original log and database data (See “Reports Database Tool”).

Reports provides analysis and reporting capabilities on device status, top bandwidth utilization and function status. MIS personnel can gain complete understanding of the detailed network statistics via the various reports. Such statistics include, for example, the exact time of failure of every WAN link, the peak rate and amount of bandwidth of every WAN link, the minimum and maximum traffic volume for a given specified day range, the traffic volume and service conditions of a certain server during a specified day range. Bandwidth Usage presents the analysis of how the bandwidth of every WAN link is used: what connections are constructed between which internal IP and external IP hosts, what services operate on the connections, and what and how much traffic is transferred through which WAN link? For example, you can obtain, from Reports analysis, the external traffic destinations from any or all devices inside the LAN or look at what internet servers attracted the most traffic from your enterprise.

It is important to have a solid grasp of the functionality and operational theory of Reports in order to effectively analyze network traffic patterns and various statistics of FortiWAN for optimal management policy definition.

Reports reporting function is calendar-based (in the upper right portion of the UI screen). Reporting can be done for a specific day, by highlighting that date in the calendar. Reporting can be done over a range of dates by specifying the start date and the end date on the Calendar.

Reports reporting function is divided into three categories and eighteen subcategories:

• Device Status: Dashboard, Bandwidth, CPU, Session, WAN Traffic, WAN Reliability, WAN Status, TR Reliability and TR Status (See “Device Status”).
• Bandwidth Usage: In Class, Out Class, WAN, Service, Internal IP and Traffic Rate (See “Bandwidth Usage”). l Function Status: Connection Limit, Firewall, Virtual Server and Multihoming (See “Function Status”).

To make those data and analysis available, please enable Reports via Log > Reports (See “Enable Reports“) or Reports > Settings > Reports (See “Settings > Reports“).

Create a Report

Enable Reports

FortiWAN’s Reports provides long-term and advanced data analysis by processing system logs to database. The original logs FortiWAN generates contains raw data which is yet to be processed, and Reports can organize and analyze these data into readable statistics.

Every FortiWAN unit embeds the Reports system (See “Reports”), or the Reports could be also a stand-alone system running on a computer. Here is the settings to specify the ways of log push for Reports servers.

Embedded Reports

Enable Reports DB         :      Enable the embedded Reports (See “Reports”). Logs will be processed directly to the database stored in the built-in hard disk. Analysis and statistics are displayed via Web UI.

The Reports displays no data without enabling this.

Stand-alone Reports

Enable Reports UDP    :   Enable it to push logs to specified stand-alone Reports server.

Recipient IP Address : Specify location of the stand-alone Reports server that logs are pushed to. This field is available only if Enable Reports UDP is checked.

The stand-alone Reports displays no data without enabling this.

A stand-alone Reports and the embedded Reports can run at the same time, but both servers use the same logs.

Events

Select the log type for FortiWAN to send to Reports.

l Firewall l Virtual Server l Bandwidth Usage l Connection Limit l Multihoming l Tunnel Routing

Selected logs here will be pushed to embedded Reports and stand-alone Reports, if any or both of them are enabled.

Enable Reports

Notification

Two methods are provided to send out the notifications for important system events: E-mail and SNMP trap.

Please configure the settings for the methods and select the event type to notify.

Notification

E-Mail Settings

The table below summarizes the event notification mail setup:

Note: If the SMTP Server is applied with a FQDN, then the DNS Server must be set in the Web UI System > Network Settings > DNS Server (See “Set DNS server for FortiWAN”).

SNMP Trap Settings

Event notification can also be sent via SNMP traps. These can only be sent if there is an existing SNMP manager for receiving FortiWAN’s SNMP traps.

Notification

Types of Events to Notify

Enable Reports

Log Control

Control sets to forward data from FortiWAN to servers via FTP, E-mail and Syslog (protocol) for archiving and analysis. Configure log push method one log type by another, or use “Copy Settings to All Other Log Types”. It copies and applies settings of one log type to others avoiding unnecessary duplicating of settings.

Notification

Enable Scheduled Push    :   Check to enable pushing schedule.

Initial Time    :   Start time for scheduled push.

Period    :    Duration for scheduled push.

Methods

FortiWAN transfer logs with FTP, Email and Syslog. It either forwards logs to external FTP server, administrator’s mail account via SMTP or a remote syslog servers.

FTP

Note: If the Server is applied with a FQDN, then the DNS Server must be set in the Web UI [System]->[Network Settings]->[DNS Server] (See “Set DNS server for FortiWAN”).

Log format

A log listed here consists of three parts:

{TIMESTAMP} {LOG_TYPE} {LOG_CONTENT}

The {TIMESTAMP} is in the format ‘yyyy-mm-dd HH:MM:SS’ and is always an UTC time. The details of {LOG_ TYPE} and {LOG_CONTENT} are described as follows.

Notation Conventions

{ADDRPORT} follows TCPDUMP format, for example:

• IPv4: 8.8.8.80 l IPv6: 2001::8:8:8:8.80 {IP-5-TUPLE}
• ICMP:PROTO=1 SRC=<ip> DST=<ip> ID=<icmpid> TYPE=<icmptype> CODE=<icmpcode> (BM log dones’t have TYPE and CODE fields, because they are bypacket)
• TCP:PROTO=6 SRC=<{ADDRPORT}> DST=<{ADDRPORT}> l UDP:PROTO=17 SRC=<{ADDRPORT}> DST=<{ADDRPORT}> l ICMPv6:PROTO=58 SRC=<ip> DST=<ip> TYPE=<icmpv6type> CODE=<icmpv6code> l Others:PROTO=<protocol num> SRC=<ip> DST=<ip>

Firewall

See “Firewall” for further information.

NAT

See “NAT” for further information.

Auto & Persistent Routing

AR {IP‐5‐TUPLE} AR=[<widx>|NONE] TOTLEN=<pktlen>

Virtual Server

See “Virtual Server” for further information.

BM

See “Bandwidth Management” for further information.

Connection Limit

Count Limit

Rate Limit

See “Connection Limit” for further information.

Cache Redirect

See “Cache Redirect” for further information.

Multihoming

See “Multihoming” for further information.

Dynamic IP

DHCP

PPPoE

PPPOE WLINK=<widx> ACTION=<start|terminated|bind> [IP=<ip>]

IP-MAC Mapping

See “IP-MAC Mapping” for further information.

Tunnel Routing

See “Tunnel Routing” for further information.

IPSec

See “IPSec VPN” for further information.

System Admin session

• <account> logged in from <ip> l <account> logged out from <ip> Account change
• Administrator account <account> removed l Monitor account <account> removed
• Administrator account <account> password successfully changed l Administrator account <account> successfully added

Monitor account <account> password successfully changed

Monitor account <account> successfully added

Access deny

• Incorrect <account> password from <ip> l Maximum # of Administrator/<account> login reached l Maximum # of Monitor/<account> login reached UI command
• There is no slave l Configuration synchronization finished successfully l Configuration synchronization failed l Peer information is not available l ARP caches are updated l Neighbor Discovery caches are updated l System time synchronized l No NTP servers in system settings l License key <key> is applied successfully, system rebooting…
• License key <key> is applied successfully l Test email is sent to <receiver> l Failed to send test email to <receiver>

UI setting

• Settings are applied for page System -> <page name> l Settings are applied for page Service -> <page name> l Settings are applied for page Log -> <page name> l Unable to add account. The maximum number of Administrator accounts have been reached. l Unable to add account. The maximum number of Monitor accounts have been reached.
• Settings are applied for RADIUS Authentication l Error starting notification daemon l Error in starting daemon for page Service -> Internal DNS l Error in starting daemon for page Service -> Multihoming Info access error l Cannot save log/event settings Update l System firmware updated

Config

System configuration restored

Multihoming daemon file write error

Shutdown

• System reset to factory default settings l System reboot Instant push
• Pushing <logtype> is initiated l Failed to push <logtype>

Service error l Restarting Internal DNS Error Connection overflow l Current Connection Number(<connections>) reach <limit> Rate overflow l Current Rate Number(<connection rate>) reach <limit> Undefined code l Undefined event code <event code> VRRP

• VRRP become master l VRRP become backup l VRRP double-check failed HA
• Peer version changed from “<Model>” to “<Model>” l Peer serial number changed from “<Serial Number>” to “<Serial Number>” l Peer state changed from “<State>” to “<State>” l Responded to Slave’s Time Synchronization Request l Responded to Slave’s Configuration Synchronization Request l Stopped configuration synchronization due to errors l Finished configuration synchronization with the Slave l Won precedence over the booting peer. Enter the Master state. l Preceded by the booting peer. Enter the Slave state. l Master heartbeat detected. Enter the Slave state.
• Slave heartbeat detected. Enter the Master state. Panic heartbeat detected. Enter the Master state.

No heartbeat detected. Enter the Master state.

Log Control

• Won precedence over the incompatible peer. Enter the Master state.
• Preceded by the incompatible peer. Enter the Panic state.
• Peer heartbeat stopped. Enter the Master state to take over services. l Preceded by another Master. Reboot to enter the Slave state.
• Too Much port down. Reboot to enter the Slave state. l Preceded by the incompatible peer. Enter the Panic state. l Peer heartbeat stopped. Enter the Master state to take over services. l Two Slaves linked at the same time. Restart HA after random delay. l Master is gone. Enter the Master state to take over services.
• Peer heartbeat stopped l Time synchronization failed. l Configuration synchronization failed.

View

View has a sub-menu of 13 log types (see the table below). Choose the desired log type, and its corresponding events will show in display window. Click the Refresh button to get the latest log records. Please be aware that this page is only for online viewing of current events. For log data pushing and archiving, see the Control in next section.