New Consoles
In FortiOS 5.4, a variety of new consoles have been added to FortiView:
FortiView Policies console
The new Policies console works similarly to other FortiView consoles, yet allows administrators to monitor policy activity, and thereby decide which policies are most and least active. This helps the administer to discern which policies are unused and can be deleted.
In addition, you have the ability to click on any policy in the table to drill down to the Policies list and view or edit that policy. You can view this new console in either Table or Bubble Chart view.
FortiView Interfaces console
The new Interfaces console works similarly to other FortiView consoles and allows administrators to perform current and historical monitoring per interface, with the ability to monitor bandwidth in particular. You can view this new console in either Table or Bubble Chart view.
FortiView Countries console
A new Countries console has been introduced to allow administrators to filter traffic according to source and destination countries. This console includes the option to view the Country Map visualization (see below).
FortiView Device Topology console
The new Device Topology console provides an overview of your network structure in the form of a Network
Segmentation Tree diagram (see below).
FortiView Traffic Shaping console
A new Traffic Shaping console has been introduced to improve monitoring of existing Traffic Shapers. Information displayed includes Shaper info, Sessions, Bandwidth, Dropped Bytes, and more.
FortiView Threat Map console
A new Threat Map console has been introduced to monitor risks coming from various international locations arriving at a specific location, depicted by the location of a FortiGate on the map (see below).
FortiView Failed Authentication console
A Failed Authentication console has been added under FortiView that allows you to drill down an entry to view the logs. This new console is particularly useful in determining whether or not the FortiGate is under a brute force attack. If an administrator sees multiple failed login attempts from the same IP, they could (for example) add a local-in policy to block that IP.
The console provides a list of unauthorized connection events in the log, including the following:
- unauthorized access to an admin interface (telnet, ssh, http, https, etc.) l failure to query for SNMP (v3) or outside of authorized range (v1, v2, v3) l failed attempts to establish any of the following:
- Dial-up IPsec VPN connections
- Site-to-site IPsec VPN connections
- SSL VPN connections
- FGFM tunnel
FortiView WiFi Clients console
The WiFi Clients console has been added to FortiView in FortiOS 5.4. As you might expect, you can use this console to display top wireless user network usage and information. You can drilldown to filter the information that is displayed.
Information displayed includes Device, Source IP, Source SSID, AP, and more.
