Applications

The Applications console provides information about the applications being used on your network.

This console can be filtered by Application, Country, Destination Interface, Policy, Result, and Source Interface. For more on filters, see Filtering options.

Specific devices and time periods can be selected and drilled down for deep inspection.

In order for information to appear in the Applications console, Application Control must be enabled in a policy.

Scenario: Viewing application usage

A manager is interested in the office internet habits of their employees:

1. Go to FortiView > Applications, to view the list of applications accessed by the users on your network. Use the time-frame options to view what applications were used in those time periods (from now, 5 minutes, 1 hour, or 24 hours).

2. From Sessions (Blocked/Allowed) and Bytes (Sent/Received), you can see how much traffic has been generated. Click these columns to show the traffic in descending order.

3. You notice that a social media application has created the most traffic of all the applications, and so it’s at the top of the list. Drill down into the application by double-clicking or right-clicking and select Drill Down to Details.

4. You are directed to a summary page of the social media application. From here, you can see which specific user has made the most use of the application.

Only FortiGate models 100D and above support the 24 hour historical data.

All Sessions

The All Sessions console provides information about all FortiGate traffic. This console can be filtered by Application, Country, Destination Interface, Destination IP, Destination Port, NAT Source IP, NAT Source Port, Policy, Protocol, Source, Source Interface, Source IP, and Source Port. For more on filters, see Filtering options.

This console has the greatest number of column options to choose from. To choose which columns you wish to view, select the column settings cog at the far right of the columns and select your desired columns. They can then be clicked and dragged in the order that you wish them to appear.

A number of columns available in FortiView are only available in All Sessions. For example, the Action column displays the type of response taken to a security event. This function can be used to review what sort of threats were detected, whether the connection was reset due to the detection of a possible threat, and so on. This would be useful to display alongside other columns such as the Source, Destination, and Bytes (Sent/Received) columns, as patterns or inconsistencies can be analyzed.

Similarly, there are a number of filters that are only available in All Sessions, one of which is Protocol. This allows you to display the protocol type associated with the selected session, e.g. TCP, FTP, HTTP, HTTPS, and so on.

Scenario: Filtering sessions by port number and application type

From the All Sessions console, a wide variety of filters can be applied to sort the session data. In this example, the All Sessions filters will be used to locate a specific user’s recent Skype activity.

1. Go to FortiView > All Sessions.

2. Select now from the Time Display options if it is not already selected.

3. Select the Filter button, then select Applications. This will open a drop-down menu listing the applications that appear in the master session list. From this list, locate and select Skype, or type “Skype” into the Search Bar and hit Enter. This will filter the session list to only feature Skype usage.

4. Select the Filter button again, then select Destination Port from the drop-down menu, then locate and select the desired port number. This will add a second filter which will restrict the results to presenting only the Skype data associated with that port number.

Only FortiGate models 100D and above support the 24 hour historical data.

WiFi Clients

The WiFi Clients console shows a list of all the devices connected to the WLAN. The type of device, source, number of sources blocked and allowed, and bytes sent and received are displayed. The source’s Service Set Identifier (SSID) is also displayed in the Source SSID column. An SSID is a case sensitive, 32 character alphanumerical identifier that acts as a password when a mobile device tries to connect to the WLAN.

This console can be filtered by AP, Device Type, Result, Source Device, Source IP, Source SSID, and User. For more on filters, see Filtering options.

Scenario: Determining the threat risk of an individual WiFi client

In this scenario,the administrator will use the WiFi Clients FortiView console to determine the risk levels associated with an individual WiFi client, and then drilldown into that client to determine where the risk originates and who might be the offending user/IP.

1. Go to FortiView > WiFi Clients and view the device list table.

2. Double-click on a device to filter on that source.

3. Under the Risk column, identify the items that present the greatest risk (using the Applications, Destinations,

Threats, and/or Sessions tabs, for example).

4. Right-click these items for further action.

Countries

The Countriesconsole displays network activity by geographic region. This console features the same view options as the other consoles, as well as Country Map. This visually highlights the countries from which user access to the network has been detected on a map of the globe.

The Time Display options for this console are 5 minutes, 1 hour, and 24 hours. The Country Map can sort by various options using the Sort By: dropdown menu. You can place your cursor over any country to display a tool-tip with detailed info on that country’s traffic, and click on any country to drill down into greater (filtered) detail. The colour gradiant on the map indicates the traffic load, where red indicates the more critical load.

This console can be filtered by Country, Destination Interface, Policy, Result, and Security Interface. For more on filters, see Filtering options.

Only FortiGate models 100D and above support the 24 hour historical data.

Scenario: Investigate international source bandwidth usage

The Countries console can be used to investigate how much bandwidth specific international sources/IP addresses are using:

1. Go to FortiView > Countries to see what and how many countries are currently logged into the corporate network. You can also see how many sessions are taking place in each country, and how much traffic they are generating, shown by bytes sent and received, and total bandwidth usage.

2. To see how much specific bandwidth any particular session is using, drill down into a country, e.g. United States, and select the Destinations drill down option.

3. All current sessions from the United States are now shown in list format. From here you can select either Bytes (Sent/Received) and/or Bandwidth column headers to show which session is generating the most bandwidth, and exactly how much bandwidth is being used.

Policies

The Policies console shows what policies are in affect on your network, what their source and destination interfaces are, how many sessions are in each policy, and what sort of traffic is occurring, represented in bytes sent and received.

This console can be filtered by Country, Destination Interface, Destination IP, Policy, Source, Source Device, and Source Interface. For more on filters, see Filtering options.

Only FortiGate models 100D and above support the 24 hour historical data.

Scenario: Investigate which policies are in effect

You can click on policy IDs to drill down to the policy list and see what policy’s are in effect for specific interfaces, how many sessions have occurred, how many of those with the policy have been blocked, and more:

1. Go to FortiView > Policies, and double-click on a policy ID to drill down.

2. You will be redirected to a summary screen of the policy ID. From here you can view the source IP of where the policy has been used, what source interface has been using the particular policy, and to verify what sort of threat scores have been measured, both blocked and allowed.

Destinations

The Destinations console provides information about the destination IP addresses of traffic on your FortiGate unit, as well as the application used. You can drill down the displayed information, and also select the device and time period, and apply search filters.

This console can be filtered by Country, Destination Interface, Destination IP, Policy, Result, and Source Interface. For more on filters, see Filtering options.

Scenario: Monitoring destination data

The Destinations console can be used to access detailed information on user destination-accessing through the use of the console’s drilldown functionality. In this scenario, the console is used to find out more about a particular user’s Facebook usage patterns over a 24-hour period:

1. Go to FortiView > Destinations.

2. Select 1 hour from the Time Display options at the top right corner of the console.

3. The easiest way to locate most destinations is to scan the Applications column for the name of the application.

Once the session containing Facebook has been located, double-click it to access the Destination summary window.

4. Locate Facebook in the Applications column and double-click it to view the Facebook drilldown page. From here, detailed information regarding the user’s Facebook session can be accessed.

Only FortiGate models 100D and above support the 24 hour historical data.

Interfaces

The Interfaces console lists the total number of interfaces connected to your network, how many sessions there are in each interface, and what sort of traffic is occurring, represented in both bytes sent and received, and the

total bandwidth used.

This console can be filtered by Country, Destination Interface, Destination IP, Policy, Result, Source, and Source

Interface. For more on filters, see Filtering options.

Only FortiGate models 100D and above support the 24 hour historical data.

Scenario: Investigate traffic spikes per user

The wan1 interface is showing a higher amount of traffic than usual. A system administrator uses the console to inspect which user (as represented by an IP address) is creating the spike in traffic:

1. 1. Go to FortiView > Interfaces and double-click on wan1, or right click and select Drill Down to Details….
2. 2. The console will drill down to a summary page of wan1, showing how many bytes are being sent and received, how much bandwidth is being used, and how many sessions are currently using this interface. You see the

IP address of the user that is showing the most amount of traffic under Source.

3. 3. You can further drill down to see the IP destination, the device, and the applications being used, and other options.

Sources

The Sources console provides information about the sources of traffic on your FortiGate unit.

This console can be filtered by Country, Destination Interface, Policy, Result, Source, and Source Interface. For more on filters, see Filtering options.

Specific devices and time periods can be selected and drilled down for deep inspection.

Scenario: Investigating a spike in traffic

A system administrator notices a spike in traffic and wants to investigate it. From the Sources window, they can determine which user is responsible for the spike by following these steps:

1. Go to FortiView > Sources.

2. In the graph display, click and drag across the peak that represents the spike in traffic.

3. Sort the sources by bandwidth use by selecting the Bytes (Sent/Received) header.

4. Drill down into whichever source is associated with the highest amount of bandwidth use by double-clicking it.

From this screen, you have an overview of that source’s traffic activity.

5. Again, in either the Applications or Destinations view, select the Bytes (Sent/Received) header to sort by bandwidth use.

6. Double-click the top entry to drill down to the final inspection level, from which you can access further details on the application or destination, and/or apply a filter to prohibit or limit access.

FortiView consoles

This section describes the following log filter consoles available in FortiView:

• Sources on page 1160 explains the features of FortiView’s Sources console, and shows how you can investigate an unusual spike in traffic to determine which user is responsible.
• Destinations on page 1161 explains the features of FortiView’s Destinations console and shows how you can access detailed information on user destination-accessing through the use of drill down functionality.
• Interfaces on page 1161 explains the number of interfaces connected to your network, how many sessions there are in each interface, and what sort of traffic is occurring.
• Policies on page 1162 explains what policies are in affect on your network, what their source and destination interfaces are, how many sessions are in each policy, and what sort of traffic is occurring.
• Countries on page 1162 explains and graphically displays network activity by geographic region.
• WiFi Clients on page 1164 shows a list of all the devices connected to the WLAN.
• All Sessions on page 1164 explains the features of FortiView’s All Sessions console and shows how you can filter sessions by port number and application type.
• Applications on page 1165 explains the features of FortiView’s Applications console and shows how you can view what sort of applications their employees are using.
• Cloud Applications on page 1165 explains the features of FortiView’s Cloud Applications console and shows how you can drill down to access detailed data on cloud application usage, e.g. YouTube.
• Web Sites on page 1166 explains the features of FortiView’s Web Sites console and shows how you can investigate instances of proxy avoidance which is the use of a proxy site in order to access data that might otherwise be blocked by the server.
• Threats on page 1167 explains the features of FortiView’s Threats console and shows how you can monitor threats to the network, both in terms of their Threat Score and Threat Level.
• Threat Map on page 1168 explains the features of Fortiview’s Threat Map console which provides a geographical display of threats, in realtime, from international sources as they arrive at your FortiGate.
• Failed Authentication on page 1169 explains instances in which users attempted to connect to the server but were unsuccessful.
• System Events on page 1169 explains security events detected by FortiOS, providing a name and description for the events, an assessment of the event’s severity level, and the number of instances the events were detected.
• Admin Logins on page 1170 explains information on administrator interactions with the network, including the number of login instances, number of failed logins, and the length of time logged in.
• VPN on page 1170 explains how users can access information on any VPNs associated with their FortiGate.