Device health

Network, Device health shows the reachability, load and possible congestion of every firewall on your live connections, worst first. Everyone can see it. The number next to the menu item counts firewalls that are down, critical or in warning.

How health is checked

FireSight checks every firewall on a schedule (every 5 minutes by default), through the connections it already uses:

through FortiManager, by reading each FortiGate's monitor data via FortiManager's device proxy. A FortiGate FortiManager reports as disconnected counts as unreachable;
directly from a standalone FortiGate's REST API.

Each check reads CPU, memory, sessions and the counters of every interface. Interface load, errors and drops are worked out from the change between two checks, so they appear from the second check on.

Offline snapshots aren't monitored.

Status

Status	Meaning
Down	Missed Down after missed checks checks in a row (2 by default).
Critical	A link is congested at 98% or more of its speed.
Warning	Something is above a threshold: a link is congested or on its way to it, an interface logs errors or drops, CPU or memory is high, or the firewall missed a check but isn't counted down yet.
OK	Nothing above the thresholds.
Not checked	No check has succeeded yet, or the connection couldn't be asked (the Issues column says why), or the platform doesn't report health.

The page

Tiles

Across the top: Firewalls (all), and one tile per status with how many firewalls have it. Tiles for statuses no firewall has are hidden (except OK). Click a tile to show only those firewalls; click it again for all.

Controls

Find a firewall, site or address filters by name, connection, management domain, region, site or management address.
All connections (when there are several) shows one connection's firewalls.
Refresh every 30 s reloads the page every 30 seconds; on by default.
Check now (implementers and administrators) checks every firewall immediately. The check is recorded in the audit log.

The Firewalls table

Column	Shows
Status	The status, and since when if it isn't OK.
Firewall	The name; click it to show its interfaces. Below: connection, management domain, and region or site.
Last seen	When it last answered (red when it is down).
CPU	A meter. It turns amber at three quarters of CPU warning (%) and red at the threshold.
Memory	A meter, against Memory warning (%).
Sessions	Current sessions.
Busiest link	The interface with the highest load, its speed and a load meter against the congestion threshold.
Load trend	A sparkline of the busiest link's load over the last 48 checks, with a dashed line at the congestion threshold. Missed checks show as red bars. no data yet until there are readings.
Issues	Why it isn't OK, such as port1 congested: 92% of 1000 Mb/s or CPU at 95%, or None.
Alerts	Mute / Unmute (implementers and administrators), or On / Muted.

Interfaces

Click a firewall's name for every interface, busiest first: Interface (and link down), Speed, In, Out, Load (a meter), Errors / min and Drops / min. Congested or erroring interfaces are highlighted. Below: the model, management address and when it was checked.

Recent alerts

The 30 most recent alerts: the type (such as down, congestion, cpu cleared), the message, when, and where it was sent (or muted, or (failed) per channel).

How problems are found

A summary of the current thresholds, with links for administrators to change them and to set where alerts go.

Thresholds

Set under Settings, Policies & schedules, Monitoring:

Setting	Default	Range	Meaning
Check firewall health every (minutes)	5	0 to 1440	How often every firewall is checked. 0 turns monitoring off.
Down after missed checks	2	1 to 20	A firewall is reported down after this many checks in a row can't reach it.
Congestion threshold (% of link speed)	80	10 to 100	An interface carrying more than this, in either direction, is over the threshold.
Congested after checks over the threshold	3	1 to 20	Ignore short bursts: an interface is congested only after this many checks in a row over the threshold.
Interface errors and drops per minute	60	1 to 100000	More than this on an interface is flagged as a possible fault or overload.
CPU warning (%)	90	10 to 100	Warn when CPU is at or above this.
Memory warning (%)	90	10 to 100	Warn when memory use is at or above this.

Load is measured against the speed the interface reports. Interfaces that report no speed have no load figure.

Alerts

An alert is raised once when a problem starts and once when it clears, never on every check:

Alert	Severity	Raised when
Down	Critical	A firewall is reported down.
Up	Info	It is reachable again.
Congestion	Warning	An interface becomes congested. Cleared when it is back under the threshold.
Errors	Warning	An interface goes over the errors and drops threshold. Cleared when it is back to normal.
CPU	Warning	CPU reaches the threshold. Cleared when it is back under.
Memory	Warning	Memory reaches the threshold. Cleared when it is back under.

Where alerts go is set under Notifications.

Muting

Mute a firewall during maintenance. A muted firewall is still checked and its alerts are still listed (marked muted), but no notifications are sent. Unmute turns them back on. Muting and unmuting are recorded in the audit log.

Not checked

A firewall shows Not checked when:

monitoring is off (Check firewall health every (minutes) is 0), or hasn't run yet;
the connection couldn't be reached at all; Issues says Health couldn't be read: and the reason;
the firewall isn't in a management domain;
the platform doesn't report health yet.

See Troubleshooting.