Yearly Archives: 2017

FortiWAN IPSec

Leave a reply

IPSec

IPSec Statistics reports the usages and states of your configured IPSec Security Associations (See “IPSec”). Go to Statistics > IPSec, a select bar and two statistics tables are displayed.

Selector

Select the combination of Mode and Phase 1 here, and then the statistics of related IPSec SAs are reported.

IPSec

Mode Select the mode, Tunnel mode or Transport mode, of the security associations that you ask for.
Phase 1 Name All the configured Phase 1 names of the mode you selected above are list in the drop-down menu. Select a Phase 1 name (ISAKMP SA) to display the statistics of the associated IPSec SAs (Phase 2).
Refresh Click to refresh the statistics page.

Statistics of the IPSec SAs associated to the ISAKMP SA you selected is displayed in two tables, Security Association Database and Security Policy Database.

Security Association Database

List information of each IPSec SA including local and remote IP addresses, negotiated encryption and authentication algorithms, timing and the states.

Local IP The local IP address of the IPSec SA.
Remote IP The remote IP address of the IPSec SA.
Encryption The encryption algorithm that the IPSec SA employs.
Authentication The authentication algorithm that the IPSec SA employs.
Used time (s) The past time since the IPSec SA is established.
Life time (s) The time interval (in seconds) that the secret key of the IPSec SA is valid during. For the expiration of a key, IKE Phase 2 is performed automatically to establish a new IPSec SA (a new key is negotiated). The value here is equal to value of Keylife of the correspondent Phase 2 configuration.
Change time (s) The time point that system starts to establish a new IPSec SA for replacing the current IPSec SA which is going to expire. New IPSec SA will be prepared in advance so that it takes over the expired IPSec SA in time. This value is related to Life time and determined by system.
Status States of the IPSec SA:
l larval: an IKE Phase 2 is in progress to establish an IPSec SA
l mature: the IPSec SA is established and still within validity
l dying: the IPSec SA is about to expire, and another IKE Phase 2 is in progress for taking over
l dead: the connectivity between two endpoints communicating through the IPSec SA is down; the peer is unavailable.

Traffic Statistics for Tunnel Routing and IPSec

Security Policy Database

List information of Quick Mode selector of each IPSec SA and the related time stamps.

Name The unique name of the IPSec SA (the name configured to the Phase 2)
Source[port] For IPSec in Tunnel mode, this is the Source and Source Port of the Quick Mode selector of the IPSec SA (the Source and Port configured to the Phase 2).

For IPSec in Transport mode, this is the source IP address of the

Tunnel Routing packets (GRE encapsulated), which is equal to the Local IP of the IPSec SA (the Local IP configured to the Phase 1).

Port information will not be list for this case.
Destination[port] For IPSec in Tunnel mode, this is the Destination and Destination Port of the Quick Mode selector of the IPSec SA (the Destination and Port configured to the Phase 2).

For IPSec in Transport mode, this is the destination IP address of the Tunnel Routing packets (GRE encapsulated), which is equal to the Remote IP of the IPSec SA (the Remote IP configured to the Phase 1). Port information will not be list for this case.
Protocol For IPSec in Tunnel mode, this is the Protocol of the Quick Mode selector of the IPSec SA (the Protocol configured to the Phase 2).

For IPSec in Transport mode, this is always “gre”.
Created time The time that the IPSec SA is established.
Last used time The time that the IPSec SA is applied last to a data packet.

For the details of parameters of IPSec, see “IPSec VPN in the Web UI”.

FortiWAN Tunnel Traffic

Leave a reply

Tunnel Traffic

It collects inbound/outbound traffic statistics regarding tunnel routing in the past 60 minutes, 24 hours, and 30 days. Statistics are displayed on chart.

Traffic Type : Traffic flow direction.
Time : Collect statistics in the past 60 minutes, 24 hours, and 30 days.
Tunnel Routing Group : Select a group from the list. Depending on N tunnels the group gets, N statistical charts will show.

FortiWAN Tunnel Status

Leave a reply

Tunnel Status

Tunnel Status displays the connectivity of every single GRE tunnel of each tunnel group defined in Service >

Tunnel Routing (see Tunnel Routing) and statistics of the corresponding data transmission

Tunnel Group The drop-down menu lists all the tunnel groups defined in Service > Tunnel Routing. Select the tunnel group for monitoring it. The statistics of the specified tunnel group will be displayed in the Tunnel Health Status table below.
Automatic Refresh Enable automatic refresh by selecting the time interval (Every 3, 6, 9, 15, … Seconds) for refreshing the statistics, or disable it by selecting Disabled. The statistics here will be automatically refreshed periodically if it is enabled.

Tunnel Health Status

This table displays the connectivity and statistics of specified tunnel group in the following four fields.

Tunnel The GRE tunnel defined in the specified tunnel group, represented by the pair of its local and remote IP addresses.
3-Second Statistics Statistics of data transmission through this tunnel in the past 3 seconds, represented by RX Packets, RX Kbps, TX Packets and TX Kbps.
1-Minute Statistics Statistics of data transmission through this tunnel in the past 1 minute, represented by RX Packets, RX Kbps, TX Packets and TX Kbps.

Tunnel Traffic

Status Indicating the connectivity of the tunnel with color schemes:

Green indicates the tunnel is available (OK).

Red indicates the tunnel is unavailable (failed).

Moreover, round trip time (RTT) between the two endpoints of the tunnel is provided here for reference. The RTT will become blank if the tunnel is failed. You can also get the RTT of the tunnel by running Tunnel Routing’s benchmark (see Tunnel Routing – Benchmark).

Default Rule Subnets

This table lists the subnets (in the local and remote sites) that the default rules of the specified tunnel group consist of. See How to set up routing rules for Tunnel Routing for the details of default rule of a tunnel group.

Local Subnets The local subnets (subnets in the local site) of the default routing rules of the specified tunnel group. It will be blank if there is no default rule enabled.
Opposite Subnets The opposite subnets (subnets in the remote site) of the default routing rules of the specified tunnel group. It will be blank if there is no default rule enabled.

The default rule subnets listed here and corresponding page on remote Web UI are supposed to be equal for a tunnel group, just the position is switched. Local subnets here are the opposite subnets for the remote site, and the opposite subnets here are the local subnets for the remote site.

FortiWAN FQDN

Leave a reply

FQDN

The IPv4 and IPv6 addresses of the FQDNs that connected via FortiWAN are shown in this page.

IPv4 FQDN

FQDN : The FQDN connected via FortiWAN.
IPv4 Address

IPv6 FQDN

 : IPv4 addresses of the FQDN connected via FortiWAN. It maintains 20 addresses at most.
FQDN : The FQDN connected via FortiWAN.
IPv6 Address : IPv6 addresses of the FQDN connected via FortiWAN. It maintains 20 addresses at most.

FortiWAN Virtual Server Status

Leave a reply

Virtual Server Status

It displays status and statistics regarding virtual server defined in Service/Virtual Server.

Automatic Refresh : Enable it and choose time interval for refreshing.
Virtual Server Status : Green = OK; Red= Failed.
WAN IP : Displays WAN IPs defined in the rules on Service/Virtual Server page.
Service : Displays services defined in the rules on Service/Virtual Server page. These services are those available for virtual servers.
Server IP : Displays server IPs defined in the rules on Service/Virtual Server page. The server IPs denote those in real network usage.
Detect : Displays detection method, TCP or ICMP.
Status : Displays detection result.

 

Connection Limit

Leave a reply

Connection Limit

It enables administrators to inspect the number of established connections in real-time and to justify the maximum number of connections allowed on [Service] -> [Connection Limit] page, to avoid network congestion.

Automatic Refresh : Select auto-refresh interval, or disable the function.
No. : Numbering of IP addresses based on the number of connections established.
IP : Shows the source IP of the connection.
Connections : Shows the number of connections that are established by the source IP address and still active in system. An connection in system might be a connection with traffic flow existing or a idle connection. This number varies from connections closing to newly opened connections.
Clear : System maintains necessary tables and information for connections. Clicking the button to abort the connections established by the source IP address, and release the occupied memory then. When system is under attacks with high volumes of malicious connections, FortiWAN’s Connection Limit (See “Connection Limit”) stops subsequent connections established by the malicious IP addresses, but it takes time to recover system from the bandwidth and memory occupied by those malicious connections that are already in system. The Clear button terminates them immediately.

FortiWAN RIP & OSPF Status

Leave a reply

RIP & OSPF Status

It shows RIP status based on RIP and OSPF settings in [System] -> [Network Settings] -> [LAN Private Subnet].

Data on this page are used to inspect private subnet’s Network IP, Netmask, and gateway list.

Type : Select from the list to view RIP or OSPF routing.
Automatic Refresh : Select auto-refresh interval, or disable the function.
Network IP : Shows the Network IP of the private subnet.
Netmask : Shows the Netmask of the private subnet.
Gateway : Shows the Gateway of the private subnet.

 

FortiWAN DHCP Lease Information

Leave a reply

DHCP Lease Information

It shows data DHCP lease assigns, i.e. lease IP and MAC address, client-hostname, and expiration time. Once option of DHCP server is selected, a list regarding all existing DHCP servers in the network will display. Option Automatic Refresh sets the time interval to regularly update DHCP servers.

DHCP Server : Displays the DHCP server and IP range to be assigned.
Automatic Refresh : The time interval after which the table of DHCP leases information is updated.
Lease IP : WAN connected by either PPPoE or DHCP.
IP Address : Shows the IPv4 address assigned to the client’s machine.
MAC Address : Shows the MAC address of the client’s machine.
Client-Hostname : Shows the name of the client machine.
Expiration Time : Shows the time period when the IP address is valid.
DHCPv6 Server : Displays DHCPv6 server and range of IPv6 addresses which can be assigned.
Lease IP : Shows the IPv6 address assigned to client’s machine.
Client ID : Shows the ID assigned to the lease IPv6 address.
Expire Time : Shows the time period during which the IPv6 address is valid.