FortiGate Firewall network monitoring with GenticFlow
FortiGate firewall posture, VPN, policy, and performance context
GenticFlow connects to FortiGate firewalls through the FortiGate REST API to sync firewall device information, performance metrics, interfaces, policies, VPN tunnels, user sessions, VDOMs, HA status, system resources, and optional SD-WAN, security profile, threat feed, routing, and DNS context.
What You Get
Firewall and Network Sync
- Device information, model, version, CPU, memory, sessions, and bandwidth metrics sync into GenticFlow
- Network interfaces, firewall policies, VPN tunnels, user sessions, VDOMs, HA status, and system resources are supported
- VDOM configuration is supported for multi-tenant firewall environments
- Version detection selects the appropriate FortiOS API endpoints
Security and Posture Context
- Threat detection metrics include IPS, malware and virus blocks, and web filter hits
- Security policy coverage tracks IPS, antivirus, and web filter usage on policies
- Subscription and firmware currency data can be collected
- Optional sync areas include SD-WAN health, application control, security profiles, threat feeds, routing, and DNS
API Access Model
- API key authentication is supported and recommended for production
- Username/password authentication is also supported
- Connection testing validates authentication and API access
- The connector is focused on monitoring and investigation context, not policy mutation
How It Works
Connect the FortiGate API
Configure host, port, VDOM, credentials or API key, SSL behavior, and timeout.
Select sync areas
Enable core firewall resources and optional SD-WAN, security profile, threat feed, routing, and DNS sync.
Collect firewall evidence
GenticFlow imports device, network, security, VPN, user, HA, and system resource context.
Use network context in tickets
VPN, firewall, and connectivity tickets can include FortiGate evidence before escalation.
Network context before escalation.
FortiGate Firewall gives GenticFlow network inventory and status context for connectivity, VPN, firewall, and device tickets. Investigations can include the relevant network evidence instead of sending technicians in cold.
See It In Action