6

For a long time now we've been having huge connection problems at work. The Internet connection is bad, for sure, but I don't think they are the main problem, they don't see any packet loss on their end and it's clearly happening every morning between 8 and 10, give or take half an hour.

We have three netgear GS724T plugged in a fortinet with two WAN ports. Looks like changing the WAN used doesn't change much, but the second connection, usually only used for VoIP, is so weak that it's hard to tell if it's the same problem or just if the connection is too slow for our needs.

I just ran get system performance status on the fortinet and I get the following:

CPU states: 0% user 6% system 0% nice 92% idle
Memory states: 56% used
Average network usage: 7137 kbps in 1 minute, 5229 kbps in 10 minutes, 4067 kbps in 30 minutes
Average sessions: 2471 sessions in 1 minute, 2542 sessions in 10 minutes, 2279 sessions in 30 minutes
Virus caught: 0 total in 1 minute
IPS attacks blocked: 0 total in 1 minute
Uptime: 238 days,  19 hours,  24 minutes

Those stats seems a little high, I don't understand what is eating so much bandwith. Any way to know which IP is downloading?

The fortinet is quite outdated I believe, running Fortigate-60 3.00,build0753,100217

Improve this question
6
  • Never used FortiOS version 3, but versions 4 and 5 are able to provide you with graphics for historical interface utilization and top sources/destinations for traffic crossing the firewall. These graphics could give you the answer you are looking for.
    – Daniel Yuste Aroca
    Jun 4, 2015 at 19:07
  • What let you think "Those stats seems a little high"? Your router is 92% idle. And 7Mbit/s is clearly far from an overloaded router. Did you check the problem isn't far before your Internet connection router?
    – dan
    Jun 5, 2015 at 10:55
  • What leads to diagnose "The Internet connection is bad, for sure"?
    – dan
    Jun 5, 2015 at 10:56
  • No graphs in version 3, or at least none that I could find. I'm not saying it's overloaded, just that I find it a little strange to be using 7 Mbit/s at this time, just wondering if maybe there is an old backup cron still runing on a server somewhere. We have a pretty long line, with a fair bit of noise, the connection isn't great. Our provider is quite known for bad-ish service too, but they isn't much choice.
    – Ulrar
    Jun 5, 2015 at 12:25
  • To try an educated guess on the origin of your problem: what kind of servers do you run inside of your network?
    – dan
    Jun 5, 2015 at 15:32

4 Answers 4

Reset to default
4

This sounds like a case study for sFlow. The best way for you to figure out what's going wrong is to figure out who's talking to who - and how much. Just spin up your favorite sFlow analyzer and start tracking the bandwidth consumption of individual users.

Here's an example sFlow configuration pulled from sflow.com that you'd put on your WAN interface:

config system sflow
   set collector-ip 10.X.X.X
   set collector-port 6343
end

config sys interface
    edit
       set sflow-sampler enable
       set sample-rate 64
       set sample-direction both
       set polling-interval 30
    next
end

Configuration snippet pulled from sflow.com, Configuring FortiGate appliances.

Improve this answer
5
  • Did find some mentions of that online, unfortunately there is no sflow support in that model I believe. I tried but config system sflow doesn't exist and set sflow-sampler neither :(
    – Ulrar
    Jun 5, 2015 at 7:59
  • Are you open to upgrading? That must be a really out of date version of it doesn't support it.
    – Ryan Foley
    Jun 5, 2015 at 13:11
  • Would like to, but It'd mean having to retake the support contract, have to convince the boss that spending that money is worth it. Might be better to just buy a better router at this point
    – Ulrar
    Jun 5, 2015 at 13:53
  • Not at all if the problem isn't coming from your Fortigate router.
    – dan
    Jun 5, 2015 at 15:34
  • 1
    You could try using a tap on the WAN link and sniffing off that if your platform doesn't support it.
    – Ryan Foley
    Jun 5, 2015 at 15:37
3

Some advice that comes to my mind:
1. The FG-60 is quite old, right, but it's nowhere from being overloaded. Watch the memory consumption (preferably in the CLI, get sys perf stat) - if it crosses the 70% line you will have problems. None if below.
2. During the morning rush it might be that the upload capacity of your link is overloaded while there still is plenty of download BW. That of course only applies if your line is asymmetrical (ADSL).
3. FOS doesn't have sflow support until (guess) v4.3. I doubt if it could tell you more than polling by SNMP which is fully supported. For a graphical frontend to SNMP you've already found Fireplotter but there is e.g. Splunk with a Fortinet add-on module. Splunk allows for long term surveillance of virtually any counter available through SNMP, along with graphs etc. Or you could use Cacti for monitoring, again using SNMP. Splunk and Cacti are Open Source. 4. Please do a reboot of the FGT after, say, 2-3 months. As in every piece of software there are memory leaks in FortiOS which might lead to really strange behavior.
5. Before investing in a new Fortigate (what else?) your local Fortinet partner should provide a demo unit for 2 weeks. This is standard procedure with Fortinet. It will take some effort to convert your configuration to the new FortiOS version (currently v5.0 or v5.2) but that is inevitable.
A model FG-60D should suffice by far. Even your boss will have to admit that his company's needs have risen 10fold over the last 10 years or so, and we are talking (only) about $1500 here, hardware, contract and work included.
FortiOS v5, and especially v5.2, will give you excellent, realtime graphs with drilldown capabilities, down to a session or a source host.

Improve this answer
5
  • +1, would you mind adding Fortigate doc references for the various points in this post?
    – Mike Pennington
    Jun 6, 2015 at 14:43
  • I'd love to but your model is already off-screen. No v3 docs available for public access at the moment. For v4.3 and v5, see docs.fortinet.com for Admin Guides, and esp. the Cookbook with recipes for common network setups. Same with datasheet, for the current model FG-60D see fortinet.com/products/fortigate/utm-90-60series.html . You find a link there to request a demo unit. Locate a vivid and dedicated Fortinet partner in your region. splunk.com and cacti.net for the monitoring tools.
    – user1016274
    Jun 6, 2015 at 19:54
  • 1
    the Web never forgets: here you can download v3 manuals for help on configuring SNMP: web.archive.org/web/20100920005100/http://docs.fortinet.com/… . Look for v3.00 MR7 docs.
    – user1016274
    Jun 6, 2015 at 20:12
  • I didn't know you could have demo unit, that's pretty good ! Guess it's worth thinking of, clearly. For SNMP, I googled a bit and I see that you can monitor things like cpu usage or number of sessions, but can you get the different bandwith usage per host like fireplotter does ? I'd like to install a cacti on a server and generate graph 24/24, but fireplotter runs only on windows, I'd like to avoid dedicating a computer to that.
    – Ulrar
    Jun 8, 2015 at 8:34
  • AFAIK there are no "current bandwidth" counters available in the MIB. You would pull the bytes count from an interface in time intervals and calculate the BW. Be sure to get the MIB corresponding to your version of FortiOS.
    – user1016274
    Jun 8, 2015 at 11:29
1

I found FirePlotter, with the trial license it's able to generate graph per service and source IP, it's pretty good. Just needs an ssh access to the router. Tried it this morning, nothing really strange in the list, but we didn't have much problems compared to yesterday. I guess I'll try again monday but it looks like the problem really isn't on the fortinet.

What seems strange is it's almost all morning, and then the rest of the day it works mostly fine. Guess I'll ask the ISP again if they see a problem !

Improve this answer
0

Have you tried using fortigate datasets? They allow you to create custom queries to report various logs from the system. An example from the fortigate manual:

This calculates an “hourstamp” to indicate the bandwidth per hour. 

config report dataset
edit appctrl.Count.Bandwidth.Top10.Apps
set query “select (timestamp-timestamp%3600)
as hourstamp”
Improve this answer
2
  • Doesn't seem to exist in this version, I get a parsing error at the config report :/
    – Ulrar
    Jun 9, 2015 at 7:29
  • config report dataset is new in v4. Thanks for the hint, I had no idea it existed before v5 - mainly because the command is absent on model without a local disk.
    – user1016274
    Jun 9, 2015 at 14:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.