Next hop inaccessible-fortinet-FortiOS

error
health-checks
fortios
fortinet
Next hop inaccessible-fortinet-FortiOS
0
#1

Next hop inaccessible-fortinet-FortiOS

Vendor: fortinet

OS: FortiOS

Description:
Indeni will review the routing table and identify when a next hop router is showing as FAILED or INCOMPLETE in the ARP table.

Remediation Steps:
Determine why the next hops are not responding.

How does this work?
This alert uses the FortiOS command “get system arp” to retrieve the full ARP table for a FortiOS firewall.

Why is this important?
Tracking the ARP entry can indicate when certain hosts are failing to repsond to ARP requests. If that host is actually a next hop router, traffic may not reach its final destination. In addition, if there’s a sudden jump in the number of ARP entries that are failing, it may indicate a connectivity issue at layer 2.

Without Indeni how would you find this?
An administrator would have to login to the Fortinet firewall and execute the “get system arp” command to check this data. Alternatively, wait for an issue to occur and check the ARP system status by running the FortiOS command “get system arp”.

fortios-get-system-arp

#! META
name: fortios-get-system-arp
description: Fortinet Firewall system ARP entries
type: monitoring
monitoring_interval: 10 minutes
requires:
    vendor: "fortinet"
    os.name: "FortiOS"
    product: "firewall"

# --------------------------------------------------------------------------------------------------
# The script publish the following metrics
#
# [arp-table]           [complex array]
# --------------------------------------------------------------------------------------------------


#! COMMENTS
arp-table:
    why: |
        Tracking the ARP entry can indicate when certain hosts are failing to repsond to ARP requests. If that host is actually a next hop router, traffic may not reach its final destination. In addition, if there's a sudden jump in the number of ARP entries that are failing, it may indicate a connectivity issue at layer 2.
    how: |
        This alert uses the FortiOS command "get system arp" to retrieve the full ARP table for a FortiOS firewall.
    without-indeni: |
        An administrator would have to login to the Fortinet firewall and execute the "get system arp" command to check this data. Alternatively, wait for an issue to occur and check the ARP system status by running the FortiOS command "get system arp".
    can-with-snmp: false
    can-with-syslog: false


#! REMOTE::SSH
get system arp

#! PARSER::AWK

BEGIN{
    # Store mask in
    table_arp_index = 0
}

# Parse all the needed info ('targetip', 'mac' & 'interface') and store them in the table
#10.10.8.145       0          88:1d:fc:60:4b:c6 lan
#212.205.216.193   0          88:1d:fc:60:4b:c6 wan1
/^[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}/{

    # Increase index of table
    table_arp_index++

    table_arp[table_arp_index, "targetip"] = $1
    table_arp[table_arp_index, "mac"] = $3
    table_arp[table_arp_index, "interface"] = $4
    table_arp[table_arp_index, "success"] = 1
}

END {
    writeComplexMetricObjectArray("arp-table", null, table_arp)
}


fortios-get-router-info-routing-table-static

#! META
name: fortios-get-router-info-routing-table-static
description: Fortinet Firewall static route entries 
type: monitoring
monitoring_interval: 10 minutes
requires:
    vendor: "fortinet"
    os.name: "FortiOS"
    product: "firewall"

# --------------------------------------------------------------------------------------------------
# The script publish the following metrics
#
# [static-routing-table]           [complex array ]
# --------------------------------------------------------------------------------------------------


#! COMMENTS
static-routing-table:
    why: |
       Capture the static route entries that are configured on the Fortinet Firewall. It is chekced if the next hop IP
       address set to the static routes can be resolved to a MAC address via ARP . If this is not the case, an alert
       would be generated.
    how: |
       This script logins to the Fortinet Firewall and retrieves the output of the "get router info routing-table
       static" command. The output includes a table with the device's configured static routes.
    without-indeni: |
       It is possible to poll this data through SNMP but additional external logic would be required to correlate the
       static routes table with the arp table entries and resolved next hop IP addresses.
    can-with-snmp: true
    can-with-syslog: false


#! REMOTE::SSH
get router info routing-table static

#! PARSER::AWK
BEGIN{
    # Store mask in
    table_routing_index = 0
}

# Parse all the needed info ('network', 'mask' & 'next-hop') and store them in the table
#S*      0.0.0.0/0 [10/0] via 212.205.216.193, wan1
#S       10.0.0.0/8 [10/0] via 10.10.8.145, lan
#S       1.1.1.1/32 [10/0] is directly connected, port1
/^S/{

    # Ensure that the $5 is ip and not text
    if($5 ~ /[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}/){

        # Increase index of table
        table_routing_index++

        # Reading network and mask. Example is "10.0.0.0/8"
        ip_mask = $2
        split(ip_mask, ip_mask_array, "/")
        table_routing[table_routing_index, "network"] = ip_mask_array[1]
        table_routing[table_routing_index, "mask"] = ip_mask_array[2]

        # Storing next-hop
        next_hop = $5

        # Removing ','
        gsub(",", "", next_hop)
        table_routing[table_routing_index, "next-hop"] = next_hop

    }
}

END {
    writeComplexMetricObjectArray("static-routing-table", null, table_routing)
}




cross_vendor_next_hop_router_inaccessible

Failed to fetch the data: https://bitbucket.org/indeni/indeni-knowledge/src/master/rules/sync_core_rules/NextHopRouterInaccessibleRule.scala