Request scheme which may be http or https.

FortiGate API FQDN/IP (ex. ngfw.example.com).

FortiGate API token.

The port of FortiGate API endpoint.

Response timeout for an API.

HTTP proxy for API requests. You can specify it using the format [protocol://][username[:password]@]proxy.example.com[:port]. See the documentation at https://www.zabbix.com/documentation/6.4/manual/config/items/itemtypes/http

This macro is used in "New available firmware found" trigger.

Threshold of CPU utilization for warning trigger in %.

Threshold of CPU utilization for critical trigger in %.

Threshold of memory utilization for warning trigger in %.

Threshold of memory utilization for critical trigger in %.

Threshold of disk free space for warning trigger in %.

Threshold of disk free space for critical trigger in %.

Macro for operational state of the interface for "Link down" trigger. Can be used with interface name as context.

Threshold of error packets rate for warning trigger. Can be used with interface name as context.

Threshold of interface bandwidth utilization for warning trigger in %. Can be used with interface name as context.

This macro is used in Network interfaces discovery. Can be overridden on the host or linked template level.

This macro is used in Network interfaces discovery. Can be overridden on the host or linked template level.

This macro is used in Network interfaces discovery. Can be overridden on the host or linked template level.

This macro is used in Network interfaces discovery. Can be overridden on the host or linked template level.

This macro is used in Network interfaces discovery. Can be overridden on the host or linked template level.

This macro is used in Network interfaces discovery. Can be overridden on the host or linked template level.

This macro is used in Network interfaces discovery. Can be overridden on the host or linked template level.

This macro is used in Network interfaces discovery. Can be overridden on the host or linked template level.

This macro is used in Network interfaces discovery. Can be overridden on the host or linked template level.

This macro is used in Network interfaces discovery. Can be overridden on the host or linked template level.

This macro is used in Firewall policies discovery. Can be overridden on the host or linked template level.

This macro is used in Firewall policies discovery. Can be overridden on the host or linked template level.

This macro is used in Firewall policies discovery. Can be overridden on the host or linked template level.

This macro is used in Firewall policies discovery. Can be overridden on the host or linked template level.

This macro is used in Firewall policies discovery. Can be overridden on the host or linked template level.

This macro is used in Firewall policies discovery. Can be overridden on the host or linked template level.

Number of days until the license expires.

This macro is used in Service discovery. Can be used with interface name as context.

This macro is used in Service discovery. Can be overridden on the host or linked template level.

This macro is used in Service discovery. Can be overridden on the host or linked template level.

This macro is used in Service discovery. Can be overridden on the host or linked template level.

This macro is used in Service discovery. Can be overridden on the host or linked template level.

This macro is used in Service discovery. Can be overridden on the host or linked template level.

This macro is used in Service discovery. Can be overridden on the host or linked template level.

Macro for the interface state for "Link down" trigger. Can be used with interface name as context.

This macro is used in SD-WAN members discovery. Can be overridden on the host or linked template level.

This macro is used in SD-WAN members discovery. Can be overridden on the host or linked template level.

This macro is used in SD-WAN members discovery. Can be overridden on the host or linked template level.

This macro is used in SD-WAN members discovery. Can be overridden on the host or linked template level.

This macro is used in SD-WAN members discovery. Can be overridden on the host or linked template level.

This macro is used in SD-WAN members discovery. Can be overridden on the host or linked template level.

This macro is used in SD-WAN members discovery. Can be overridden on the host or linked template level.

This macro is used in SD-WAN members discovery. Can be overridden on the host or linked template level.

Macro for the interface state for "Link down" trigger. Can be used with interface name as context.

This macro is used in SD-WAN health-checks discovery. Can be overridden on the host or linked template level.

This macro is used in SD-WAN health-checks discovery. Can be overridden on the host or linked template level.

This macro is used in SD-WAN health-checks discovery. Can be overridden on the host or linked template level.

This macro is used in SD-WAN health-checks discovery. Can be overridden on the host or linked template level.

This macro is used in SD-WAN health-checks discovery. Can be overridden on the host or linked template level.

This macro is used in SD-WAN health-checks discovery. Can be overridden on the host or linked template level.

This macro is used in SD-WAN health-checks discovery. Can be overridden on the host or linked template level.

This macro is used in SD-WAN health-checks discovery. Can be overridden on the host or linked template level.

Threshold of packets loss for warning trigger in %. Can be used with interface name as context.

Preprocessing

• Discard unchanged with heartbeat: 10m

Item for gathering device system info from FortiGate API.

Preprocessing

• Check for not supported value

  ⛔️Custom on fail: Set value to: {"error":"Not supported value received"}

Item for gathering errors of the device system info.

Preprocessing

• JSON Path: $.error

  ⛔️Custom on fail: Set value to: ``

• Discard unchanged with heartbeat: 1h

Checking API availability by response.

Preprocessing

• JSON Path: $.build

  ⛔️Custom on fail: Set value to: 0

• In range: -> 0

  ⛔️Custom on fail: Set value to: 1

Item for gathering device firmware info from FortiGate API.

Preprocessing

• Check for not supported value

  ⛔️Custom on fail: Set value to: {"error":"Not supported value received"}

Item for gathering errors of the device firmware info.

Preprocessing

• JSON Path: $.error

  ⛔️Custom on fail: Set value to: ``

• Discard unchanged with heartbeat: 1h

Item for gathering information about service licenses from FortiGate API.

Item for gathering errors of the service licenses data.

Preprocessing

• JSON Path: $.error

  ⛔️Custom on fail: Discard value

• Discard unchanged with heartbeat: 1h

Item for gathering device resource data from FortiGate API.

Item for gathering errors of the device resources.

Preprocessing

• JSON Path: $.error

  ⛔️Custom on fail: Discard value

• Discard unchanged with heartbeat: 1h

Item for gathering network interfaces info from FortiGate API.

Item for gathering errors of network interfaces.

Preprocessing

• JSON Path: $.error

  ⛔️Custom on fail: Discard value

• Discard unchanged with heartbeat: 1h

Item for gathering SD-WAN information from FortiGate API.

Item for gathering errors of SD-WAN.

Preprocessing

• JSON Path: $.error

  ⛔️Custom on fail: Discard value

• Discard unchanged with heartbeat: 1h

Item for gathering firewall policies info from FortiGate API.

Item for gathering errors of firewall policies.

Preprocessing

• JSON Path: $.error

  ⛔️Custom on fail: Discard value

• Discard unchanged with heartbeat: 1h

Number of available firmware versions to download.

Preprocessing

• JSON Path: $.results.available.length()

  ⛔️Custom on fail: Discard value

• Discard unchanged with heartbeat: 12h

Current version of the device firmware.

Preprocessing

• JSON Path: $.results.current

• JavaScript: The text is too long. Please see the template.

• Discard unchanged with heartbeat: 1d

The model name of the device.

Preprocessing

• JSON Path: $.results

• JavaScript: The text is too long. Please see the template.

• Discard unchanged with heartbeat: 1d

The device serial number.

Preprocessing

• JSON Path: $.serial

• Discard unchanged with heartbeat: 1d

Name of the current Virtual Domain.

Preprocessing

• JSON Path: $.vdom

• Discard unchanged with heartbeat: 12h

The system host name.

Preprocessing

• JSON Path: $.results.hostname

• Discard unchanged with heartbeat: 12h

The system uptime is calculated on the basis of boot time.

Preprocessing

• JSON Path: $.results.utc_last_reboot

• JavaScript: The text is too long. Please see the template.

Number of processors according to the current license.

Preprocessing

• JSON Path: $.data.vm.cpu_used

• Discard unchanged with heartbeat: 1d

CPU utilization, expressed in %.

Preprocessing

• JSON Path: $.data.cpu

Total memory, expressed in bytes.

Preprocessing

• JSON Path: $.data.vm.mem_used

• Discard unchanged with heartbeat: 1d

Memory utilization, expressed in %.

Preprocessing

• JSON Path: $.data.mem

The total space of the current disk, in bytes.

Preprocessing

• JSON Path: $.data.disk_total

• Discard unchanged with heartbeat: 1d

The used space of the current disk, in bytes.

Preprocessing

• JSON Path: $.data.disk_used

The free space of the current disk, in bytes.

Preprocessing

• JSON Path: $.data.disk_free

Disk utilization, expressed in %.

Preprocessing

• JSON Path: $.data.disk

• FortiGate: Unexpected response from API

Received an unexpected response from API. It may be unavailable.

• FortiGate: Port {$FGATE.API.PORT} is unavailable

• FortiGate: Unexpected response from API

• FortiGate: Unexpected response from API

• FortiGate: Unexpected response from API

• FortiGate: Unexpected response from API

• FortiGate: Unexpected response from API

• FortiGate: Unexpected response from API

New available firmware versions found to download.

This trigger expression works as follows:
1. It can be triggered if there are one or more available firmware versions.
2. {$FIRMWARE.UPDATES.CONTROL}=1 - a user can redefine context macro to value - 0. That marks this notification as not important. No new trigger will be fired if new firmware is found.

Device serial number has changed. Acknowledge to close the problem manually.

The name of the system has changed. Acknowledge to close the problem manually.

Uptime is less than 10 minutes.

The CPU utilization is too high. The system might be slow to respond.

The CPU utilization is high.

• FortiGate: CPU utilization is too high

Free memory size is too low.

The system is running out of free memory.

• FortiGate: Memory utilization is too high

Left disk space is too low.

Left disk space is not enough.

• FortiGate: Free disk space is too low

Discovery for FortiGate firewall policies.

Preprocessing

• JSON Path: $.data

• Discard unchanged with heartbeat: 1h

Item for gathering data for the {#FWNAME} firewall policy.

Preprocessing

• JSON Path: $.data[?(@.uuid == "{#FWUUID}")].first()

  ⛔️Custom on fail: Discard value

Number of active sessions covered by this rule.

Preprocessing

• JSON Path: $.active_sessions

Number of bytes processed only by the software firewall.

Preprocessing

• JSON Path: $.software_bytes

• Change per second

Number of bytes processed only by the hardware (ASIC) firewall.

Preprocessing

• JSON Path: $.asic_bytes

• Change per second

Number of bytes processed by both the software and hardware (ASIC) firewall.

Preprocessing

• JSON Path: $.bytes

• Change per second

Number of packets hit into the firewall policy per second.

Preprocessing

• JSON Path: $.hit_count

  ⛔️Custom on fail: Set value to: 0

• Change per second

The time at which the firewall policy was used the last time.

Preprocessing

• JSON Path: $.last_used

  ⛔️Custom on fail: Discard value

The firewall policy action (accept / deny / ipsec).

Preprocessing

• JSON Path: $.action

• JavaScript: The text is too long. Please see the template.

• Discard unchanged with heartbeat: 12h

The firewall policy status.

Preprocessing

• JSON Path: $.status

• JavaScript: The text is too long. Please see the template.

• Discard unchanged with heartbeat: 1h

Discovery for FortiGate services.

Preprocessing

• JSON Path: $.lld

• Discard unchanged with heartbeat: 6h

Item for gathering data about license for the {#NAME} service.

Preprocessing

• JSON Path: $.data["{#KEY}"]

  ⛔️Custom on fail: Discard value

Current license status of the {#NAME} service.

Preprocessing

• JSON Path: $.status

  ⛔️Custom on fail: Discard value

• JavaScript: The text is too long. Please see the template.

• Discard unchanged with heartbeat: 1h

Current type of the {#NAME} service.

Preprocessing

• JSON Path: $.type

  ⛔️Custom on fail: Discard value

• Discard unchanged with heartbeat: 1h

Current version of the {#NAME} service.

Preprocessing

• JSON Path: $.version

  ⛔️Custom on fail: Discard value

• Discard unchanged with heartbeat: 1h

Expiration date for the license of the current service.

Preprocessing

• JSON Path: $.expires

  ⛔️Custom on fail: Discard value

• Discard unchanged with heartbeat: 1h

Last update time of the current service.

Preprocessing

• JSON Path: $.last_update

  ⛔️Custom on fail: Discard value

• Discard unchanged with heartbeat: 1h

Last update attempt time of the current service.

Preprocessing

• JSON Path: $.last_update_attempt

  ⛔️Custom on fail: Discard value

• Discard unchanged with heartbeat: 1h

Current update method of the {#NAME} service.

Preprocessing

• JSON Path: $.last_update_method_status

  ⛔️Custom on fail: Discard value

• Discard unchanged with heartbeat: 1h

Last update result of the {#NAME} service.

Preprocessing

• JSON Path: $.last_update_result_status

  ⛔️Custom on fail: Discard value

• Discard unchanged with heartbeat: 1h

This trigger expression works as follows:
1. It can be triggered if the license status is unsuccessful.
2. {$SERVICE.LICENSE.CONTROL:"{#IFNAME}"}=1 - a user can redefine context macro to value - 0. That marks the license of this service as not important. No new trigger will be fired if this license is unsuccessful.

This trigger expression works as follows:
1. It can be triggered if the license expires soon.
2. {$SERVICE.LICENSE.CONTROL:"{#IFNAME}"}=1 - a user can redefine context macro to value - 0. That marks the license of this service as not important. No new trigger will be fired if this license expires.

Discovery for FortiGate SD-WAN members.

Preprocessing

• JSON Path: $.data.member_lld

• Discard unchanged with heartbeat: 1h

Item for gathering data about the {#NAME} interface in the {#ZONE} zone.

Preprocessing

• JSON Path: $.data.member_lld[?(@.interface == "{#NAME}")].first()

  ⛔️Custom on fail: Discard value

Current status of the {#NAME} interface in the {#ZONE} zone.

Preprocessing

• JSON Path: $.status

• JavaScript: The text is too long. Please see the template.

• Discard unchanged with heartbeat: 1h

Current link status of the {#NAME} interface in the {#ZONE} zone.

Preprocessing

• JSON Path: $.link

• JavaScript: The text is too long. Please see the template.

Number of active sessions opened through the {#NAME} interface in the {#ZONE} zone.

Preprocessing

• JSON Path: $.session

Bytes sent through the {#NAME} interface in the {#ZONE} zone per second.

Preprocessing

• JSON Path: $.tx_bytes

  ⛔️Custom on fail: Set value to: 0

• Change per second

Bytes received from the {#NAME} interface in the {#ZONE} zone per second.

Preprocessing

• JSON Path: $.rx_bytes

  ⛔️Custom on fail: Set value to: 0

• Change per second

Transmitting bandwidth of the {#NAME} interface in the {#ZONE} zone.

Preprocessing

• JSON Path: $.tx_bandwidth

  ⛔️Custom on fail: Set value to: 0

• Change per second

Receiving bandwidth of the {#NAME} interface in the {#ZONE} zone.

Preprocessing

• JSON Path: $.rx_bandwidth

  ⛔️Custom on fail: Set value to: 0

• Change per second

Last state changing time of the {#NAME} interface in the {#ZONE} zone.

Preprocessing

• JSON Path: $.state_changed

  ⛔️Custom on fail: Discard value

• Discard unchanged with heartbeat: 1h

This trigger expression works as follows:
1. It can be triggered if the interface status is down.
2. {$SDWAN.MEMBER.IF.CONTROL:"{#NAME}"}=1 - a user can redefine context macro to value - 0. That marks this interface as not important. No new trigger will be fired if this interface is down.
3. {TEMPLATE_NAME:METRIC.diff()}=1 - the trigger fires only if the interface status was up to (1) sometime before.

WARNING: If closed manually, it will not fire again on the next poll because of .diff.

Discovery for FortiGate SD-WAN health-checks.

Preprocessing

• JSON Path: $.data.health_lld

• Discard unchanged with heartbeat: 1h

Item for gathering data about the {#IFNAME} interface in the {#NAME} health-check.

Preprocessing

• JSON Path: The text is too long. Please see the template.

  ⛔️Custom on fail: Discard value

Current status of the {#IFNAME} interface in the {#NAME} health-check.

Preprocessing

• JSON Path: $.status

• JavaScript: The text is too long. Please see the template.

Current jitter value for the {#IFNAME} interface in the {#NAME} health-check.

Preprocessing

• JSON Path: $.jitter

  ⛔️Custom on fail: Discard value

Current latency value for the {#IFNAME} interface in the {#NAME} health-check.

Preprocessing

• JSON Path: $.latency

  ⛔️Custom on fail: Discard value

Percent of lost packets for the {#IFNAME} interface in the {#NAME} health-check.

Preprocessing

• JSON Path: $.packet_loss

  ⛔️Custom on fail: Discard value

Number of packets sent through the {#IFNAME} interface in the {#NAME} health-check per second.

Preprocessing

• JSON Path: $.packet_sent

  ⛔️Custom on fail: Discard value

• Change per second

Number of packets received from the {#IFNAME} interface in the {#NAME} health-check per second.

Preprocessing

• JSON Path: $.packet_received

  ⛔️Custom on fail: Discard value

• Change per second

This trigger expression works as follows:
1. It can be triggered if the interface status is down.
2. {$SDWAN.HEALTH.IF.CONTROL:"{#NAME}"}=1 - a user can redefine context macro to value - 0. That marks this interface as not important. No new trigger will be fired if this interface is down/error.
3. {TEMPLATE_NAME:METRIC.diff()}=1 - the trigger fires only if the interface status was up to (1) sometime before.

WARNING: If closed manually, it will not fire again on the next poll because of .diff.

This trigger expression works as follows:
1. It can be triggered if the interface status is error.
2. {$SDWAN.HEALTH.IF.CONTROL:"{#IFNAME}"}=1 - a user can redefine context macro to value - 0. That marks this interface as not important. No new trigger will be fired if this interface is down/error.
3. {TEMPLATE_NAME:METRIC.diff()}=1 - the trigger fires only if the interface status was up to (1) sometime before.

WARNING: If closed manually, it will not fire again on the next poll because of .diff.

High level of packets loss detected.

Discovery for FortiGate network interfaces.

Preprocessing

• JSON Path: $.data

• Discard unchanged with heartbeat: 6h

Item for gathering data for the {#IFKEY} interface.

Preprocessing

• JSON Path: $.data[?(@.id == "{#IFKEY}")].first()

  ⛔️Custom on fail: Discard value

Current link status of the interface.

Preprocessing

• JSON Path: $.link

• Boolean to decimal

The total number of octets received on the interface per second.

Preprocessing

• JSON Path: $.rx_bytes

  ⛔️Custom on fail: Set value to: 0

• Change per second

• Custom multiplier: 8

The total number of packets received on the interface per second.

Preprocessing

• JSON Path: $.rx_packets

  ⛔️Custom on fail: Set value to: 0

• Change per second

The total number of octets transmitted out of the interface.

Preprocessing

• JSON Path: $.tx_bytes

  ⛔️Custom on fail: Set value to: 0

• Change per second

• Custom multiplier: 8

The total number of packets transmitted out of the interface per second.

Preprocessing

• JSON Path: $.tx_packets

  ⛔️Custom on fail: Set value to: 0

• Change per second

The total number of errors received.

Preprocessing

• JSON Path: $.rx_errors

  ⛔️Custom on fail: Set value to: 0

• Change per second

The total number of errors transmitted.

Preprocessing

• JSON Path: $.tx_errors

  ⛔️Custom on fail: Set value to: 0

• Change per second

Type of the interface.

Preprocessing

• JSON Path: $.type

• JavaScript: The text is too long. Please see the template.

• Discard unchanged with heartbeat: 1h

Speed of the interface.

Preprocessing

• JSON Path: $.speed

  ⛔️Custom on fail: Set value to: 0

• Custom multiplier: 1000000

• Discard unchanged with heartbeat: 1h

This trigger expression works as follows:
1. It can be triggered if the interface link status is down.
2. {$NET.IF.CONTROL:"{#IFNAME}"}=1 - a user can redefine context macro to value - 0. That marks this interface as not important. No new trigger will be fired if this interface link is down.
3. {TEMPLATE_NAME:METRIC.diff()}=1 - the trigger fires only if the interface link status was up to (1) sometime before.

WARNING: If closed manually, it will not fire again on the next poll because of .diff.

The utilization of the network interface is close to its estimated maximum bandwidth.

• Interface [{#IFNAME}({#IFALIAS})]: Link down

It recovers when it is below 80% of the {$NET.IF.ERRORS.WARN:"{#IFKEY}"} threshold.

• Interface [{#IFNAME}({#IFALIAS})]: Link down

This Ethernet connection has transitioned down from its known maximum speed. This might be a sign of autonegotiation issues. Acknowledge to close the problem manually.

• Interface [{#IFNAME}({#IFALIAS})]: Link down