FORTINET-CORE-MIB

All MIBs › FORTINET-CORE-MIB

Organization: Fortinet Technologies, Inc.

Last Updated: 2024-02-29

Category: Textual Conventions and Registries, Vendor: Fortinet

Description: Core MIB shared across all Fortinet products, defining common system configuration objects, trap definitions, and base OIDs imported by product-specific MIBs.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is FORTINET-CORE-MIB?

FORTINET-CORE-MIB is the shared base MIB imported by all of Fortinet's product-specific MIBs (such as those for FortiGate firewalls and FortiWAN), defining common system identification objects, an administrator table, and a generic trap-message framework. It exposes system-level configuration data (serial number, management language) and an administrator/session table, plus a generic trap object used across the product line to carry event text. Its monitoring role is foundational: it lets an operator confirm device identity and see the shared trap channel through which product-specific MIBs report hardware and software faults, functioning as the common OID base other Fortinet MIBs build fault and status reporting on top of. It is explicitly designed to be imported by product-specific Fortinet MIBs rather than used entirely standalone. It underlies management of any Fortinet security appliance in the field, from firewalls to WAN optimization devices. Administrators searching for fortinet-core-mib documentation should note it is meant to be compiled as a dependency rather than queried directly, since its trap and identity objects only become meaningful once product-specific Fortinet MIBs are loaded alongside it.

IPNetwork Monitor allows you to monitor SNMP objects defined in FORTINET-CORE-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

Fortinet FortiGate 3800G (2025) — high-performance data center NGFW for AI workloads
Fortinet FortiGate 700G (2025) — campus NGFW with post-quantum crypto readiness

Monitoring Examples

An admin polls fnSysSerial to positively identify a device and the fnAdminTable (fnAdminIndex, fnAdminName, fnAdminAddr) to audit which administrator accounts and management addresses are configured; the shared fnGenTrapMsg object is the generic trap payload that Fortinet's product-specific MIBs use to report events such as configuration changes or hardware faults.

What Can Be Monitored

system serial number
administrator account table and addresses
generic trap/event messages
management language/locale setting

Imported Objects

From IF-MIB

ifIndex

OBJECT-TYPE

From INET-ADDRESS-MIB

InetAddress
InetAddressPrefixLength
InetAddressType

From SNMPv2-CONF

MODULE-COMPLIANCE
NOTIFICATION-GROUP
OBJECT-GROUP

From SNMPv2-MIB

sysName

OBJECT-TYPE

From SNMPv2-SMI

Integer32
MODULE-IDENTITY
NOTIFICATION-TYPE
OBJECT-TYPE
enterprises

From SNMPv2-TC

DisplayString
TEXTUAL-CONVENTION

How to Use in IPNetwork Monitor

Example using fnAdminNumber OID:

Select a Fortinet FortiGate 3800G (2025) as the target host to create a monitor — the SNMP service should be up and running on it. Click New Monitor, then check SNMP Custom on the Favorites tab, click Next, and confirm the host. On the next page, click Select... to open the built-in SNMP MIB Browser and type fnAdminNumber into the Find box to locate it in the OID tree, then select it and click OK. It reports the number of administrator accounts currently configured on the FortiGate. On the monitor's Main parameters page you can set the target's SNMP port (default 161), credentials, polling interval, and other settings — see the SNMP Monitor help for details. On the State conditions and Alerting tabs, configure when the monitor should change state and trigger an alert; since this is an Integer32-type OID, Value bounds is the most useful condition here — trigger an alert if the admin account count changes unexpectedly, which can flag an unauthorized account being added. Click Finish to create the monitor; you can adjust any parameter later.

OIDs

OID symbolic	OID numeric	Type	Access	Description
fnAdmin	1.3.6.1.4.1.12356.100.1.2.100
IP fnAdminAddr	1.3.6.1.4.1.12356.100.1.2.100.2.1.4	InetAddress	read-only	The address prefix identifying where the administrator account can be used from, typically an IPv4 address. The address type/format is determined by fnAdminAddrType.
IPt fnAdminAddrType	1.3.6.1.4.1.12356.100.1.2.100.2.1.3	InetAddressType	read-only	The type of address stored in fnAdminAddr, in compliance with INET-ADDRESS-MIB
fnAdminComplianceGroup	1.3.6.1.4.1.12356.100.10.3			Administration access control objects.
fnAdminEntry	1.3.6.1.4.1.12356.100.1.2.100.2.1		not-accessible	An entry containing information applicable to a particular admin account
I32 fnAdminIndex	1.3.6.1.4.1.12356.100.1.2.100.2.1.1	Integer32	not-accessible	An index uniquely defining an administrator account within the fnAdminTable
ADR fnAdminMask	1.3.6.1.4.1.12356.100.1.2.100.2.1.5	InetAddressPrefixLength	read-only	The address prefix length (or network mask) applied to the fgAdminAddr to determine the subnet or host the administrator can access the device from
STR fnAdminName	1.3.6.1.4.1.12356.100.1.2.100.2.1.2	DisplayString	read-only	The user-name of the specified administrator account
I32 fnAdminNumberEx	1.3.6.1.4.1.12356.100.1.2.100.1	Integer32	read-only	The number of admin accounts in fnAdminTable
fnAdminTable	1.3.6.1.4.1.12356.100.1.2.100.2		not-accessible	A table of administrator accounts on the device. This table is intended to be extended with platform specific information.
fnCommon	1.3.6.1.4.1.12356.100.1
fnCoreMib	1.3.6.1.4.1.12356.100
STR fnGenTrapMsg	1.3.6.1.4.1.12356.100.1.3.1.1	DisplayString	accessible-for-notify	Generic message associated with an event. The content will depend on the nature of the trap.
fnMgmt	1.3.6.1.4.1.12356.100.1.2
fnMgmtComplianceGroup	1.3.6.1.4.1.12356.100.10.2			Objects relating the management of a device.
FNL fnMgmtLanguage	1.3.6.1.4.1.12356.100.1.2.1	FnLanguage	read-only	Language used for administration interfaces
fnMIBCompliance	1.3.6.1.4.1.12356.100.10.100			The compliance statement for the application MIB.
fnMIBConformance	1.3.6.1.4.1.12356.100.10
fnNotifObjectsComplianceGroup	1.3.6.1.4.1.12356.100.10.5			Object identifiers used in notifications
STR fnSysSerial	1.3.6.1.4.1.12356.100.1.1.1	DisplayString	read-only	Device serial number. This is the same serial number as given in the ENTITY-MIB tables for the base entity.
fnSystem	1.3.6.1.4.1.12356.100.1.1
fnSystemComplianceGroup	1.3.6.1.4.1.12356.100.10.1			Objects relating to the physical device.
NTF fnTrapAmcIfBypassMode	1.3.6.1.4.1.12356.100.1.3.0.107			An AMC interface entered bypass mode. Available on models with an AMC expansion slot. Used with the ASM-CX4 and ASM-FX2 cards.
NTF fnTrapCpuThreshold	1.3.6.1.4.1.12356.100.1.3.0.101			Indicates that the CPU usage has exceeded the configured threshold.
NTF fnTrapFanFailure	1.3.6.1.4.1.12356.100.1.3.0.108			A fan failure has been detected. Not all devices have fan sensors. See manual for specifications.
NTF fnTrapIfEnterBypassMode	1.3.6.1.4.1.12356.100.1.3.0.109			Interface entered bypass mode. Available on models with bypass ports.
NTF fnTrapIfExitBypassMode	1.3.6.1.4.1.12356.100.1.3.0.110			Interface exited bypass mode. Available on models with bypass ports.
NTF fnTrapIpChange	1.3.6.1.4.1.12356.100.1.3.0.201			Indicates that the IP address of the specified interface has been changed.
NTF fnTrapLogDiskThreshold	1.3.6.1.4.1.12356.100.1.3.0.103			Log disk usage has exceeded the configured threshold. Only available on devices with log disks.
NTF fnTrapMemThreshold	1.3.6.1.4.1.12356.100.1.3.0.102			Indicates memory usage has exceeded the configured threshold.
fnTrapObjects	1.3.6.1.4.1.12356.100.1.3.1
NTF fnTrapPowerSupply	1.3.6.1.4.1.12356.100.1.3.0.106			Power supply event (failure or restore) detected. Not available on all models. Available on some devices which support redundant power supplies. See manual for specifications.
fnTraps	1.3.6.1.4.1.12356.100.1.3
fnTrapsComplianceGroup	1.3.6.1.4.1.12356.100.10.4			Event notifications
NTF fnTrapSecurityLevelChange	1.3.6.1.4.1.12356.100.1.3.0.111			BIOS security level has been change.
fnTrapsPrefix	1.3.6.1.4.1.12356.100.1.3.0
NTF fnTrapTempHigh	1.3.6.1.4.1.12356.100.1.3.0.104			A temperature sensor on the device has exceeded its threshold. Not all devices have thermal sensors. See manual for specifications.
NTF fnTrapTest	1.3.6.1.4.1.12356.100.1.3.0.999			Trap sent for diagnostic purposes by an administrator.
NTF fnTrapVoltageOutOfRange	1.3.6.1.4.1.12356.100.1.3.0.105			Power levels have fluctuated outside of normal levels. Not all devices have voltage monitoring instrumentation. See manual for specifications.
fortinet	1.3.6.1.4.1.12356			MIB module for Fortinet network devices.

FAQ

What is FORTINET-CORE-MIB used for in a Fortinet appliance monitoring setup?
It's the shared base MIB that all Fortinet product MIBs (FortiGate, FortiWAN, etc.) import, exposing common system identification (serial number, management language), an administrator/session table, and a generic trap-message object used across the product line to carry event text. An operator uses it to confirm device identity and watch the shared trap channel through which Fortinet's product-specific MIBs report hardware and software faults.

Can I query FORTINET-CORE-MIB objects on their own, without other Fortinet MIBs loaded?
Not meaningfully — it's explicitly designed to be imported by product-specific Fortinet MIBs rather than used standalone; its trap and identity objects only become fully meaningful once the relevant product MIB, such as one for a FortiGate firewall, is compiled alongside it.

RFC description

Root enterprise registration and core MIB structure for Fortinet security appliances and firewalls.

Start monitoring Fortinet security appliance, any product line (shared base/trap MIB) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download FORTINET-CORE-MIB