FORTINET-FORTIAUTHENTICATOR-MIB

All MIBs › FORTINET-FORTIAUTHENTICATOR-MIB

Organization: Fortinet Technologies, Inc.

Last Updated: 2020--0-4-

Category: Domain: Security, Vendor: Fortinet

Description: Fortinet FortiAuthenticator MIB providing SNMP management objects for centralized authentication, certificate management, and two-factor auth services.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is FORTINET-FORTIAUTHENTICATOR-MIB?

FORTINET-FORTIAUTHENTICATOR-MIB is a Fortinet enterprise MIB for the FortiAuthenticator appliance, which provides centralized authentication services including RADIUS/LDAP proxying, certificate management, and two-factor (FortiToken) authentication. It exposes system identity data (model, serial number, software version), resource utilization metrics, high-availability status, and authentication service capacity counters such as user and group counts and licensed token counts. It is explicitly useful for monitoring hardware/software status: facSysCpuUsage and facSysMemUsage track CPU and memory load, facSysLogDiskUsage tracks disk space consumption by logs, facSysVersion tracks firmware version, and facHaCurrentStatus reports HA cluster health/failover state. It depends on the standard Fortinet enterprise MIB conventions shared across FortiGate/FortiWeb sibling products but is otherwise self-contained. It is typically deployed in enterprise or service-provider identity/authentication infrastructure alongside FortiGate firewalls doing 802.1X or VPN authentication. Engineers can download the FORTINET-FORTIAUTHENTICATOR-MIB file directly to load it into their MIB browser.

IPNetwork Monitor allows you to monitor SNMP objects defined in FORTINET-FORTIAUTHENTICATOR-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

Fortinet FortiAuthenticator appliance

Monitoring Examples

An administrator polling facSysCpuUsage and facSysMemUsage can detect resource exhaustion on a FortiAuthenticator handling a surge of RADIUS authentication requests, while facSysLogDiskUsage nearing capacity warns of an impending log-storage failure. facAuthUserCount versus facAuthUsersRemaining and facFortiTokenCount reveal how close the appliance is to its licensed user or token limits. facHaCurrentStatus would be checked to confirm the active/standby role of each node in an HA pair, and a change in that value signals an unplanned failover event.

What Can Be Monitored

CPU usage
memory usage
log disk usage
HA status
authenticated user/group counts
FortiToken license count

Imported Objects

From FORTINET-CORE-MIB

FnIndex
fnGenTrapMsg	OBJECT-TYPE
fortinet	MODULE-IDENTITY

From SNMPv2-CONF

MODULE-COMPLIANCE
NOTIFICATION-GROUP
OBJECT-GROUP

From SNMPv2-MIB

sysName

OBJECT-TYPE

From SNMPv2-SMI

Gauge32
MODULE-IDENTITY
NOTIFICATION-TYPE
OBJECT-TYPE

From SNMPv2-TC

DisplayString
TEXTUAL-CONVENTION

How to Use in IPNetwork Monitor

Example using facSysCpuUsage OID:

Select a Fortinet FortiAuthenticator appliance (centralized AAA/2FA) as the target host to create a monitor — the SNMP service should be up and running on it. Click New Monitor, then check SNMP Custom on the Favorites tab, click Next, and confirm the host. On the next page, click Select... to open the built-in SNMP MIB Browser and type facSysCpuUsage into the Find box to locate it in the OID tree, then select it and click OK. Instantaneous CPU usage. On the monitor's Main parameters page you can set the target's SNMP port (default 161), credentials, polling interval, and other settings — see the SNMP Monitor help for details. On the State conditions and Alerting tabs, configure when the monitor should change state and trigger an alert; since this is a Gauge32-type OID, Value bounds is the most useful condition here — trigger an alert if utilization exceeds 85%, a common warning threshold before sustained high load affects performance. Click Finish to create the monitor; you can adjust any parameter later.

OIDs

OID symbolic	OID numeric	Type	Access	Description
fnFortiAuthenticatorMib	1.3.6.1.4.1.12356.113			MIB module for Fortinet FortiAuthenticator devices
facTraps	1.3.6.1.4.1.12356.113.0
NTF facTrapAuthUsersThreshold	1.3.6.1.4.1.12356.113.0.100			The user table is nearly full.
NTF facTrapAuthGroupThreshold	1.3.6.1.4.1.12356.113.0.101			The user group table is nearly full.
NTF facTrapRadiusNasThreshold	1.3.6.1.4.1.12356.113.0.102			The Radius NAS table is nearly full.
NTF facTrapAuthEventsThreshold	1.3.6.1.4.1.12356.113.0.103			The Authentication request rate has exceded the configured threshhold.
NTF facTrapAuthFailureThreshold	1.3.6.1.4.1.12356.113.0.104			The Authentication failure rate has exceded the configured threshhold.
NTF facTrapUserLockout	1.3.6.1.4.1.12356.113.0.105			A user has been locked out for repeated login failures.
NTF facTrapHAStatusChange	1.3.6.1.4.1.12356.113.0.106			The FAC device's HA status has changed.
NTF facTrapHASyncActivityLow	1.3.6.1.4.1.12356.113.0.107			There has been low HA sync activity recently.
NTF facTrapRaidStatusChange	1.3.6.1.4.1.12356.113.0.108			The FAC device's RAID status has changed.
facSystem	1.3.6.1.4.1.12356.113.1
STR facSysModel	1.3.6.1.4.1.12356.113.1.1	DisplayString	read-only	System model string
STR facSysSerial	1.3.6.1.4.1.12356.113.1.2	DisplayString	read-only	Device serial number
STR facSysVersion	1.3.6.1.4.1.12356.113.1.3	DisplayString	read-only	Device firmware version
G32 facSysCpuUsageEx	1.3.6.1.4.1.12356.113.1.4	Gauge32	read-only	Instantaneous CPU usage
G32 facSysMemUsage	1.3.6.1.4.1.12356.113.1.5	Gauge32	read-only	Instantaneous memory utilization
G32 facSysLogDiskUsage	1.3.6.1.4.1.12356.113.1.6	Gauge32	read-only	Instantaneous log disk usage
facHa	1.3.6.1.4.1.12356.113.1.201
FAC facHaCurrentStatus	1.3.6.1.4.1.12356.113.1.201.1	FacHaState	read-only	Instantaneous HA status for this node
facAuth	1.3.6.1.4.1.12356.113.1.202
FNI facAuthUserCount	1.3.6.1.4.1.12356.113.1.202.1	FnIndex	read-only	Number of local users
FNI facAuthGroupCount	1.3.6.1.4.1.12356.113.1.202.2	FnIndex	read-only	Number of user groups
FNI facFortiTokenCount	1.3.6.1.4.1.12356.113.1.202.3	FnIndex	read-only	Number of FortiTokens
FNI facAuthUsersRemaining	1.3.6.1.4.1.12356.113.1.202.4	FnIndex	read-only	Number of local users that can still be added before reaching the table limit
FNI facAuthGroupRemaining	1.3.6.1.4.1.12356.113.1.202.5	FnIndex	read-only	Number of user groups that can still be added before reaching the table limit
FNI facFortiTokenRemaining	1.3.6.1.4.1.12356.113.1.202.6	FnIndex	read-only	Number of FortiTokens that can still be added before reaching the table limit
FNI facRadiusNasCount	1.3.6.1.4.1.12356.113.1.202.7	FnIndex	read-only	Number of Radius NAS
FNI facRadiusNasRemaining	1.3.6.1.4.1.12356.113.1.202.8	FnIndex	read-only	Number of Radius NAS that can still be added before reaching the table limit
FNI facUserCertificateCount	1.3.6.1.4.1.12356.113.1.202.9	FnIndex	read-only	Number of user certificates
FNI facRadiusLoginsTotal	1.3.6.1.4.1.12356.113.1.202.10	FnIndex	read-only	Number of Radius logins since startup
FNI facRadiusLogins5Mins	1.3.6.1.4.1.12356.113.1.202.11	FnIndex	read-only	Number of Radius logins in the last 5 minutes
FNI facRadiusFailuresTotal	1.3.6.1.4.1.12356.113.1.202.12	FnIndex	read-only	Number of Radius login failures since startup
FNI facRadiusFailures5Mins	1.3.6.1.4.1.12356.113.1.202.13	FnIndex	read-only	Number of Radius login failures in the last 5 minutes
FNI facRadiusAccountingTotal	1.3.6.1.4.1.12356.113.1.202.14	FnIndex	read-only	Number of Radius accounting records since startup
FNI facRadiusAccounting5Mins	1.3.6.1.4.1.12356.113.1.202.15	FnIndex	read-only	Number of Radius accounting records in the last 5 minutes
FNI facLdapLoginsTotal	1.3.6.1.4.1.12356.113.1.202.16	FnIndex	read-only	Number of Ldap logins since startup
FNI facLdapLogins5Mins	1.3.6.1.4.1.12356.113.1.202.17	FnIndex	read-only	Number of Ldap logins in the last 5 minutes
FNI facLdapFailuresTotal	1.3.6.1.4.1.12356.113.1.202.18	FnIndex	read-only	Number of Ldap login failures since startup
FNI facLdapFailures5Mins	1.3.6.1.4.1.12356.113.1.202.19	FnIndex	read-only	Number of Ldap login failures in the last 5 minutes
FNI facAuthEventsTotal	1.3.6.1.4.1.12356.113.1.202.20	FnIndex	read-only	Number of authentication events since startup
FNI facAuthEvents5Mins	1.3.6.1.4.1.12356.113.1.202.21	FnIndex	read-only	Number of authentication events in the last 5 minutes
FNI facAuthFailuresTotal	1.3.6.1.4.1.12356.113.1.202.22	FnIndex	read-only	Number of authentication failures since startup
FNI facAuthFailures5Mins	1.3.6.1.4.1.12356.113.1.202.23	FnIndex	read-only	Number of authentication failures in the last 5 minutes
FNI facRadiusProxyInTotal	1.3.6.1.4.1.12356.113.1.202.24	FnIndex	read-only	Number of Radius accounting proxy requests received since startup
FNI facRadiusProxyOutTotal	1.3.6.1.4.1.12356.113.1.202.25	FnIndex	read-only	Number of Radius accounting proxy requests sent since startup
FNI facFssoUserCount	1.3.6.1.4.1.12356.113.1.202.26	FnIndex	read-only	Number of signed-in fsso users
FNI facFssoUserRemaining	1.3.6.1.4.1.12356.113.1.202.27	FnIndex	read-only	Number of fsso users can still signed in before reaching the table limit
INT facRaidStatus	1.3.6.1.4.1.12356.113.1.202.28	INTEGER	read-only	RAID status
facModel	1.3.6.1.4.1.12356.113.100
facvm	1.3.6.1.4.1.12356.113.100.101
facvmhv	1.3.6.1.4.1.12356.113.100.102
facvmxen	1.3.6.1.4.1.12356.113.100.103
facvmkvm	1.3.6.1.4.1.12356.113.100.104
facdocker	1.3.6.1.4.1.12356.113.100.105
fac2hd	1.3.6.1.4.1.12356.113.100.204
fac2he	1.3.6.1.4.1.12356.113.100.205
fac4hc	1.3.6.1.4.1.12356.113.100.303
fac4he	1.3.6.1.4.1.12356.113.100.305
fac1kc	1.3.6.1.4.1.12356.113.100.403
fac1kd	1.3.6.1.4.1.12356.113.100.404
fac2ke	1.3.6.1.4.1.12356.113.100.505
fac3kd	1.3.6.1.4.1.12356.113.100.604
fac3ke	1.3.6.1.4.1.12356.113.100.605
fac3hf	1.3.6.1.4.1.12356.113.100.706
fac8hf	1.3.6.1.4.1.12356.113.100.806
facMIBConformance	1.3.6.1.4.1.12356.113.600
facSystemConformanceGroup	1.3.6.1.4.1.12356.113.600.1			Basic FortiAuthenticator system information
facTrapsConformanceGroup	1.3.6.1.4.1.12356.113.600.2			Event notifications.
facMIBCompliance	1.3.6.1.4.1.12356.113.600.100			Compliance statement for FortiAuthenticator MIB

RFC description

MIB for Fortinet FortiAuthenticator authentication appliances including FSSO, RADIUS proxy, and high availability monitoring.

Start monitoring Fortinet FortiAuthenticator appliance (centralized AAA/2FA) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download FORTINET-FORTIAUTHENTICATOR-MIB