How to Enable SNMP on a FortiGate for Auvik (HA-Safe Guide)

This guide provides safe, simplified steps to enable SNMP on a FortiGate for monitoring with Auvik. It includes specific guidance for High Availability (HA) environments to help avoid accidental loss of access.

Configure SNMPv3 for Auvik

If SNMPv3 is enabled on the FortiGate, create an SNMPv3 user with authentication and privacy settings that Auvik can use.

In Auvik, add an SNMPv3 credential for the site and enter the values that match the FortiGate:

• Username
• Authentication protocol and password
• Privacy protocol and password
• Context, if one is configured

The SNMPv3 username, authentication settings, privacy settings, and context must match on both the FortiGate and Auvik. For troubleshooting SNMPv3 authorization errors, see Troubleshoot SNMP credentials.

Confirm that the collector can reach the FortiGate over UDP port 161. UDP port 162 is only required if SNMP traps are being used.

After configuring the credential, allow time for polling to resume or run a manual rediscovery if available in your account.

SNMP and the FortiGate Device API

Keep SNMP enabled even when the FortiGate Device API is configured successfully. Auvik uses SNMP for core inventory and monitoring, while the FortiGate Device API provides additional information and collection capabilities. The Device API does not replace SNMP for standard monitoring.

⚠️ Before You Begin

FortiGate HA deployments can use either standard data interfaces or a dedicated HA management interface.

Do not change the IP address of any management interface unless you are certain how HA is configured. This can result in immediate loss of access.

Step 1 — Identify Your Setup

Run the following command:

get system ha status

• If you see HA Management Interface: enabled → Go to Scenario B
• If not → Use Scenario A

Scenario A — Standard Setup (Recommended)

Most environments do not use a dedicated HA management interface.

What to do

1. Enable SNMP on the interface Auvik will use:

config system interface
edit <interface-used-by-auvik>
set allowaccess ping snmp https ssh
next
end

2. Configure the SNMP community:

config system snmp community
edit 1
set name <community-string>
config hosts
edit 1
set ip <auvik-collector-ip> 255.255.255.255
next
end
end

Result

• Auvik polls the firewall using the primary (cluster) IP
• No HA-specific configuration is required

Scenario B — HA Management Interface Enabled

This setup allows each HA unit to have its own management IP.

Use this only if:

• You need to monitor each HA unit individually
• The Auvik collector can reach those management IPs

If not, return to Scenario A.

Important Notes

• Do not change interface IPs in this process
• HA management IPs are configured separately from normal interfaces

What to do

1. Enable SNMP access on the HA management interface:

config system interface
edit <ha-mgmt-interface>
set allowaccess ping snmp https ssh
next
end

config system snmp community
edit 1
set name <community-string>
config hosts
edit 1
set ip <auvik-collector-ip> 255.255.255.255
next
end
end

Result

• Auvik can poll individual HA units
• Additional routing or access configuration may be required

Recommended Approach

For most deployments, use Scenario A (standard setup).

This approach:

• Minimizes risk
• Requires less configuration
• Avoids HA-specific complexity

Troubleshooting

SNMP not responding:

• Confirm SNMP is allowed on the correct interface
• Verify the collector IP is permitted
• Test connectivity with:

ping <fortigate-ip>

Lost access after changes:

• Try connecting via a different interface
• Use console access if needed to restore previous settings

Configure Auvik after enabling SNMP

After configuring SNMP on the FortiGate:

1. Add the matching SNMP credential in Auvik at the site level.
2. Confirm the credential includes the correct community string or SNMPv3 username, authentication method, privacy method, and keys.
3. Confirm the Auvik collector can reach the FortiGate management interface over UDP 161.
4. Run a rescan or retry the SNMP credential.
5. Confirm that the FortiGate is managed and SNMP polling succeeds.

The FortiGate’s interface access rules, firewall policies, and SNMP access lists must allow the collector’s source IP. If SSH or HTTPS is also used for monitoring or management, allow the corresponding ports as required by the configured services.

Optional: Forward FortiGate syslog to Auvik

Syslog is optional and provides event and log data in addition to SNMP monitoring.

To configure syslog forwarding, see How to configure syslog on Fortinet FortiGate firewalls.

Use the Auvik collector’s IP address as the syslog destination and confirm that the configured syslog port and protocol are allowed between the FortiGate and collector. The default syslog port is UDP 514 unless another supported configuration is being used.

After configuring syslog, confirm that events appear in Auvik’s logging view.

Summary

If you’re unsure which setup applies, use the standard configuration or contact your network administrator before proceeding.

For more information: https://kb.fortinet.com/kb/documentLink.do?externalID=FD34731