FortiGate: Troubleshooting SNMP or Device API connectivity

Use this guide when Auvik reports that SNMP is not responding, FortiGate Device API credentials fail, or a FortiGate is displayed as a generic device.

Confirm reachability from the Auvik collector

Confirm that the collector can reach the FortiGate management IP and that the required traffic is allowed:

• ICMP for basic reachability.
• TCP 443 for the FortiOS REST API.
• TCP 22 for SSH or CLI collection.
• UDP 161 for SNMP polling.
• UDP 162 only if SNMP traps are being used.

If the collector cannot reach the management IP, review routing, VLANs, VPNs, firewalls, and ACLs between the collector and the FortiGate.

Verify the FortiGate management interface

The FortiGate interface used by Auvik must allow the services required for monitoring.

Ask a FortiGate administrator to confirm that the target interface allows:

• HTTPS for Device API access.
• SSH for CLI collection.
• SNMP for SNMP polling.
• ICMP if ping-based reachability checks are being used.

If the FortiGate uses an out-of-band management interface or an in-band management VLAN, confirm that the collector has a route to that interface and that the correct IP address is configured in Auvik.

Verify SNMP configuration

Confirm that:

• SNMP is enabled on the FortiGate.
• The SNMP credential in Auvik matches the FortiGate configuration.
• The Auvik collector’s source IP is allowed to query SNMP.
• UDP port 161 is permitted between the collector and FortiGate.
• SNMP access controls are not blocking the collector.
• The correct SNMP context is configured, if one is required.
• The selected SNMP version, authentication protocol, privacy protocol, usernames, and passwords match on both sides.

For SNMPv3, verify the security level and authentication and privacy settings carefully. A mismatch in any of these values can cause timeouts or authorization failures.

For more information, see Troubleshoot SNMP credentials.

Test SNMP from the collector

Use Auvik’s available SNMP troubleshooting workflow or diagnostic tools to test the connection from the collector’s network.

A successful test should confirm that:

• The collector can reach the FortiGate.
• The configured SNMP username or community is accepted.
• Authentication and privacy settings are correct.
• The FortiGate returns standard system information.

Timeouts, authorization failures, or missing system information usually indicate a credential mismatch, interface access issue, ACL restriction, or routing problem.

Verify FortiGate Device API configuration

If Auvik uses the FortiOS REST API, confirm that:

• A REST API administrator exists on the FortiGate.
• The API administrator has the permissions required by Auvik.
• The API token is active and was copied correctly into Auvik.
• The API administrator is configured at the supported scope.
• The collector’s source IP is included in the FortiGate Trusted Hosts list, if Trusted Hosts are configured.
• HTTPS administrative access is enabled on the interface used by the collector.
• The FortiGate management IP and HTTPS port in Auvik are correct.
• TCP port 443 is reachable from the collector.
• No TLS inspection device is interfering with the connection.

A FortiGate administrator may test the API directly from the collector host or another approved management system. A successful response indicates that the token, endpoint, and network path are working.

For more information, see Troubleshooting Fortinet device API credentials.

Common API responses

• 401 Unauthorized: The token may be invalid, expired, revoked, or configured at the wrong scope.
• 403 Forbidden: The API administrator may not have sufficient permissions, or the collector may not be included in Trusted Hosts.
• 404 Not Found: The endpoint may not be available for the FortiOS version or the configured API path may be incorrect.
• TLS or certificate error: The HTTPS connection may be blocked, inspected, or incompatible with the device or client configuration.

FortiGate HA considerations

For a FortiGate HA deployment, confirm that:

• Auvik is polling the intended shared management IP or active unit.
• The active unit responds on the configured management address.
• A dedicated HA management interface is reachable from the collector, if one is configured.
• Routing and ACLs allow access to each HA management address.
• Required services are enabled on the specific interface used by Auvik.
• Both HA members are configured consistently when both units are being monitored.

If monitoring changes after a failover, confirm which management IP Auvik is using and whether the new active unit accepts SNMP, SSH, and API requests from the collector.

For more information, see Configure Fortinet HA Pairs for Monitoring in Auvik.

If the FortiGate appears as a generic device

A generic device classification may indicate that Auvik can reach the device but cannot successfully query the expected SNMP, CLI, or API information.

Check:

• SNMP credentials and authorization.
• FortiGate interface access settings.
• Collector-to-device routing and ACLs.
• SSH or API availability.
• Device API permissions and Trusted Hosts.
• Whether the FortiGate firmware and collection method are supported.

After correcting the issue, allow Auvik to update the device or run rediscovery if that option is available for the site.

FortiGate API authentication fails when header-based access is not working

Only a FortiGate administrator should make this change. Header-based authentication is preferred. Query-string authentication can expose API tokens in URLs, logs, browser history, proxy systems, and monitoring tools.

Before enabling this option:

• Confirm that the FortiGate API token is valid and active.
• Confirm that HTTPS access is enabled on the FortiGate interface used by the Auvik collector.
• Confirm that the collector IP is included in the FortiGate API administrator’s Trusted Hosts configuration, if Trusted Hosts are enabled.
• Confirm that the collector can reach the FortiGate over HTTPS.
• Verify that the FortiOS version and API configuration support the required authentication method.

If the FortiGate environment specifically requires legacy token-in-URL authentication, a FortiGate administrator can enable it globally:

config system global
    set rest-api-key-url-query enable
end

Use the query-string parameter required by the FortiOS API documentation for the endpoint being called. For example:

https://<fortigate-address>/api/v2/<resource>?access_token=<API_TOKEN>

Use this method only when header-based authentication is not supported or is being altered by an intermediary system. Do not include API tokens in support requests, screenshots, shell history, or unsecured logs.

After making the change:

1. Retest the API connection from the collector or approved management system.
2. Confirm that the FortiGate API credential test succeeds in Auvik.
3. Confirm that Auvik resumes collecting the expected device data.
4. Review FortiGate and intermediary-system logs for exposed query-string credentials.

When legacy query-string authentication is no longer required, disable it:

config system global
    set rest-api-key-url-query disable
end

If the issue continues, provide Support with the FortiOS version, API authentication method, response code, timestamp, and collector connectivity results. Do not provide the API token or other credentials.
 

Test FortiGate API connectivity with curl

A FortiGate administrator can use curl to confirm that the FortiGate API is reachable and that the API token is accepted.

Before you begin

Confirm that:

• The FortiGate management address is correct.
• The HTTPS management port is reachable from the Auvik collector.
• The API token is active and assigned to the correct administrator profile.
• HTTPS administrative access is enabled on the FortiGate interface used by the collector.

The default HTTPS management port is usually 443, but it may be different in your environment.

Test with a trusted certificate

Set the API token in an environment variable, then run:

export FGT_TOKEN='REPLACE_WITH_API_TOKEN'

curl -v \
  -H "Authorization: Bearer ${FGT_TOKEN}" \
  "https://<FGT_IP_OR_DNS>/api/v2/monitor/system/time"

Replace <FGT_IP_OR_DNS> with the FortiGate management address.

If the FortiGate uses a non-default HTTPS port, include the port:

curl -v \
  -H "Authorization: Bearer ${FGT_TOKEN}" \
  "https://<FGT_IP_OR_DNS>:8443/api/v2/monitor/system/time"

Test with a self-signed certificate

For temporary testing only, use -k to bypass certificate validation:

curl -k -v \
  -H "Authorization: Bearer ${FGT_TOKEN}" \
  "https://<FGT_IP_OR_DNS>/api/v2/monitor/system/time"

The -k option should not be used as a permanent production configuration. For production testing, use a trusted certificate or provide the appropriate certificate authority:

curl --cacert <CA_OR_CHAIN_FILE> -v \
  -H "Authorization: Bearer ${FGT_TOKEN}" \
  "https://<FGT_IP_OR_DNS>/api/v2/monitor/system/time"

Interpret the response

• HTTP 200: The FortiGate API is reachable and the token was accepted for the requested endpoint.
• Certificate error: The certificate is self-signed, untrusted, expired, or does not match the address. Use a trusted CA bundle or -k only for temporary testing.
• Connection refused or timeout: Verify the FortiGate address, HTTPS port, routing, firewall rules, and Trusted Hosts configuration.
• 401 Unauthorized: Check the API token, authentication format, token scope, and whether the token is active.
• 403 Forbidden: Check the administrator profile permissions and confirm that the collector’s source IP is authorized.
• 404 Not Found: Confirm the API path and FortiOS version. The endpoint may differ by FortiOS release.

The exact endpoint may vary by FortiOS version. If /api/v2/monitor/system/time is unavailable, use another supported read-only monitor endpoint documented for that FortiOS release.

Security considerations

• Do not include API tokens in screenshots, support requests, or shared command history.
• Clear the FGT_TOKEN environment variable after testing:

unset FGT_TOKEN

• Use read-only API requests for connectivity testing.
• Prefer trusted certificate validation in production environments.

Information to collect before contacting Support

Provide:

• FortiGate model and FortiOS version.
• Auvik site and device name.
• FortiGate management IP and configured management port.
• Collector name and source IP.
• SNMP version and credential type, without including passwords.
• API authentication method, without including the token.
• The exact Auvik error message.
• The approximate time of the failed test.
• Relevant screenshots from Auvik and the FortiGate.
• Whether the device is standalone or part of an HA cluster.
• Results of any approved connectivity or credential tests.

Do not include SNMP passwords, API tokens, private keys, or other secrets in Support requests.