Solution brief
LiveAssurance

LiveAssurance for Fortinet FortiGate

Network observability and health

Contact Us
Download as PDF
BlueCat LiveAssurance for Fortinet FortiGate solution brief cover highlighting network observability, health, and automated best practices
Key takeawaysKey takeaways are generated with AI assistance. Because automated summaries can occasionally contain errors or miss important context, always refer to the full blog post for complete information.

The article describes BlueCat LiveAssurance for Fortinet FortiGate, a proactive network observability and health solution that detects hidden firewall operational issues before they cause outages. It addresses real-world problems such as configuration drift, missed maintenance (like expired certificates or backups), high availability inconsistencies, and failures to connect to critical external services in FortiGate environments, reducing the operational burden on understaffed IT teams. By automating continuous health checks, auto-triage, root-cause analysis, and recommended remediation steps authored by certified experts, LiveAssurance optimizes security infrastructure performance and reduces mean time to resolution.

How does LiveAssurance detect and help remediate FortiGate firewall issues before they cause outages?

LiveAssurance continuously assess FortiGate devices by comparing expected configurations against current states to detect lurking issues such as conserve mode, high log disk utilization, session clashes, or missing connections to FortiAnalyzer. When it detects symptoms, its auto-triage capability gathers contextual diagnostics, analyzes root causes, and performs common troubleshooting tasks without human intervention. It then delivers a prioritized list of actionable remediation steps authored by certified Fortinet Network Security Experts so IT operations teams can quickly apply fixes, reducing mean time to resolution and preventing service degradation or outages.

What specific operational risks and maintenance tasks does LiveAssurance monitor for FortiGate environments?

LiveAssurance monitors a wide range of risks and maintenance items including stateful health indicators (memory usage, kernel session deletions, ephemeral session spikes), connectivity to external critical services (NTP, DNS, FortiManager, FortiAnalyzer, FortiGuard updates), high availability readiness (cluster sync, heartbeat links, priority settings), and configuration best-practices (routing changes, missing explicit deny rules, wildcard FQDN usage). It also automates proactive maintenance such as configuration backups, license validation, and certificate expiry warnings, ensuring these routine tasks are completed and raising alerts if failures or impending expirations are detected.

What differentiates LiveAssurance from other network monitoring and management tools?

LiveAssurance differentiates itself through four core capabilities: automation, visibility, detection, and root-cause remediation. Its automation is built from a crowdsourced community of experts and real-world device knowledge, enabling continuous, expert-driven checks. It provides deep visibility into misconfigurations, errors, and best-practice deviations specific to FortiGate, rather than generic alerts. Upon detection, LiveAssurance automates troubleshooting and root-cause analysis instead of stopping at notifications, and it uniquely delivers actionable remediation steps derived from certified experts’ experience to help IT teams resolve issues faster and prevent recurrence.

Challenge

Undetected firewall issues can expose your network to security breaches or lead to an outage. Existing monitoring tools are reactive, only notifying users of an issue after it occurs and do not provide actionable next steps.

Solution

LiveAssurance proactively alerts Fortinet FortiGate users to issues. It provides remediation steps that IT operations teams can use to resolve problems before they cause significant damage.

Benefits

  • Proactively identify issues to avoid outages
  • Optimize the performance of security infrastructure
  • Reduce mean time to resolution
  • Work more effectively

Automating best practices and operational device issue detection in your security infrastructure

Without automation, IT operations teams would spend countless hours gathering diagnostics and device data to keep firewalls up and running. IT teams that manage firewalls often have limited resources, resulting in an even greater need for automated diagnostics and issue detection. The typical security engineer spends a notable portion of their time identifying and remediating known errors.

IT operations teams can avoid costly outages if they receive advance notice about common issues that can lead to bigger problems. These issues might include hidden configuration drift, forgotten ongoing maintenance tasks, or a lack of adherence to vendor, industry, and/or high availability best practices.

This solution brief presents how BlueCat LiveAssurance automates detection of operational device issues, which are often hidden, in your security infrastructure. It provides specific examples from a variety of use cases for Fortinet FortiGate customers to simplify Day 2 operations, adhere to best practices, and ensure maximum reliability. It also covers key differentiators from other solutions and primary solution benefits.

Solution overview

LiveAssurance avoids network disruption with automation. Think of it as a virtual expert that can expand team skills and is on duty 24/7.

LiveAssurance provides deep visibility into your security infrastructure to flag early warning signs of issues. With our domain expertise codified into LiveAssurance, the platform knows what to look for, analyzing your firewalls to ensure they are healthy.

Should it find something, the platform proactively alerts IT operations teams that a service failure—or any level of degradation of service—might be coming. Our auto-triage capability will investigate a problem without any human intervention. It gathers additional contextual diagnostic information, analyzes, and performs common troubleshooting tasks and root cause analysis.

Then, LiveAssurance provides a list of recommended remediation steps that IT operations teams can use as a guide to help address the problem. IT operations teams gain firewall-specific knowledge from issue descriptions and recommended remediations built from the real-world experience of certified security experts.

Effectively, we’ve automated best practices to help you improve the efficiency of your security operations, reduce mean time to resolution, and prevent costly disruptions.

Solution overview

Use cases

For Fortinet FortiGate customers, moving beyond the reactive mindset when things go awry is within reach. In this section, we outline six scenarios that you might encounter, with specific real-world examples of detected issues. Each explores how LiveAssurance can help ensure your security infrastructure works as intended. Once issues are detected, LiveAssurance provides actionable information to help IT operations teams address them. They can troubleshoot issues by following remediation steps authored by certified Fortinet Network Security Experts.

Use case 1: Stateful health checking

LiveAssurance continuously assesses the health of Fortinet FortiGate firewalls by comparing expected device configurations against the current status. The goal is to find and address lurking issues before they impact services.

Sample common issues detected, based on real experience, include:

  • Firewall enters conserve mode, with an analysis of memory consumption by process
  • Crashlog entries have been logged
  • Log disk utilization is high
  • Firewall not connected to FortiAnalyzer
  • Top active file descriptors, socket memory, and memory processes
  • Session clash
  • Kernel sessions are deleted due to lack of memory or resources
  • Sessions have been dropped due to maximum limit
  • High number of ephemeral sessions, which can be an indication of denial-of-service attacks
  • Memory logging is enabled
  • Session clash counter increase

Use case 2: External critical services

Firewalls depend on many external services in near real-time. It is important to monitor the connection to these critical services. LiveAssurance’s automation features ensure, through regular testing, that communication with these external services is always available.

Critical services that a firewall requires include:

  • Clock synchronization with an NTP server
  • Access to DNS for name resolution
  • Access to FortiManager for firewall policies
  • Forwarding syslog to FortiAnalyzer for auditing, compliance, incident response

To equip firewalls with the latest preventative threat intelligence, firewalls frequently get dynamic content updates from FortiGuard. Timely updates are key to protecting your networks before threats become widespread. LiveAssurance ensures frequent updates of intrusion prevention system (IPS) signatures and antivirus databases to minimize exposure to zero-day attacks.

Use case 3: Ensure high availability

You invested in deploying redundant infrastructure to ensure always-on services and prevent a single point of failure on your network. Unfortunately, despite the investment, failovers do not always go smoothly. LiveAssurance constantly detects high availability unreadiness from cross-device inconsistencies in security policies, forwarding tables, and other configurations and states.

Examples of high availability readiness issues that LiveAssurance might detect and provide alerts for include:

  • One or more firewalls in a firewall cluster experiences problems
  • Firewall cluster configuration synchronization issues, including checks for sync status, debug zone, and configuration file checksum
  • Cluster heartbeat interface problems by tracking link status and bandwidth utilization
  • Status of critical high availability monitor links
  • The number of operational heartbeat links are less than the two recommended high availability links (no redundancy)
  • High availability heartbeat interfaces do not have different priorities

Use case 4: Misconfigurations and best practice validation

Device misconfiguration is a major cause of unplanned downtime. Configuration errors can create security gaps in your network, making it vulnerable to cyberattacks. LiveAssurance continuously detects misconfiguration by verifying against gold standard for your network. It continuously assesses devices for alignment with configuration recommendations from Fortinet and seasoned practitioners.

Misconfiguration issues that LiveAssurance might detect and provide notifications for include:

  • Static routing table has changed
  • DNS or NTP servers configured do not match requirement
  • IPv4 Denial of Service policy L3 or L4 is not configured
  • Firewall does not have an explicit deny rule to log unauthorized traffic (violation traffic)
  • Wildcard FQDNs are used in firewall rules
  • Disk logging enabled, potentially causing performance degradation
  • Fortinet uninterruptible upgrade is disabled
  • NTP sync status critical for logging analysis and troubleshooting

Use cases 5: Proactive maintenance notifications

Maintaining availability requires ongoing maintenance. Tasks like device configuration backup are important to ensure your security infrastructure is safe from failure and disruption. LiveAssurance automates device configuration backup and proactively notifies you if the backup fails.

One of the most easily forgotten maintenance tasks is certificate renewal. Your firewalls use certificates for a variety of purposes. Valid certificates are needed for inbound SSL inspection, user authentication, and IPSec site-to-site VPN. Not having a valid certificate will likely impact services.

LiveAssurance provides warnings in advance if certificates are about to expire, giving you ample time to act. LiveAssurance also checks for valid licenses to ensure software license compliance. An expired license can potentially cause a service outage to security profiles such as web filters. Automating these maintenance activities helps maintain the health and performance of your firewalls.

Use case 6: Validate change requests

In both staging and production environments, change requests are an unavoidable part of transformation initiatives for security infrastructure. While change requests are necessary, they can also bring significant challenges and risks if executed incorrectly. Recognizing the warning signs that patches or upgrades were not successfully applied is a manual and time-consuming process, which can prolong business disruption.

With LiveAssurance, Manifest helps simplify change management across IT environments by validating that security infrastructure is back to its normal state after applying updates. IT operations teams can schedule automated snapshots

of firewall states and configurations before and after requested updates to confirm services are back up and running.

Key differentiators

There are four major differences between LiveAssurance and other network monitoring and management solutions.

Our community of experts developed LiveAssurance’s automation elements. By bringing expertise from our community, security vendors, and Fortune 1,000 customers, we can gather the most relevant and important device knowledge. Crowdsourcing brings together ideas and expertise that would not otherwise be available.

When deploying LiveAssurance in a security environment, customers immediately receive notifications about misconfigurations, errors, security risks, vulnerabilities, and lack of adherence to best practices. Because LiveAssurance knows what to look for, it can continually and preemptively identify issues to avoid bigger problems. Other network monitoring solutions lack specific, codified domain expertise.

When it detects the symptoms of various potential problems, LiveAssurance automates the troubleshooting process to determine root causes. Other network monitoring and management solutions provide alerts but stop there. It’s left to IT operations teams to conduct troubleshooting and root cause analysis themselves. Automated detection and analysis of issues can prevent them from recurring and reduce downtime.

Once root causes have been determined, LiveAssurance goes further than other monitoring solutions by providing a list of actionable remediation steps that IT operations teams can take. IT operations teams gain specific knowledge from issue descriptions and recommended remediations compiled from experts’ real-world experience. These specific, actionable insights also reduce troubleshooting time.

Solution benefits

IT operations teams enjoy several benefits when using LiveAssurance as a solution for hidden issue detection and recommended remediation. They include:

Avoid downtime

Proactively identify misconfigurations, high availability inconsistencies, forgotten maintenance tasks, and other best practices to avoid outages.

Optimize the performance of your security infrastructure

Automation streamlines IT operations, allowing IT teams to deliver optimal security services to your organization.

Reduce mean time to resolution

Accelerate troubleshooting by conducting automated root cause analysis without human intervention.

Work more efficiently

LiveAssurance surfaces useful and actionable information that immediately facilitates your IT operations team’s work.

Next steps

Discover how LiveAssurance For Fortinet Fortigate Solution Brief can transform your network operations.

Contact us

BlueCat’s Intelligent Network Operations (NetOps)

BlueCat’s Intelligent NetOps solutions provide the analytics and intelligence needed to enable, optimize, and secure the network to achieve business goals. With an Intelligent NetOps suite, organizations can more easily change and modernize the network as business requirements demand.

Discover the Intelligent Network
Isometric blue UI tiles showing gear, shield, chip, and magnifying glass icons on a grid background

📣  Now live: Explore BlueCat Horizon, our SaaS-first Intelligent NetOps platform.

Explore Horizon