@@ -11,6 +11,7 @@ Prometheus exporter for FortiGate® firewalls.
1111
1212 * [ Supported Metrics] ( #supported-metrics )
1313 * [ Usage] ( #usage )
14+ + [ Dynamic configuration] ( #dynamic-configuration )
1415 + [ Available CLI parameters] ( #available-cli-parameters )
1516 + [ Fortigate Configuration] ( #fortigate-configuration )
1617 + [ Prometheus Configuration] ( #prometheus-configuration )
@@ -245,6 +246,37 @@ Per-VDOM, managed access point and interface:
245246 * ` fortigate_wifi_managed_ap_interface_rx_dropped_packets_total `
246247 * ` fortigate_wifi_managed_ap_interface_tx_dropped_packets_total `
247248
249+ Per-VDOM, managed switch and interface:
250+ * _ Switch/ManagedSwitch_
251+ * ` fortigate_managed_switch_collisions_total `
252+ * ` fortigate_managed_switch_crc_alignments_total `
253+ * ` fortigate_managed_switch_fragments_total `
254+ * ` fortigate_managed_switch_info `
255+ * ` fortigate_managed_switch_jabbers_total `
256+ * ` fortigate_managed_switch_l3_packets_total `
257+ * ` fortigate_managed_switch_max_poe_budget_watt `
258+ * ` fortigate_managed_switch_port_info `
259+ * ` fortigate_managed_switch_port_power_status `
260+ * ` fortigate_managed_switch_port_power_watt `
261+ * ` fortigate_managed_switch_port_status `
262+ * ` fortigate_managed_switch_rx_bcast_packets_total `
263+ * ` fortigate_managed_switch_rx_bytes_total `
264+ * ` fortigate_managed_switch_rx_drops_total `
265+ * ` fortigate_managed_switch_rx_errors_total `
266+ * ` fortigate_managed_switch_rx_mcast_packets_total `
267+ * ` fortigate_managed_switch_rx_oversize_total `
268+ * ` fortigate_managed_switch_rx_packets_total `
269+ * ` fortigate_managed_switch_rx_ucast_packets_total `
270+ * ` fortigate_managed_switch_tx_bcast_packets_total `
271+ * ` fortigate_managed_switch_tx_bytes_total `
272+ * ` fortigate_managed_switch_tx_drops_total `
273+ * ` fortigate_managed_switch_tx_errors_total `
274+ * ` fortigate_managed_switch_tx_mcast_packets_total `
275+ * ` fortigate_managed_switch_tx_oversize_total `
276+ * ` fortigate_managed_switch_tx_packets_total `
277+ * ` fortigate_managed_switch_tx_ucast_packets_total `
278+ * ` fortigate_managed_switch_under_size_total `
279+
248280## Usage
249281
250282Example:
@@ -323,6 +355,39 @@ Special cases:
323355
324356To probe a FortiGate, do something like ` curl 'localhost:9710/probe?target=https://my-fortigate' `
325357
358+ ### Dynamic configuration
359+ In use cases where the Fortigates that is to be scraped through the fortigate-exporter is configured in
360+ Prometheus using some discovery method it becomes problematic that the ` fortigate-key.yaml ` configuration also
361+ has to be updated for each fortigate, and that the fortigate-exporter needs to be restarted on each change.
362+ For that scenario the token can be passed as a query parameter, ` token ` , to the fortigate.
363+
364+ Example:
365+ ``` bash
366+ curl ' localhost:9710/probe?target=https://192.168.2.31&token=ghi6eItWzWewgbrFMsazvBVwDjZzzb'
367+ ```
368+ It is also possible to pass a ` profile ` query parameter. The value will match an entry in the ` fortigate-key.yaml `
369+ file, but only to use the ` probes ` section for include/exclude directives.
370+
371+ Example:
372+ ``` bash
373+ curl ' localhost:9710/probe?target=https://192.168.2.31&token=ghi6eItWzWewgbrFMsazvBVwDjZzzb&profile=fs124e'
374+ ```
375+ The ` profile=fs124e ` would match the following entry in ` fortigate-key.yaml ` .
376+
377+ Example:
378+ ``` yaml
379+ fs124e :
380+ # token: not used
381+ probes :
382+ include :
383+ - System
384+ - Firewall
385+ exclude :
386+ - System/LinkMonitor
387+ ` ` `
388+
389+
390+
326391### Available CLI parameters
327392
328393| flag | default value | description |
@@ -374,7 +439,7 @@ To improve security, limit permissions to required ones only (least privilege pr
374439|Wifi/APStatus | wifi |api/v2/monitor/wifi/ap_status |
375440|Wifi/Clients | wifi |api/v2/monitor/wifi/client |
376441|Wifi/ManagedAP | wifi |api/v2/monitor/wifi/managed_ap |
377-
442+ |Switch/ManagedSwitch | switch |api/v2/monitor/switch-controller/managed-switch|
378443If you omit to grant some of these permissions you will receive log messages warning about
379444403 errors and relevant metrics will be unavailable, but other metrics will still work.
380445If you do not need some probes to be run, do not grant permission for them and use ` include/exclude` feature (see `Usage` section).
@@ -438,6 +503,40 @@ An example configuration for Prometheus looks something like this:
438503 replacement: '[::1]:9710'
439504```
440505
506+ If using [ Dynamic configuration] ( #dynamic-configuration ) :
507+ ``` yaml
508+ - job_name : ' fortigate_exporter'
509+ metrics_path : /probe
510+ file_sd_configs :
511+ - files :
512+ - /etc/prometheus/file_sd/fws/*.yml
513+ params :
514+ profile :
515+ - fs124e
516+ relabel_configs :
517+ - source_labels : [__address__]
518+ target_label : __param_target
519+ - source_labels : [token]
520+ target_label : __param_token
521+ - source_labels : [__param_target]
522+ regex : ' (?:.+)(?::\/\/)([^:]*).*'
523+ target_label : instance
524+ - target_label : __address__
525+ replacement : ' [::1]:9710'
526+ - action : labeldrop
527+ regex : token
528+ ` ` `
529+ > Make sure to use the last labeldrop on the ` token` label so that the tokens is not be part of your time series.
530+
531+ > Since `token` is a label it will be shown in the Prometheus webgui at `http://<your prometheus>:9090/targets`.
532+ >
533+ > **Make sure you protect your Prometheus if you add the token part of your prometheus config**
534+ >
535+ > Some options to protect Prometheus:
536+ > - Only expose UI to localhost --web.listen-address="127.0.0.1:9090"
537+ > - Basic authentication access - https://prometheus.io/docs/guides/basic-auth/
538+ > - **It is your responsibility!**
539+
441540# ## Docker
442541
443542You can either use the automatic builds on
0 commit comments