Browse documentation
FortiGate firewalls
↩ Devices
A FortiGate firewall can show far more than SNMP alone allows — its rules, its zones, and its security posture. That needs a second credential, and without it the extra tabs are hidden rather than disabled, which makes their absence hard to diagnose.
What you need
A FortiGate API credential — an API token, HTTPS port, VDOM and verify-SSL option — assigned to the firewall as a rules profile, on top of its existing SNMP scanning profile. The two do different jobs and both are used.
If a firewall shows no Rules, Zones or Security tabs, it has no FortiGate API profile. Nothing on screen explains the absence, so this is the first thing to check.
What the tabs show
| Tab | Shows |
|---|---|
| Firewall rules | The policy table, including policy hit counts. |
| Zones | Configured zones and their interfaces. |
| Security | Certificates and administrative accounts on the device. |
Why hits are over seven days
The policy table's hit counter is labelled Hits 7d, not 24 hours like most counters in JOATOS. That's not an inconsistency for its own sake: FortiOS only exposes a seven-day rolling window for policy hits, so seven days is the honest label for what the number actually covers.
Use it for what it's good at — spotting rules that have never been hit, which are usually the ones worth removing.
Notes & tips
- Verified against real hardware, so if the tabs are present but empty, look at the API token's permissions and the VDOM before suspecting JOATOS.
- The API credential is separate from the SNMP one deliberately — revoking API access doesn't stop basic monitoring.