├── .gitignore ├── static ├── .DS_Store ├── ha_screen_01.png ├── ha_screen_02.png └── active_vpn_tunnels.png ├── tests ├── tf │ ├── provider.tf │ ├── variables.tf │ ├── network.tf │ ├── compute.tf │ └── user-data.sh └── test_coverage.py ├── mibs ├── README.md ├── FORTINET-CORE-MIB.mib ├── FORTINET-FORTIMANAGER-FORTIANALYZER-MIB.mib └── FORTINET-FORTIAP-MIB.mib └── README.md /.gitignore: -------------------------------------------------------------------------------- 1 | tmp 2 | .DS_Store 3 | Pipfile* 4 | .terraform 5 | .terraform.lock* -------------------------------------------------------------------------------- /static/.DS_Store: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/mbdraks/fortinet-zabbix/HEAD/static/.DS_Store -------------------------------------------------------------------------------- /static/ha_screen_01.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/mbdraks/fortinet-zabbix/HEAD/static/ha_screen_01.png -------------------------------------------------------------------------------- /static/ha_screen_02.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/mbdraks/fortinet-zabbix/HEAD/static/ha_screen_02.png -------------------------------------------------------------------------------- /static/active_vpn_tunnels.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/mbdraks/fortinet-zabbix/HEAD/static/active_vpn_tunnels.png -------------------------------------------------------------------------------- /tests/tf/provider.tf: -------------------------------------------------------------------------------- 1 | terraform { 2 | required_version = ">= 0.13" 3 | required_providers { 4 | aws = { 5 | source = "hashicorp/aws" 6 | version = "~> 2.7.0" 7 | } 8 | } 9 | } 10 | 11 | provider "aws" { 12 | region = var.region 13 | } 14 | 15 | terraform { 16 | backend "s3" { 17 | bucket = "zabbix-mb" 18 | key = "terraform.tfstate" 19 | region = "us-east-1" 20 | } 21 | } 22 | -------------------------------------------------------------------------------- /mibs/README.md: -------------------------------------------------------------------------------- 1 | # MIBs 2 | 3 | | MIB | Version | Build | 4 | |-----------------------------------------|---------------|-------| 5 | | FORTINET-CORE-MIB | 6.4.0 | b1579 | 6 | | FORTINET-FORTIGATE-MIB | 6.4.0 | b1579 | 7 | | FORTINET-FORTIMANAGER-FORTIANALYZER-MIB | 6.4.0 | b2002 | 8 | | FORTINET-FORTIAP-MIB | 6.4.0 interim | b0416 | 9 | 10 | 17 | -------------------------------------------------------------------------------- /tests/tf/variables.tf: -------------------------------------------------------------------------------- 1 | variable "region" { 2 | type = string 3 | default = "us-east-1" 4 | } 5 | 6 | variable "ec2_image_id" { 7 | type = string 8 | # Ubuntu 18.04 LTS amd64 bionic | us-east-1 9 | default = "ami-007e8beb808004fdc" 10 | } 11 | 12 | variable "ec2_key_name" { 13 | type = string 14 | default = "draks@loki.local" 15 | } 16 | 17 | variable "ec2_key_filename" { 18 | type = string 19 | default = "~/.ssh/id_rsa.pub" 20 | } 21 | 22 | variable "my_ip_addresses" { 23 | description = "My allowed IP addresses" 24 | type = list(string) 25 | default = ["0.0.0.0/0"] # example: 198.51.1.1/32 26 | } 27 | 28 | variable "zabbix_access_allowed_ip_addresses" { 29 | description = "The IP addressess that are allowed to access my Zabbix service interface" 30 | type = list(string) 31 | default = ["0.0.0.0/0"] # example: 0.0.0.0/0 32 | } 33 | 34 | variable "zabbix_service_allowed_ip_addresses" { 35 | description = "The IP addressess that are allowed to send data to my Zabbix service" 36 | type = list(string) 37 | default = ["0.0.0.0/0"] # example: 0.0.0.0/0 38 | } 39 | -------------------------------------------------------------------------------- /tests/tf/network.tf: -------------------------------------------------------------------------------- 1 | # Create a VPC 2 | resource "aws_vpc" "vpc" { 3 | cidr_block = "10.215.0.0/24" 4 | enable_dns_support = true 5 | enable_dns_hostnames = true 6 | 7 | tags = { 8 | Name = "My-Zabbix-VPC" 9 | } 10 | } 11 | 12 | # Create an Internet Gateway 13 | resource "aws_internet_gateway" "igw" { 14 | vpc_id = aws_vpc.vpc.id 15 | 16 | tags = { 17 | Name = "My-Zabbix-VPC-IGW" 18 | } 19 | } 20 | 21 | # Create subnets 22 | # az1 23 | resource "aws_subnet" "public-subnet-1" { 24 | vpc_id = aws_vpc.vpc.id 25 | cidr_block = "10.215.0.0/27" 26 | map_public_ip_on_launch = true 27 | availability_zone = "${var.region}a" 28 | 29 | tags = { 30 | Name = "Zabbix-Public-Subnet-1" 31 | } 32 | } 33 | resource "aws_subnet" "private-subnet-1" { 34 | vpc_id = aws_vpc.vpc.id 35 | cidr_block = "10.215.0.32/27" 36 | map_public_ip_on_launch = false 37 | availability_zone = "${var.region}a" 38 | 39 | tags = { 40 | Name = "Zabbix-Private-Subnet-1" 41 | } 42 | } 43 | 44 | # Create the Route Tables 45 | resource "aws_route_table" "public" { 46 | vpc_id = aws_vpc.vpc.id 47 | route { 48 | cidr_block = "0.0.0.0/0" 49 | gateway_id = aws_internet_gateway.igw.id 50 | } 51 | 52 | tags = { 53 | Name = "Zabix-Public-Route-Table" 54 | } 55 | } 56 | resource "aws_route_table" "private" { 57 | vpc_id = aws_vpc.vpc.id 58 | 59 | tags = { 60 | Name = "Zabbix-Private-Route-Table" 61 | } 62 | } 63 | 64 | # Create Route Table Associations 65 | # public 66 | resource "aws_route_table_association" "public-subnet-association-1" { 67 | subnet_id = aws_subnet.public-subnet-1.id 68 | route_table_id = aws_route_table.public.id 69 | } 70 | 71 | # private 72 | resource "aws_route_table_association" "private-association-1" { 73 | subnet_id = aws_subnet.private-subnet-1.id 74 | route_table_id = aws_route_table.private.id 75 | } 76 | -------------------------------------------------------------------------------- /tests/tf/compute.tf: -------------------------------------------------------------------------------- 1 | # Create Security Group - ZabbixServer 2 | resource "aws_security_group" "zabbix-server" { 3 | vpc_id = aws_vpc.vpc.id 4 | name = "Zabbix-Server" 5 | description = "Security Group for the Zabbix Server." 6 | 7 | ingress { 8 | protocol = "tcp" 9 | from_port = 22 10 | to_port = 22 11 | cidr_blocks = var.my_ip_addresses 12 | } 13 | ingress { 14 | protocol = "tcp" 15 | from_port = 80 16 | to_port = 80 17 | cidr_blocks = var.zabbix_access_allowed_ip_addresses 18 | } 19 | ingress { 20 | protocol = "tcp" 21 | from_port = 443 22 | to_port = 443 23 | cidr_blocks = var.zabbix_access_allowed_ip_addresses 24 | } 25 | ingress { 26 | protocol = "tcp" 27 | from_port = 10050 28 | to_port = 10051 29 | cidr_blocks = var.zabbix_service_allowed_ip_addresses 30 | } 31 | 32 | egress { 33 | protocol = "-1" 34 | from_port = 0 35 | to_port = 0 36 | cidr_blocks = ["0.0.0.0/0"] # service can communitcate out withou restrictions, change it if needed 37 | } 38 | 39 | tags = { 40 | Name = "Zabbix-Server" 41 | Application = "Zabbix Server" 42 | } 43 | } 44 | # Create EC2 Instance - ZabbixServer 45 | resource "aws_instance" "instance-zabbix-server" { 46 | instance_type = "t3a.small" 47 | ami = var.ec2_image_id 48 | vpc_security_group_ids = [aws_security_group.zabbix-server.id] 49 | subnet_id = aws_subnet.public-subnet-1.id 50 | key_name = var.ec2_key_name 51 | associate_public_ip_address = true 52 | user_data = file("user-data.sh") 53 | 54 | tags = { 55 | Name = "Zabbix-Server" 56 | Application = "Zabbix Server" 57 | } 58 | } 59 | # Create EIP for EC2 Instance ZabbixServer 60 | resource "aws_eip" "eip-instance-zabbix-server" { 61 | 62 | instance = aws_instance.instance-zabbix-server.id 63 | vpc = true 64 | 65 | tags = { 66 | Name = "Zabbix-Server" 67 | } 68 | } 69 | 70 | # Output 71 | output "zabbixserver-eip" { 72 | value = "http://${aws_eip.eip-instance-zabbix-server.public_ip}/zabbix" 73 | } 74 | 75 | output "User" { 76 | value = "Admin" 77 | } 78 | 79 | output "SSH-User" { 80 | value = "ubuntu" 81 | } 82 | 83 | output "Password" { 84 | value = "zabbix" 85 | } 86 | -------------------------------------------------------------------------------- /tests/test_coverage.py: -------------------------------------------------------------------------------- 1 | import markdown_table 2 | 3 | ALL_OIDS_FILENAME = './tmp/FORTINET-FORTIGATE-MIB.oids.md' 4 | FOS_TEMPLATE_FILENAME = './Template Net Fortinet FortiGate SNMPv2.xml' 5 | 6 | with open(ALL_OIDS_FILENAME) as f: 7 | oids = f.readlines() 8 | 9 | parsed_oids = [] 10 | parsed_oids_numbers = [] 11 | for line in oids: 12 | line = line.split() 13 | d = {} 14 | d[line[0]] = line[1] 15 | parsed_oids.append(d) 16 | parsed_oids_numbers.append(line[1]) 17 | 18 | with open(FOS_TEMPLATE_FILENAME) as f: 19 | template = f.readlines() 20 | 21 | parsed_template = [] 22 | for line in template: 23 | if 'snmp_oid' in line: 24 | if not 'discovery' in line: 25 | line = line.split('')[1] 26 | line = line.split('')[0] 27 | parsed_template.append(line) 28 | 29 | results = [] 30 | for line in parsed_oids_numbers: 31 | for template_line in parsed_template: 32 | if line in template_line: 33 | results.append(line) 34 | results = set(results) 35 | 36 | parsed_oids_numbers = set(parsed_oids_numbers) 37 | missing = parsed_oids_numbers.difference(results) 38 | 39 | combined_results = [] 40 | for dict_line in parsed_oids: 41 | for oid_name, oid_number in dict_line.items(): 42 | for line in results: 43 | if line == oid_number: 44 | combined_results.append(dict_line) 45 | 46 | combined_missing = [] 47 | for dict_line in parsed_oids: 48 | for oid_name, oid_number in dict_line.items(): 49 | for line in missing: 50 | if line == oid_number: 51 | combined_missing.append(dict_line) 52 | 53 | coverage_list = [] 54 | for line in combined_results: 55 | for key, value in line.items(): 56 | temp = [key,value] 57 | coverage_list.append(temp) 58 | 59 | headers = ["Name","OID"] 60 | coverage = markdown_table.render(headers,coverage_list) 61 | 62 | 63 | 64 | missing_list = [] 65 | for line in combined_missing: 66 | for key, value in line.items(): 67 | temp = [key,value] 68 | missing_list.append(temp) 69 | 70 | missing = markdown_table.render(headers,missing_list) 71 | 72 | total_coverage = len(combined_results) 73 | full_oid = len(parsed_oids) 74 | coverage_percentage = (total_coverage/full_oid)*100 75 | 76 | summary = f''' 77 | 78 | # Coverage Summary 79 | 80 | Full OID list: { full_oid } 81 | Coverage: { total_coverage } ({coverage_percentage:.2f}%) 82 | 83 | # Coverage Detailed 84 | 85 | ''' 86 | 87 | coverage_final = summary + coverage 88 | 89 | missing_header = f''' 90 | 91 | # Missing Detailed 92 | 93 | ''' 94 | 95 | coverage_final = summary + coverage + missing_header + missing 96 | 97 | with open("COVERAGE.md", "w") as f: 98 | f.write(coverage_final) -------------------------------------------------------------------------------- /tests/tf/user-data.sh: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | 3 | echo "=== User Data start ===" 4 | 5 | # https://www.zabbix.com/documentation/5.0/manual/installation/install_from_packages/debian_ubuntu 6 | 7 | ########################################################### 8 | # VARIABLES -- CHANGE THINGS HERE 9 | ########################################################### 10 | # ZABBIX_PKG_NAME="zabbix-release_5.0-1+bionic_all.deb" 11 | # ZABBIX_REPO_URL="https://repo.zabbix.com/zabbix/5.0/ubuntu/pool/main/z/zabbix-release" 12 | ZABBIX_PKG_NAME="zabbix-release_5.2-1+ubuntu18.04_all.deb" 13 | ZABBIX_REPO_URL="https://repo.zabbix.com/zabbix/5.2/ubuntu/pool/main/z/zabbix-release" 14 | 15 | 16 | DB_HOST="localhost" 17 | DB_PORT=3306 18 | DB_USER="zabbix" # change your zabbix database username as needed 19 | DB_PASS="zabbix" # change your zabbix database password as needed 20 | DB_NAME="zabbix" # change your zabbix database name as needed 21 | ZBX_SERVER_HOST="localhost" 22 | 23 | DB_SERVER_HOST=${DB_HOST} 24 | DB_SERVER_PORT=${DB_PORT} 25 | DB_SERVER_DBNAME=${DB_NAME} 26 | MYSQL_USER=${DB_USER} 27 | MYSQL_PASSWORD=${DB_PASS} 28 | MYSQL_DATABASE=${DB_NAME} 29 | 30 | ZBX_LOADMODULE="" 31 | ZBX_DEBUGLEVEL=5 32 | ZBX_TIMEOUT=10 33 | 34 | # ***** THERE IS NO NEED TO CHANGE ANYTHING AFTER THIS POINT **** # 35 | 36 | ########################################################### 37 | # COMMON 38 | ########################################################### 39 | AWS_INSTANCE_ID=`curl -s http://169.254.169.254/latest/meta-data/instance-id` 40 | TEMP_INSTALL_DIR="/root/install" 41 | 42 | mkdir ${TEMP_INSTALL_DIR} 43 | cd ${TEMP_INSTALL_DIR} 44 | wget ${ZABBIX_REPO_URL}/${ZABBIX_PKG_NAME} 45 | dpkg -i ${ZABBIX_PKG_NAME} 46 | 47 | # update OS 48 | mv /boot/grub/menu.lst /tmp/ 49 | update-grub-legacy-ec2 -y 50 | apt-get dist-upgrade -qq --force-yes 51 | apt update 52 | apt full-upgrade -y 53 | 54 | ########################################################### 55 | # MySQL INSTALLATION AND CONFIGURATION FOR ZABBIX 56 | ########################################################### 57 | 58 | apt install zabbix-server-mysql -y 59 | cp -pd /etc/zabbix/zabbix_server.conf /etc/zabbix/zabbix_server.conf.orig 60 | 61 | service zabbix-server start 62 | update-rc.d zabbix-server enable 63 | 64 | ########################################################### 65 | # ZABBIX FRONTEND 66 | ########################################################### 67 | 68 | apt install apache2 -y 69 | apt install php libapache2-mod-php -y 70 | update-rc.d apache2 enable 71 | service apache2 start 72 | 73 | apt install zabbix-frontend-php -y 74 | service apache2 restart 75 | 76 | ########################################################### 77 | # ZABBIX DATA 78 | ########################################################### 79 | 80 | cd ${TEMP_INSTALL_DIR} 81 | 82 | apt install mysql-server -y 83 | service mysql start 84 | update-rc.d mysql enable 85 | 86 | echo "CREATE DATABASE IF NOT EXISTS ${DB_NAME} CHARACTER SET utf8 COLLATE utf8_bin;" > ${TEMP_INSTALL_DIR}/create_zabbix.sql 87 | echo "GRANT ALL ON *.* TO '${DB_USER}'@'localhost' IDENTIFIED BY '${DB_PASS}';" >> ${TEMP_INSTALL_DIR}/create_zabbix.sql 88 | echo "FLUSH PRIVILEGES;" >> ${TEMP_INSTALL_DIR}/create_zabbix.sql 89 | mysql -u root < ${TEMP_INSTALL_DIR}/create_zabbix.sql 90 | 91 | zcat /usr/share/doc/zabbix-server-mysql/create.sql.gz | mysql -u root ${DB_NAME} 92 | 93 | ########################################################### 94 | # ZABBIX AGENT 95 | ########################################################### 96 | 97 | apt install zabbix-agent -y 98 | service zabbix-agent start 99 | 100 | ########################################################### 101 | # ZABBIX CONFIG 102 | ########################################################### 103 | 104 | cat > /etc/apache2/conf-available/zabbix.conf < 112 | Options FollowSymLinks 113 | AllowOverride None 114 | Require all granted 115 | 116 | 117 | php_value max_execution_time 300 118 | php_value memory_limit 512M 119 | php_value post_max_size 128M 120 | php_value upload_max_filesize 128M 121 | php_value max_input_time 300 122 | php_value max_input_vars 10000 123 | php_value always_populate_raw_post_data -1 124 | php_value date.timezone America/Toronto 125 | 126 | 127 | 128 | 129 | Require all denied 130 | 131 | 132 | 133 | Require all denied 134 | 135 | 136 | 137 | Require all denied 138 | 139 | 140 | 141 | Require all denied 142 | 143 | EOF 144 | ln -s /etc/apache2/conf-available/zabbix.conf /etc/apache2/conf-enabled/zabbix.conf 145 | 146 | ########################################################### 147 | # ZABBIX GUI CONFIG 148 | ########################################################### 149 | 150 | cat > /usr/share/zabbix/conf/zabbix.conf.php < 185 | EOF 186 | 187 | 188 | ########################################################### 189 | # ZABBIX SERVER CONFIG 190 | ########################################################### 191 | mkdir -p /run/zabbix/ 192 | cat > /etc/zabbix/zabbix_server.conf <