Firewall Monitoring for FortiGate, MikroTik, pfSense

What it does

The answers, before the questions

Every vendor reports into the same pages, findings and reports.

🔎

Findings first

Each firewall page opens with what to look at: an internet link down, one device using most of the traffic, high-risk applications, VPN tunnels that are down or keep dropping, new devices, an old firmware release, and high CPU, memory, disk or temperature.

🌐

Internet usage that is real

How much came in and went out on the links that face the internet, not on every LAN port, with a 30-day history and a PDF that opens with the key findings.

👥

Who is using the bandwidth

Top sources list the devices on your own network behind the firewall, and top applications and destinations show where the traffic goes.

🔗

VPN tunnels and WAN links

Site-to-site tunnels up or down, remote-access sessions where the firewall reports them, WAN links with their current bandwidth, and failover state, so a dead ISP or tunnel is found before the client calls.

⏱️

Heartbeat and offline detection

A 60-second heartbeat separates a firewall that is offline from one that is only quiet, and alerts reach you through email, Telegram, WhatsApp or webhooks.

🧱

Cisco Firepower and ASA

Cisco Firepower Threat Defense and ASA are read over SNMPv3 or v2c by a small agent on any Linux or Windows host in the customer network, every minute and read only.

Evidence

A firewall report that fits a review meeting

Thirty-day statistics, interface usage and top sources export as a PDF that opens with the key findings, so a client sees what the firewall did and what needs attention.

A traffic collector reads the NetFlow and IPFIX records a firewall sends, for traffic by source and by application
Accurate totals: the running counters on MikroTik and pfSense are converted to what was used in the period
MikroTik routers can add DHCP and ARP names with an optional roster script
Firewalls also appear on the Control Room wall and in Needs attention

INTERNET USAGE · 30 DAYSIllustrative data

Counted onInternet-facing links only

Busiest source38% of traffic

Supported vendors

Six vendors, one set of pages

MikroTik

FortiGate

Sophos

Kerio Control

pfSense

Cisco Firepower (FTD)

Cisco ASA

SNMP v2c and v3

NetFlow and IPFIX

FAQ

Questions teams
ask us first

Anything else? Ask on the demo.

How does monytr.ai collect firewall data?

A small agent runs on or near the firewall and pushes its readings to your dashboard over HTTPS, so nothing connects into the customer network from outside. Cisco devices are read over SNMP from an agent on any Linux or Windows host in the customer network.

Which firewall vendors are supported?

MikroTik, FortiGate, Sophos, Kerio Control, pfSense, and Cisco Firepower Threat Defense and ASA.

Can I see which device is using the internet?

Yes. Top Sources lists the devices on your own network behind the firewall, and the Internet Usage box counts only the links that face the internet. MikroTik routers can add device names from DHCP and ARP with an optional roster script.

How fast do I find out a firewall or a link is down?

Firewalls send a lightweight heartbeat every 60 seconds, so a dead firewall shows as offline quickly. WAN links, tunnels and findings come from each full report, and alerts go to email, Telegram, WhatsApp or webhooks.

Do I need a separate tool for each vendor?

No. All six vendors report into the same pages, findings and reports, so a client with a FortiGate at head office and MikroTik routers at branches is one view.

Keep going