FortiGate SD-WAN Monitor n8n Workflow: Gmail Alerts & Top User

FortiGate SD-WAN monitoring that emails you real-time health, bandwidth, and “top user” insights

This n8n workflow continuously monitors your FortiGate SD-WAN link health and bandwidth usage, then sends automated Gmail alerts and HTML reports for WAN outages, congestion, and slow connections—plus an optional, passphrase-verified command flow to identify (and clear) the top bandwidth user via SSH.

What this workflow does

• Triggers by email or schedule: Runs when a matching Gmail message is received or automatically every 10 minutes.
• Parses the newest allowed email command: Determines whether to generate a read-only report or request a session clear action.
• Verifies the command sender: Loads the full email to validate the sender before any kill/session-clear operation is performed.
• Queries FortiGate via REST API: Retrieves SD-WAN member health-check status, interface bandwidth capacity, and FortiView top sources and destinations.
• Classifies WAN quality: Labels each WAN as OK / SLOW / CHOKED / DOWN using capacity, latency, and packet loss thresholds, and selects an eligible top private-IP bandwidth user that is not in a protected list.
• Optional automated remediation: If the verified command requests it, the workflow connects to FortiGate via SSH, clears sessions for the selected top source, waits 10 seconds, then re-queries results.
• Sends Gmail reports: Sends an HTML email report on every valid command, or only during WAN problems and once on recovery for scheduled monitoring.

Use cases

• Get Gmail alerts when SD-WAN links move to DOWN or CHOKED.
• Investigate sudden bandwidth spikes by automatically identifying the top bandwidth user.
• Run controlled, passphrase-verified “clear sessions” commands to accelerate troubleshooting without manual FortiGate CLI work.

Technical details

• Integrations: FortiGate REST API (SD-WAN + FortiView top sources/destinations), Gmail, SSH.
• n8n nodes/logic: if, set, ssh, code, wait, gmail.
• Authentication: Uses a FortiGate API admin plus an n8n HTTP Header Auth credential with a Bearer token for the FortiGate API.