🚀 SwitchPulse: Managed FortiSwitch Observability

SwitchPulse is a lightweight, log-free telemetry agent designed for real-time observability of managed FortiSwitches through a FortiGate controller. It provides a clean, responsive interface for tracking FortiSwitch health, port status, and historical outages without the need for complex monitoring infrastructure.

---

Features

• Real-Time Telemetry: Instant status updates for all managed FortiSwitches.
• Auto-Refresh: Configurable refresh intervals (5s - 300s) for continuous monitoring.
• Outage History: Persistent tracking of offline events, stored locally in your browser.
• Multi-User Configuration: Support for server-side defaults via .env or system environment variables.
• UI Overrides: Access multiple controller devices from a single instance with manual credential overrides.
• Port Details: Deep-dive into specific FortiSwitch port statuses, speeds, and POE budgets.
• Responsive Design: Elegant UI with native Dark Mode support.
• Data Export: Export your FortiSwitch inventory and status to CSV or JSON formats.

---

Tech Stack

• Backend: Go (Standard Library, Zero-Dependency)
• Frontend: Vanilla HTML5, CSS3, ES6 Javascript
• Protocol: HTTPS/HTTP (Custom Telemetry Tunnel)

---

Prerequisites

• Go: 1.18+ (if building from source)
• Controller Access: A valid API Key for the FortiGate controller.
• Network: The machine running SwitchPulse must have network access to the FortiGate management interface. (Tested version FortiOS 7.6.6)

---

Installation & Setup

1. Clone the Project:

   git clone <repository_url>
   cd SwitchPulse

2. Configure Environment Variables: Create a .env.local file (recommended) or .env in the root directory:

   FORTIGATE_IP=192.168.1.99
   FORTIGATE_API_KEY=your_secret_token

3. Run the Application:

   go run main.go

   The application will automatically attempt to open your default browser at the configured port (default: http://127.0.0.1:8080).

---

Configuration Options

Variable	Description	Default
FORTIGATE_IP	The management IP of your FortiGate controller.	N/A
FORTIGATE_API_KEY	Your FortiOS API User token.	N/A
PORT	The local port to serve the UI.	8080

---

SSRF & DNS-Rebinding Hardening

The backend implements strict destination validation at the network socket layer (DialContext). Every request is resolved and verified before connection, preventing:

• DNS Rebinding: Hostnames cannot be swapped for internal IPs after validation.
• Service Discovery Protection: Prevents the agent from being used to scan internal metadata or loopback services.
• Configurable Scope: Use ALLOW_LOCAL_NETWORK=true (default) to reach internal FortiGates, and ALLOW_LOOPBACK=true (default: false) to reach services on the local host.

---

Configuration Options

Variable	Description	Default
FORTIGATE_IP	The management IP of your FortiGate controller.	N/A
FORTIGATE_API_KEY	Your FortiOS API User token.	N/A
PORT	The local port to serve the UI.	8080
ALLOW_LOCAL_NETWORK	Permit access to private RFC1918 subnets.	true
ALLOW_LOOPBACK	Permit access to 127.0.0.1 / localhost.	false

---

Manual Testing Guide

1. Security Verification: Attempt to set Controller IP to 127.0.0.1. The backend should return a 403 Forbidden with a security violation message.
2. Server Configuration: Populated .env.local and ensure the ⚡ Server Defaults Active message appears in the UI.
3. Telemetry Verification: Click Load Switches and verify the table populates with your switch data.
4. Outage Tracking: Briefly disconnect a switch and verify a red 🔴 pulse entry appears in the "Offline History".
5. Export Check: Download CSV/JSON exports and verify all fields match the live UI data.

---

License

This project is licensed under the GNU Affero General Public License v3.0 (AGPL-3.0).

(C) 2026 Zettaflop Team. See the LICENSE file for details.

Support me?

Buy me a coffee