Monitor FortiGate WAN health and clear top bandwidth users via Gmail

Description

Quick overview
Monitors FortiGate SD-WAN link health and real-time bandwidth usage. Sends Gmail reports and alerts for WAN outages, congestion, and slow connections. Supports secure, passphrase-verified email commands to identify the top bandwidth user and optionally clear their sessions through SSH, enabling automated network visibility, troubleshooting, and traffic management.

How it works
Triggers either when a matching Gmail message is received or every 10 minutes on a schedule.
Parses the newest allowed email command to decide whether to run a read-only report or request a session clear, and loads the full email to verify the sender for kill requests.
Queries the FortiGate REST API for SD-WAN members, health-check status, interface bandwidth capacity, and FortiView top sources and destinations.
Analyzes WANs as OK/SLOW/CHOKED/DOWN based on capacity, latency, and packet loss thresholds, and selects an eligible top private-IP bandwidth user that is not in the protected list.
If a verified email command requests it, connects to the FortiGate via SSH to clear sessions for the selected top source, waits 10 seconds, and re-queries top sources and SD-WAN members.
Builds an HTML email report and sends it via Gmail for every email command, or only on WAN problems and once on recovery for scheduled monitoring.

Setup
Create a FortiGate REST API admin and add an n8n HTTP Header Auth credential with an Authorization Bearer token for the FortiGate API requests.
Create a FortiGate CLI admin with SSH access from your n8n host and configure an SSH credential for the session-clearing step.
Connect a Gmail account for reading command emails and sending reports, then update the Gmail search query to include your chosen passphrase.
In the workflow settings values, set your FortiGate URL, allowed sender emails, report recipient, WAN interface names, protected IPs, and any thresholds (choke/latency/loss, cooldown, top N).