Fortinet FortiGate

Fortinet FortiGate is a next-generation firewall providing security and visibility for end-to-end protection across the entire enterprise network.

Asset Types Fetched

This adapter fetches the following types of assets:

• Devices, Users, Groups, Network/Firewall Rules, Network Devices, Alerts/Incidents, Networks, Network Routes

Before You Begin

APIs

Axonius uses the FortiOS REST API (api/v2) to fetch data directly from a FortiGate. When the connection goes through FortiManager, Axonius uses the FortiManager JSON-RPC API instead. The following endpoints are called:

Required Permissions

The value supplied for User Name, if used when connecting the adapter, must have read access to devices.

To fetch the network topology, the user must also have read access to the system interfaces, zones, and VDOMs. If the user cannot read them, the adapter does not fetch network segments and continues without an error.

In addition, you need to create an Administrator profile and a FortiManager API locally defined API admin user, and assign the required permissions in the process.

Creating an Administrator Profile

1. On the FortiManager GUI, select System Settings > Admin Profiles > Create New.

2. Populate the fields as shown in the image below.

3. Select the permissions of your choice.
   

4. Click OK.

Creating the JSON API Admin

After you create your administrator profile, use the steps below to create a FortiManager API locally defined API admin user.

1. On the FortiManager GUI, select System Settings > Administrators > Create New.

2. Populate the fields as shown in the image below. Make sure you assign select:read (rpc-permit), ALL ADOMs, and ALL Packages (Policy Package Access).
   

3. Click OK.

Generating the FortiOS API Key (Optional)

If you authenticate with a FortiOS API Key, you need to create a profile that only has read access to the firewall address permission group.

1. In the FortiGate GUI, select System > Admin Profiles > Create New.

2. Select at least read permissions for:

   1. User/Device
   2. Firewall
   3. Policy
   4. Address
   5. Schedule
   6. Network
   7. System
   8. VPN
   9. WiFi and Switch

3. Click OK.

4. Back in the FortiGate GUI, select System > Administrators > Create New > REST API Admin.

5. Populate the fields as shown below:
   

   In 6.4.2 and earlier, the Trusted Host must be specified to ensure that your local host can reach the FortiGate. For example, to restrict requests as coming from only 10.20.100.99, enter 10.20.100.99/32.

6. Click OK and an API token will be generated. The API token as it is only shown once and cannot be retrieved. It will be needed for the rest of the process.

7. Click Close.

Deploying the Adapter in Axonius

1. Host Name - The hostname or IP address of the Fortinet FortiGate server.
2. Port - If not supplied, Axonius will use TCP port 443.
3. User Name and Password - The credentials for a user account that has the Required Permissions to fetch assets.

   1. Note:

      As of FortiGate 7.6.6 FortiGate supports only token-based authentication for API calls. Token-based authentication requires the administrator to generate a token, which is then included in each API request for authentication. A token (the FortiOS API Key) is automatically generated when a new API administrator is created in FortiOS.

4. FortiOS API Key (optional) - An API Key associated with a user account that has the Required Permissions to fetch assets.

Optional Parameters

1. Virtual Domain - Specify a comma-separated list of Virtual Domains (VDOMs) so that Axonius will fetch data from specified virtual domains. The value applies to all API calls to the FortiGate. When this field is empty, the adapter reads the zones and interfaces of all VDOMs.
2. Is Hosted on Cloud - Select this option when Fortinet FortiGate is hosted on Cloud.
3. Verify SSL - Select whether to verify the SSL certificate of the server against the CA database inside of Axonius. For more details, see SSL Trust & CA Settings.
4. HTTPS Proxy - Connect the adapter to a proxy instead of directly connecting it to the domain.
5. HTTPS Proxy User Name - The user name to use when connecting to the value supplied in Host Name or IP Address via the value supplied in HTTPS Proxy.
6. HTTPS Proxy Password - The password to use when connecting to the server using the HTTPS Proxy.

To learn more about common adapter connection parameters and buttons, see Adding a New Adapter Connection.

Advanced Settings

1. DHCP lease time (seconds) (required, default: 604800) - Specify the DHCP lease time, that refers to the life of an IP address remains assigned to a device.
2. Interfaces exclude list (optional) - Specify a comma-separated list of Fortinet FortiGate interfaces so that the adapter will only fetch devices that are not associated with the specified interfaces.
3. VMware Interfaces exclude list (optional) - Specify a comma-separated list of Fortinet FortiGate interfaces so that the adapter will only fetch virtual devices that are not associated with the specified interfaces.
4. Do not fetch OS Type field (optional) - Select to exclude fetching data from the OS Type field.
5. Allow IPSEC VPN devices - Select to allow fetching IPSEC VPN devices.
6. Use Fortigate new OS version parser - Select this option to fetch the OS minor version from another field on a FortiOS device instance.
7. Fetch firewall rules (default: enabled) - Select this option to fetch all the firewall rules, as well as their policies and addresses. When this option is cleared, the adapter does not fetch firewall policies, VIP policies, IPS profiles, addresses, or intrazone rules.
8. Maximum number of chunks (default:50) - Enter a number to set the maximum number of parallel chunks to fetch information from the ADOMs. This can be a value between 50 and 100. Select the number of parallel calls that works best with your system.
9. Fetch VPN SSL Sessions as Devices - Select this option to fetch VPN SSL sessions as Devices.
10. Fetch SD-WAN configuration and health checks (default: disabled) - Select this option to add the SD-WAN zones, members, health checks (with link states), and service rules to the FortiGate device. Available for direct FortiOS connections only. On FortiOS 6.x the adapter reads system/virtual-wan-link.
11. Parse IPsec VPN phase 2 selectors (default: disabled) - Select this option to add the local and remote subnets and the status of the IPsec VPN phase 2 selectors to the IPsec VPN tunnel devices. The adapter uses data that it already fetches and sends no additional request. This setting is relevant when Allow IPSEC VPN devices is enabled.
12. Fetch IPsec VPN tunnel configuration (default: disabled) - Select this option to add the IPsec phase 1 and phase 2 interface configuration to the IPsec VPN tunnel devices. Available for direct FortiOS connections only. This setting is relevant when Allow IPSEC VPN devices is enabled.
13. Fetch SSL-VPN settings (default: disabled) - Select this option to add the SSL-VPN settings (listen interfaces, port, tunnel IP pools, default portal, and authentication rules) to the FortiGate device. Available for direct FortiOS connections only.
14. Fetch routing configuration (default: disabled) - Select this option to add the static routes and the BGP and OSPF neighbors to the FortiGate device. Available for direct FortiOS connections only.
15. Fetch DHCP server scopes as Networks (default: disabled) - Select this option to create a Network asset (asset type IPv4 Subnet) for each DHCP server scope, with the CIDR blocks, interface, default gateway, DNS servers, DHCP ranges, and reserved addresses. Available for direct FortiOS connections only.

Network Topology

The adapter shows the network topology of a FortiGate: its virtual domains (VDOMs), zones, and interfaces. This is the same model used for the Network Topology data of other adapters.

Network Segments

Each FortiGate interface that has an IPv4 address is fetched as a Networks asset with the Asset Type FortiGate Interface Network. An interface with no IPv4 address does not create an asset. The asset includes the following fields:

• Name - The interface name.
• Segment Type - VLAN when the interface has a VLAN ID, otherwise Subnet.
• Network ID - The VLAN ID. Empty for a Subnet.
• Gateway IP - The IP address of the interface.
• Subnets - The subnet of the interface, in CIDR form.
• Is Enabled - Yes when the interface status is up and No when it is down. Empty when FortiOS does not report the status.
• Zone - The zone of the interface. Empty when the interface is not a zone member.
• Interface, Alias, Fortigate Name, and Allow Access - The management access types of the interface.
• Scope Chain - The place of the interface in the FortiGate hierarchy.

Scope Chain

Scope Chain includes the sub-fields Levels and Domain Path. Each level includes Type, Name, Remote ID, Remote ID Source, Order, and Scope ID. The levels, from the outermost level:

• Network Device - The FortiGate. Name is the host name, or the serial number when there is no host name. Remote ID is the serial number and Remote ID Source is Serial.
• Virtual Domain - The VDOM name.
• Zone - The zone name. Only when the interface is a zone member.
• Segment - The interface name.

FortiOS has no IDs for VDOMs, zones, and interfaces, so Remote ID is empty for these levels.

Device Placement

• The FortiGate device includes Scope Chain with one level, Network Device.
• Devices that the FortiGate reports (DHCP leases, ARP entries, and detected devices) include Network Segment Chain under Network Interfaces. The value is the scope chain of the FortiGate interface that reported the device.

Firewall Rules

Each FortiOS firewall policy is fetched as a Network/Firewall Rules asset with the Asset Type Fortigate Firewall Rule. The asset shows where the policy is enforced, in which order, and which traffic it matches.

Policy Fields

• Priority - The position of the policy in the FortiOS policy list, starting from 1. A lower number is evaluated first.
• Network Security Rules - The rule that the policy enforces:
  • Remote ID - The policy UUID.
  • Enforcement Point - A scope chain with two levels: Network Device (the FortiGate, by serial number) and Virtual Domain (the VDOM).
  • Match Source and Match Destination - One entry for each source or destination interface of the policy. Each entry includes Scope Chain, Allowed Endpoints, and Excluded Endpoints.
  • Protocols - ANY when the policy service is ALL. Empty for other services.

Each interface in Match Source and Match Destination is shown as follows:

• A zone, or an interface that is a zone member - The last level of the scope chain is Zone.
• Another interface - The last level is Segment, the same segment as in Network Segments.
• The interface any - A Segment level named any.

The source and destination addresses of the policy are shown in Allowed Endpoints. When the policy negates the source or destination address, they are shown in Excluded Endpoints. The adapter also reads address groups, including nested groups. The supported address types are subnet, IP range, and FQDN. The address all means any address.

Some address types, such as country and MAC address objects, are not read. In this case, an allow policy matches only the addresses that the adapter can read, and a deny policy matches all addresses on its interfaces.

Intrazone Rules

Each zone with two or more member interfaces creates an additional rule asset:

• Name - The zone name.
• Rule Type - Intrazone.
• Is Enabled - Yes.
• Action - Allowed when the zone allows intrazone traffic, otherwise Denied (the FortiOS default).

The rule matches the zone to the same zone, for any protocol.

Policies without Network Security Rules

The policy asset is still fetched, but without Network Security Rules, when:

• The policy action is not accept or deny (for example, IPsec).
• The policy uses Internet Service objects.
• The policy also matches on users, user groups, or FSSO groups.
• The policy services are negated.
• The policy has no IPv4 address (IPv6 only).
• A source or destination address resolves to nothing, or an allow policy has a negated side with an address that the adapter cannot read.

Supported From Version

Supported from Axonius version 4.5