FortiGate (API) connector

The FortiGate (API) connector adds a FortiGate firewall as an asset by querying the FortiOS REST API. It requires neither SNMP, nor script execution, nor agent installation.

It retrieves:

  • the FortiOS version and build, used to compute vulnerabilities;
  • the name, model and serial number of the FortiGate;
  • the high availability mode;
  • the version and date of the antivirus and IPS signature databases;
  • the expiration dates of the FortiGuard licenses and of the FortiCare support;
  • the availability of a FortiOS patch;
  • the IP addresses of the interfaces, including those obtained through DHCP;
  • configuration flaws in the administration of the FortiGate.

It also allows evaluating the CIS compliance of the FortiGate.

All requests are read-only.

The connector can be used in two ways:

  • directly: Cyberwatch queries the API of each FortiGate, with an API key specific to the device;
  • through a FortiManager: Cyberwatch queries the FortiManager, which relays the requests to the FortiGates it manages. A single API key, the FortiManager’s, is enough for the whole fleet.

Prerequisites

Creating agentless connections of type FortiGate (API) requires enabling this type of connection from the menu Administration > Connectors management.

For a direct connection, the Cyberwatch scanner must reach the HTTPS administration interface of the FortiGate. Through a FortiManager, it must reach the JSON API of the FortiManager.

Direct connection

Prepare the FortiGate

  1. Create an administrator profile whose permissions are all read-only (System > Admin Profiles). If virtual domains (VDOM) are enabled, give the profile a global scope.
  2. Create a REST API administrator with this profile (System > Administrators > Create New > REST API Admin).
  3. In the trusted hosts (Trusted Hosts) of this administrator, only allow the address of the Cyberwatch scanner.
  4. Write down the generated API key: FortiOS displays it only once.

Configure the credentials

You may configure your credentials from the Stored credentials menu of the sidebar, then click on the Add button. In the form, select the type Fortinet, then fill in:

  • API key: the key of the REST API administrator;
  • URL: optional, it is only used by the FortiGate discovery;
  • Disable certificate verification: check it if the FortiGate presents a self-signed certificate;
  • Ignore proxy: check it if the scanner reaches the FortiGate without going through the proxy configured in Cyberwatch.

Add the FortiGate

In Cyberwatch, under the Assets section:

  1. Go to the Assets menu and click on Agentless connections
  2. Select the FortiGate (API) access protocol
  3. In the Address field, enter the IP address or the name of the FortiGate
  4. In the Port field, enter the port of the HTTPS administration interface (443 by default)
  5. Select the Fortinet credential set, or create one
  6. Click on Save

Cyberwatch always calls the FortiGate at the address and on the port of the connection, whatever the URL of the credential set.

Connection through a FortiManager

Configure the credentials

The credential set is the one of the FortiManager discovery: type FortiManager, with the URL of the FortiManager and the API key of an administrator of its JSON API.

Add a FortiGate

In Cyberwatch, under the Assets section:

  1. Go to the Assets menu and click on Agentless connections
  2. Select the FortiGate (API) access protocol
  3. Select the FortiManager credential set: the Port field disappears
  4. In the Address field, enter the name of the FortiGate on the FortiManager
  5. Click on Save

Add the FortiGates of a FortiManager discovery

A FortiManager discovery of type Discover FortiGates records the name of each FortiGate on the FortiManager. It can create the connections automatically: in the discovery, select the FortiManager credential set as the agentless connection credential, with the connection type FortiGate (API).

The discovered FortiGates can also be added from the discovered assets page. Only those reported by a Discover FortiGates discovery are accepted: after a Cyberwatch update, run the discovery again before creating the connections.

  1. Go to the Discoveries menu
  2. On the FortiManager discovery, click on Display discovered assets
  3. Select the FortiGates to add
  4. Click on Bulk actions, then on Scan with agentless connections
  5. In Credentials, select the FortiManager credential set
  6. Select the connection type FortiGate (API)
  7. Click on Create agentless connections

Reported information

The connector describes the FortiGate with the same information as the SNMP scan: the FortiOS firmware and the metadata below. These metadata are visible in the Information tab of the asset.

KeyValue
system-manufacturerFortinet
system-product-nameModel, for example FortiGate-81F
system-serial-numberSerial number
ha-stateHigh availability mode: standalone, active-active or active-passive, the same on each cluster member
av-signature-version, av-signature-dateVersion and date of the last update of the antivirus signature database
ips-signature-version, ips-signature-dateVersion and date of the last update of the IPS signature database
license-expirationNearest expiration date of the FortiGuard licenses (antivirus, IPS, web filtering…), current or expired
support-expirationNearest expiration date of the FortiCare support contracts (hardware, 24x7…), current or expired, otherwise that of the updates (Firmware & General Updates)
firmware-update-availabletrue if FortiGuard publishes a more recent patch of the installed FortiOS branch, otherwise false. A new branch, for example 7.6 for a FortiGate running 7.4, does not count. No value when the FortiGate cannot reach FortiGuard.

Dates are in the YYYY-MM-DD format.

Security issues

The connector reads the administrative access of the interfaces and the global configuration of the FortiGate, and reports the following issues. Disabled interfaces are ignored.

IssueCondition
FortiGate administration over a cleartext protocolAn interface accepts administration over Telnet, unless Telnet is globally disabled (admin-telnet), or over HTTP without redirection to HTTPS (admin-https-redirect)
FortiGate administration open on a WAN interfaceAn interface with the WAN role accepts administration over HTTPS, SSH, HTTP or Telnet
FortiGate administration with weak TLSHTTPS administration accepts a version older than TLS 1.2 (admin-https-ssl-versions), or strong cryptography is disabled (strong-crypto)

The first two issues are reported per interface, the third one per setting at fault: one of them can thus be ignored without hiding the others.

If the profile of the API key does not allow reading the global configuration, the TLS issue is not evaluated, Telnet is reported even if it is globally disabled, and HTTP is not reported.

Troubleshooting

Only reading the status of the FortiGate is essential to the scan. When the profile of the API key denies another read, the scan continues without the corresponding information, and the script output records it with a comment line, for example # /api/v2/monitor/license/status: HTTP 403.

A transient error (timeout, 5xx error) when reading the addresses or the configuration makes the scan fail: the asset then keeps the addresses and the security issues of the previous scan.

ErrorProbable cause
HTTP 401Invalid API key, or scanner address missing from the trusted hosts of the REST API administrator
HTTP 403Profile of the REST API administrator without read access
Certificate errorSelf-signed certificate: check Disable certificate verification in the credential set
HTTP <code>: not a FortiOS API responseThe port of the connection is not the one of the HTTPS administration interface, for example it is the one of the SSL VPN portal
<name>: …Through a FortiManager: the FortiManager could not relay the request to the FortiGate <name>