Fortinet device importer¶

Versio.io can import, historize and process configuration data from Fortinet FortiGate firewalls. Besides the network device itself, the importer reads interfaces, firewall policies, IPsec VPNs, address and service objects, licenses and administrators. Optionally it collects performance metrics such as CPU, sessions, interface traffic and VPN tunnel status.

Configuration¶

You can find the configuration option in Versio.io at Environment settings > OneImporter > Configurations > Network devices > Fortinet.

Here you can edit all existing configurations, create new configurations or delete existing configurations. To add a new configuration, enter a Name for your importer.

Click Add to proceed to the configuration.

To edit an existing configuration, click the arrow on the left of your importer name to expand the configuration options.

The following configuration options are available:

Field	Description	Advice
Name	Meaningful name	Add the word "Fortinet" to identify the importer when viewing the logs
Active	Option to activate and deactivate the configuration. Data is only imported if the configuration is activated.
Credential	Select authorization for network device access.	Enter the API token of the REST API administrator as password at `Settings > Access Management > Credential Vaults`. See Create Fortinet API user.
Domains & IPs	Enter all FortiGate domains or IPs.	The OneImporter connects via HTTPS on port 443.
Entities	Select the entities to be inventoried by Versio.io.	See Imported entities.
Metric groups	Select the performance metrics to be collected (expert mode).	See Metrics.
Executing OneImporter	Select a Versio.io OneImporter to import the data based on the importer configuration.	Requires an installed OneImporter: Installation instructions
Schedule time (cron format)	Determine the frequency of imports in CRON format	Learn more about CRON format: https://en.wikipedia.org/wiki/Cron. Run every 10 minutes if you monitor VPN tunnels.

Table: Fortinet network device configuration parameters

Imported entities¶

Entity	Content
Network device	Hostname, serial number, model, FortiOS version and MAC address. Always imported.
Configuration	Global system settings, e.g. administrative access, timeouts and cryptography settings.
Interfaces	Interfaces with addresses, role, administrative access, zone membership and MAC address.
Policies	Firewall policies including their evaluation order.
VPNs	IPsec phase 1 interfaces with their phase 2 selectors.
Objects	Addresses, address groups, services, service groups and virtual IPs.
Licenses	FortiGuard and FortiCare licenses with status and expiry date.
Admins	Local administrator accounts with profile, trusted hosts and two-factor settings.
Physical connection	Neighbors detected via the ARP table. Not available for FortiGate VMs in public clouds.

Table: Imported Fortinet entities

Versio.io does not import secrets. Pre-shared keys and password hashes are removed before the data is sent.

With policies, objects, interfaces and VPNs imported, the network device page shows the firewall communication as flow diagram and matrix: which networks may reach which destinations, and through which policies.

Metrics¶

The importer collects the following metric groups for the network device:

Metric group	Metrics
CPU	CPU usage
Memory	Memory usage
Sessions	Concurrent sessions and new sessions per second
Network	Traffic, packets and errors per interface
VPN tunnels	Tunnel status, phase 2 selectors up and traffic per tunnel

Table: Fortinet metric groups

CPU, memory and sessions are read from the FortiGate history of the last hour, so an hourly schedule gives values for every minute. Traffic is the average since the previous import. The VPN tunnel status reflects the moment of the import.

Create Fortinet API user¶

Versio.io executes the following read-only requests to your FortiGate:

# Network device and configuration
https://${address}/api/v2/cmdb/system/global
https://${address}/api/v2/cmdb/system/interface
https://${address}/api/v2/cmdb/system/zone
https://${address}/api/v2/monitor/system/status
https://${address}/api/v2/monitor/system/interface

# Policies, VPNs and objects
https://${address}/api/v2/cmdb/firewall/policy
https://${address}/api/v2/cmdb/vpn.ipsec/phase1-interface
https://${address}/api/v2/cmdb/vpn.ipsec/phase2-interface
https://${address}/api/v2/cmdb/firewall/address
https://${address}/api/v2/cmdb/firewall/addrgrp
https://${address}/api/v2/cmdb/firewall.service/custom
https://${address}/api/v2/cmdb/firewall.service/group
https://${address}/api/v2/cmdb/firewall/vip

# Licenses and administrators
https://${address}/api/v2/monitor/license/status
https://${address}/api/v2/cmdb/system/admin

# Network topology
https://${address}/api/v2/monitor/network/arp

# Metrics
https://${address}/api/v2/monitor/system/resource/usage
https://${address}/api/v2/monitor/vpn/ipsec

Requests: Executed requests for inventory and metrics

For the inventory, it is necessary to create a REST API administrator with a read-only profile so that Versio.io can authenticate itself on the FortiGate. A super_admin can create it with the following commands:

# Create a read-only administrator profile
config system accprofile
    edit "versio-readonly"
        set sysgrp read
        set netgrp read
        set fwgrp read
        set vpngrp read
        set loggrp read
        set utmgrp read
    next
end

# Create the REST API administrator, restricted to the OneImporter host
config system api-user
    edit "versio"
        set accprofile "versio-readonly"
        set vdom "root"
        config trusthost
            edit 1
                set ipv4-trusthost <OneImporter IP> 255.255.255.255
            next
        end
    next
end

# Generate the API token
execute api-user generate-key versio

Commands: Create a REST API administrator for Versio.io

The token is shown only once. Store it in the Credential Vault of Versio.io.

A profile other than super_admin may not list administrator accounts with a higher profile. If the importer log reports No admins visible, the admin entity is skipped and all other entities are imported as usual.

Reference¶

FortiOS Administration Guide: REST API administrator