Adding Fortinet Firewall Device

• General prerequisites:
  • Ensure communication between AppViewX and the firewall is enabled.
  • Valid firewall account details, including API tokens/keys and user credentials, are necessary.
• IP Address/FQDN: IP address or FQDN
• User Privilege: Username/Password
• Services and Port for AppViewX Communication: Port number 22 (SSH)
  Note: For Visual Workflow action items, you will require credentials with write privilege.

To add a FortiGate device:

Required for JSON API operations, it enables AppViewX to communicate with FortiManager through REST API calls. (System Settings -> Administrator -> Edit Administrator).

Required access: Read/Write

System Settings Access

Required to manage system certificates and configurations. (System Settings > Admin Profiles > Edit Administrator)

Required access: Read/Write

To add a FortiManager device:

• Discovery (on-demand and scheduled) of certificates from the FortiManager certificate repository including:
  • Local certificates
  • Local CA certificates
• The system creates the following certificate profiles with correct naming conventions:

  Certificate Profile	Naming Convention
  System Local	deviceName::FortiManager::System
  HTTPS & Web Service	deviceName::FortiManager::System::AdminServerCertificate
  SAML SSO IdP (when enabled)	deviceName::FortiManager::System::SamlIdp
  HA Cluster	deviceName::FortiManager::System::HA

• When config sync is triggered and cert sync is enabled, the system automatically:
  • Initiates certificate discovery
  • Creates/updates corresponding profiles
  • Maintains the association between certificates and profiles
  Note: Certificates from FortiGate devices managed by FortiManager are currently not supported in this integration.
• Frame application connectors for the server certificates based on the profile it was discovered from. (Default connector is overridden by Profile connectors.)

Parameters

• Certificate File Name: Mandatory parameter specifying the name for the certificate file on the device

Push Root and Intermediate Certificates

• Functionality: Root and intermediate certificates can be included with the server certificate during push operation
• Import Behaviour:
  • Server certificate imported to local cert store
  • Trust certificates (root/intermediate) imported to local ca cert store

File Naming Requirements

• File name is mandatory for all certificates in the chain.
• Each certificate in the chain requires a unique file name.
• If any of the specified names already exists on the device, the push operation will fail
• Overwrite Option: Can be resolved by checking the overwrite option to replace existing certificates
• Private Key In Device option: Used to map certificate to a CSR file in FortiManager. When selected, the CSR file in the device will be updated with the certificate content.

Trust Certificate Push

All trust certificates will be imported to the local ca certificate store on the FortiManager device.

Certificates can be bound to profile connectors in FortiManager. Certificate binding is supported for the following profiles:

• Admin Server Certificate
• SAML Identity Provider
• High Availability (HA)

After the push operation, the certificate will be referenced using the pushed certificate name in the FortiManager configuration. This ensures proper association between the certificate and the specific profile functionality.

Parameters

• CSR File Name: Mandatory parameter specifying the name for the CSR file on the device.

CSR generation

1. Generate CSR in the device:

   execute certificate local generate <name> <key_size> <CN> <C> <ST> <L> <O> <OU>
           <email>

2. Get CSR file content : show system certificate local <csr_file_name>

APIs

POST https://$HOST:$HTTPS_PORT/jsonrpc: This is the standard format of the API URLs triggered in FortiManager for all the use cases.

Standard payload format:

{
  "id": <id>,
  "method": "<method, could be exec, add, update>",
  "params": [
      {
          "url": "URL for the request",
          "data": {
              <Data required for the request>
          }
      }
  ],
  "session": <session_id>
}

After adding the device, you can validate the device by searching device in the device inventory.