fortigate adapter

Inmanta module to manage fortigate

Features

The module supports all existing fortigate resources used for policies, networking rules and resources and resource management.

Environment variables

Env variable name	Description
FORTIGATE_API_TOKEN	Fortigate api token, used as main credentials to interact with netbox. Only required if you use fortigate::base::Api with api_token_env_var.
Defined by the user	Fortigate Flex api username, used as main credentials to interact with Fortiflex. Only required if you use fortigate::fortiflex::BaseFlexApi with username_env_var.
Defined by the user	Fortigate Flex api password, used as main credentials to interact with Fortiflex. Only required if you use fortigate::fortiflex::BaseFlexApi with password_env_var.

FortiOS versions

The module is tested in CI against one FortiOS 7.4 appliance and one 7.6 appliance. The api schemas it ships in files/ are the 7.2 ones, so the module lags the devices it manages, and the handlers close the gap at deploy time.

Some fields changed from a single value into a table of entries between releases:

Resource	Field	7.2	7.4	7.6
fortigate::LocalInPolicy	intf	single value	table	table
fortigate::LocalInPolicy6	intf	single value	table	table
fortigate::IpSecPhase1Interface	monitor	single value	table	table

The model keeps the single value in every case, so intf = "port2" is valid whatever the device runs. The handlers ask the device which form it expects, by reading the schema it publishes for its own objects, so releases that are not listed here are handled too.

The following attributes are still part of the model but no longer exist in 7.6. They only work on older releases, setting them on a 7.6 device makes the deploy fail:

• fortigate::Policy: cifs_profile

• fortigate::Interface: disconnect_threshold, drop_overlapped_fragment, and dnssl / rdnss on ipv6.ip6_prefix_list

• fortigate::Settings: application_bandwidth_tracking, gui_endpoint_control, gui_endpoint_control_advanced, gui_proxy_inspection

• fortigate::SDWan: route_tag on service

• fortigate::IpSecPhase1Interface: forticlient_enforcement

• fortigate::IpSecPhase2Interface: ipv4_df

7.6 also dropped the ssl and hdlc values of fortigate::Interface.type.

Attributes the device requires but the schema does not

The schema marks some attributes optional that the device insists on when it creates the object. They are nullable in the model, so a model that leaves them out compiles, and keeps converging for as long as the object happens to exist already: an update sends no value and the device keeps the one it has. It fails the first time the object has to be created, on a device that was reset or replaced, which is a long way from the change that introduced it.

Resource	Attribute	Device error
fortigate::Static	device	Attribute 'device' MUST be set., error -651

Usage example

This simple example shows how to create one interfac with one policy attached to the interface:

import fortigate
import fortigate::base
import fortigate::common
import fortigate::firewall_policy

api = fortigate::base::Api(
    token_env_var="FORTIGATE_API_TOKEN",
    base_url="https//example.com",
)

purged = false

policy = fortigate::Policy(
    dstaddr = [Dstaddr(name="all")],
    dstintf = [Dstintf(name="l2t.root")],
    logtraffic = "all",
    policyid=1,
    name = "test_policy_on_first_itf",
    schedule = "always",
    service = [Service(name="ALL")],
    srcaddr = [Srcaddr(name="all")],
    srcintf = [Srcintf(name=vlan_itf.name)],
    action = "accept",
    nat = 'disable',
    purged = purged,
    api = api,
)

if purged:
    policy.provides += vlan_itf
else:
    policy.requires += vlan_itf
end

vlan_itf = fortigate::Interface(
    name = "vlan_itf",
    interface = "port2",
    vlanid = 43,
    role = "lan",
    vdom = "root",
    purged = purged,
    api = api,
)

• Module fortigate
• Changelog