Skip to main content
rmreddy
Staff
rmreddy
Staff
August 1, 2021

Technical Tip: Creating automation stitches in FortiOS v7.0 and v7.2

  • August 1, 2021
  • 0 replies
  • 6289 views

Description

 

This article describes how to configure FortiGate to automatically respond to various trigger events. This article is for FortiOS v7.0 and v7.2, the automation workflow was redesigned to be more efficient and clearer for the user.

 

Scope

 

FortiGate.


Solution

 

Automation stitches, actions, and triggers have separate dialogs and are no longer part of the main automation stitch dialog, like in previous FortiOS versions (v6.2, v6.4).

 

  1. When creating a stitch, selecting 'Add Trigger' or 'Add Action' displays a list of available triggers and actions, and also the option to create new ones

    trigger-action.png

 

  1. Once the stitch is configured, a process diagram of the trigger, actions, and delays is displayed.

 

ready-stitch.PNG

 

Notice the 'Action execution' options, it allows to choose if additional actions are executed in a specific order ('Sequential') or simultaneously ('Parallel'). If 'Sequential' is chosen, it is possible to configure a delay between actions in seconds ('Add delay' button). However, if one of the actions fails, then the next actions will not be executed, and the automation stitch will stop.

 
To configure a trigger or update an existing one:
Select a trigger from the list, e.g., 'Network Down', and add events to which automation will react when executing the stitch:
  • Select 'Link monitor status' if the link monitor is configured.
  • Select 'Routing information changed' if SD WAN is configured with a performance SLA.
  • Select 'Interface status changed' if the physical status of the uplink should be monitored.
 
It is possible to add additional field filters for the automation to be triggered at specific values; however, it should match across the chosen events.
 
trigger.png

 

Not all the triggers can be edited if they are based on some singular FortiOS event, e.g., reboot or failover.

The trigger can also be configured as a recurring schedule (hourly, daily, etc) for a specific action:

 

schedule.PNG

 

Other possible triggers:

 

newstitch.PNG

 

To configure an action or update an existing one:

One of the most widespread actions is sending an email to the administrator after a specific event has happened. To configure it, select 'Default Email' on the Action page and specify the recipient(s) and subject:
 
email.PNG

 

Another popular activity is running a CLI script - for example, it can be used to restart a process if automation gets triggered by 'High CPU' or 'Conserve Mode' triggers. To configure it, choose 'Create New' on the Action page and find 'CLI Script':
 
cli.PNG

 

The commands can be either specified manually or recorded in the console widget.
 
Other possible actions:
 

actions2.PNG

 

Enhancements in automation stitches in FortiOS v7.2.0-v7.2.1 and up:
 
New automation triggers were added:
  • Local Certificate Expiry: specify the certificate name to execute.
  • Separate triggers based on Event logs, such as Virus Logs, SSH logs, IPS Logs, Webfilter violations, etc.
  • Schedule-based trigger allows to configure a one-time action, not only a recurrent.
 
Example of CLI configuration:
 
Default automation stitch to send an email when a network goes down.
 
config system automation-stitch
    edit "Network Down"
        set status enable
        set trigger "Network Down"
            config actions
                edit 1
                    set action "Default Email"
                next
            end
     next   
 end
 
Default automation trigger for when a network connection goes down.
 
config system automation-trigger
    edit "Network Down"
        set event-type event-log
        set logid 22922 22921 -> ID of the Event logs chosen for this trigger.
    next
end
 
Default automation action to send an email:
 
config system automation-action
    edit "Default Email"
        set action-type email
        set email-from <Email sender name>
        set email-to <email-address>
        set email-subject <subject-name>
        set minimum-interval <seconds> -> Default value is 0.
    next
end

To debug the automation stitch, the debug commands below can be used:
 
diagnose debug application autod -1
diagnose debug enable

Terms & ConditionsAccessibility statement