Technical Tip: FortiGate REST API access using PKI group

Description

This article provides a basic guideline to access FortiGate using REST API access with a PKI group. For detailed documents and tools, join the Fortinet Developer Network.

Scope

FortiOS 7.2.x, 7.4.x, 7.6.x, 8.0.x.

Solution

This article includes a configuration from scratch - creating user.peer, group and enabling peer-auth for an api-user.

1. Create a user.peer:

config user peer
    edit "peer01"
        set ca "ACCVRAIZ1"
    next
end

2. Create a user.group, and make user.peer a member of this group. Do not create peer.group under 'config user peergrp':

config user group
    edit "pkiggg"
        set member "1"
    next
end

3. Enable peer-auth and select the created user.group in 'config system api-user':

config system api-user
    edit "apiadm01"
        set peer-auth enable
        set peer-group 
name    set user group name
---VDOM:root---
pkiggg   

Here, 'pkiggg' is the created user.group in step #2.

4. Test authentication on FortiGate in curl. Successful output is shown below:

curl --key ./<user private key> --cert <user certificate> -v --cacert <CA certtificate> https://<FQDN>/api/v2/cmdb/firewall/address/?access_token=<put the token after generation> --tlsv1.2

curl --key ./useKeyr.pem --cert ./user.crt -v --cacert /etc/ssl/certs/Fortinet_CA https://FGVM020000158352/api/v2/cmdb/firewall/address/?access_token=t9t4sm6qpwHr8qGpyb3xy9ybts1t8r --tlsv1.2

* Server certificate:
* subject: C=US; ST=California; L=Sunnyvale; O=Fortinet; OU=FortiGate; CN=FGVM020000158352; emailAddress=support@fortinet.com
* start date: Oct 23 11:04:36 2019 GMT
* expire date: Jan 19 03:14:07 2056 GMT
* common name: FGVM020000158352 (matched)
* issuer: C=US; ST=California; L=Sunnyvale; O=Fortinet; OU=Certificate Authority; CN=fortinet-subca2001; emailAddress=support@fortinet.com
* SSL certificate verify ok.
> GET /api/v2/cmdb/firewall/address/?access_token=t9t4sm6qpwHr8qGpyb3xy9ybts1t8r HTTP/1.1
> Host: FGVM020000158352
> User-Agent: curl/7.58.0
> Accept: */*
>
< HTTP/1.1 200 OK
< Date: Wed, 08 Jul 2020 11:53:10 GMT
< Server: Apache
< X-Frame-Options: SAMEORIGIN
< Content-Security-Policy: frame-ancestors 'self'
< X-XSS-Protection: 1; mode=block
< Strict-Transport-Security: max-age=0
< X-UA-Compatible: IE=Edge
< Cache-Control: no-cache, must-revalidate
< ETag: 2a3997e13943e98865004c368a65a8de
< Content-Length: 7940
< Content-Type: application/json
<
{
"http_method":"GET",
"revision":"2a3997e13943e98865004c368a65a8de",
"results":[
{
"name":"FABRIC_DEVICE",
"q_origin_key":"FABRIC_DEVICE",
"uuid":"70ce8e32-b7a7-51ea-c80b-1fc1e86bfcfc",
"subnet":"0.0.0.0 0.0.0.0",
"type":"ipmask",
"sub-type":"sdn",
"clearpass-spt":"unknown",
"start-mac":"00:00:00:00:00:00",
"end-mac":"00:00:00:00:00:00",
"country":"",
"cache-ttl":0,
"sdn":"",
"fsso-group":[
],

Related document:

REST API administrator