Technical Tip: FortiGate automation using webhook to update address group in FortiManager

Description

This article describes how to use a webhook automation stitch action to update an address group (add/append new address object) for a managed FortiGate in FortiManager.

Scope

FortiGate, FortiManager.

Solution

In scenarios where the automation stitches (either directly or via the FortiAnalyzer Event Handler) are used on a managed FortiGate to create address objects based on banned IP addresses and add the address object to an address group which is used in a firewall policy to block access, this change does not get updated in the FortiManager ADOM DB (Policy & Objects) automatically. As a reuslt, upon the next policy install from FortiManager, the address object is deleted.

The solution in this case is to use Webhook Action on the FortiGate automation stitch to connect to FortiManager and update the address group by first creating the new address object and then adding it to an address group in the ADOM DB.

1. Create an automation stitch.

Refer to the article Technical Tip: How to permanently block SSL VPN failed logins using an Automation Stitch, which describes how to make an Automation stitch that monitors and adds remote IP addresses associated with failed SSL VPN logins to a permanent block list (any other IP block scenario can also be considered).

The same automation stitch can also be created from FortiManager as well: FortiManager -> Device Manager -> Device & Groups -> Select a FortiGate -> Security Fabric -> Automation Stitch.

2. Create a FortiManager API admin.

To create an API Admin user in FortiManager, refer to Creating administrators for the FortiManager API, set JSON API Access 'Read-Write' and set the FortiGate IP address as a trusted host. Keep the API safe which will be used later.

Recommendation: Create a new Admin Profile in FortiManager for this API user to restrict to 'Read-Write' access only on 'Policy Package & Objects' and for the rest set them to 'Read-Only' access. Refer to Administrator profiles and Permissions.

3. Create webhook actions.

Under FortiManager -> Device Manager -> Device & Groups -> Select a FortiGate -> Security Fabric -> Automation Action -> Create New:

(If Automation Stitch/Action/Trigger are not visible, use Feature Visibility to enable it.)

• Name: Create_Address_Object

• Type: Webhook

• Protocol: HTTPS

• URL: <FortiManager_IP_or_FQDN>/jsonrpc

• Port: 443 (or FortiManager admin access port)

• Method: POST

• HTTP body:

{
    "method": "set",
    "params": [
        {
            "data": [
                {
					"name": "SSLVPN-Block-%%log.remip%%",
					"type": "ipmask",
					"obj-type": "ip",
					"subnet": "%%log.remip%%/32"
                }
            ],
            "url": "pm/config/adom/root/obj/firewall/address"
        }
    ],
    "id": "1"
}

• HTTP header:

  • Name = Content-Type, Value = 'application/json'.

  • Name = Authorization, Value = 'Bearer X', where X is the FortiManager API key from step 2.

Under Advanced Options: keep the 'verify-host-cert' on whether FortiManager has a custom certificate (set for HTTPS access) with IP/FQDN set as SAN (recommended) - otherwise, turn it off.

Create another webhook action to append the newly created address object to an existing address group, and keep all of the same config. The only difference will be the HTTP body:

• Name: Append_to_Group

• HTTP body:

The following script will append the member to an existing address group without overwriting the existing one:

{
    "method": "add",
    "params": [
        {
            "data": [
                "SSLVPN-Block-%%log.remip%%"
            ],
            "url": "pm/config/adom/root/obj/firewall/addrgrp/VPN_Failed_Login/member"
        }
    ],
    "id": "2"
}

In the 'url' of the HTTP Body, 'root' refers to the root ADOM of FortiManager and VPN_Failed_Login is the address group that should be present in FortiManager ADOM DB (Policy & Objects -> Firewall Objects -> Address).

4. Add webhook actions to automation stitch.

Go to the automation stitch created in Step 1: FortiManager -> Device Manager -> Device & Groups -> Select a FortiGate -> Security Fabric -> Automation Stitch and edit the stitch.

Under Action, use the '+' to add the newly created webhook actions in order.

5. Install changes to FortiGate.

Finally, use the Install Wizard to push the automation stitch changes to the FortiGate.

Troubleshooting:

On FortiGate, use the following command to debug the automation stitch:

diagnose debug app autod -1
diagnose debug enable

On FortiManager, use the following debug commands:

diagnose debug application auth 255
diagnose debug service httpd 255
diagnose debug service main 255
diagnose debug enable