Technical Tip: How to create and generate Fabric Authorization Template using the API

Description

This article describes how to create a Fabric Authorization Template in FortiManager using the API.

Scope

FortiManager.

Solution

Fabric authorization templates can be used to allow FortiManager to automatically authorize FortiAP, FortiSwitch, and FortiExtender devices, as well as optionally apply profiles to them. Refer to the document Fabric authorization template for the workflow.

1. Create a Model Device.

Create a Model Device; refer to Technical Tip: How to add a model device to FortiManager using the API.

2. Create the Template.
   
   

{
    "id": "3",
    "method": "add",
    "params": [
        {
            "url": "pm/config/adom/{{ADOM}}/obj/fmg/fabric/authorization/template",
            "data": [
                {
                    "name": "Fabric_Auth_Temp",
                    "description": "",
                    "extender-controller": "enable",
                    "switch-controller": "enable",
                    "wireless-controller": "enable",
                    "platforms": [
                        {
                            "count": "5",
                            "prefix": "FP231K",
                            "type": "ap",
                            "wtpprof": "Test_FAP_Profile"
                        },
                        {
                            "count": "1",
                            "fortilink": "fortilink",
                            "prefix": "S108FN",
                            "type": "switch",
                            "fspprof": "Test_FSW_Template"
                        },
                        {
                            "count": "1",
                            "prefix": "FX04DA", 
                            "type": "extender",
                            "fxtprof": "Test_FEX_Template",
                            "extension-type": "wan-extension"
                        }
                    ]
                }
            ]
        }
    ],
    "session": "{{session}}",
    "verbose": 1
}

Explanation of fields:

• count = Number of Devices.

• prefix = Prefix of the Device, for example, for FortiAP 231K, is set to 'FP231K'.

• type = Type of Device, 'ap', 'switch', or 'extender'.

• extension-type = Type of FortiExtender Extension. Values can be 'wan-extender' or 'lan-extender'.

FortiManager v8.0.0 and higher fields only:

• wtpprof = FortiAP Profile. Select any existing profile; if left empty, the default template for that model will be applied.

• fspprof = FortiSwitch Template. Select any existing profile; if left empty, no template will be assigned.

• fxtprof = FortiExtender Template. Select any existing profile; if left empty, the default template for that model will be applied.
  
  

3. Generate a template for a FortiGate.
   
   

{
    "id": "4",
    "method": "exec",
    "params": [
        {
            "url": "securityconsole/generate/device/controllers",
            "data": {
                "adom": "{{ADOM_NAME}}",
                "template": "<FABRIC_TEMPLATE_NAME>",
                "scope": [
                    {
                        "name": "<FORTIGATE_NAME>",
                        "vdom": "root"
                    }
                ]
            }
        }
    ],
    "session": "{{session}}",
    "verbose": 1
}

This generates Model FortiAP, FortiSwitch and FortiExtender for the selected FortiGate, which can be verified under AP Manager, FortiSwitch Manager and Extender Manager respectively.

Note:

To get the current Fabric Authorization Templates:

{
    "id": "2",
    "method": "get",
    "params": [
        {
            "url": "pm/config/adom/{{ADOM_NAME}}/obj/fmg/fabric/authorization/template",
            "option": [
                "extra info"
            ]
        }
    ],
    "session": "{{session}}",
    "verbose": 1
}

To delete a template:

{
    "id": "4",
    "method": "delete",
    "params": [
        {
            "url": "pm/config/adom/{{ADOM_NAME}}/obj/fmg/fabric/authorization/template",
            "confirm": 1,
            "filter": [
                "name",
                "in",
                "<NAME_OF_TEMPLATE>"
            ]
        }
    ],
    "session": "{{session}}",
    "verbose": 1
}

Troubleshooting:

API Call fails to create the template with the error:

"message": 
"invalid value - prop[fabric authorization template]: Default profile FAP231K-default for platform FP231K does not exist, cannot be used in template"

To fix the issue, create a new FortiAP Profile under: AP Manager -> Operation Profiles -> FortiAP Profiles. Set the Name to match the one shown in error.

The following commands can be used on the FortiManager CLI to debug the API calls:

diagnose debug service httpd 255
diagnose debug service main 255
diagnose debug enable

Postman API Collection for quick use: Fabric_Authorization_Template.