New Member

Solved

Rest api usage

Forum|Forum|9 years ago
January 11, 2017
3 replies
114102 views

Hi,

I am setting up a new 30E firewall for a small office and for once I had some time on my hands so I thought I would play around a little bit with the rest API for learning purposes since it would help out with managing other firewalls.

So I read through the reference guide http://docs.fortinet.com/d/fortiweb-5.5-restful-api-reference which seems pretty straight forward. However I get stuck right from the bat.

testing out the initial example: curl -H "Authorization: YWRtaW46" -k "https://172.22.10.74:90/api/v1.0/System/Network/StaticRoute"

But I get no response.

The firewall arrived with fortios v5.4.1 which I think has api v2 so I tried changing the url accordingly but with no difference

I cannot find anywhere to verify which api version my firewall is using, also I am lacking information in the reference guide on weather I have to manually enable the api or not.

I'm sure I'm just missing something, can someone here see any obvious signs?

Best answer by oheigl

Hi,

remove the GET parameter, it's not needed if you pass the API key via the header:

curl -k -o $IP-$D.conf -H "Authorization: Bearer $TOKEN" "https://$IP/api/v2/monitor/system/config/backup?scope=global"

Also you can have a look at the debug on the FortiGate (connect via SSH since GUI is also making API requests):

diag debug application httpsd -1
diag debug enable

And please upgrade your Firmware version, in 5.6.3 everything could be a bug

kartofflarnaAuthor

New Member

That was a bad example I'm so frustrated I've been trying around with anything I can find on the web, that particular line and document is for the fortiweb appliance. I'm starting to doubt the very existance of the rest api on the fortigate, does it exist or did I dream?

kartofflarnaAuthor

New Member

So I found out it is working but I only have access from the browser on

https://192.168.1.99/api/v2/monitor/system/interface However I am not able to curl it with:

curl -H "Authorization: YWRtaW46" -k "https://192.168.1.99/api/v2/monitor/system/interface"

I get a 401 Authorization required

kartofflarnaAuthor

New Member

All the admin guides I find seem to be off, I dont think the firewall accepts basic authentication, does anyone know the url to create an authentication token?

arosenblatt

New Member

Well, despite my earlier comment, I'm having issues running GET calls against the API. The docs read as follows:

"If login is successful, the response will contain the authentication token in the APSCOOKIE cookie value. This cookie value must be included in any further requests."

They do not say how that value should be included. Also, there is no actual APSCOOKIE cookie value but there is a APSCOOKIE_4055590611 cookie value, which is what I'm using. I've tried sending it as both an X-APSCOOKIE header and as an APSCOOKIE request parameter but I get a 401 each time. So, any word on how the API expects it to be provided or are we just supposed to guess?

oheigl

New Member

I tried it right now and yeah the APSCOOKIE value has some "random" number attached to it. I sent the cookie value back the same way as I got it, with the full number and can query the monitor API just fine.

I'm not sure how you try it, but if you use for example the python request library and only want to use the monitor API, you don't have to do anything with these values. Just login with a session object and a post request, then send a GET request to the monitor API.

s.post("https://ip:port/logincheck", data='username=admin&secretkey=password', verify=False)
result = s.get("https://ip:port/api/v2/monitor/firewall/policy/")

ciccio81

New Member

Hello everyone, not sure this thread is still active. I'm experiencing some problems as well with the password based authentication...I get the 3 different cookies, I passed them back in a POST request to close a session:

POST /api/v2/monitor/firewall/session/close?vdom=root HTTP/1.1 Host: 10.20.0.1 User-Agent: XXXX Accept: text/html Cookie: ccsrftoken_10656386745237807568="DCE862FD87E523BEE641546449B5AF3C"; APSCOOKIE_10656386745237807568="Era%3D0%26Payload%3DYMNNBUoKmNoiinWPLyZGSE8b++PURX2fjApAJHICiNOs6nJg5nZWzpy6qZbt4oET%0AvqeYC839nOfmZIyC7KEXGHuS43fnJXVJFCZrhCnzkZt66ouxIwbzhgoNsIeeiDpP%0AIO+TLdDC%2FVi80I1EFfGAjYSiQ6Nckwrkh4Oau7Yi6K1Lhv3%2FH13hdi9S79fb5H8u%0A0SdhT0P8kB69%2FY8i7IWudw%3D%3D%0A%26AuthHash%3DbC4cjbd9fNwWXsuBcP2TvWYQH2YA%0A"; ccsrftoken="DCE862FD87E523BEE641546449B5AF3C" Content-Length: 87 Content-Type: application/json {'pro':"TCP", 'saddr':"172.16.4.21", 'daddr':"172.16.4.1", 'sport':2489, 'dport':135}

But I get an error back (here the debugging output from FortiOS):

[httpsd 282 - 1511087694 info] handle_req_v2_vdom[2522] -- new API request (action='close',path='firewall',name='session',vdom='root',user='admin')

[httpsd 282 - 1511087694 error] is_valid_csrf_token[2845] -- no CSRF token found

[httpsd 282 - 1511087694 error] api_monitor_execute_handler[2400] -- no valid CSRF token found

Bear in mind that GET's always get through, even without a CSRF token, so requesting "api/v2/monitor/user/banned/select/" will always work after having successfully submitted credentials to "/logincheck"

Did anyone managed to send the 3 cookies back properly?

Thanks!

jeremyscline_FTNT

Staff

That is the API guide for FortiWeb, not the FortiGate. There are FortiOS API guides on FNDN - you will need to request sponsorship from someone you know at Fortinet. The guide for 5.4.1 is:

https://fndn.fortinet.net/index.php?/documents/file/9-fortios-54-rest-api-reference-541/

Sign up

Login with SSO

Login to the community

Login with SSO

Scanning file for viruses.

This file cannot be downloaded