Some devices accessing fortigate via rest gets blocked

Forum|Forum|4 years ago
April 6, 2022
3 replies
3266 views

Hi,

We have a fortigate (cluster/HA), running 6.4.6 and have started to pull some info using rest from external systems.

We have ran into some problems though.

Some servers get blocked by the default policy 0 (deny all) stating threat 262144 while other machines can access the fw information via the rest account without problem.

We're running using a token at this moment and web access (port 443) using curl.

Some special local-in policy required or?

Any ideas?
Kenth
FortiGate

FortiGate

Yurisk

SuperUser

Are other querying machines coming from the same IP address?

When allowing API access to api-user pay attention that allowed IP of this user shoulde be a SUBSET of the trusted host(s) used in any of the admin users.

As the last option - you can run debug and try to understand, but make sure no one works on the GUI as admin, as you will get a lot of output. Save the output to a log file for further analysis.

dia debug enable diagnose debug httpsd -1 diagnose debug application httpsd -1

yurisk.info - all things Fortinet blog, no ads

KenthAuthor

Explorer

Hi Yuri,
So if I understand you correctly the ip for the device making the request should come from an ip or subnet that is allowed for an admin account (not the rest admin account but the "real" admin accounts) as well?

We have tried with restadmin account with no trusted hosts set for it as well as trusted hosts on ip or subnet fort the restadmin but that did not make any difference.

I'l run the diags as well to get better logs.