| Description |
This article describes how to create a custom FortiAnalyzer report that gathers carrier-grade NAT session info and how to pull this information using Postman.
For the table to be populated, carrier-grade NAT sessions must be traversing the monitored FortiGate. Without live sessions, the report can still be run for testing purposes; however, session info will be blank. |
| Scope | Fortianalyzer v7.4/v7.6. |
| Solution |
This procedure is split into two parts:
Creating the reports: For the following section, download the attached custom chart, then import it into the chart library: Once imported, CGN - Chart1 will appear in the chart library, and CGN - Dataset1 will appear in Datasets. The dataset can be explored by selecting it:
Create a new report and navigate to the Editor tab. Next, insert the CGN - Chart1 by clicking the insert chart button:
Leave all settings as default for this demonstration and select Apply. These can be edited later as desired.
Now the report is ready to run. It can be run by selecting it in the All Reports tab and clicking Run Report. The resulting report will be placed in Generated Reports.
Create JSON RPC in Postman: For an introduction to using APIs and the FortiAnalyzer, look through the following article: Technical Tip: Using FortiManager FortiAnalyzer API
More information can also be found at the Fortinet Developer Network:
The first call is to use the login user, which has the following body:
The response will include the session ID, which will be referenced throughout the next calls:
To test whether the login has been successful and test the session ID, use the system status call:
Result:
Next, the layout ID of the report will need to be found with the following call:
Search the response for the name of the chart, and the layout ID will be referenced in this section:
Using the run report API, reference the layout ID, the session ID, as well as the source or destination address that is needed to look up the mapping for:
The response will reference the task ID (tid) of what has just been run:
The final step will be to pull the data from the report:
In the response, the IP mapping for 10.1.1.1 is 203.0.113.110:
|
