Technical Tip: FortiDeceptor quarantine integration with FortiGate over Webhook

[JerryQu]

Description	This article describes how to automatically perform to ban IP and unlock IP, when FortiDeceptor quarantine integration with FortiGate over Webhook.
Scope	FortiGate, FortiDeceptor, Webhook.
Solution	create an API account and an admin profile on the FortiGate: Config automation on the FortiGate, create an action profile, for example, IP ban: Create a trigger profile, for example, FDC_webhook_banip: Create a stitch policy, and select this action profile and this trigger profile: Above finish ban IP config on the FortiGate. Config automation again on the FortiGate, create an action profile , for example, FDC_unblock_ip: if VDOM, the script needs to add the VDOM name, for example: config vdom     edit root     diagnose user banned-ip delete src4 %%log.srcip%% Create a trigger profile, for example, FDC_webhook_unlock: Create a stitch policy, and select this action profile and this trigger profile: Finish all on the FortiGate. Config quarantine integration on the FortiDeceptor: Integrate method select FGT-WEBHOOK. Block Expiry is user-defined ,for example 600s. ban URL and unlock URL ,  you can copy  the Incoming webhook triggle‘s URL on the FortiGate . Authorization is API account secret key on the FortiGate. Result: Related document: Integration with FortiGate over Webhook