Rest api usage

[kartofflarna]

Hi,

I am setting up a new 30E firewall for a small office and for once I had some time on my hands so I thought I would play around a little bit with the rest API for learning purposes since it would help out with managing other firewalls.

So I read through the reference guide http://docs.fortinet.com/d/fortiweb-5.5-restful-api-reference which seems pretty straight forward. However I get stuck right from the bat.

testing out the initial example: curl -H "Authorization: YWRtaW46" -k "https://172.22.10.74:90/api/v1.0/System/Network/StaticRoute"

But I get no response.

The firewall arrived with fortios v5.4.1 which I think has api v2 so I tried changing the url accordingly but with no difference

I cannot find anywhere to verify which api version my firewall is using, also I am lacking information in the reference guide on weather I have to manually enable the api or not.

I'm sure I'm just missing something, can someone here see any obvious signs?

[nelis99 · Accepted solution]

If anyone is interested here is a powershell call for it as well (@markonans tx for curl example to build from).

$fwaddress = "192.168.1.99"

$postParams = @{username='myadminacct';secretkey='PASSWORD'} $request = Invoke-WebRequest -Headers $headers -Uri "https://$fwaddress/logincheck" -SessionVariable fgtSession -Method POST -Body $postParams

$headers = New-Object "System.Collections.Generic.Dictionary[[String],[String]]" $headers.Add('Accept','application/json') $headers.Add('Content-Type','application/json')

$request = Invoke-WebRequest -Headers $headers -Uri "https://$fwaddress/api/v2/monitor/router/ipv4/" -WebSession $fgtSession -Method GET write-host $request.Content

[alk0v · Accepted solution]

Hi, all. Next example working with FG-300 v.5.4 and PHP

$fghost = "myfg.loc"; $fglogin = "admin"; $fgpass = "supersecret";

$url = '[link]https://'.$fghost.'/logincheck';[/link]

$data = array('username'=>$fglogin,'secretkey'=>$fgpass); $post_data = http_build_query($data);

$curl_connection = curl_init($url);

curl_setopt($curl_connection, CURLOPT_SSL_VERIFYPEER, FALSE); curl_setopt($curl_connection, CURLOPT_POST, TRUE); curl_setopt($curl_connection, CURLOPT_POSTFIELDS, $post_data); curl_setopt($curl_connection, CURLOPT_RETURNTRANSFER, TRUE); curl_setopt($curl_connection, CURLOPT_HEADER, TRUE);

$response = curl_exec($curl_connection);

preg_match_all('/^Set-Cookie:\s*([^;]*)/mi', $response, $matches);

$curl_connection = curl_init('[link]https://'.$fghost.'/api/v2/cmdb/firewall/vip/');[/link] curl_setopt($curl_connection, CURLOPT_SSL_VERIFYPEER, FALSE); curl_setopt($curl_connection, CURLOPT_COOKIE, $matches[1][0]); $response = curl_exec($curl_connection);

echo ($responce);

curl_close($curl_connection);

[kartofflarna]

That was a bad example I'm so frustrated I've been trying around with anything I can find on the web, that particular line and document is for the fortiweb appliance. I'm starting to doubt the very existance of the rest api on the fortigate, does it exist or did I dream?

[kartofflarna]

So I found out it is working but I only have access from the browser on 

https://192.168.1.99/api/v2/monitor/system/interface However I am not able to curl it with:

curl -H "Authorization: YWRtaW46" -k "https://192.168.1.99/api/v2/monitor/system/interface"

I get a 401 Authorization required

[kartofflarna]

All the admin guides I find seem to be off, I dont think the firewall accepts basic authentication, does anyone know the url to create an authentication token?

[pcraponi]

Hi,

Official API documentation is paid.... The product is "Fortinet Developer Network" https://www.fortinet.com/content/dam/fortinet/assets/data-sheets/Fortinet_Developer_Network.pdf

But... you can start accessing "/logincheck" on your fortigate device to generate the authentication token for the REST API ;)

Regards,

Paulo Raponi, NSE8

[kartofflarna]

hmm okay, will mess around with that some more initial test just gave me 302 error though.

[MikePruett]

The API is wicked awesome and incredibly powerful. You have to have the developer network to get the great prebuilt tools etc that exist (saves you SO MUCH TIME).

I witnessed a wonderful demo of it at the Fortinet XTreme Team 2016 USA event.

[chrisp]

the only way to use API is to pay ?

do I understand it correctly? 

if not why is it so difficult to find the correct format for curl with authentication?

[Baptiste]

No, if you know two FTNT guys, you can join for free for a basic access :

https://fndn.fortinet.net/index.php?/login/

https://www.fortinet.com/content/dam/fortinet/assets/data-sheets/Fortinet_Developer_Network.pdf

[arosenblatt]

So, I went to sign up for the FDN since I desperately need this API that doesn't appear to to be mentioned in any of the docs I've read. On the sign-up form is this: "All new accounts require two Fortinet Sponsors. Sponsors are Fortinet employees that can confirm your identity and validate your need for an FNDN account. Please enter emails of your Sponsors in the fields below." Are you kidding me? I need Fortinet employee sponsorship (plus apparently paying, based on the PDF linked earlier in this thread) to gain access to the API docs and tools for the devices we've already purchased? I can't even find mention of the developer network on the main Fortinet web site.  So, what's the next step here for a pleb like me?