Rest api usage

[kartofflarna]

Hi,

I am setting up a new 30E firewall for a small office and for once I had some time on my hands so I thought I would play around a little bit with the rest API for learning purposes since it would help out with managing other firewalls.

So I read through the reference guide http://docs.fortinet.com/d/fortiweb-5.5-restful-api-reference which seems pretty straight forward. However I get stuck right from the bat.

testing out the initial example: curl -H "Authorization: YWRtaW46" -k "https://172.22.10.74:90/api/v1.0/System/Network/StaticRoute"

But I get no response.

The firewall arrived with fortios v5.4.1 which I think has api v2 so I tried changing the url accordingly but with no difference

I cannot find anywhere to verify which api version my firewall is using, also I am lacking information in the reference guide on weather I have to manually enable the api or not.

I'm sure I'm just missing something, can someone here see any obvious signs?

[nelis99 · Accepted solution]

If anyone is interested here is a powershell call for it as well (@markonans tx for curl example to build from).

$fwaddress = "192.168.1.99"

$postParams = @{username='myadminacct';secretkey='PASSWORD'} $request = Invoke-WebRequest -Headers $headers -Uri "https://$fwaddress/logincheck" -SessionVariable fgtSession -Method POST -Body $postParams

$headers = New-Object "System.Collections.Generic.Dictionary[[String],[String]]" $headers.Add('Accept','application/json') $headers.Add('Content-Type','application/json')

$request = Invoke-WebRequest -Headers $headers -Uri "https://$fwaddress/api/v2/monitor/router/ipv4/" -WebSession $fgtSession -Method GET write-host $request.Content

[alk0v · Accepted solution]

Hi, all. Next example working with FG-300 v.5.4 and PHP

$fghost = "myfg.loc"; $fglogin = "admin"; $fgpass = "supersecret";

$url = '[link]https://'.$fghost.'/logincheck';[/link]

$data = array('username'=>$fglogin,'secretkey'=>$fgpass); $post_data = http_build_query($data);

$curl_connection = curl_init($url);

curl_setopt($curl_connection, CURLOPT_SSL_VERIFYPEER, FALSE); curl_setopt($curl_connection, CURLOPT_POST, TRUE); curl_setopt($curl_connection, CURLOPT_POSTFIELDS, $post_data); curl_setopt($curl_connection, CURLOPT_RETURNTRANSFER, TRUE); curl_setopt($curl_connection, CURLOPT_HEADER, TRUE);

$response = curl_exec($curl_connection);

preg_match_all('/^Set-Cookie:\s*([^;]*)/mi', $response, $matches);

$curl_connection = curl_init('[link]https://'.$fghost.'/api/v2/cmdb/firewall/vip/');[/link] curl_setopt($curl_connection, CURLOPT_SSL_VERIFYPEER, FALSE); curl_setopt($curl_connection, CURLOPT_COOKIE, $matches[1][0]); $response = curl_exec($curl_connection);

echo ($responce);

curl_close($curl_connection);

[oheigl]

Can't you ask your Fortinet Account Manager to provide you with it? I think getting these two sponsors shouldn't be too hard. Also if you just want to access the API here is a link to a GIT repository where the access is implemented in python (it's managed by a Fortinet employee). Check out the fortiosapi.py regarding the connection to the API, and the testssh.py for examples on how to get information out of it.

I think this will help you more than any docs 

https://github.com/fortinet-solutions-cse/fortiosapi

[arosenblatt]

Alright, I have the API working now in an API tester. How long is the CSRF token good for before it expires?

For the person who was originally asking, the docs on the Fortinet site are indeed just plain wrong and it does not use a standard http auth header at all. the PDF linked earlier describes the correct method for authentication but it's not terribly clear in how it does so (and actually seems like it might be self-contradictory, even), so here's the skinny.

Start with a POST to /logincheck that has the fields 'username' and 'secretkey' as the POST data, with their appropriate admin username and password values set. This will return a cookie with the field ccsrftoken (yes, two 'c's). For your next request, ditch the auth post data and set the "X-CSRFTOKEN" http header to be the value of that cookie field, and you should be good to go. 

[arosenblatt]

Follow-up: Using my IDE's REST client, I'm able to do the auth process and get my CSRF token just fine. However, when I use cURL to do this programmatically, all of my cookie values come back as "0&260" (this might have actually been "0&0", as "%26" is the url-encoded form of "&"). I'm pretty much stuck now as I can;t seem to determine what's happening here. Any suggestions would be greatly appreciated.

[arosenblatt]

Well, despite my earlier comment, I'm having issues running GET calls against the API. The docs read as follows:

"If login is successful, the response will contain the authentication token in the APSCOOKIE cookie value. This cookie value must be included in any further requests."

They do not say how that value should be included. Also, there is no actual APSCOOKIE cookie value but there is a APSCOOKIE_4055590611 cookie value, which is what I'm using. I've tried sending it as both an X-APSCOOKIE header and as an APSCOOKIE request parameter but I get a 401 each time.  So, any word on how the API expects it to be provided or are we just supposed to guess?

[oheigl]

I tried it right now and yeah the APSCOOKIE value has some "random" number attached to it. I sent the cookie value back the same way as I got it, with the full number and can query the monitor API just fine.

I'm not sure how you try it, but if you use for example the python request library and only want to use the monitor API, you don't have to do anything with these values. Just login with a session object and a post request, then send a GET request to the  monitor API.

s.post("https://ip:port/logincheck", data='username=admin&secretkey=password', verify=False)
result = s.get("https://ip:port/api/v2/monitor/firewall/policy/")

[ciccio81]

Hello everyone, not sure this thread is still active. I'm experiencing some problems as well with the password based authentication...I get the 3 different cookies, I passed them back in a POST request to close a session:

POST /api/v2/monitor/firewall/session/close?vdom=root HTTP/1.1 Host: 10.20.0.1 User-Agent: XXXX Accept: text/html Cookie: ccsrftoken_10656386745237807568="DCE862FD87E523BEE641546449B5AF3C"; APSCOOKIE_10656386745237807568="Era%3D0%26Payload%3DYMNNBUoKmNoiinWPLyZGSE8b++PURX2fjApAJHICiNOs6nJg5nZWzpy6qZbt4oET%0AvqeYC839nOfmZIyC7KEXGHuS43fnJXVJFCZrhCnzkZt66ouxIwbzhgoNsIeeiDpP%0AIO+TLdDC%2FVi80I1EFfGAjYSiQ6Nckwrkh4Oau7Yi6K1Lhv3%2FH13hdi9S79fb5H8u%0A0SdhT0P8kB69%2FY8i7IWudw%3D%3D%0A%26AuthHash%3DbC4cjbd9fNwWXsuBcP2TvWYQH2YA%0A"; ccsrftoken="DCE862FD87E523BEE641546449B5AF3C" Content-Length: 87 Content-Type: application/json {'pro':"TCP", 'saddr':"172.16.4.21", 'daddr':"172.16.4.1", 'sport':2489, 'dport':135}

But I get an error back (here the debugging output from FortiOS):

[httpsd 282 - 1511087694     info] handle_req_v2_vdom[2522] -- new API request (action='close',path='firewall',name='session',vdom='root',user='admin')[httpsd 282 - 1511087694    error] is_valid_csrf_token[2845] -- no CSRF token found[httpsd 282 - 1511087694    error] api_monitor_execute_handler[2400] -- no valid CSRF token found

Bear in mind that GET's always get through, even without a CSRF token, so requesting "api/v2/monitor/user/banned/select/" will always work after having successfully submitted credentials to "/logincheck"

Did anyone managed to send the 3 cookies back properly?

Thanks!

[oheigl]

I think your ccsrftoken cookie is wrong. At least for me it looks something like this, not with an underscore and a number as name:

ccsrftoken="C95D2......4A1D80"

Also GET requests don't need a ccsrftoken, only POST and PUT (configuration changes) requests need to have it.

EDIT: A never mind, seems it's further down and correct, hmmm

[markonans]

Working commands

curl -k -v -c fgt.txt -d username=admin -d secretkey=PASSWORD "https://192.168.128.2:4443/logincheck" curl -k --cookie fgt.txt -i -H "Accept: application/json" -H "Content-Type: application/json" -X GET "https://192.168.128.2:4443/api/v2/monitor/router/ipv4/"

[nelis99 · Accepted solution]

If anyone is interested here is a powershell call for it as well (@markonans tx for curl example to build from).

$fwaddress = "192.168.1.99"

$postParams = @{username='myadminacct';secretkey='PASSWORD'} $request = Invoke-WebRequest -Headers $headers -Uri "https://$fwaddress/logincheck" -SessionVariable fgtSession -Method POST -Body $postParams

$headers = New-Object "System.Collections.Generic.Dictionary[[String],[String]]" $headers.Add('Accept','application/json') $headers.Add('Content-Type','application/json')

$request = Invoke-WebRequest -Headers $headers -Uri "https://$fwaddress/api/v2/monitor/router/ipv4/" -WebSession $fgtSession -Method GET write-host $request.Content

[alk0v · Accepted solution]

Hi, all. Next example working with FG-300 v.5.4 and PHP

$fghost = "myfg.loc"; $fglogin = "admin"; $fgpass = "supersecret";

$url = '[link]https://'.$fghost.'/logincheck';[/link]

$data = array('username'=>$fglogin,'secretkey'=>$fgpass); $post_data = http_build_query($data);

$curl_connection = curl_init($url);

curl_setopt($curl_connection, CURLOPT_SSL_VERIFYPEER, FALSE); curl_setopt($curl_connection, CURLOPT_POST, TRUE); curl_setopt($curl_connection, CURLOPT_POSTFIELDS, $post_data); curl_setopt($curl_connection, CURLOPT_RETURNTRANSFER, TRUE); curl_setopt($curl_connection, CURLOPT_HEADER, TRUE);

$response = curl_exec($curl_connection);

preg_match_all('/^Set-Cookie:\s*([^;]*)/mi', $response, $matches);

$curl_connection = curl_init('[link]https://'.$fghost.'/api/v2/cmdb/firewall/vip/');[/link] curl_setopt($curl_connection, CURLOPT_SSL_VERIFYPEER, FALSE); curl_setopt($curl_connection, CURLOPT_COOKIE, $matches[1][0]); $response = curl_exec($curl_connection);

echo ($responce);

curl_close($curl_connection);