Hi,
I am setting up a new 30E firewall for a small office and for once I had some time on my hands so I thought I would play around a little bit with the rest API for learning purposes since it would help out with managing other firewalls.
So I read through the reference guide http://docs.fortinet.com/d/fortiweb-5.5-restful-api-reference which seems pretty straight forward. However I get stuck right from the bat.
testing out the initial example: curl -H "Authorization: YWRtaW46" -k "https://172.22.10.74:90/api/v1.0/System/Network/StaticRoute"
But I get no response.
The firewall arrived with fortios v5.4.1 which I think has api v2 so I tried changing the url accordingly but with no difference
I cannot find anywhere to verify which api version my firewall is using, also I am lacking information in the reference guide on weather I have to manually enable the api or not.
I'm sure I'm just missing something, can someone here see any obvious signs?
Solved! Go to Solution.
Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
If anyone is interested here is a powershell call for it as well (@markonans tx for curl example to build from).
$fwaddress = "192.168.1.99"
$postParams = @{username='myadminacct';secretkey='PASSWORD'} $request = Invoke-WebRequest -Headers $headers -Uri "https://$fwaddress/logincheck" -SessionVariable fgtSession -Method POST -Body $postParams
$headers = New-Object "System.Collections.Generic.Dictionary[[String],[String]]" $headers.Add('Accept','application/json') $headers.Add('Content-Type','application/json')
$request = Invoke-WebRequest -Headers $headers -Uri "https://$fwaddress/api/v2/monitor/router/ipv4/" -WebSession $fgtSession -Method GET write-host $request.Content
Hi, all. Next example working with FG-300 v.5.4 and PHP
$fghost = "myfg.loc"; $fglogin = "admin"; $fgpass = "supersecret";
$url = '[link]https://'.$fghost.'/logincheck';[/link]
$data = array('username'=>$fglogin,'secretkey'=>$fgpass); $post_data = http_build_query($data);
$curl_connection = curl_init($url);
curl_setopt($curl_connection, CURLOPT_SSL_VERIFYPEER, FALSE); curl_setopt($curl_connection, CURLOPT_POST, TRUE); curl_setopt($curl_connection, CURLOPT_POSTFIELDS, $post_data); curl_setopt($curl_connection, CURLOPT_RETURNTRANSFER, TRUE); curl_setopt($curl_connection, CURLOPT_HEADER, TRUE);
$response = curl_exec($curl_connection);
preg_match_all('/^Set-Cookie:\s*([^;]*)/mi', $response, $matches);
$curl_connection = curl_init('[link]https://'.$fghost.'/api/v2/cmdb/firewall/vip/');[/link] curl_setopt($curl_connection, CURLOPT_SSL_VERIFYPEER, FALSE); curl_setopt($curl_connection, CURLOPT_COOKIE, $matches[1][0]); $response = curl_exec($curl_connection);
echo ($responce);
curl_close($curl_connection);
Hi,
remove the GET parameter, it's not needed if you pass the API key via the header:
curl -k -o $IP-$D.conf -H "Authorization: Bearer $TOKEN" "https://$IP/api/v2/monitor/system/config/backup?scope=global"
Also you can have a look at the debug on the FortiGate (connect via SSH since GUI is also making API requests):
diag debug application httpsd -1
diag debug enable
And please upgrade your Firmware version, in 5.6.3 everything could be a bug
Hi, Create api user, You will get api key token.
then curl -k https://<deviceipaddress>/api/v2/cmdb/firewall/address?vdom=root&access_token=<apikeytokenhere>
SW INFO: -fortigate version
Version: FortiGate-VM64-KVM v6.2.1,build0932,190716 (GA)
CONFIG:
# show system api-user config system api-user edit "api-admin" set api-key ENC SH2PPzcc9QjwfKbZt65EU5ufPXSGvnazXmEJatKySDyFiAUjmbEk0ZEKRbXG2Q= set accprofile "super_admin" set vdom "root" config trusthost edit 1 set ipv4-trusthost 10.0.1.70 255.255.255.255 next end next end
PROBLEMS: # curl -k http://10.0.1.51/api/v2/c...x4gwhH53jb551QrbQwkG58 [1] 28518 root@eve-ng:~# <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <HTML><HEAD> <TITLE>401 Authorization Required</TITLE> </HEAD><BODY> <H1>Authorization Required</H1> This server could not verify that you are authorized to access the document requested. Either you supplied the wrong credentials (e.g., bad password), or your browser doesn't understand how to supply the credentials required.<P> <P>Additionally, a 401 Authorization Required error was encountered while trying to use an ErrorDocument to handle the request. </BODY></HTML>
QUESTIONS:
1. I got above error with those config, although I am using super_admin profile
What's wrong with step?
In curl, I can only using http because I am using trial license
tq
Pass the header in the header field.
https://socpuppet.blogspot.com/2019/09/howto-use-fortios-apiuser.html
Header set with curl and "-H" option, this is required.
"Authorization: Bearer 6qQyk7Q3Hpz8k6z74161xG0Q5GNkpn"
BTW, I'm like 100% sure the API will not work over HTTP, but double-check. In real life nobody will send credentials over unsecured HTTP.
Ken Felix
Ken Felix
PCNSE
NSE
StrongSwan
emnoc wrote:
BTW, I'm like 100% sure the API will not work over HTTP, but double-check. In real life nobody will send credentials over unsecured HTTP.
This is correct - API keys can only be used over HTTPS.
@emnoc
I am following your way, but I still got error 403
Here my steps
STEPS TAKEN https://github.com/Nevets82/Posh-FortiGate config system accprofile edit "readonly_admin" set mntgrp read set admingrp read set updategrp read set authgrp read set sysgrp read set netgrp read set loggrp read set routegrp read set fwgrp read set vpngrp read set utmgrp read set wanoptgrp read set endpoint-control-grp read set wifi read next end config system admin edit readonly_user set trusthost1 192.168.88.70 255.255.255.255 set accprofile readonly_admin set comments "User for PowerShell backup and troubleshooting tasks" set vdom root set password P@ssw0rd next end config system api-user edit api-readonly_user set accprofile readonly_admin set vdom root config trusthost edit 1 set ipv4-trusthost 192.168.88.70 255.255.255.255 end end # execute api-user generate-key api-readonly_user New API key: mrfQbbhnwsp39HQmtkjw4N6HxyNgmm NOTE: The bearer of this API key will be granted all access privileges assigned to the api-user api-admin. # cat fortibackup.sh #/bin/bash IP=192.168.88.41 TOKEN=mrfQbbhnwsp39HQmtkjw4N6HxyNgmm D=`date +%F_%T` curl -k -o $IP-$D.conf -H "Authorization: Bearer $TOKEN" "https://$IP/api/v2/monitor/system/config/backup/?scope=global&access_token=$TOKEN" exit PROBLEMS: # ./fortibackup.sh # cat 192.168.88.41-2019-11-21_14\:58\:15.conf { "http_method":"GET", "status":"error", "http_status":403, "vdom":"root", "path":"system", "name":"config", "action":"backup", "serial":"FGT80C3909631394", "version":"v5.6.3", "build":1547 } QUESTIONS: [ol]
emnoc wrote:Pass the header in the header field.
https://socpuppet.blogspot.com/2019/09/howto-use-fortios-apiuser.html
Header set with curl and "-H" option, this is required.
"Authorization: Bearer 6qQyk7Q3Hpz8k6z74161xG0Q5GNkpn"
BTW, I'm like 100% sure the API will not work over HTTP, but double-check. In real life nobody will send credentials over unsecured HTTP.
Ken Felix
Ken Felix
Hi,
remove the GET parameter, it's not needed if you pass the API key via the header:
curl -k -o $IP-$D.conf -H "Authorization: Bearer $TOKEN" "https://$IP/api/v2/monitor/system/config/backup?scope=global"
Also you can have a look at the debug on the FortiGate (connect via SSH since GUI is also making API requests):
diag debug application httpsd -1
diag debug enable
And please upgrade your Firmware version, in 5.6.3 everything could be a bug
You are correct guru
1. modify accprofile mntgrp
-turn on debug
diag debug application httpsd -1 diag debug enable
I can see, maintenance group complain about write permission
-modify
config system accprofile edit "readonly_admin" set mntgrp read change to config system accprofile edit "readonly_admin" set mntgrp read-write 2. modify this curl -k -o $IP-$D.conf -H "Authorization: Bearer $TOKEN" "https://$IP/api/v2/monitor/system/config/backup/?scope=global" RESULT: 1. I can get the config but not full config. How do I know that, because full config usually 500kb, while this is 125kb QUESTIONS: 1. How to get full configI don't think it's possible, because you can't even select something like that via the GUI, only via CLI.
But the full configuration just adds all the default values, so it's not useful anyway, or what would you like to achieve?
Full configuration is useful in case I need to keep my public key.
Public key won't appear in standard config.
Unless I need to take note which Fortigate has public key and what the key
QUESTIONS: 1. beside Public key. In what case do I need full-config actually I am curios why full-config is created.
Must a be a reason for that
2. Can I restore using full-config
tq
I just tried a configuration backup and the certificate with the public and private key is in there, without a full configuration. The full configuration is useful to check if default values have changed or something like that, but other then that I can't see a reason why you would need it. Maybe in older FortiOS versions the keys weren't backuped, can't remember exactly.
Kind regards
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
User | Count |
---|---|
1711 | |
1093 | |
752 | |
447 | |
231 |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.