Rest api usage

kartofflarna · ‎01-11-2017

Hi,

I am setting up a new 30E firewall for a small office and for once I had some time on my hands so I thought I would play around a little bit with the rest API for learning purposes since it would help out with managing other firewalls.

So I read through the reference guide http://docs.fortinet.com/d/fortiweb-5.5-restful-api-reference which seems pretty straight forward. However I get stuck right from the bat.

testing out the initial example: curl -H "Authorization: YWRtaW46" -k "https://172.22.10.74:90/api/v1.0/System/Network/StaticRoute"

But I get no response.

The firewall arrived with fortios v5.4.1 which I think has api v2 so I tried changing the url accordingly but with no difference

I cannot find anywhere to verify which api version my firewall is using, also I am lacking information in the reference guide on weather I have to manually enable the api or not.

I'm sure I'm just missing something, can someone here see any obvious signs?

nelis99 · ‎05-29-2018

If anyone is interested here is a powershell call for it as well (@markonans tx for curl example to build from).

$fwaddress = "192.168.1.99"

$postParams = @{username='myadminacct';secretkey='PASSWORD'} $request = Invoke-WebRequest -Headers $headers -Uri "https://$fwaddress/logincheck" -SessionVariable fgtSession -Method POST -Body $postParams

$headers = New-Object "System.Collections.Generic.Dictionary[[String],[String]]" $headers.Add('Accept','application/json') $headers.Add('Content-Type','application/json')

$request = Invoke-WebRequest -Headers $headers -Uri "https://$fwaddress/api/v2/monitor/router/ipv4/" -WebSession $fgtSession -Method GET write-host $request.Content

View solution in original post

alk0v · ‎07-10-2018

Hi, all. Next example working with FG-300 v.5.4 and PHP

$fghost = "myfg.loc"; $fglogin = "admin"; $fgpass = "supersecret";

$url = '[link]https://'.$fghost.'/logincheck';[/link]

$data = array('username'=>$fglogin,'secretkey'=>$fgpass); $post_data = http_build_query($data);

$curl_connection = curl_init($url);

curl_setopt($curl_connection, CURLOPT_SSL_VERIFYPEER, FALSE); curl_setopt($curl_connection, CURLOPT_POST, TRUE); curl_setopt($curl_connection, CURLOPT_POSTFIELDS, $post_data); curl_setopt($curl_connection, CURLOPT_RETURNTRANSFER, TRUE); curl_setopt($curl_connection, CURLOPT_HEADER, TRUE);

$response = curl_exec($curl_connection);

preg_match_all('/^Set-Cookie:\s*([^;]*)/mi', $response, $matches);

$curl_connection = curl_init('[link]https://'.$fghost.'/api/v2/cmdb/firewall/vip/');[/link] curl_setopt($curl_connection, CURLOPT_SSL_VERIFYPEER, FALSE); curl_setopt($curl_connection, CURLOPT_COOKIE, $matches[1][0]); $response = curl_exec($curl_connection);

echo ($responce);

curl_close($curl_connection);

View solution in original post

oheigl · ‎11-21-2019

Hi,

remove the GET parameter, it's not needed if you pass the API key via the header:

curl -k -o $IP-$D.conf -H "Authorization: Bearer $TOKEN" "https://$IP/api/v2/monitor/system/config/backup?scope=global"

Also you can have a look at the debug on the FortiGate (connect via SSH since GUI is also making API requests):

diag debug application httpsd -1
diag debug enable

And please upgrade your Firmware version, in 5.6.3 everything could be a bug

View solution in original post

Irfan_Pathan · ‎08-10-2019

Hi, Create api user, You will get api key token.

then curl -k https://<deviceipaddress>/api/v2/cmdb/firewall/address?vdom=root&access_token=<apikeytokenhere>

nbctcp · ‎11-19-2019

SW INFO: -fortigate version

Version: FortiGate-VM64-KVM v6.2.1,build0932,190716 (GA)

CONFIG:

# show system api-user config system api-user edit "api-admin" set api-key ENC SH2PPzcc9QjwfKbZt65EU5ufPXSGvnazXmEJatKySDyFiAUjmbEk0ZEKRbXG2Q= set accprofile "super_admin" set vdom "root" config trusthost edit 1 set ipv4-trusthost 10.0.1.70 255.255.255.255 next end next end

PROBLEMS: # curl -k http://10.0.1.51/api/v2/c...x4gwhH53jb551QrbQwkG58 [1] 28518 root@eve-ng:~# <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <HTML><HEAD> <TITLE>401 Authorization Required</TITLE> </HEAD><BODY> <H1>Authorization Required</H1> This server could not verify that you are authorized to access the document requested. Either you supplied the wrong credentials (e.g., bad password), or your browser doesn't understand how to supply the credentials required.<P> <P>Additionally, a 401 Authorization Required error was encountered while trying to use an ErrorDocument to handle the request. </BODY></HTML>

QUESTIONS:

1. I got above error with those config, although I am using super_admin profile

What's wrong with step?

In curl, I can only using http because I am using trial license

tq

http://goo.gl/lhQjmU
http://nbctcp.wordpress.com

emnoc · ‎11-19-2019

Pass the header in the header field.

https://socpuppet.blogspot.com/2019/09/howto-use-fortios-apiuser.html

Header set with curl and "-H" option, this is required.

"Authorization: Bearer 6qQyk7Q3Hpz8k6z74161xG0Q5GNkpn"

BTW, I'm like 100% sure the API will not work over HTTP, but double-check. In real life nobody will send credentials over unsecured HTTP.

Ken Felix

PCNSE

NSE

StrongSwan

Jordan_Thompson_FTNT · ‎11-19-2019

emnoc wrote:

BTW, I'm like 100% sure the API will not work over HTTP, but double-check. In real life nobody will send credentials over unsecured HTTP.

This is correct - API keys can only be used over HTTPS.

nbctcp · ‎11-21-2019

@emnoc

I am following your way, but I still got error 403

Here my steps

STEPS TAKEN https://github.com/Nevets82/Posh-FortiGate config system accprofile edit "readonly_admin" set mntgrp read set admingrp read set updategrp read set authgrp read set sysgrp read set netgrp read set loggrp read set routegrp read set fwgrp read set vpngrp read set utmgrp read set wanoptgrp read set endpoint-control-grp read set wifi read next end config system admin edit readonly_user set trusthost1 192.168.88.70 255.255.255.255 set accprofile readonly_admin set comments "User for PowerShell backup and troubleshooting tasks" set vdom root set password P@ssw0rd next end config system api-user edit api-readonly_user set accprofile readonly_admin set vdom root config trusthost edit 1 set ipv4-trusthost 192.168.88.70 255.255.255.255 end end # execute api-user generate-key api-readonly_user New API key: mrfQbbhnwsp39HQmtkjw4N6HxyNgmm NOTE: The bearer of this API key will be granted all access privileges assigned to the api-user api-admin. # cat fortibackup.sh #/bin/bash IP=192.168.88.41 TOKEN=mrfQbbhnwsp39HQmtkjw4N6HxyNgmm D=`date +%F_%T` curl -k -o $IP-$D.conf -H "Authorization: Bearer $TOKEN" "https://$IP/api/v2/monitor/system/config/backup/?scope=global&access_token=$TOKEN" exit PROBLEMS: # ./fortibackup.sh # cat 192.168.88.41-2019-11-21_14\:58\:15.conf { "http_method":"GET", "status":"error", "http_status":403, "vdom":"root", "path":"system", "name":"config", "action":"backup", "serial":"FGT80C3909631394", "version":"v5.6.3", "build":1547 } QUESTIONS: [ol]

I still got error 403 code [/ol]Which steps I am missing tq

emnoc wrote:
Pass the header in the header field.

https://socpuppet.blogspot.com/2019/09/howto-use-fortios-apiuser.html

Header set with curl and "-H" option, this is required.

"Authorization: Bearer 6qQyk7Q3Hpz8k6z74161xG0Q5GNkpn"

BTW, I'm like 100% sure the API will not work over HTTP, but double-check. In real life nobody will send credentials over unsecured HTTP.

Ken Felix

Ken Felix

http://goo.gl/lhQjmU
http://nbctcp.wordpress.com

oheigl · ‎11-21-2019

Hi,

remove the GET parameter, it's not needed if you pass the API key via the header:

curl -k -o $IP-$D.conf -H "Authorization: Bearer $TOKEN" "https://$IP/api/v2/monitor/system/config/backup?scope=global"

Also you can have a look at the debug on the FortiGate (connect via SSH since GUI is also making API requests):

diag debug application httpsd -1
diag debug enable

And please upgrade your Firmware version, in 5.6.3 everything could be a bug

nbctcp · ‎11-21-2019

You are correct guru

1. modify accprofile mntgrp

-turn on debug

diag debug application httpsd -1 diag debug enable

I can see, maintenance group complain about write permission

-modify

config system accprofile edit "readonly_admin" set mntgrp read change to config system accprofile edit "readonly_admin" set mntgrp read-write 2. modify this curl -k -o $IP-$D.conf -H "Authorization: Bearer $TOKEN" "https://$IP/api/v2/monitor/system/config/backup/?scope=global" RESULT: 1. I can get the config but not full config. How do I know that, because full config usually 500kb, while this is 125kb QUESTIONS: 1. How to get full config

http://goo.gl/lhQjmU
http://nbctcp.wordpress.com

oheigl · ‎11-21-2019

I don't think it's possible, because you can't even select something like that via the GUI, only via CLI.

But the full configuration just adds all the default values, so it's not useful anyway, or what would you like to achieve?

nbctcp · ‎11-21-2019

Full configuration is useful in case I need to keep my public key.

Public key won't appear in standard config.

Unless I need to take note which Fortigate has public key and what the key

QUESTIONS: 1. beside Public key. In what case do I need full-config actually I am curios why full-config is created.

Must a be a reason for that

2. Can I restore using full-config

tq

http://goo.gl/lhQjmU
http://nbctcp.wordpress.com

oheigl · ‎11-21-2019

I just tried a configuration backup and the certificate with the public and private key is in there, without a full configuration. The full configuration is useful to check if default values have changed or something like that, but other then that I can't see a reason why you would need it. Maybe in older FortiOS versions the keys weren't backuped, can't remember exactly.

Kind regards

Rest api usage

Nominate a Forum Post for Knowledge Article Creation