Fortinet black logo

Administration Guide

Integrate with FortiGate 6.0.3 to 7.2.3 over REST-API

Copy Link
Copy Doc ID 250a63c1-9b8e-11ee-a142-fa163e15d75b:245689
Download PDF

Integrate with FortiGate 6.0.3 to 7.2.3 over REST-API

The following instructions are based on FortiGate 6.0.3 to 7.2.3 and FortiDeceptor 4.3.0. For information about the versions of FortiGate and FortiDeceptor you are using, select the version in the Fortinet Document Library.

1. Configure FortiGate

1.1 Configure a new profile with minimum permissions for REST API integration

  1. On FortiGate, go to System > Admin Profiles and click Create New.
  2. Configure the profile Access Permissions. The following are the minimum required permissions.

    Access Control

    Permissions

    Security FabricRead/Write
    FortiViewRead
    User & DeviceRead/Write
    FirewallRead
    Log & ReportRead
    NetworkRead
    SystemRead/Write
    Security ProfileRead
    VPNRead
    WAN Opt & CacheRead
    WiFi & SwitchRead

1.2 Create a new administrator

  1. On FortiGate, go to System > Administrators.
  2. Click Create New > Administrator.
  3. Enter a Username and Password for the administrator.
  4. From the Administrator profile dropdown, select the profile you created in step 1.1 Create the administrator profile in FortiGate.

  5. Click OK.

2. Configure FortiDeceptor to integrate with FortiGate

  1. In FortiDeceptor, go to Fabric > Quarantine Integration and click Quarantine Integration With New Device.

  2. Configure the integration settings and click OK.
    EnabledEnable the integration.
    NameEnter a name for the integration.
    Integrate MethodSelect FGT-REST-API.
    IPEnter the IP address of the FortiGate.
    PortEnter the Port for the FortiGate.
    UsernameEnter the username for the admin you just created.
    PasswordEnter the password for the admin you just created.

    Vdom

    Enter the VDOM the FortiGate belongs to.

  3. Verify the integration Status is Ready.

3. Test the integration

  1. Send an attack against a decoy.
  2. On FortiDeceptor, check the quarantine status.
  3. On FortiGate, go to Dashboard > Users Device and expand the Quarantine widget to check quarantine status.
  4. (Optional) Check the quarantine status on FortiDeceptor after it has expired.
    • On FortiDeceptor, go to Fabric > Quarantine Status to check the status.
  5. (Optional) Check the quarantine status on FortiGate after it has expired.
    • On FortiGate, go to Dashboard > Users Device and expand the Quarantine widget to check quarantine status.

Integrate with FortiGate 6.0.3 to 7.2.3 over REST-API

The following instructions are based on FortiGate 6.0.3 to 7.2.3 and FortiDeceptor 4.3.0. For information about the versions of FortiGate and FortiDeceptor you are using, select the version in the Fortinet Document Library.

1. Configure FortiGate

1.1 Configure a new profile with minimum permissions for REST API integration

  1. On FortiGate, go to System > Admin Profiles and click Create New.
  2. Configure the profile Access Permissions. The following are the minimum required permissions.

    Access Control

    Permissions

    Security FabricRead/Write
    FortiViewRead
    User & DeviceRead/Write
    FirewallRead
    Log & ReportRead
    NetworkRead
    SystemRead/Write
    Security ProfileRead
    VPNRead
    WAN Opt & CacheRead
    WiFi & SwitchRead

1.2 Create a new administrator

  1. On FortiGate, go to System > Administrators.
  2. Click Create New > Administrator.
  3. Enter a Username and Password for the administrator.
  4. From the Administrator profile dropdown, select the profile you created in step 1.1 Create the administrator profile in FortiGate.

  5. Click OK.

2. Configure FortiDeceptor to integrate with FortiGate

  1. In FortiDeceptor, go to Fabric > Quarantine Integration and click Quarantine Integration With New Device.

  2. Configure the integration settings and click OK.
    EnabledEnable the integration.
    NameEnter a name for the integration.
    Integrate MethodSelect FGT-REST-API.
    IPEnter the IP address of the FortiGate.
    PortEnter the Port for the FortiGate.
    UsernameEnter the username for the admin you just created.
    PasswordEnter the password for the admin you just created.

    Vdom

    Enter the VDOM the FortiGate belongs to.

  3. Verify the integration Status is Ready.

3. Test the integration

  1. Send an attack against a decoy.
  2. On FortiDeceptor, check the quarantine status.
  3. On FortiGate, go to Dashboard > Users Device and expand the Quarantine widget to check quarantine status.
  4. (Optional) Check the quarantine status on FortiDeceptor after it has expired.
    • On FortiDeceptor, go to Fabric > Quarantine Status to check the status.
  5. (Optional) Check the quarantine status on FortiGate after it has expired.
    • On FortiGate, go to Dashboard > Users Device and expand the Quarantine widget to check quarantine status.