Fortinet black logo

Administration Guide

Integration with FortiNAC

Copy Link
Copy Doc ID 250a63c1-9b8e-11ee-a142-fa163e15d75b:338582
Download PDF

Integration with FortiNAC

This topic assumes FortiNAC has been set up properly as a NAC solution. We have provided an example on how to configure the integration for testing purposes.

To integrate FortiDeceptor with FortiNAC:
  1. Configure the attack host on FortiNAC.
  2. Convert the pingable device to a host.
  3. Verify the host was added successfully.
  4. Generate an API token on FortiNAC.
  5. Configure the integration with FortiNAC (Gen-Webhook).
  6. Configure the integration with FortiNAC (FNAC-WEBHOOK).

1. Configure the attack host on FortiNAC

  1. On FortiNAC, go to Network > Inventory.
  2. Select the Container icon.
  3. Right-click a container and select Add Pingable Device or right-click a pingable device in the Devices tab and select Modify.
  4. From the drop-down menu select the Container where this device will be stored. You can use the icon next to the Container field to add a new container.
  5. Configure the pingable device.

    IP AddressEnter the IP address of the endpoint.
    Physical AddressEnter the address of hardware endpoint.

  6. Click OK.

For information about adding and modifying pingable devices in FortiNAC, see Add or modify a pingable device in the FortiNAC Administration Guide.

2. Convert the pingable device to a host

  1. In FortiNAC, click Network > Inventory.
  2. Expand the Container where the device is located.
  3. Select the device to be converted.
  4. Right-click a device and select Convert To Host. This option converts the non-SNMP devices selected to hosts.

  5. Click Yes on the confirmation window.
  6. Select and verify that the pingable devices now display.

For more information, see Convert all pingables to hosts in the FortiNAC Administration Guide.

3. Verify the host was added successfully

Go to the Hosts tab, and check the status. For information, see Host Summary in the FortiNAC Administration Guide.

4. Generate an API token on FortiNAC

  1. In FortiNAC go to the Users tab.
  2. Select a user from the list. The Modify User page opens.
  3. Next to REST API Access Token, click Regenerate Token.

5. Configure the integration with FortiNAC (Gen-Webhook)

  1. In FortiDeceptor, go to Fabric > Quarantine Integration and click Quarantine Integration With New Device.

  2. Configure the integration settings and click Save.

    Integrate Method Select GEN-WEBHOOK.
    Block Action
    Http MethodPOST
    URLhttps://<your-fortinac-address:8443>/api/v2/host/disable-by-ip
    AuthorizationEnter the API access token you generated in step 4
    HTTP Headerblockheader
    HTTP Dataip
    Unblock Action
    HTTP MethodPOST
    URLhttps://<your-fortinac-address:8443>/api/v2/host/enable-by-ip

6. Configure the integration with FortiNAC (FNAC-WEBHOOK)

  1. In FortiDeceptor, go to Fabric > Quarantine Integration and click Quarantine Integration With New Device.

  2. Configure the integration settings and click Save.

    IPEnter the FortiNAC address.
    PORT8443
    Authorization TokenEnter the API access token you generated in Step 4.
    Expiry1-3600 (default is 3600).

  3. Verify the device status is Ready.

Integration with FortiNAC

This topic assumes FortiNAC has been set up properly as a NAC solution. We have provided an example on how to configure the integration for testing purposes.

To integrate FortiDeceptor with FortiNAC:
  1. Configure the attack host on FortiNAC.
  2. Convert the pingable device to a host.
  3. Verify the host was added successfully.
  4. Generate an API token on FortiNAC.
  5. Configure the integration with FortiNAC (Gen-Webhook).
  6. Configure the integration with FortiNAC (FNAC-WEBHOOK).

1. Configure the attack host on FortiNAC

  1. On FortiNAC, go to Network > Inventory.
  2. Select the Container icon.
  3. Right-click a container and select Add Pingable Device or right-click a pingable device in the Devices tab and select Modify.
  4. From the drop-down menu select the Container where this device will be stored. You can use the icon next to the Container field to add a new container.
  5. Configure the pingable device.

    IP AddressEnter the IP address of the endpoint.
    Physical AddressEnter the address of hardware endpoint.

  6. Click OK.

For information about adding and modifying pingable devices in FortiNAC, see Add or modify a pingable device in the FortiNAC Administration Guide.

2. Convert the pingable device to a host

  1. In FortiNAC, click Network > Inventory.
  2. Expand the Container where the device is located.
  3. Select the device to be converted.
  4. Right-click a device and select Convert To Host. This option converts the non-SNMP devices selected to hosts.

  5. Click Yes on the confirmation window.
  6. Select and verify that the pingable devices now display.

For more information, see Convert all pingables to hosts in the FortiNAC Administration Guide.

3. Verify the host was added successfully

Go to the Hosts tab, and check the status. For information, see Host Summary in the FortiNAC Administration Guide.

4. Generate an API token on FortiNAC

  1. In FortiNAC go to the Users tab.
  2. Select a user from the list. The Modify User page opens.
  3. Next to REST API Access Token, click Regenerate Token.

5. Configure the integration with FortiNAC (Gen-Webhook)

  1. In FortiDeceptor, go to Fabric > Quarantine Integration and click Quarantine Integration With New Device.

  2. Configure the integration settings and click Save.

    Integrate Method Select GEN-WEBHOOK.
    Block Action
    Http MethodPOST
    URLhttps://<your-fortinac-address:8443>/api/v2/host/disable-by-ip
    AuthorizationEnter the API access token you generated in step 4
    HTTP Headerblockheader
    HTTP Dataip
    Unblock Action
    HTTP MethodPOST
    URLhttps://<your-fortinac-address:8443>/api/v2/host/enable-by-ip

6. Configure the integration with FortiNAC (FNAC-WEBHOOK)

  1. In FortiDeceptor, go to Fabric > Quarantine Integration and click Quarantine Integration With New Device.

  2. Configure the integration settings and click Save.

    IPEnter the FortiNAC address.
    PORT8443
    Authorization TokenEnter the API access token you generated in Step 4.
    Expiry1-3600 (default is 3600).

  3. Verify the device status is Ready.