SDN connectors

Fabric connectors to SDNs provide integration and orchestration of Fortinet products with SDN solutions. Fabric connectors ensure that any changes in the SDN environment are automatically updated in your network.

There are four steps to creating and using an SDN connector:

1. Gather the required information
2. Create the fabric connector
3. Create a fabric connector address
4. Add the address to a firewall policy

An example of creating a Microsoft Azure SDN connector is available at Configuring an SDN connector in Azure.

Create the fabric connector

To create an SDN Fabric connector in the GUI:

1. Go to Security Fabric > External Connectors.
2. Click Create New.
3. Click the service that you are using.
4. Enter the Name, Status, and Update Interval for the connector.
5. Enter the previously collected information for the specific connector that you are creating.
6. Click OK.

To create an SDN Fabric connector in the CLI:

config system sdn-connector
    edit <name>
        set status {enable | disable}
        set type {connector type}
        ...
        set update-interval <integer>
    next
end

The available CLI commands will vary depending on the selected SDN connector type.

Create a fabric connector address

A fabric connector address can be used in the following ways:

• As the source or destination address for firewall policies.
• To automatically update changes to addresses in the environment of the service that you are using, based on specified filtering conditions.
• To automatically apply changes to firewall policies that use the address, based on specified filtering conditions.

To create a fabric connector address in the GUI:

1. Go to Policy & Objects > Addresses.
2. Click Create New > Address.
3. Enter a name for the address.
4. Set the Type to Fabric Connector Address.
5. Select an SDN Connector from the dropdown list, or click Create New to make a new one.
6. Set the SDN address type. Only addresses of the selected type will be collected.
7. Configure the connector specific settings.
8. Select an Interface for the address, or leave it as any, enable or disable Show in Address List, and optionally add Comments.
9. Add tags.
10. Click OK.

To create a fabric connector address in the CLI:

config firewall address
    edit <name>
        set type dynamic
        set sdn <sdn_connector>
        set visibility enable
        set associated-interface <interface_name>
        set color <integer>
        ...
        set comment <comment>
        config tagging
            edit <name>
                set category <string>
                set tags <strings>
            next
        end
    next
end

The available CLI commands will vary depending on the selected SDN connector type.

Add the address to a firewall policy

A fabric connector address can be used as either the source or destination address.

To add the address to a firewall policy in the GUI:

1. Go to Policy & Objects > Firewall Policy.
2. Click Create New.
3. Enter a name for the policy.
4. Set the incoming and outgoing interfaces.
5. Use the fabric connector address as the source or destination address.
6. Configure the remaining settings as needed.
7. Click OK.

To add the address to a firewall policy in the CLI:

config firewall policy
    edit 0
        set name <name>
        set srcintf <port_name>
        set dstintf <port_name>
        set srcaddr <firewall_address>
        set dstaddr <firewall_address>
        set action accept
        set schedule <schedule>
        set service <service>
    next
		end

Connector tooltips

In the Security Fabric > External Connectors page, hover over an SDN connector to view a tooltip that shows basic configuration information.

There are three buttons that provide additional information:

• View Connector Objects shows the connector's dynamic objects, such as filters and instances.
• View Policies shows a list of policies that use the dynamic addresses from the connector.
• View Automation Rules shows a list of automation actions that use the connector.