Fortinet Fortigate

Fortinet Fortigate is a leading network security solution that offers advanced threat protection and secure networking capabilities.

Fortinet Fortigate is a leading network security platform that provides comprehensive threat protection and secure network management. This connector allows Swimlane Turbine users to seamlessly integrate Fortinet Fortigate's capabilities into their security automation workflows. By leveraging this integration, users can automate the creation, management, and deletion of network policies and address objects, enhancing their security posture and operational efficiency.

Prerequisites

Before you can use the Fortinet Fortigate connector for Turbine, you'll need access to the Fortinet Fortigate API. This requires the following:

HTTP Bearer Token authentication using the following parameters:

URL: The endpoint URL for accessing the Fortinet Fortigate API.

API Token: A valid API token for authenticating requests to the Fortinet Fortigate system.

Obtaining an API Key:

Step 1: Determine your Source Address

The source address is needed to ensure the API token can only be used from trusted hosts. This step can be skipped if the trusted host IP address is already known.

On the FortiGate GUI, select the Status dashboard and locate the Administrators widget.

Click your-userid > Show active administrator sessions.

Make note of the Source Address for your-userid as it will be needed to create the Trusted Host in Step 3: Create the REST API Admin.

Step 2: Create an Administrator profile

On the FortiGate GUI, select System > Admin Profiles > Create New.

Populate the following fields Security Fabric, FortiView, User & Device, Firewall, Log & Report, Network, System, Security Profile, VPN, WAN Opt & Cache and Wifi & Switch.

Click OK.

Step 3: Create the REST API Admin

On the FortiGate GUI, select System > Administrators > Create New > REST API Admin.

Populate the following fields Username, Administrator Profile, CORS and Trusted Hosts.

The Trusted Host must be specified to ensure that your local host can reach the FortiGate. For example, to restrict requests as coming from only 10.20.100.99, enter 10.20.100.99/32. The Trusted Host is created from the Source Address obtained in Step 1: Determine your Source Address.

Click OK and an API token will be generated.

Make note of the API token as it is only shown once and cannot be retrieved.

Click Close to complete creation of the REST API Admin.

About filtering addresses, address groups and group members.

The following 3 fields are mandatory

Key, objects will be filtered on property with this name.

Pattern, objects will be filtered on property with this value.

Filter, see table below.

Operator	Description
==	Case insensitive match with pattern
!=	Does not match with pattern (case insensitive)
=@	Pattern found in object value (case insensitive)
!@	Pattern not found in object value (case insensitive)
<=	Value must be less than or equal to pattern
<	Value must be less than pattern
>=	Value must be greater than or equal to pattern
>	Value must be greater than pattern
Logical OR	Separate filters using commas ','
Logical AND	Filter strings can be combined to create logical AND queries by including multiple filters in the request
Combining AND and OR	You can combine AND and OR filters together to create more complex filters.

Capabilities

The Fortinet Fortigate connector provides the following capabilities:

Create Address

Create Address Group

Create IPV4 firewall Policy

Create Policy

Delete Address

Get Addresses

Get Group Members

Update Address Group

This connector was last tested against product version: 7.

Additional Documentation

Fortinet Fortigate Connector Documentation

Fortinet Fortigate API Documentation

Configurations

Fortinet Fortigate HTTP Bearer Authentication

Authenticates using bearer token

Configuration Parameters

Parameter	Description	Type	Required
url	A URL to the target host.	string	Required
token	API Token.	string	Required
verify_ssl	Verify SSL certificate.	boolean	Optional
http_proxy	A proxy to route requests through.	string	Optional
pem_b64	PEM certificate in Base64 format.	string	Optional

Actions

Create Address

Create a new address object in Fortinet Fortigate for use in security policies and configurations. Requires JSON body input.

Endpoint

URL: /api/v2/cmdb/firewall/address

Method: POST

Input

Argument Name	Type	Required	Description
parameters.vdom	string	Optional	Specify the Virtual Domain(s) from which results are returned or changes are applied to. If this parameter is not provided, the management VDOM will be used. If the admin does not have access to the VDOM, a permission error will be returned.
parameters.action	string	Optional	If supported, an action can be specified. "clone" - Clone this specific resource. When action=clone is set, the extra parameters Nkey must be provided.
parameters.nkey	string	Optional	If action=clone, use Nkey to specify the ID for the new resource to be created.
name	string	Optional	Name of the resource
uuid	string	Optional	Unique identifier
subnet	string	Optional	Parameter for Create Address
type	string	Optional	Type of the resource
sub-type	string	Optional	Type of the resource
clearpass-spt	string	Optional	Parameter for Create Address
macaddr	array	Optional	Parameter for Create Address
macaddr.macaddr	string	Optional	Parameter for Create Address
start-ip	string	Optional	Parameter for Create Address
end-ip	string	Optional	Parameter for Create Address
fqdn	string	Optional	Parameter for Create Address
country	string	Optional	Parameter for Create Address
wildcard-fqdn	string	Optional	Parameter for Create Address
cache-ttl	number	Optional	Parameter for Create Address
wildcard	string	Optional	Parameter for Create Address
sdn	string	Optional	Parameter for Create Address
fsso-group	array	Optional	Parameter for Create Address
fsso-group.name	string	Optional	Name of the resource
interface	string	Optional	Parameter for Create Address
tenant	string	Optional	Parameter for Create Address
organization	string	Optional	Parameter for Create Address
epg-name	string	Optional	Name of the resource

Input Example

{"parameters":{"vdom":"vdom1,vdom2","action":"clone","nkey":"testkey1"},"json_body":{"name":"ExampleAddress","uuid":"123e4567-e89b-12d3-a456-426655440000","subnet":"192.168.1.0/24","type":"ipmask","sub-type":"sdn","clearpass-spt":"healthy","macaddr":[{"macaddr":"00:11:22:33:44:55-00:11:22:33:44:66"}],"start-ip":"192.168.1.10","end-ip":"192.168.1.20","fqdn":"example.com","country":"US","wildcard-fqdn":"*.example.com","cache-ttl":3600,"wildcard":"192.168.2.0/255.255.255.0","sdn":"example-sdn","fsso-group":[{"name":"ExampleFSSOGroup"}],"interface":"example-interface","tenant":"example-tenant","organization":"exampleorg/domain","epg-name":"ExampleEPG","subnet-name":"ExampleSubnet","sdn-tag":"ExampleSDNTag","policy-group":"ExamplePolicyGroup","obj-tag":"ExampleObjTag","obj-type":"ip","tag-detection-level":"ExampleTagDetection","tag-type":"ExampleTagType","comment":"Example comment","associated-interface":"example-associated-interface","color":15,"filter":"example-filter","sdn-addr-type":"private","node-ip-only":"enable","obj-id":"ExampleObjID","list":[{"ip":"192.168.1.100"}],"tagging":[{"name":"ExampleTagName","category":"ExampleTagCategory","tags":["Tag1","Tag2"]}],"allow-routing":"enable","fabric-object":"enable"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase

Output Example

{"status_code":200,"response_headers":{"date":"Mon, 08 May 2023 21:41:54 GMT","x-frame-options":"SAMEORIGIN","content-security-policy":"frame-ancestors 'self'","x-xss-protection":"1; mode=block","content-length":"354","content-type":"text/html; charset=iso-8859-1","Connection":"keep-alive"},"reason":"OK","json_body":{}}

Create Address Group

Create a new address group in Fortinet Fortigate to efficiently manage multiple addresses.

Endpoint

URL: /api/v2/cmdb/firewall/addrgrp

Method: POST

Input

Argument Name	Type	Required	Description
name	string	Optional	Name of the resource
type	string	Optional	Type of the resource
category	string	Optional	Parameter for Create Address Group
uuid	string	Optional	Unique identifier
member	array	Optional	Parameter for Create Address Group
member.name	string	Optional	Name of the resource
comment	string	Optional	Parameter for Create Address Group
exclude	string	Optional	Parameter for Create Address Group
exclude-member	array	Optional	Parameter for Create Address Group
exclude-member.name	string	Optional	Name of the resource
color	number	Optional	Parameter for Create Address Group
tagging	array	Optional	Parameter for Create Address Group
tagging.name	string	Optional	Name of the resource
tagging.category	string	Optional	Parameter for Create Address Group
tagging.tags	array	Optional	Parameter for Create Address Group
allow-routing	string	Optional	Parameter for Create Address Group
fabric-object	string	Optional	Parameter for Create Address Group

Input Example

{"json_body":{"name":"ExampleAddressGroupName","type":"default","category":"default","uuid":"123e4567-e89b-12d3-a456-426655440000","member":[{"name":"ExampleAddress1"},{"name":"ExampleAddress2"}],"comment":"Example comment","exclude":"enable","exclude-member":[{"name":"ExampleExcludeAddress1"},{"name":"ExampleExcludeAddress2"}],"color":15,"tagging":[{"name":"ExampleTagName","category":"ExampleTagCategory","tags":["Tag1","Tag2"]}],"allow-routing":"enable","fabric-object":"enable"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase

Output Example

Create IPV4 Firewall Policy

Establish A New IPv4 Firewall Policy In Fortinet Fortigate To Manage Network Traffic.

Endpoint

URL: /api/v2/cmdb/firewall/policy

Method: POST

Input

Argument Name	Type	Required	Description
policyid	number	Optional	Unique identifier
status	string	Optional	Status value
name	string	Optional	Name of the resource
uuid	string	Optional	Unique identifier
srcintf	array	Optional	Parameter for Create IPV4 Firewall Policy
srcintf.name	string	Optional	Name of the resource
dstintf	array	Optional	Parameter for Create IPV4 Firewall Policy
dstintf.name	string	Optional	Name of the resource
action	string	Optional	Parameter for Create IPV4 Firewall Policy
nat64	string	Optional	Parameter for Create IPV4 Firewall Policy
nat46	string	Optional	Parameter for Create IPV4 Firewall Policy
ztna-status	string	Optional	Status value
ztna-device-ownership	string	Optional	Parameter for Create IPV4 Firewall Policy
srcaddr	array	Optional	Parameter for Create IPV4 Firewall Policy
srcaddr.name	string	Optional	Name of the resource
dstaddr	array	Optional	Parameter for Create IPV4 Firewall Policy
dstaddr.name	string	Optional	Name of the resource
srcaddr6	array	Optional	Parameter for Create IPV4 Firewall Policy
srcaddr6.name	string	Optional	Name of the resource
dstaddr6	array	Optional	Parameter for Create IPV4 Firewall Policy
dstaddr6.name	string	Optional	Name of the resource
ztna-ems-tag	array	Optional	Parameter for Create IPV4 Firewall Policy
ztna-ems-tag.name	string	Optional	Name of the resource
ztna-tags-match-logic	string	Optional	Parameter for Create IPV4 Firewall Policy
ztna-geo-tag	array	Optional	Parameter for Create IPV4 Firewall Policy

Input Example

{"json_body":{"policyid":1,"status":"enable","name":"ExamplePolicyName","uuid":"123e4567-e89b-12d3-a456-426655440000","srcintf":[{"name":"ingressInterface1"}],"dstintf":[{"name":"egressInterface1"}],"action":"accept","nat64":"enable","nat46":"enable","ztna-status":"enable","ztna-device-ownership":"enable","srcaddr":[{"name":"SourceAddress1"}],"dstaddr":[{"name":"DestinationAddress1"}],"srcaddr6":[{"name":"SourceAddressIPv61"}],"dstaddr6":[{"name":"DestinationAddressIPv61"}],"ztna-ems-tag":[{"name":"ZTNAEmsTag1"}],"ztna-tags-match-logic":"or","ztna-geo-tag":[{"name":"ZTNAGeoTag1"}],"internet-service":"enable","internet-service-name":[{"name":"InternetServiceName1"}],"internet-service-group":[{"name":"InternetServiceGroupName1"}],"internet-service-custom":[{"name":"CustomInternetServiceName1"}],"network-service-dynamic":[{"name":"DynamicNetworkServiceName1"}],"internet-service-custom-group":[{"name":"CustomInternetServiceGroupName1"}],"internet-service-src":"enable","internet-service-src-name":[{"name":"InternetServiceSourceName1"}],"internet-service-src-group":[{"name":"InternetServiceSourceGroupName1"}],"internet-service-src-custom":[{"name":"CustomInternetServiceSourceName1"}],"network-service-src-dynamic":[{"name":"DynamicNetworkServiceSourceName1"}],"internet-service-src-custom-group":[{"name":"CustomInternetServiceSourceGroupName1"}],"reputation-minimum":0,"reputation-direction":"source","src-vendor-mac":[{"id":1}],"internet-service6":"enable","internet-service6-name":[{"name":"IPv6InternetServiceName1"}],"internet-service6-group":[{"name":"IPv6InternetServiceGroupName1"}]}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase

Output Example

Create Policy

Establish a new network policy within Fortinet Fortigate to oversee and regulate security procedures.

Endpoint

URL: /api/v2/cmdb/firewall/DoS-policy

Method: POST

Input

Argument Name	Type	Required	Description
policyid	number	Optional	Unique identifier
status	string	Optional	Status value
name	string	Optional	Name of the resource
comments	string	Optional	Parameter for Create Policy
interface	string	Optional	Parameter for Create Policy
srcaddr	array	Optional	Parameter for Create Policy
srcaddr.name	string	Optional	Name of the resource
dstaddr	array	Optional	Parameter for Create Policy
dstaddr.name	string	Optional	Name of the resource
service	array	Optional	Parameter for Create Policy
service.name	string	Optional	Name of the resource
anomaly	array	Optional	Parameter for Create Policy
anomaly.name	string	Optional	Name of the resource
anomaly.status	string	Optional	Status value
anomaly.log	string	Optional	Parameter for Create Policy
anomaly.action	string	Optional	Parameter for Create Policy
anomaly.quarantine	string	Optional	Parameter for Create Policy
anomaly.quarantine-expiry	string	Optional	Parameter for Create Policy
anomaly.quarantine-log	string	Optional	Parameter for Create Policy
anomaly.threshold	number	Optional	Parameter for Create Policy
anomaly.threshold(default)	number	Optional	Parameter for Create Policy

Input Example

{"json_body":{"policyid":9999,"status":"enable","name":"string","comments":"string","interface":"string","srcaddr":[{"name":"string"}],"dstaddr":[{"name":"string"}],"service":[{"name":"string"}],"anomaly":[{"name":"string","status":"disable","log":"enable","action":"pass","quarantine":"none","quarantine-expiry":"string","quarantine-log":"disable","threshold":2147483647,"threshold(default)":4294967295}]}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase

Output Example

Delete Address

Remove a specified address object from Fortinet Fortigate configurations using the provided name.

Endpoint

URL: /api/v2/cmdb/firewall/address/{{name}}

Method: DELETE

Input

Argument Name	Type	Required	Description
path_parameters.name	string	Required	Parameters for the Delete Address action

Input Example

{"path_parameters":{"name":"foo"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase

Output Example

Get Addresses

Fetches a list of configured addresses from Fortinet Fortigate to enhance security automation playbooks.

Endpoint

URL: /api/v2/cmdb/firewall/address/

Method: GET

Input

Argument Name	Type	Required	Description
parameters.filter	string	Optional	Query string to filter the results. Format is . Example values are name==test, name!=test etc. For operator values pls refer https://fndn.fortinet.net/index.php?/fortiapi/1-fortios/94/

Input Example

{"parameters":{"filter":"name==2.2.2.2"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
http_method	string	HTTP method to use
revision	string	Output field: revision
results	array	Result of the operation
results.q_origin_key	string	Result of the operation
results.name	string	Name of the resource
results.uuid	string	Unique identifier
results.subnet	string	Result of the operation
results.type	string	Type of the resource
results.start-mac	string	Result of the operation
results.end-mac	string	Result of the operation
results.start-ip	string	Result of the operation
results.end-ip	string	Result of the operation
results.fqdn	string	Result of the operation
results.country	string	Result of the operation
results.wildcard-fqdn	string	Result of the operation
results.cache-ttl	number	Result of the operation
results.wildcard	string	Result of the operation
results.sdn	string	Result of the operation
results.interface	string	Result of the operation
results.tenant	string	Result of the operation
results.organization	string	Result of the operation
results.epg-name	string	Name of the resource
results.subnet-name	string	Name of the resource

Output Example

{"status_code":429,"response_headers":{"date":"Mon, 08 May 2023 21:41:54 GMT","x-frame-options":"SAMEORIGIN","content-security-policy":"frame-ancestors 'self'","x-xss-protection":"1; mode=block","content-length":"354","content-type":"text/html; charset=iso-8859-1","Connection":"keep-alive"},"reason":"Too Many Requests","json_body":{"http_method":"GET","revision":"124.0.206.9538334086041268915.1559577065","results":[{}]}}

Get Group Members

Retrieve a list of members from a specified group within the Fortinet Fortigate system.

Endpoint

URL: /api/v2/cmdb/firewall/addrgrp/

Method: GET

Input

Argument Name	Type	Required	Description
parameters.filter	string	Optional	Query string to filter the results. Format is . Example values are name==test, name!=test etc. For operator values pls refer https://fndn.fortinet.net/index.php?/fortiapi/1-fortios/94/

Input Example

{"parameters":{"filter":"name==Swimlane DEMO Group"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
http_method	string	HTTP method to use
revision	string	Output field: revision
results	array	Result of the operation
results.name	string	Name of the resource
results.q_origin_key	string	Result of the operation
results.type	string	Type of the resource
results.category	string	Result of the operation
results.uuid	string	Unique identifier
results.member	array	Result of the operation
results.member.name	string	Name of the resource
results.member.q_origin_key	string	Result of the operation
results.comment	string	Result of the operation
results.exclude	string	Result of the operation
results.exclude-member	array	Result of the operation
results.exclude-member.file_name	string	Name of the resource
results.exclude-member.file	string	Result of the operation
results.color	number	Result of the operation
results.tagging	array	Result of the operation
results.tagging.file_name	string	Name of the resource
results.tagging.file	string	Result of the operation
results.allow-routing	string	Result of the operation
results.fabric-object	string	Result of the operation
vdom	string	Output field: vdom

Output Example

{"status_code":200,"response_headers":{"date":"Fri, 01 Aug 2025 06:00:08 GMT","x-frame-options":"SAMEORIGIN","content-security-policy":"frame-ancestors 'self'","x-xss-protection":"1; mode=block","access-control-allow-credentials":"true","vary":"Origin","etag":"0FA4F0E2AB56A2B4DEC69CA64947634CEF88A14B7A5D2A6D49B07477D4662738","content-length":"630","cache-control":"no-cache, must-revalidate","content-type":"application/json","content-encoding":"gzip","Connection":"keep-alive"},"reason":"OK","json...

Update Address Group

Update an existing network address group in Fortinet Fortigate using the specified group name.

Endpoint

URL: /api/v2/cmdb/firewall/addrgrp/{{name}}

Method: PUT

Input

Argument Name	Type	Required	Description
path_parameters.name	string	Required	Parameters for the Update Address Group action
parameters.vdom	string	Optional	Specify the Virtual Domain(s) from which results are returned or changes are applied to. If this parameter is not provided, the management VDOM will be used. If the admin does not have access to the VDOM, a permission error will be returned.
parameters.action	string	Optional	If supported, an action can be specified. "clone" - Clone this specific resource. When action=clone is set, the extra parameters Nkey must be provided.
parameters.nkey	string	Optional	If action=clone, use Nkey to specify the ID for the new resource to be created.
name	string	Optional	To update the name, provide new_name here.
type	string	Optional	Type of the resource
category	string	Optional	Parameter for Update Address Group
uuid	string	Optional	Unique identifier
member	array	Optional	Parameter for Update Address Group
member.name	string	Optional	Name of the resource
comment	string	Optional	Parameter for Update Address Group
exclude	string	Optional	Parameter for Update Address Group
exclude-member	array	Optional	Parameter for Update Address Group
exclude-member.name	string	Optional	Name of the resource
color	number	Optional	Parameter for Update Address Group
tagging	array	Optional	Parameter for Update Address Group
tagging.name	string	Optional	Name of the resource
tagging.category	string	Optional	Parameter for Update Address Group
tagging.tags	array	Optional	Parameter for Update Address Group
allow-routing	string	Optional	Parameter for Update Address Group
fabric-object	string	Optional	Parameter for Update Address Group

Input Example

{"parameters":{"vdom":"vdom1,vdom2","action":"clone","nkey":"testkey1"},"json_body":{"name":"AddressGroupName Update","type":"default","category":"default","uuid":"123e4567-e89b-12d3-a456-426655440000","member":[{"name":"ExampleAddress1"},{"name":"ExampleAddress2"}],"comment":"test comment","exclude":"enable","exclude-member":[{"name":"ExampleExcludeAddress1"},{"name":"ExampleExcludeAddress2"}],"color":15,"tagging":[{"name":"ExampleTagName","category":"ExampleTagCategory","tags":["tag1","tag2"]}],"allow-routing":"enable"},"path_parameters":{"name":"AddressGroupName"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase

Output Example

{"status_code":200,"response_headers":{"Date":"Mon, 16 Oct 2023 17:08:40 GMT","content-length":"354","content-type":"text/html; charset=iso-8859-1","Content-Type":"text/xml;charset=UTF-8","Transfer-Encoding":"chunked","Connection":"keep-alive","x-frame-options":"SAMEORIGIN","x-xss-protection":"1; mode=block","strict-transport-security":"max-age=63072000; includeSubDomains;"},"reason":"","json_body":{}}

Response Headers

Header	Description	Example
access-control-allow-credentials	HTTP response header: access-control-allow-credentials	true
cache-control	Directives for caching mechanisms	no-cache, must-revalidate
Connection	HTTP response header: Connection	keep-alive
content-encoding	HTTP response header: content-encoding	gzip
content-length	The length of the response body in bytes	354
content-security-policy	HTTP response header: content-security-policy	frame-ancestors 'self'
content-type	The media type of the resource	application/json
date	The date and time at which the message was originated	Mon, 08 May 2023 21:41:54 GMT
etag	An identifier for a specific version of a resource	0FA4F0E2AB56A2B4DEC69CA64947634CEF88A14B7A5D2A6D49B07477D4662738
strict-transport-security	HTTP response header: strict-transport-security	max-age=63072000; includeSubDomains;
Transfer-Encoding	HTTP response header: Transfer-Encoding	chunked
vary	HTTP response header: vary	Origin
x-frame-options	HTTP response header: x-frame-options	SAMEORIGIN
x-xss-protection	HTTP response header: x-xss-protection	1; mode=block