FortiAnalyzer FortiAnalyzer

Import the inventory of Fortinet devices managed by FortiAnalyzer into OverView

The FortiAnalyzer connector imports into OverView the inventory of Fortinet devices registered in the FortiAnalyzer Device Manager. It queries the appliance's JSON-RPC API in read-only mode, using an API key.

Prerequisites

  • FortiAnalyzer 7.2.2 or later, the version from which API key authentication is available
  • A FortiAnalyzer administrator account with the Super_User profile, to create the REST API administrator
  • An OverView OutPost deployed in your network: FortiAnalyzer runs on premises, so OverView reaches its API through the OutPost
  • An HTTPS flow allowed from the OutPost VM to the FortiAnalyzer appliance

Information to provide in OverView

FieldDescription
API URLBase URL of the appliance as the OutPost VM reaches it, e.g. https://faz.example.com, without the /jsonrpc path
API KeyAPI key of the REST API administrator (see the procedure below)

Parameters

These parameters are optional. Leave them at their default value unless you have a specific reason to change them.

ParameterDescriptionDefault
ADOMsList of ADOMs to collect. When empty, the connector collects every ADOM visible to the API keyAll
Verify SSLVerify the appliance's TLS certificate. Disable it for a self-signed certificateEnabled
LoadsubLoad VDOMs and cluster members along with each deviceEnabled

Procedure

Create the REST API administrator

  1. Sign in to FortiAnalyzer with an account that has the Super_User profile.
  2. Go to System Settings > Administrators, then Create New > REST API Admin.
  3. Fill in the form:
    • User Name: a meaningful name, such as overview-api
    • Admin Profile: a read-only profile (see Required permissions)
    • JSON API Access: Read
    • Administrative Domain: All ADOMs, or only the ADOMs to bring into OverView
    • Trusted Hosts: the LAN IP address of the OutPost VM
  4. Click OK.

Trusted hosts are mandatory for a REST API administrator: FortiAnalyzer rejects calls that do not come from a declared address. OverView calls originate from the OutPost VM, whose LAN IP address is shown on the hypervisor console banner.

Generate the API key

  1. Open the administrator created in the previous step again.
  2. Click Regenerate > Generate.
  3. Copy the key and store it securely: it will not be shown again.

The key can also be generated from the CLI:

execute api-user generate-key overview-api

Configure the connector in OverView

  1. In OverView, go to Data Sources Settings > Sources.
  2. Select FortiAnalyzer and click Configure.
  3. Select your OutPost as the collection point.
  4. Enter the API URL and the API Key.
  5. Click Save Configuration.

On save, OverView checks access to the ADOM list, then to the devices of each ADOM.

Required permissions

The connector only performs reads. The REST API administrator needs:

  • JSON API Access set to Read (CLI: set rpc-permit read)
  • an admin profile with Read-Only on Device Manager, all other rights set to None
  • access to the ADOMs to collect

FortiAnalyzer permissions apply ADOM by ADOM. Every ADOM visible to the administrator must allow reading its devices, otherwise the access check fails. To limit collection to some ADOMs, restrict the administrator's Administrative Domain or fill in the ADOMs parameter.

Secrets stored by FortiAnalyzer (admin passwords, private keys, pre-shared keys) are never requested by the connector.

"No permission for the resource" error

FortiAnalyzer returns the error -11 No permission for the resource in two cases:

  • the LAN IP address of the OutPost VM is not declared in the administrator's Trusted Hosts;
  • the administrator cannot read the devices of an ADOM.

Run from the FortiAnalyzer CLI, the following commands show the source address of API calls and whether it matches an administrator:

diagnose debug application auth 8
diagnose debug enable
# … then to stop:
diagnose debug disable

Official Documentation

← PreviousCiscoNext →FortiNAC