[{"data":1,"prerenderedAt":451},["ShallowReactive",2],{"connector-fr-fortianalyzer":3},{"id":4,"title":5,"body":6,"category":441,"description":442,"extension":443,"meta":444,"navigation":445,"path":446,"seo":447,"sidebar":448,"stem":449,"updatedAt":441,"__hash__":450},"connectorsFr\u002Ffr\u002Fconnectors\u002Ffortianalyzer.md","FortiAnalyzer",{"type":7,"value":8,"toc":425},"minimark",[9,13,18,44,48,95,99,102,156,160,165,247,250,254,270,273,283,287,323,326,329,332,362,370,373,377,384,395,398,404,408],[10,11,12],"p",{},"Le connecteur FortiAnalyzer importe dans OverView l'inventaire des équipements Fortinet enregistrés dans le Device Manager de FortiAnalyzer. Il interroge l'API JSON-RPC de l'appliance en lecture seule, avec une clé API.",[14,15,17],"h2",{"id":16},"prerequisites","Prérequis",[19,20,21,25,33,41],"ul",{},[22,23,24],"li",{},"FortiAnalyzer en version 7.2.2 ou supérieure, version à partir de laquelle l'authentification par clé API est disponible",[22,26,27,28,32],{},"Un compte administrateur FortiAnalyzer disposant du profil ",[29,30,31],"code",{},"Super_User",", pour créer l'administrateur REST API",[22,34,35,36,40],{},"Un ",[37,38,39],"strong",{},"OverView OutPost"," déployé dans votre réseau : FortiAnalyzer étant installé sur site, OverView joint son API au travers de l'OutPost",[22,42,43],{},"Un flux HTTPS autorisé de la VM OutPost vers l'appliance FortiAnalyzer",[14,45,47],{"id":46},"information-to-provide-in-overview","Informations à fournir dans OverView",[49,50,51,64],"table",{},[52,53,54],"thead",{},[55,56,57,61],"tr",{},[58,59,60],"th",{},"Champ",[58,62,63],{},"Description",[65,66,67,85],"tbody",{},[55,68,69,75],{},[70,71,72],"td",{},[37,73,74],{},"API URL",[70,76,77,78,81,82],{},"URL de base de l'appliance telle que la VM OutPost la joint, ex. ",[29,79,80],{},"https:\u002F\u002Ffaz.example.com",", sans le chemin ",[29,83,84],{},"\u002Fjsonrpc",[55,86,87,92],{},[70,88,89],{},[37,90,91],{},"API Key",[70,93,94],{},"Clé API de l'administrateur REST API (voir la procédure ci-dessous)",[14,96,98],{"id":97},"parameters","Paramètres",[10,100,101],{},"Ces paramètres sont facultatifs. Conservez leur valeur par défaut sauf besoin particulier.",[49,103,104,116],{},[52,105,106],{},[55,107,108,111,113],{},[58,109,110],{},"Paramètre",[58,112,63],{},[58,114,115],{},"Défaut",[65,117,118,131,144],{},[55,119,120,125,128],{},[70,121,122],{},[37,123,124],{},"ADOMs",[70,126,127],{},"Liste des ADOMs à collecter. Laissé vide, le connecteur collecte tous les ADOMs visibles par la clé API",[70,129,130],{},"Tous",[55,132,133,138,141],{},[70,134,135],{},[37,136,137],{},"Verify SSL",[70,139,140],{},"Vérifier le certificat TLS de l'appliance. À désactiver pour un certificat auto-signé",[70,142,143],{},"Activé",[55,145,146,151,154],{},[70,147,148],{},[37,149,150],{},"Loadsub",[70,152,153],{},"Charger les VDOM et les membres de cluster avec chaque équipement",[70,155,143],{},[14,157,159],{"id":158},"procedure","Procédure",[161,162,164],"h3",{"id":163},"create-the-rest-api-administrator","Créer l'administrateur REST API",[166,167,168,174,191,241],"ol",{},[22,169,170,171,173],{},"Connectez-vous à FortiAnalyzer avec un compte disposant du profil ",[29,172,31],{},".",[22,175,176,177,180,181,184,185,180,188,173],{},"Allez dans ",[37,178,179],{},"System Settings"," > ",[37,182,183],{},"Administrators",", puis ",[37,186,187],{},"Create New",[37,189,190],{},"REST API Admin",[22,192,193,194],{},"Remplissez le formulaire :\n",[19,195,196,205,217,226,235],{},[22,197,198,201,202],{},[37,199,200],{},"User Name"," : un nom explicite, par exemple ",[29,203,204],{},"overview-api",[22,206,207,210,211,216],{},[37,208,209],{},"Admin Profile"," : un profil en lecture seule (voir ",[212,213,215],"a",{"href":214},"#required-permissions","Permissions requises",")",[22,218,219,222,223],{},[37,220,221],{},"JSON API Access"," : ",[37,224,225],{},"Read",[22,227,228,222,231,234],{},[37,229,230],{},"Administrative Domain",[37,232,233],{},"All ADOMs",", ou uniquement les ADOMs à remonter dans OverView",[22,236,237,240],{},[37,238,239],{},"Trusted Hosts"," : l'adresse IP LAN de la VM OutPost",[22,242,243,244,173],{},"Cliquez sur ",[37,245,246],{},"OK",[10,248,249],{},"Les trusted hosts sont obligatoires pour un administrateur REST API : FortiAnalyzer refuse les appels qui ne proviennent pas d'une adresse déclarée. Les appels d'OverView partent de la VM OutPost, dont l'adresse IP LAN s'affiche sur la bannière console de l'hyperviseur.",[161,251,253],{"id":252},"generate-the-api-key","Générer la clé API",[166,255,256,259,267],{},[22,257,258],{},"Rouvrez l'administrateur créé à l'étape précédente.",[22,260,243,261,180,264,173],{},[37,262,263],{},"Regenerate",[37,265,266],{},"Generate",[22,268,269],{},"Copiez la clé et conservez-la en lieu sûr : elle ne sera plus affichée.",[10,271,272],{},"La clé peut aussi être générée en CLI :",[274,275,281],"pre",{"className":276,"code":278,"language":279,"meta":280},[277],"language-text","execute api-user generate-key overview-api\n","text","",[29,282,278],{"__ignoreMap":280},[161,284,286],{"id":285},"configure-the-connector-in-overview","Configurer le connecteur dans OverView",[166,288,289,298,307,310,318],{},[22,290,291,292,180,295,173],{},"Dans OverView, allez dans ",[37,293,294],{},"Data Sources Settings",[37,296,297],{},"Sources",[22,299,300,301,303,304,173],{},"Sélectionnez ",[37,302,5],{}," et cliquez sur ",[37,305,306],{},"Configure",[22,308,309],{},"Choisissez votre OutPost comme point de collecte.",[22,311,312,313,315,316,173],{},"Renseignez l'",[37,314,74],{}," et l'",[37,317,91],{},[22,319,243,320,173],{},[37,321,322],{},"Save Configuration",[10,324,325],{},"À l'enregistrement, OverView vérifie l'accès à la liste des ADOMs, puis aux équipements de chaque ADOM.",[14,327,215],{"id":328},"required-permissions",[10,330,331],{},"Le connecteur effectue uniquement des lectures. L'administrateur REST API a besoin de :",[19,333,334,345,359],{},[22,335,336,338,339,341,342,216],{},[37,337,221],{}," en ",[37,340,225],{}," (en CLI : ",[29,343,344],{},"set rpc-permit read",[22,346,347,348,351,352,355,356],{},"un profil d'administration en ",[37,349,350],{},"Read-Only"," sur le ",[37,353,354],{},"Device Manager",", les autres droits à ",[37,357,358],{},"None",[22,360,361],{},"l'accès aux ADOMs à collecter",[10,363,364,365,367,368,173],{},"Les droits FortiAnalyzer s'appliquent ADOM par ADOM. Chaque ADOM visible par l'administrateur doit autoriser la lecture de ses équipements, faute de quoi la vérification des accès échoue. Pour limiter la collecte à certains ADOMs, restreignez l'",[37,366,230],{}," de l'administrateur ou renseignez le paramètre ",[37,369,124],{},[10,371,372],{},"Les secrets stockés par FortiAnalyzer (mots de passe d'administration, clés privées, clés pré-partagées) ne sont jamais demandés par le connecteur.",[161,374,376],{"id":375},"no-permission-for-the-resource-error","Erreur « No permission for the resource »",[10,378,379,380,383],{},"FortiAnalyzer renvoie l'erreur ",[29,381,382],{},"-11 No permission for the resource"," dans deux cas :",[19,385,386,392],{},[22,387,388,389,391],{},"l'adresse IP LAN de la VM OutPost n'est pas déclarée dans les ",[37,390,239],{}," de l'administrateur ;",[22,393,394],{},"l'administrateur n'a pas accès en lecture aux équipements d'un ADOM.",[10,396,397],{},"Lancées en CLI sur FortiAnalyzer, les commandes suivantes affichent l'adresse d'origine des appels API et indiquent si elle correspond à un administrateur :",[274,399,402],{"className":400,"code":401,"language":279,"meta":280},[277],"diagnose debug application auth 8\ndiagnose debug enable\n# … puis pour arrêter :\ndiagnose debug disable\n",[29,403,401],{"__ignoreMap":280},[14,405,407],{"id":406},"official-documentation","Documentation officielle",[19,409,410,418],{},[22,411,412],{},[212,413,417],{"href":414,"rel":415},"https:\u002F\u002Fcommunity.fortinet.com\u002Ft5\u002FFortiManager\u002FTechnical-Tip-API-requests-by-using-the-API-token-authentication\u002Fta-p\u002F276351",[416],"nofollow","Fortinet Community : API requests using API token authentication",[22,419,420],{},[212,421,424],{"href":422,"rel":423},"https:\u002F\u002Fcommunity.fortinet.com\u002Ffortianalyzer-6\u002Ftroubleshooting-tip-troubleshooting-rest-api-access-error-190160",[416],"Fortinet Community : Troubleshooting REST API access error",{"title":280,"searchDepth":426,"depth":426,"links":427},2,[428,429,430,431,437,440],{"id":16,"depth":426,"text":17},{"id":46,"depth":426,"text":47},{"id":97,"depth":426,"text":98},{"id":158,"depth":426,"text":159,"children":432},[433,435,436],{"id":163,"depth":434,"text":164},3,{"id":252,"depth":434,"text":253},{"id":285,"depth":434,"text":286},{"id":328,"depth":426,"text":215,"children":438},[439],{"id":375,"depth":434,"text":376},{"id":406,"depth":426,"text":407},null,"Importez dans OverView l'inventaire des équipements Fortinet gérés par FortiAnalyzer","md",{},true,"\u002Ffr\u002Fconnectors\u002Ffortianalyzer",{"title":5,"description":442},{"label":5},"fr\u002Fconnectors\u002Ffortianalyzer","FOZbMGwCna79tjHB7Sn_eCLg_c6heEClBDDra5jXp_A",1791970233659]