---
sourceDocument: Brazil IT Operations Management
sourceDocumentLink: https://www.servicenow.com/docs/r/it-operations-management

 Release :

    - brazil

ft:locale :

    - en-US

ft:publication_title :

    - Brazil IT Operations Management

ft:clusterId :

    - itom

bundleId :

    - itom

workflow :

    - Technology


---

# Fortinet firewall and FortiGate VDOM REST-based

# Fortinet firewall and FortiGate VDOM REST-based discovery {#ariaid-title1}

Release version: Brazil  
Updated September 10, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 5 minutes to read
Summarize  
![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI  
This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete.  

## Summary of Fortinet firewall and FortiGate VDOM REST-based discovery

The Discovery and Service Mapping Patterns application in ServiceNow uses the Next Generation Fortinet Network Firewall - REST pattern to discover Fortinet firewalls via REST API calls.
An extension, VDOM Discovery, enables discovery of FortiGate Virtual Domains (VDOMs), supporting only multi-VDOM mode.
This REST-based discovery method is required to find VDOMs, as SNMP-based discovery does not support them.
Show full answer Show less  
Customers should ensure they have the latest version of the Discovery and Service Mapping Patterns application from the ServiceNow Store to access these capabilities.

## Key Features

* **REST API-based discovery:** Uses specific Fortinet REST APIs to gather detailed firewall, cluster, interface, VDOM, and policy information.
* **VDOM Discovery:** Discovers FortiGate Virtual Domains, including their interfaces and policies, which are critical for multi-VDOM FortiGate deployments.
* **Extended CMDB data model:** Introduces new CI classes extending existing firewall and network interface classes to represent Fortinet firewalls, clusters, VDOMs, interfaces, and policies accurately in the CMDB.
* **API token authentication:** Requires creation of an API token in Fortinet with sufficient permissions to access necessary REST endpoints.
* **REST-specific configuration:** Includes prerequisites such as disabling SNMP-based discovery for Fortinet firewalls and creating aliases for API credentials and serverless discovery schedules.

## Data Collected and CMDB Impact

The discovery populates rich data in the CMDB across various new and extended classes, including:

* **Fortinet Firewall Device and Cluster:** Hostname, serial number, IP, manufacturer, model, firmware, OS version, and operational status.
* **Network Adapters and IP Addresses:** IPs, netmasks, MAC addresses, and relationships to firewall devices.
* **Fortinet Virtual Domains (VDOMs):** VDOM indexes, names, descriptions, and associated IP addresses.
* **Firewall Interfaces:** Interface IDs, names, IPs, MAC addresses, types (physical, VLAN, aggregate), and descriptions.
* **Firewall Policies:** Policy IDs, UUIDs, names, source/destination interfaces and addresses, and managed internet services.
* **Network Topology:** VLAN IDs linked to interfaces.

## CI Relationships and References

The discovery creates and maintains key relationships to provide a comprehensive view of Fortinet firewall infrastructure, including:

* Firewall clusters hosting firewall devices.
* Firewall devices owning IP addresses and network adapters.
* Interfaces belonging to VDOMs and linked to firewall policies.
* VDOMs hosted on firewall devices and containing interfaces and policies.

## Practical Considerations for ServiceNow Customers

* **Ensure application currency:** Update the Discovery and Service Mapping Patterns app to the latest version to enable full REST-based Fortinet firewall and VDOM discovery.
* **Configure API access:** Create and assign appropriate API tokens in Fortinet with the required REST API permissions for discovery to succeed.
* **Disable SNMP discovery for Fortinet:** To avoid conflicts and ensure VDOMs are discovered, disable the older SNMP-based discovery method for Fortinet firewalls.
* **Leverage new CMDB classes and relationships:** Use the detailed CI data and relationships to enhance visibility, reporting, and operational workflows around Fortinet firewall infrastructure.
* **Use serverless schedules and credential aliases:** Simplify and secure discovery scheduling and credential management following best practices outlined in ServiceNow documentation.

By implementing this REST-based discovery approach, ServiceNow customers can achieve comprehensive and accurate visibility into their Fortinet firewall devices and FortiGate VDOM configurations, facilitating improved network security management and IT operations.  
The Discovery and Service Mapping Patterns application uses the Next Generation Fortinet Network Firewall - REST pattern to find Fortinet firewalls through REST API calls. Additionally, the pattern extension VDOM Discovery finds FortiGate Virtual Domains (VDOMs). Discovering some of these resources might require updating to the latest version of the Discovery and Service Mapping Patterns application from the ServiceNow Store.
The Next Generation Fortinet Network Firewall - REST pattern uses a set of REST API calls to find the Fortinet firewalls. For FortiGate VDOM discovery, only multi-VDOM mode is supported.  
Note:  
Only the REST-based Fortinet firewall discovery method finds FortiGate VDOMs. The SNMP-based Fortinet firewall discovery method doesn't discover them. For information about the default SNMP-based Fortinet firewall discovery, see [Next-Generation Fortinet Network Firewall SNMP-based discovery](https://www.servicenow.com/docs/Lhkd0G4PQ~gD3NX5IjSKRA "The Discovery and Service Mapping Patterns application uses the Next Generation Fortinet Network Firewall pattern to find Fortinet firewalls through a series of SNMP calls. Discovering some of these resources might require updating to the latest version of the Discovery and Service Mapping Patterns application from the ServiceNow Store.").

## Request apps on the Store {#fortinet-fw-vdoms-rest-discovery__section_h2l_h55_vcc}

Visit the [ServiceNow Store](https://store.servicenow.com/sn_appstore_store.do#!/store/home) to view all the available apps, and for information about submitting requests to the store. For cumulative release notes information for all released apps, see the [ServiceNow Store version history release notes](https://www.servicenow.com/docs/r/store-release-notes/sn-store-release-notes.html).{#fortinet-fw-vdoms-rest-discovery__inline-send-to-store}
To learn about Fortinet Firewalls and their versions that you can discover, refer to [Detailed information on products discovered by ITOM Visibility](https://www.servicenow.com/docs/2IbEWd79nVxVuz0xDcFb4A "Discovery and Service Mapping can discover a wide range of operating systems and applications.").

## Fortinet firewall and FortiGate VDOM data model {#fortinet-fw-vdoms-rest-discovery__section_data_model}

The Next Generation Fortinet Network Firewall - REST pattern and VDOM Discovery extension introduce the following CI classes that extend existing CMDB classes.  
{#fortinet-fw-vdoms-rest-discovery__table_extends_fortinet_rest__entry__2}

| CI class | Extends from |
|-|-|
| Fortinet Firewall Cluster \[cmdb_ci_firewall_cluster_fortinet\] | Firewall Cluster \[cmdb_ci_firewall_cluster\] |
| Fortinet Firewall Device \[cmdb_ci_firewall_device_fortinet\] | Firewall Device \[cmdb_ci_firewall_device\] |
| Fortinet Firewall Interface \[cmdb_ci_fortinet_firewall_interface\] | Network Interface \[cmdb_ci_ni_interface\] |
| Fortinet Firewall Policy \[cmdb_ci_fortinet_firewall_policy\] | Firewall Security Policy \[cmdb_ci_firewall_sec_policy\] |
| Fortinet Virtual Domain \[cmdb_ci_fortinet_vdom\] | IP Firewall \[cmdb_ci_ip_firewall\] |
[Table 1. CI classes introduced by these patterns]

{#fortinet-fw-vdoms-rest-discovery__table_extends_fortinet_rest}

## Prerequisites {#fortinet-fw-vdoms-rest-discovery__section_wct_3kr_5cc}

Verify that the applications are up to date
:
    * Discovery and Service Mapping Patterns
    * CMDB CI Class Models
    {#fortinet-fw-vdoms-rest-discovery__ul_k2z_q5n_tcc}

Create API Token{#fortinet-fw-vdoms-rest-discovery__create-fortinet-api-token}
:   Create an API Token in Fortinet. For instructions, go to the [Fortinet Document Library](https://docs.fortinet.com/). Search for the "Connect FortiGate device via API Token - Online Help" article under the FortiConverter Tool product family.

Verify API access and permissions{#fortinet-fw-vdoms-rest-discovery__verify-api-access-permissions-fortinet}
:
    * Verify that the MID Server can access the Fortinet APIs.
    * Verify that the API Token has sufficient permissions to retrieve the required information from the Fortinet devices.
    {#fortinet-fw-vdoms-rest-discovery__ul_ygt_5wr_zcc}
:   Required Fortinet APIs:

    * `v2/cmdb/system/global`
    * `api/v2/monitor/system/status`
    * `api/v2/cmdb/system/ha`
    * `api/v2/cmdb/router/static`
    * `/api/v2/cmdb/firewall/policy`
    * `api/v2/cmdb/system/vdom-property`
    * `api/v2/cmdb/system/interface`
    * `/api/v2/monitor/system/interface/select`
    {#fortinet-fw-vdoms-rest-discovery__ul_dw4_blr_5cc}

Disable SNMP-based Fortinet firewall discovery
:   For more information, see [Disable SNMP-based Fortinet firewall discovery](https://www.servicenow.com/docs/k8_K0SZrnqRUEGATMMgc7w "Disable the default SNMP-based Fortinet firewall discovery and use REST-based discovery instead to discover FortiGate Virtual Domains (VDOMs).").

Create an alias for the API Key Credentials
:   For more information, see [Create an alias for the API key credential for Fortinet firewall REST-based discovery](https://www.servicenow.com/docs/n8INu~eCEeyUtq9Q3p2kug "Create an alias and add it to an API key credential to discover Fortinet firewalls and FortiGate Virtual Domains (VDOMs) through REST-based discovery.").

Create a serverless discovery schedule
:   For more information, see [Create a serverless schedule for Fortinet firewall REST-based discovery](https://www.servicenow.com/docs/_lb3y_OlTy74jzghlKRc~g "Create a serverless discovery schedule to discover Fortinet firewalls and FortiGate Virtual Domains (VDOMs) through REST-based discovery.").

## Data collected by Discovery during horizontal discovery {#fortinet-fw-vdoms-rest-discovery__section_dwy_qlr_5cc}

Discovery populates the data in the CMDB when running the Next Generation Fortinet Network Firewall - REST pattern.  
{#fortinet-fw-vdoms-rest-discovery__table_xdt_5lr_5cc__entry__2}

| Field | Description |
|-|-|
| Name \[name\] | Hostname field of the Fortinet device. |
| Serial number \[serial_number\] | Serial number of the Fortinet device. |
| Fully qualified domain name \[fqdn\] | Fully qualified domain name of the Fortinet device. |
| Operational status \[operational_status\] | Indicates whether the Fortinet device is in active state. |
| IP Address \[ip_address\] | IP address of the Fortinet device. |
| Manufacturer \[manufacturer\] | Fortinet device manufacturer. |
| Description \[short_description\] | Short description of the Fortinet device. |
| Model Number \[model_number\] | Fortinet device model number. |
| Firmware version \[firmware_version\] | Fortinet device firmware version. |
| Hardware OS \[hardware_os\] | OS running on the hardware. |
| Hardware OS Version \[hardware_os_version\] | OS version running on the hardware. |
[Table 2. Fortinet Firewall Device \[cmdb_ci_firewall_device_fortinet\]]

{#fortinet-fw-vdoms-rest-discovery__table_xdt_5lr_5cc}  
{#fortinet-fw-vdoms-rest-discovery__table_r5g_4rw_rcc__entry__2}

| Field | Description |
|-|-|
| Name \[name\] | Hostname field of the Fortinet firewall cluster. |
| Fully qualified domain name \[fqdn\] | Fully qualified domain name of the firewall cluster. |
| IP address \[ip_address\] | IP address of the firewall cluster. |
| Manufacturer \[manufacturer\] | Device manufacturer. |
| Description \[short_description\] | Short description of the firewall cluster. |
| Model Number \[model_number\] | Device model number. |
| Hardware OS \[hardware_os\] | OS running on the hardware. |
| Hardware OS Version \[hardware_os_version\] | OS version running on the hardware. |
[Table 3. Fortinet Firewall Cluster \[cmdb_ci_firewall_cluster_fortinet\]]

{#fortinet-fw-vdoms-rest-discovery__table_r5g_4rw_rcc}  
{#fortinet-fw-vdoms-rest-discovery__table_ybv_drw_rcc__entry__2}

| Field | Description |
|-|-|
| IP Address \[ip_address\] | IP address of the network adapter. |
| Netmask \[netmask\] | Netmask of the network adapter. |
| Alias \[alias\] | User-assigned name for the network adapter. |
| MAC Address \[mac_address\] | MAC address of the network adapter. |
| Name \[name\] | Name of the network adapter. |
| Configuration Item \[cmdb_ci\] | References the Fortinet Firewall Device \[cmdb_ci_firewall_device_fortinet\] table. |
[Table 4. Network Adapter \[cmdb_ci_network_adapter\]]

{#fortinet-fw-vdoms-rest-discovery__table_ybv_drw_rcc}  
{#fortinet-fw-vdoms-rest-discovery__table_w2b_drw_rcc__entry__2}

| Field | Description |
|-|-|
| IP Address \[ip_address\] | IP address of the Fortinet firewall. |
| Netmask \[netmask\] | Netmask of the Fortinet firewall. |
| Nic \[nic\] | References the Network Adapter \[cmdb_ci_network_adapter\] table. |
[Table 5. IP Address \[cmdb_ci_ip_address\]]

{#fortinet-fw-vdoms-rest-discovery__table_w2b_drw_rcc}

Discovery populates the data in the CMDB when running the Next Generation Fortinet Network Firewall - REST pattern extension VDOM Discovery.  
{#fortinet-fw-vdoms-rest-discovery__table_o15_xmr_5cc__entry__2}

| Field | Description |
|-|-|
| Vdom Index \[vdom_index\] | Index of the VDOM in the list. |
| Name \[name\] | Name of the VDOM. |
| Description \[short_description\] | Description of the VDOM property that provides additional context or information about the purpose of the property. |
| IP Address \[ip_address\] | IP address of the Fortinet device associated with this VDOM. |
[Table 6. Fortinet Virtual Domain \[cmdb_ci_fortinet_vdom\]]

{#fortinet-fw-vdoms-rest-discovery__table_o15_xmr_5cc}  
{#fortinet-fw-vdoms-rest-discovery__table_krg_snr_5cc__entry__2}

| Field | Description |
|-|-|
| ID \[id\] | Unique identifier for the interface. For example: port1. |
| Name \[name\] | Name of the interface. For example: LAN. |
| IP Address \[ip_address\] | IP address assigned to the interface. |
| Description \[short_description\] | Description of the interface, often used for documentation or identification purposes. For example: Main LAN interface. |
| MAC Address \[mac_address\] | MAC address of the interface. |
| Access Type \[access_type\] | Type of interface. For example: physical, VLAN, or aggregate. |
[Table 7. Fortinet Firewall Interface \[cmdb_ci_fortinet_firewall_interface\]]

{#fortinet-fw-vdoms-rest-discovery__table_krg_snr_5cc}  
{#fortinet-fw-vdoms-rest-discovery__table_u1l_b4r_5cc__entry__2}

| Field | Description |
|-|-|
| Name \[name\] | Virtual LAN (VLAN) ID associated with the interface, if applicable. The format is: <kbd class="ph userinput">VLAN-{Vlan ID}</kbd>. For example: VLAN-310. |
[Table 8. Network Topology \[cmdb_ci_network_topology\]]

{#fortinet-fw-vdoms-rest-discovery__table_u1l_b4r_5cc}  
{#fortinet-fw-vdoms-rest-discovery__table_sms_2nr_5cc__entry__2}

| Field | Description |
|-|-|
| Policy ID \[policy_id\] | Unique ID assigned to the policy in VDOM or device level. |
| UUID \[uuid\] | Global unique identifier (GUID) for the firewall policy. |
| Name \[name\] | Name of the policy. |
| Source interface \[source_interface\] | Network interface from which the traffic originates. |
| Destination interface \[destination_interface\] | Network interface to which the traffic is directed. |
| Source address \[source_address\] | Source address or address group from which traffic originates. |
| Destination address \[destination_address\] | Destination address or address group to which traffic is directed. |
| Internet Service \[internet_service\] | Service or application being managed by the policy, often represented by a service group or name. |
[Table 9. Fortinet Firewall Policy \[cmdb_ci_fortinet_firewall_policy\]]

{#fortinet-fw-vdoms-rest-discovery__table_sms_2nr_5cc}

## CI relationships {#fortinet-fw-vdoms-rest-discovery__section_mw1_3qr_5cc}

The Next Generation Fortinet Network Firewall - REST pattern creates the following relationships and references to support Fortinet firewall discovery. References link to records in other tables and don't appear in the CI Relationship \[cmdb_rel_ci\] table.  
{#fortinet-fw-vdoms-rest-discovery__table_agp_zxz_ykb__entry__3}

| CI | Relationship | CI |
|-|-|-|
| Fortinet Firewall Cluster \[cmdb_ci_firewall_cluster_fortinet\] | Hosted on::Hosts | Fortinet Firewall Device \[cmdb_ci_firewall_device_fortinet\] |
| Fortinet Firewall Device \[cmdb_ci_firewall_device_fortinet\] | Owns::Owned by | IP Address \[cmdb_ci_ip_address\] |
| Fortinet Firewall Device \[cmdb_ci_firewall_device_fortinet\] | Owns::Owned by | Network Adapter \[cmdb_ci_network_adapter\] |
| Fortinet Firewall Device \[cmdb_ci_firewall_device_fortinet\] | Uses::Used by | Router Interface \[dscy_router_interface\] |
| Network Adapter \[cmdb_ci_network_adapter\] | Owns::Owned by | IP Address \[cmdb_ci_ip_address\] |
[Table 10. CI relationships]

{#fortinet-fw-vdoms-rest-discovery__table_agp_zxz_ykb}  
{#fortinet-fw-vdoms-rest-discovery__table_ci_references_fortinet_rest__entry__3}

| CI | Field | Referenced CI |
|-|-|-|
| Serial Number \[cmdb_serial_number\] | Configuration item \[configuration_item\] | Fortinet Firewall Device \[cmdb_ci_firewall_device_fortinet\] |
| Network Adapter \[cmdb_ci_network_adapter\] | Configuration Item \[cmdb_ci\] | Fortinet Firewall Device \[cmdb_ci_firewall_device_fortinet\] |
| Router Interface \[dscy_router_interface\] | Configuration Item \[cmdb_ci\] | Fortinet Firewall Device \[cmdb_ci_firewall_device_fortinet\] |
| IP Address \[cmdb_ci_ip_address\] | Nic \[nic\] | Network Adapter \[cmdb_ci_network_adapter\] |
[Table 11. CI references]

{#fortinet-fw-vdoms-rest-discovery__table_ci_references_fortinet_rest}

The VDOM Discovery extension creates the following relationships to support FortiGate VDOM discovery.  
{#fortinet-fw-vdoms-rest-discovery__table_qgv_gw5_vcc__entry__3}

| CI | Relationship | CI |
|-|-|-|
| Fortinet Virtual Domain \[cmdb_ci_fortinet_vdom\] | Contains::Contained by | Fortinet Firewall Interface \[cmdb_ci_fortinet_firewall_interface\] |
| Fortinet Virtual Domain \[cmdb_ci_fortinet_vdom\] | Contains::Contained by | Fortinet Firewall Policy \[cmdb_ci_fortinet_firewall_policy\] |
| Fortinet Virtual Domain \[cmdb_ci_fortinet_vdom\] | Hosted on::Hosts | Fortinet Firewall Device \[cmdb_ci_firewall_device_fortinet\] |
| Fortinet Firewall Interface \[cmdb_ci_fortinet_firewall_interface\] | Members::Member of | Network Topology \[cmdb_ci_network_topology\] |
[Table 12. CI relationships]

{#fortinet-fw-vdoms-rest-discovery__table_qgv_gw5_vcc}