Fortinet firewall and FortiGate VDOM REST-based discovery

The Discovery and Service Mapping Patterns application uses the Next Generation Fortinet Network Firewall - REST pattern to find Fortinet firewalls through REST API calls. Additionally, the pattern extension VDOM Discovery finds FortiGate Virtual Domains (VDOMs). Discovering some of these resources may require updating to the latest version of the Discovery and Service Mapping Patterns application from the ServiceNow Store.

The Next Generation Fortinet Network Firewall - REST pattern uses a set of REST API calls to find the Fortinet firewalls. Discovery uses the pattern to run horizontal discovery.

注:

Only the REST-based Fortinet firewall discovery method finds FortiGate VDOMs. The SNMP-based Fortinet firewall discovery method doesn't discover them. For information about the default SNMP-based Fortinet firewall discovery, see Next-Generation Fortinet Network Firewall SNMP-based discovery.

Request apps on the Store

Visit the ServiceNow Store to view all the available apps, and for information about submitting requests to the store. For cumulative release notes information for all released apps, see the ServiceNow Store version history release notes.

To learn about Fortinet Firewalls and their versions that you can discover, refer to Detailed information on products discovered by ITOM Visibility.

Prerequisites

Verify that the applications are up to date

• Discovery and Service Mapping Patterns
• CMDB CI Class Models

Create API Token

Create an API Token in Fortinet. For instructions on creating an API Token, go to the Fortinet Document Library and search for the "Connect FortiGate device via API Token - Online Help" article under the FortiConverter Tool product family.

Verify API access and permissions

• Verify that the MID Server can access the Fortinet APIs.
• Verify that the API Token has sufficient permissions to retrieve the required information from the Fortinet devices.

Required Fortinet APIs:

• v2/cmdb/system/global
• api/v2/monitor/system/status
• api/v2/cmdb/system/ha
• api/v2/cmdb/router/static
• /api/v2/cmdb/firewall/policy
• api/v2/cmdb/system/vdom-property
• api/v2/cmdb/system/interface
• /api/v2/monitor/system/interface/select

Disable SNMP-based Fortinet firewall discovery

For more information, see Disable SNMP-based Fortinet firewall discovery.

Create an alias for the API Key Credentials

For more information, see Create an alias for the API key credential for Fortinet firewall REST-based discovery.

Create a serverless discovery schedule

For more information, see Create a serverless schedule for Fortinet firewall REST-based discovery.

Data collected by Discovery during horizontal discovery

Discovery populates the data in the CMDB when running the Next Generation Fortinet Network Firewall - REST pattern.

表 : 1. Fortinet Firewall Device [cmdb_ci_firewall_device_fortinet]

Field	Description
Name [name]	Hostname field of the Fortinet device.
Serial number [serial_number]	Serial number of the Fortinet device.
Fully qualified domain name [fqdn]	Fully qualified domain name of the Fortinet device.
Operational status [operational_status]	Indicates whether the Fortinet device is in active state.
IP Address [ip_address]	IP address of the Fortinet device.
Manufacturer [manufacturer]	Fortinet device manufacturer.
Description [short_description]	Short description of the Fortinet device.
Model Number [model_number]	Fortinet device model number.
Firmware version [firmware_version]	Fortinet device firmware version.
Hardware OS [hardware_os]	OS running on the hardware.
Hardware OS Version [hardware_os_version]	OS version running on the hardware.

表 : 2. Fortinet Firewall Cluster [cmdb_ci_firewall_cluster_fortinet]

Field	Description
Name [name]	Hostname field of the Fortinet firewall cluster.
Fully qualified domain name [fqdn]	Fully qualified domain name of the firewall cluster.
IP address [ip_address]	IP address of the firewall cluster.
Manufacturer [manufacturer]	Device manufacturer.
Description [short_description]	Short description of the firewall cluster.
Model Number [model_number]	Device model number.
Hardware OS [hardware_os]	OS running on the hardware.
Hardware OS Version [hardware_os_version]	OS version running on the hardware.

表 : 3. Network Adapter [cmdb_ci_network_adapter]

Field	Description
IP Address [ip_address]	IP address of the network adapter.
Netmask [netmask]	Netmask of the network adapter.
Alias [alias]	User-assigned name for the network adapter.
MAC Address [mac_address]	MAC address of the network adapter.
Name [name]	Name of the network adapter.
Configuration Item [cmdb_ci]	References the Fortinet Firewall Device [cmdb_ci_firewall_device_fortinet] table.

表 : 4. IP Address [cmdb_ci_ip_address]

Field	Description
IP Address [ip_address]	IP address of the Fortinet firewall.
Netmask [netmask]	Netmask of the Fortinet firewall.

Discovery populates the data in the CMDB when running the Next Generation Fortinet Network Firewall - REST pattern extension VDOM Discovery.

表 : 5. Fortinet Virtual Domain [cmdb_ci_fortinet_vdom]

Field	Description
Vdom Index [vdom_index]	Index of the VDOM in the list.
Name [name]	Name of the VDOM.
Description [short_description]	Description of the VDOM property that provides additional context or information about the purpose of the property.

表 : 6. Fortinet Firewall Interface [cmdb_ci_fortinet_firewall_interface]

Field	Description
ID [id]	Unique identifier for the interface. For example: port1.
Name [name]	Name of the interface. For example: LAN.
IP Address [ip_address]	IP address assigned to the interface.
Description [short_description]	Description of the interface, often used for documentation or identification purposes. For example: Main LAN interface.
MAC Address [mac_address]	MAC address of the interface.
Access Type [access_type]	Type of interface. For example: physical, VLAN, or aggregate.

表 : 7. Network Topology [cmdb_ci_network_topology]

Field	Description
Name [name]	Virtual LAN (VLAN) ID associated with the interface, if applicable. The format is: VLAN-{Vlan ID}. For example: VLAN-310.

表 : 8. Fortinet Firewall Policy [cmdb_ci_fortinet_firewall_policy]

Field	Description
Policy ID [policy_id]	Unique ID assigned to the policy in VDOM or device level.
UUID [uuid]	Global unique identifier (GUID) for the firewall policy.
Name [name]	Name of the policy.
source_interface	Network interface from which the traffic originates.
destination_interface	Network interface to which the traffic is directed.
Source address [source_address]	Source address or address group from which traffic originates.
Destination address [destination_address]	Destination address or address group to which traffic is directed.
Internet Service [internet_service]	Service or application being managed by the policy, often represented by a service group or name.

CI relationships

Discovery creates these relationships to support the Fortinet firewall discovery.

CI	Relationship	CI
Fortinet Firewall Cluster [cmdb_ci_firewall_cluster_fortinet]	Hosted on::Hosts	Fortinet Firewall Device [cmdb_ci_firewall_device_fortinet]
Fortinet Firewall Device [cmdb_ci_firewall_device_fortinet]	Owns::Owned by	IP Address [cmdb_ci_ip_address]
Fortinet Firewall Device [cmdb_ci_firewall_device_fortinet]	Owns::Owned by	Network Adapter [cmdb_ci_network_adapter]
Fortinet Firewall Device [cmdb_ci_firewall_device_fortinet]	Uses::Used by	Router Interface [dscy_router_interface]
Network Adapter [cmdb_ci_network_adapter]	Owns::Owned by	IP Address [cmdb_ci_ip_address]
Network Adapter [cmdb_ci_network_adapter]	References	Fortinet Firewall Device [cmdb_ci_firewall_device_fortinet]
Router Interface [dscy_router_interface]	References	Fortinet Firewall Device [cmdb_ci_firewall_device_fortinet]
Serial Number [cmdb_serial_number]	References	Fortinet Firewall Device [cmdb_ci_firewall_device_fortinet]

Discovery creates these relationships to support the FortiGate VDOM discovery.

CI	Relationship	CI
Fortinet Firewall Interface [cmdb_ci_fortinet_firewall_interface]	Extends from	Network Interface [cmdb_ci_ni_interface]
Fortinet Firewall Policy [cmdb_ci_fortinet_firewall_policy]	Extends from	Firewall Security Policy [cmdb_ci_firewall_sec_policy]
Fortinet Virtual Domain [cmdb_ci_fortinet_vdom]	Contains::Contained By	Fortinet Firewall Interface [cmdb_ci_fortinet_firewall_interface]
Fortinet Virtual Domain [cmdb_ci_fortinet_vdom]	Contains::Contained By	Fortinet Firewall Policy [cmdb_ci_fortinet_firewall_policy]
Fortinet Virtual Domain [cmdb_ci_fortinet_vdom]	Extends from	IP Firewall [cmdb_ci_ip_firewall]
Fortinet Virtual Domain [cmdb_ci_fortinet_vdom]	Hosted on::Hosts	Fortinet Firewall Device [cmdb_ci_firewall_device_fortinet]
Network Topology [cmdb_ci_network_topology]	Members::Member of	Fortinet Firewall Interface [cmdb_ci_fortinet_firewall_interface]