FireSight docsConnections
A connection is how FireSight reaches your firewalls. Administrators manage connections under Settings, Connections. The line at the top lists the platforms; planned ones are marked "coming" (see Supported and planned platforms).
| Button | Adds | See |
|---|---|---|
| Add FortiManager | A FortiManager and every management domain (Fortinet: ADOM), firewall and policy set (Fortinet: policy package) on it. | Connect a FortiManager |
| Add FortiGate | One standalone FortiGate, managed directly. | Connect a standalone FortiGate |
| Add offline snapshot | Uploaded files for a read-only review. | Offline snapshots |
The Connections table
| Column | Shows |
|---|---|
| Name | The connection's name. Built-in demo data marks the demo connections. |
| Type | FortiManager, FortiGate (Standalone) or Offline snapshot. |
| Address | Host and port. Certificate not verified appears when TLS verification is off. |
| API token | Stored encrypted (and the environment variable, if one is used), or Missing. |
| Last sync | Synced, Synced with warnings or Sync failed, and when. The result of Test appears here too. |
Row buttons for live connections:
- Test checks the address and token, and shows the host name and version that answered.
- Sync now reads everything again (see below).
- Backups (standalone FortiGates only) lists the configuration backups FireSight took. See Connect a standalone FortiGate.
- Edit opens the connection's settings. The demo connections can't be edited.
Connection settings
| Field | Default | Meaning |
|---|---|---|
| Name | Letters, digits, spaces and _ . -, up to 100 characters. Must be unique. |
|
| Port | 443 | HTTPS port of the FortiManager or FortiGate API. |
| Host name or IP | Address of the FortiManager or FortiGate. | |
| API token | Stored encrypted; you can't view it again. When editing, leave it empty to keep the stored token. | |
| Or read the token from an environment variable | Only when adding. A variable name starting with FMG_, such as FMG_ROME_TOKEN, set in the FireSight container. See Server configuration. |
|
| Verify the TLS certificate | on | Turn off only for a lab device with a self-signed certificate. |
| Assume workspace mode if an ADOM's setting can't be read | off | FortiManager only. See workspace mode. |
| Install new policies only on the firewalls in the traffic path (Install On) | on | FortiManager only. See Install On. |
| Remove the stored token | off | Only when editing. Clears the stored token. |
Click Save connection.
Warning
When you change a connection's address, you must enter the token again (or remove it). A stored token never follows a connection to a new address unnoticed.
FireSight has no button to delete a live connection; contact support if you need to retire one. Offline snapshots can be deleted.
The ADOMs and firewalls table
Below the connections, ADOMs and firewalls lists every management domain (Fortinet: ADOM):
| Column | Shows |
|---|---|
| ADOM | Name, number of firewalls and packages. |
| Connection | Which connection it belongs to, and its type. |
| How changes are made | Changes apply directly, Workspace: lock, commit, unlock, Workflow mode (not supported), Live on the firewall, backup first (standalone FortiGate) or Read-only snapshot. |
| Workspace mode | FortiManager only: the override (see workspace mode). |
| Approvers | The approval chain the domain uses. Change it under Approval chains. |
Sync
A sync reads, for every management domain on the connection:
- the management domain's description, version, workspace mode and normalised interfaces;
- every firewall: name, serial number, model, firmware, management address, connection status, VDOMs and location;
- each firewall's interface addresses (recorded as discovered IP allocations), its routing tables (IPv4 and IPv6, every VDOM and VRF), zones, policy routes and SD-WAN;
- address and service objects, including groups;
- every policy set, its installation scope and its policies;
- hit counters and last-used times from every firewall each policy set is installed on.
What sync keeps and changes:
- Regions, sites and manual IP allocations you set in FireSight are kept.
- A firewall that has disappeared is marked Removed from FortiManager and stops counting for the license.
- A policy set that no longer exists is removed, unless a rule request still refers to it.
- Problems reading one part (for example a firewall FortiManager can't reach) don't stop the sync. They're listed as warnings, the status reads Synced with warnings, and the Policy packages page shows them in a banner.
When syncs run
- Scheduled: every 60 minutes by default (Sync connections every (minutes); 0 turns it off). With Audit every package after a scheduled sync on (the default), every policy set is audited afterwards. See Settings reference.
- On demand: Sync now in Settings (administrators), or the Sync button named after the connection on the Policy packages page (implementers and administrators). A sync on demand doesn't audit automatically; click Audit all packages or Run audit.
- After a deployment or back-out: the changed policy set is re-synced.
Offline snapshots are read once, when their files are loaded.