FAQ

General

Which firewalls does FireSight support?

Fortinet today: FortiManager, standalone FortiGates, and offline snapshots of either. Palo Alto Networks, Check Point, Cisco and Linux are planned, not available yet. See Supported and planned platforms.

Do I need FortiManager?

No. A standalone FortiGate can be connected directly, and a path can cross from FortiManager-managed firewalls to standalone ones.

Does FireSight change anything when I just connect it?

No. Syncing and auditing only read. Changes are made only when an implementer deploys an approved request, and only when FIRESIGHT_DEPLOY_MODE=live. The default is simulate.

Can I try it without real firewalls?

Yes, with the demo.

Requests and approvals

Can a requester pick who approves their request?

No. Requesters can never create, change or choose approval chains. The chains follow from the management domains (Fortinet: ADOMs) the request changes and the conditions it matches, both set by administrators. A draft shows who will approve it.

Does a request need approval from every domain it touches?

Yes. Each management domain's chain approves in parallel, and all must approve. Domains that share a chain share one set of approvals.

Can someone approve their own request, or approve twice?

Not by default. See Approve and reject.

Will I get an email when something needs my approval?

No. FireSight sends notifications for device health only. Check Approvals; the menu shows how many requests are waiting.

What if the rule base changes after a request was approved?

Deployment is refused, because the request would no longer do what was approved. Cancel it and raise a new one.

How do I give temporary access?

Set Remove after on the request. FireSight backs the rule out automatically after that day. See Temporary rules.

Deployment

What happens if a deployment fails half-way?

The target is marked Deploy failed and what was written is recorded. Deploy again to retry, or back it out to clean up. On a standalone FortiGate, a policy that isn't in position yet is left disabled.

Can back-out remove someone else's rule?

No. A policy is only deleted if it still carries FireSight's name for that request, and objects still in use elsewhere are kept.

Why can't I back out a simulated deployment?

Nothing was changed, so there is nothing to back out.

Audit

Why isn't my "allow" above the deny-all flagged?

Because that's normal design: a narrow exception above a broader rule is how rule bases work. Only rules that cross (share some traffic, neither containing the other, opposite actions), duplicates and hidden rules are reported. See Finding types.

Why are there no Never hit findings for my snapshot?

Configuration files and backups contain no hit counters. Use a FortiManager export, which does.

Can I give the audit to a customer?

Yes: download the PDF audit report, with Prepared for filled in.

Offline review

Does the export script change anything on FortiManager?

No. It refuses anything that isn't a read before it is sent. Use a read-only admin for a second guarantee. See The FortiManager export script.

Where do I get fmg-export.py?

In FireSight: Settings, Connections, Add offline snapshot, Config files or export, Download export script.

Licensing

What counts as a firewall?

Each physical or virtual firewall. An HA cluster counts once; VDOMs, managers, offline snapshots and the demo are free. See Licensing.

What happens when the license runs out?

A warning, then 30 days of grace, then new deployments stop. Back-out, approvals, sync and audit always keep working.

Does FireSight need internet access for licensing?

No. A license is a signed file checked on the system itself. Online renewal is optional and off by default.

We moved FireSight to a new server.

The license keeps working for 30 days. Request a re-host on the portal. See Moving to new hardware.

Accounts

Does FireSight have two-factor sign-in?

Not on its own accounts. Use single sign-on (OpenID Connect or SAML) and enforce multi-factor authentication at your identity provider.

We turned off FireSight accounts and the directory is down. How do we get in?

Administrators with a FireSight account can always sign in with their password. See Sign-in methods.