Connect a standalone FortiGate

A FortiGate that isn't managed by FortiManager can be connected directly over the FortiOS REST API. A small organisation with a single firewall gets the same placement, auditing, approvals and back-out as a FortiManager estate. A path can cross from a FortiManager-managed firewall to a standalone one.

FortiOS 7.0 or later is assumed.

How a standalone firewall appears

• Each VDOM appears as its own management domain (FireSight screens call it an ADOM), named after the firewall's host name (for example FGT-1), or FGT-1/<vdom> when the firewall has several VDOMs.
• Each VDOM has one policy set (policy package) called policy, installed on that firewall and VDOM.
• The firewall counts once for the license, however many VDOMs it has.

Step 1: create the REST API administrator on the FortiGate

1. Create an admin profile that allows firewall policy, address, service and system configuration (read-write).
2. Create a REST API administrator with that profile, and restrict its trusted hosts to the FireSight server.
3. Generate its API key and copy it.

Step 2: add it in FireSight

1. Open Settings, Connections, and click Add FortiGate.
2. Enter a Name (for example Head office), the Host name or IP and the Port (443).
3. Paste the key into API token (or name an FMG_ environment variable).
4. Click Save connection, then Test, then Sync now.

The FortiManager-only options (workspace mode and Install On) don't apply.

What a deployment does on a FortiGate

Every write on a FortiGate takes effect at once, so FireSight is careful about order:

1. Takes a full configuration backup and stores it encrypted.
2. Creates or reuses address and service objects.
3. Adds the policy disabled, then moves it into position.
4. Enables it.

If anything fails before the last step, the policy is left disabled, so it never takes effect in the wrong place. In ADOMs and firewalls, these domains show Live on the firewall, backup first.

Configuration backups

A backup is taken before every change FireSight makes to a standalone FortiGate, including back-outs. To see them, click Backups on the connection's row.

Download saves the configuration as a .conf file. Backups contain the firewall's secrets, so only administrators can download them, and every download is recorded in the audit log. Up to 200 of the most recent backups are listed.