Offline snapshots

An offline snapshot lets you audit a rule base without connecting FireSight to it: for example a customer's firewalls, or an environment FireSight can't reach. You upload files; FireSight reads them, runs the full rule audit and shows the findings.

Only administrators can add, replace and delete snapshots.

What you can upload

Configuration files and backups hold no hit counters, so Never hit and Inactive findings can't be reported for them. A FortiManager export includes the counters.

Add a snapshot

1. Open Settings, Connections, and click Add offline snapshot.
2. Enter a Name, such as Customer X review, October. It must be unique among connections.

3. Choose what you're uploading:

   FortiManager backup

   • Backup file: the .dat file from FortiManager's System Settings > Backup. Up to 4 GB.
   • Backup password: the password set when the backup was made. It's used only to open the file and is never stored or logged.

   Config files or export

   • Files: up to 50 files, 200 MB in total. FortiGate .conf files, or one FortiManager export. Files compressed with gzip (.gz) are accepted and expanded automatically.
   • Download export script saves fmg-export.py. See The FortiManager export script.

4. Click Load and audit. FireSight reads the files and audits every policy set in them.

When it finishes, the dialog says how many policy packages it audited and how many issues it found by severity. For a backup, it also lists the firewalls whose latest configuration it found. View findings opens them; notes from reading the files lists anything that couldn't be read.

If the files can't be read, FireSight says why and nothing is kept.

Upload limits

If an upload is too large:

• Compress it with gzip before uploading. FortiManager exports from the script are already compressed.
• For a very large FortiManager, export a few ADOMs (management domains) at a time with --adom and load each as its own snapshot.

FortiManager backups

Fortinet doesn't document the backup format. FireSight reads Fortinet's own backup container, the OpenSSL AES-256 format and plain archives, and looks through nested archives. An encrypted FortiGate backup can be loaded the same way.

• Backups from FortiManager 7.4 can't be read yet. Use the export script instead.
• If a backup can't be read, FireSight says why: the password is wrong, the encryption is unknown, or there are no device configurations inside.
• Password-protected FortiGate .conf files can't be read as configuration files: back up without a password, or load them as a backup with their password.

Why snapshots are read-only

A snapshot can be audited but never changed, and this is enforced in FireSight's code, not just by convention:

• The snapshot reader refuses every write (objects, policies, moves, installs and backups) with this is an offline snapshot: it can be audited, but nothing can be changed or deployed.
• Snapshots are never used to plan live rules, even when they contain firewalls with the same names as live ones, and they can't be chosen for manual placement.
• They're left out of IP address management, approval routing, device health, licensing and the Overview counts.
• The uploaded files are stored encrypted.

Snapshots in the Connections table

Row buttons:

• View findings opens Audit findings with this snapshot as the source.
• Load new files replaces the snapshot's contents with new files and audits again. If the new files can't be read, the previous ones are kept.
• Delete asks Delete …? and, after Delete snapshot, removes the uploaded files, the policies read from them and their findings. Live connections aren't affected. The audit log keeps a record.

Loading, replacing and deleting are all written to the audit log.

Findings and reports

On Audit findings, choose the snapshot in the Source list (shown as Snapshot: name). Download CSV and PDF report then cover only that snapshot. See Audit findings and PDF audit report.