Device Management

8. Device Management#

8.1. How to get a managed device OID?#

Some API calls require to pass the OID of a managed device rather than a symbolic device name. The following example shows how to get the OID of the dev_001 managed device:

REQUEST

{
  "id": 3,
  "method": "get",
  "params": [
    {
      "fields": [
        "name"
      ],
      "filter": [
        "name",
        "==",
        "dev_001"
      ],
      "option": [
        "no loadsub"
      ],
      "url": "/dvmdb/device"
    }
  ],
  "session": "{{session}}",
  "verbose": 1
}

Note

You could avoid the filter block by using the /dvmdb/device/dev_001 URL.

RESPONSE

{
  "id": 3,
  "result": [
    {
      "data": [
        {
          "name": "dev_001",
          "oid": 276
        }
      ],
      "status": {
        "code": 0,
        "message": "OK"
      },
      "url": "/dvmdb/device"
    }
  ]
}

Note

The OID of the dev_001 managed device is 276.

8.2. How to rename a managed device?#

Warning

This section is describing how to change the device name used by FortiManager.

Changing the device’s hostname is a different topic (even though most of the time, for ease of operations, both are identical).

You can use two endpoints:

/dvmdb/device/<device>
/dvmdb/adom/<adom>/device/<device>

8.2.1. Using /dvmdb/device/<device>#

To rename the fgt-741-001 device to fgt-742-001 in the dc_emea ADOM:

REQUEST

{
  "id": 3,
  "method": "set",
  "params": [
    {
      "data": {
        "name": "fgt-742-001"
      },
      "url": "/dvmdb/device/fgt-741-001"
    }
  ],
  "session": "{{session}}"
}

RESPONSE

{
  "id": 3,
  "result": [
    {
      "data": {
        "name": "fgt-742-001"
      },
      "status": {
        "code": 0,
        "message": "OK"
      },
      "url": "/dvmdb/device/foobar"
    }
  ]
}

8.2.2. Using /dvmdb/adom/<adom>/device/<device>#

To rename the fgt-741-001 device to fgt-742-001 in the dc_emea ADOM:

REQUEST

{
  "id": 3,
  "method": "update",
  "params": [
    {
      "data": {
        "name": "fgt-742-001"
      },
      "url": "/dvmdb/adom/dc_emea/device/fgt-741-001"
    }
  ],
  "session": "{{session}}"
}

Note

You can also use the set method

RESPONSE

{
  "id": 3,
  "result": [
    {
      "data": {
        "name": "fgt-742-001"
      },
      "status": {
        "code": 0,
        "message": "OK"
      },
      "url": "/dvmdb/adom/dc_emea/device/fgt-741-001"
    }
  ]
}

8.3. Device status#

Captured in #462768.

This section is about getting the Config Status, Policy Package Status, Provisioning Templates status, ADOM membership, cluster member status, etc. for the managed devices.

This is more or less the information showing up int the Device Manager > Device & Groups page of the FortiManager GUI:

It is now possible to get these different status when getting the list of devices with the Fortimanager API URL /dvmdb/device[/<device>].

You just have to pass the two options extra info and assignment info.

The following example shows how to get these status for a single managed cluster; cluster_001 in this case:

REQUEST

{
  "id": 3,
  "method": "get",
  "params": [
    {
      "option": [
        "extra info",
        "assignment info"
      ],
      "url": "/dvmdb/device/cluster_001"
    }
  ],
  "session": "{{session}}",
  "verbose": 1
}

RESPONSE

{
  "id": 3,
  "result": [
    {
      "data": {
        "adm_pass": [
          "ENC",
          "g9ZrdUj7gIqEKVU6aI9Azk8+hXo8BUUpRXFzN++KBvjfXH+dcK90agrchqFtsr2WH/nkbeLDxeS/jhmlnXKAg5/q+D6nYsrMDudW1SHLBWLgYzJccx9ja5tZOOwvYoYm1ac+txELl+U/XCIarQHlRB0AEO5syVKzfWAye8akyCNqVwGs"
        ],
        "adm_usr": "admin",
        "app_ver": "",
        "assignment info": [
          {
            "name": "system_template_001",
            "status": "installed",
            "type": "devprof"
          }
        ],
        "...": "...",
        "conf_status": "insync",
        "conn_mode": "passive",
        "conn_status": "up",
        "db_status": "nomod",
        "dev_status": "auto_updated",
        "extra info": {
          "adom": "demo"
        },
        "ha_slave": [
          {
            "did": "cluster_001",
            "flags": null,
            "idx": 0,
            "name": "dev_001",
            "obj ver": -1,
            "oid": 1463,
            "prio": 200,
            "role": "master",
            "sn": "FGVMULREDACTED61",
            "status": 1
          },
          {
            "did": "cluster_001",
            "flags": null,
            "idx": 2147483647,
            "name": "dev_002",
            "obj ver": -1,
            "oid": 1464,
            "prio": 100,
            "role": "slave",
            "sn": "FGVMULREDACTED60",
            "status": 2
          }
        ],
        "...": "...",
        "hostname": "dev_001",
        "...": "..."
        "vdom": [
          {
            "assignment info": [
              {
                "name": "ppkg_001",
                "status": "installed",
                "type": "policy"
              },
              {
                "name": "1375-3",
                "status": "installed",
                "type": "wtp"
              },
              {
                "name": "sdwan_template_001",
                "status": "installed",
                "type": "wanprof"
              },
              {
                "name": "1375-3",
                "status": "installed",
                "type": "fsp"
              },
              {
                "name": "1375-3",
                "status": "imported",
                "type": "fext"
              },
              {
                "name": "cli_template_group_001",
                "status": "installed",
                "type": "cli"
              },
              {
                "name": "ipsec_tunnel_template_001",
                "status": "installed",
                "stype": "_ipsec",
                "type": "template"
              },
              {
                "name": "static_route_template_001",
                "status": "installed",
                "stype": "_router_static",
                "type": "template"
              },
              "...": "...",
            ],
            "...": "...",
            "extra info": {
              "adom": "demo"
            },
            "...": "..."
            "name": "root",
            "...": "..."
          }
        ],
        "...": "..."
      },
      "status": {
        "code": 0,
        "message": "OK"
      },
      "url": "/dvmdb/device/cluster_site_1"
    }
  ]
}

Note

This output is showing a lot of information:

Lines 12-18

This is showing that the device (global scope) is assigned to a system template (devprof) named system_template_001 and that it is in sync (installed). It means the content of the system template has been applied to real managed device.

The system template is not at the VDOM level. That’s the only template that need to be applied against the global scope.

Lines 20-24

Those are the device status.

Lines 25-27

The device (global scope) belongs to ADOM demo.

One of its VDOMs could belong to other ADOMs.

Lines 28-53

It indicates this is a cluster and with two members: dev_001 and dev_002. The status indicates the status of the member. 1 means the member is up while 2 means it is down.

Lines 57-101

The vdom block gives the status information for all VDOMs. Lines 61-65 gives the policy package name (ppkg_001) and status (installed), lines 71-75 gives the SD-WAN Template name (sdwan_template_001) and status (installed), etc.

Lines 105-109

It gives the ADOM name (demo) the VDOM belongs to along with the VDOM name (root).

The following example shows how to get these status for the root VDOM of the dev_001 managed device:

REQUEST

{
  "id": 1,
  "method": "get",
  "params": [
    {
      "option": [
        "extra info",
        "assignment info"
      ],
      "url": "/dvmdb/device/dev_001/vdom/root"
    }
  ],
  "session": "{{session}}"
}

RESPONSE

{
  "id": 1,
  "result": [
    {
      "data": {
        "assignment info": [
          {
            "name": "ppkg_001",
            "status": "installed",
            "type": "policy"
          },
          {
            "name": "3565-3",
            "status": "installed",
            "type": "wtp"
          }
        ],
        "comments": "",
        "devid": "dev_001",
        "ext_flags": 1,
        "extra info": {
          "adom": "demo"
        },
        "flags": 0,
        "name": "root",
        "node_flags": 4,
        "obj ver": -1,
        "oid": 3,
        "opmode": 1,
        "rtm_prof_id": 0
      },
      "status": {
        "code": 0,
        "message": "OK"
      },
      "url": "/dvmdb/device/dev_001/vdom/root"
    }
  ]
}

The following example shows how to get these status for all managed devices:

REQUEST

{
  "id": 3,
  "method": "get",
  "params": [
    {
      "option": [
        "extra info",
        "assignment info"
      ],
      "url": "/dvmdb/device"
    }
  ],
  "session": "{{session}}",
  "verbose": 1
}

Starting with FortiManager 7.4.8, 7.6.5 and 8.0.0 (#1192521), you can also use the new _vdom/status API request. as shown below:

REQUEST

{
  "id": 3,
  "method": "get",
  "params": [
    {
      "url": "/pm/config/adom/demo/_vdom/status"
    }
  ],
  "session": "{{session}}",
  "verbose": 1
}

RESPONSE

{
  "id": 3,
  "result": [
    {
      "data": [
        {
          "auto update": 1,
          "conf_status": "in sync",
          "db_status": "not modified",
          "dev": "dev_001"
        },
        {
          "auto update": 0,
          "dev": "dev_001",
          "status": "not modified",
          "vdom": "root"
        },
        {
          "auto update": 1,
          "conf_status": "in sync",
          "db_status": "not modified",
          "dev": "dev_002"
        },
        {"...": "..."},
        {
          "auto update": 0,
          "dev": "dev_009",
          "status": "modified",
          "vdom": "root"
        },
        {
          "auto update": 0,
          "conf_status": "unknown",
          "db_status": "modified",
          "dev": "dev_010"
        },
        {
          "auto update": 0,
          "dev": "dev_010",
          "status": "modified",
          "vdom": "root"
        }
      ],
      "status": {
        "code": 0,
        "message": "OK"
      },
      "url": "/pm/config/adom/demo/_vdom/status"
    }
  ]
}

8.3.1. Policy Package Status for Managed devices#

It’s an alternative to obtain the Policy Package Status only.

It’s a bit similar to what has been documented in section Policy Package Status.

Goal is to get the Policy Package Status of a specific device or vdom.

The output should return the policy package status (installed for instance) along with the name of the corresponding Policy Package.

If the Policy Package isn’t in the root folder, then the complete or absolute path should be returned.

We need to use the following method and url:

Method	get
URL	/pm/config/adom/<adom>/_package/status/<device>/<vdom>

The following example shows how to get the status of the Policy Package assigned to the dev_001 managed device and its root VDOM in the demo ADOM:

REQUEST

{
  "id": 1,
  "method": "get",
  "params": [
    {
      "url": "/pm/config/adom/demo/_package/status/dev_001/root"
    }
  ],
  "session": "{{session}}",
  "verbose": 1
}

RESPONSE

{
  "id": 1,
  "result": [
    {
      "data": {
        "dev": "dev_001",
        "pkg": "emea/spain/ppkg_001",
        "status": "installed",
        "vdom": "root"
      },
      "status": {
        "code": 0,
        "message": "OK"
      },
      "url": "/pm/config/adom/demo/_package/status/dev_001/root"
    }
  ]
}

Note

In the above output, you can see that the status of Policy Package ppkg_001 assigned to the root VDOM of the dev_001 managed device in the demo ADOM is installed. Furthermore, you can see it is not in the root folder but in the emea/spain folder.

8.4. How to refresh a device?#

It’s about using API to reproduce the GUI Refresh Device action available when you right click a managed device from the Device Manager > Device & Groups page.

8.4.1. Refresh one device#

REQUEST:

{
  "method": "exec",
  "params": [
    {
      "data": {
        "adom": "{{adom}}",
        "device": "fgt_1",
        "flags": [
          "create_task",
          "nonblocking"
        ]
      },
      "url": "/dvm/cmd/update/device"
    }
  ],
  "session": "{{session_id}}",
  "id": 1
}

RESPONSE:

{
  "id": 1,
  "result": [
    {
      "data": {
        "pid": 6665,
        "taskid": 4
      },
      "status": {
        "code": 0,
        "message": "OK"
      },
      "url": "/dvm/cmd/update/device"
    }
  ]
}

8.4.2. Refresh multiple devices#

REQUEST:

{
  "id": 1,
  "session": "{{session_id}}",
  "params": [
    {
      "url": "/dvm/cmd/update/dev-list",
      "data": {
        "adom": "{{adom}}",
        "flags": [
          "create_task",
          "nonblocking"
        ],
        "update-dev-member-list": [
          {
            "name": "fgt_1"
          },
          {
            "name": "hub_1"
          },
          {
            "name": "hub_2"
          }
        ]
      }
    }
  ]
}

RESPONSE:

{
  "id": 1,
  "result": [
    {
      "data": {
        "taskid": 100
      },
      "status": {
        "code": 0,
        "message": "OK"
      },
      "url": "/dvm/cmd/update/dev-list"
    }
  ]
}

8.5. Device timezone#

8.5.1. How to get the list of available timezones?#

Caught in #1018335.

The following example shows how to obtain the list of available timezones for the dev_001 managed device:

REQUEST

{
  "id": 3,
  "method": "get",
  "params": [
    {
      "option": "get reserved",
      "url": "/pm/config/device/demo_dev_001/global/system/timezone"
    }
  ],
  "session": "{{session}}"
}

RESPONSE

{
  "id": 3,
  "result": [
    {
      "data": [
        {
          "name": "Africa/Abidjan",
          "obj description": "",
          "oid": 0
        },
        {
          "name": "Africa/Accra",
          "obj description": "",
          "oid": 0
        },
        {
          "name": "Africa/Addis_Ababa",
          "obj description": "",
          "oid": 0
        },
        {"...": "..."},
        {
          "name": "W-SU",
          "obj description": "",
          "oid": 0
        },
        {
          "name": "WET",
          "obj description": "",
          "oid": 0
        },
        {
          "name": "Zulu",
          "obj description": "",
          "oid": 0
        }
      ],
      "status": {
        "code": 0,
        "message": "OK"
      },
      "url": "/pm/config/device/demo_dev_001/global/system/timezone"
    }
  ]
}

Note

Yes! You can check using your FortiGate CLI, but the config system timezome does exist.

8.6. Device coordinates#

You can configure the device coordinates in the device CMDB using the FMG JSON RPC API url:

/pm/config/device/<device>/global/system/global

by touching the gui-device-latitude and gui-device-longitude attributes.

You can also set the coordinates in the device’s metadata using the FMG JSON RPC API url:

/dvmdb/device/<device>

by touching the latidude and longitude attributes.

According to #0708937, FMG is saving the method used to change the coordinates in the attribute location_from from device’s metadata.

This attribute could have value like gui, json, config or unset. It helps FMG to figure out how to set the coordinates. It helps to figure out how the coordinates synchronization is performed between device configuration and metadata…

In the below example, we can see that the coordinates were existing in devices configuration before their on-boarding in FMG:

REQUEST:

{
  "id": 1,
  "jsonrpc": "1.0",
  "method": "get",
  "params": [
    {
      "fields": [
        "name",
        "location_from"
      ],
      "loadsub": 0,
      "url": "/dvmdb/device"
    }
  ],
  "session": "9US6WwzjEQ/ktSRPInyURpuhjleLsrLvAk/kPo8rgFTAo/AAoLFTNywA666X7j65u1UoKd1EBDu0TdA8plmCyA==",
  "verbose": 1
}

RESPONSE:

{
  "id": 1,
  "result": [
    {
      "data": [
        {
          "location_from": "config",
          "name": "fgt_00_1",
          "oid": 161
        },
        {
          "location_from": "config",
          "name": "fgt_01_1",
          "oid": 170
        },
        {
          "location_from": "config",
          "name": "fgt_02_1",
          "oid": 174
        },
        {
          "location_from": "config",
          "name": "fgt_03_1",
          "oid": 172
        },
        {
          "location_from": "config",
          "name": "fgt_04_1",
          "oid": 176
        },
        {
          "location_from": "config",
          "name": "fgt_05_1",
          "oid": 182
        },
        {
          "location_from": "config",
          "name": "fgt_06_1",
          "oid": 184
        },
        {
          "location_from": "config",
          "name": "fgt_07_1",
          "oid": 186
        },
        {
          "location_from": "config",
          "name": "fgt_08_1",
          "oid": 189
        }
      ],
      "status": {
        "code": 0,
        "message": "OK"
      },
      "url": "/dvmdb/device"
    }
  ]
}

8.7. How to get the full device database syntax?#

Caught in #0607071.

The following example shows how to get the full device database syntax for the dev_001 manage device:

REQUEST

{
  "id": 1,
        "method": "get",
        "params": [
          {
            "url": "/pm/config/device/dev_001/global/_syntax/cli_only"
            "option": "syntax"
          }
        ]
}

8.8. How to get the list of devices?#

You can ask for the list of all managed devices using the following API endpoint:

/dvmdb/device

Alternatively, you can ask for the list of managed devices in a specific ADOM using the following endpoint:

/dvmdb/adom/{{adom}}/device

A third form that allows to get list of managed devices per ADOM can be used by combining the following endpoint with the expand member attribute:

/dvmdb/adom

8.8.1. How to get all managed devices?#

The following example shows how to get all managed devices:

REQUEST

{
  "id": 3,
  "method": "get",
  "params": [
    {
      "fields": [
        "name",
        "sn"
      ],
      "loadsub": 0,
      "url": "/dvmdb/device"
    }
  ],
  "session": "{{session}}",
  "verbose": 1
}

Note

The loadsub and fields attributes have been used to reduce the volume of the returned data
"loadsub": 0 will prevent to return sub-tables (like the vdom table)
The fields attribute instructs FortiManager to only return the name and the sn information for each managed device

RESPONSE

{
  "id": 3,
  "result": [
    {
      "data": [
        {
          "name": "dev_001",
          "oid": 36012,
          "sn": "FGVMMLTM00000001"
        },
        {
          "name": "dev_002",
          "oid": 36013,
          "sn": "FGVMMLTM00000002"
        },
        {
          "name": "dev_003",
          "oid": 36014,
          "sn": "FGVMMLTM00000003"
        }
      ],
      "status": {
        "code": 0,
        "message": "OK"
      },
      "url": "/dvmdb/device"
    }
  ]
}

Note

This FortiManager manages three devices: dev_001, dev_002 and dev_003
You don’t have the ADOM information exposed in the output
You can try without the fields attribute, you won’t see the ADOM information

8.8.2. How to get managed devices for a specific ADOM?#

The following example shows how to get managed devices for the demo_001 ADOM:

REQUEST

{
  "id": 3,
  "method": "get",
  "params": [
    {
      "fields": [
        "name",
        "sn"
      ],
      "option": [
        "no loadsub"
      ],
      "url": "/dvmdb/adom/demo_001/device"
    }
  ],
  "session": "{{session}}",
  "verbose": 1
}

Note

The no loadsub option and fields attributes have been used to reduce the volume of the returned data
"no loadsub will prevent to return sub-tables (like the vdom table)
The fields attribute instructs FortiManager to only return the name and the sn information for each managed device

RESPONSE

{
  "id": 3,
  "result": [
    {
      "data": [
        {
          "name": "dev_001",
          "oid": 36012,
          "sn": "FGVMMLTM00000001"
        },
        {
          "name": "dev_002",
          "oid": 36013,
          "sn": "FGVMMLTM00000002"
        }
      ],
      "status": {
        "code": 0,
        "message": "OK"
      },
      "url": "/dvmdb/adom/demo_001/device"
    }
  ]
}

Note

The demo_001 ADOM manages two devices: dev_001 and dev_002

8.8.3. How to get list of managed devices for all ADOMs?#

Section How to get all managed devices? described how to get all managed devices, but it was lacking the ADOM information.

Section How to get managed devices for a specific ADOM? described how to get managed devices for a specific ADOM, but it was not for all ADOMs.

What if you want to get the list of all managed devices and also expose the ADOM information?

The following example shows how to get the list of managed devices for all ADOMs using the expand member mechanism:

REQUEST

{
  "id": 3,
  "method": "get",
  "params": [
    {
      "expand member": [
        {
          "fields": [
            "name",
            "sn"
          ],
          "url": "device"
        }
      ],
      "fields": [
        "name",
      ],
      "filter": [
        "restricted_prds",
        "==",
        "fos"
      ],
      "option": [
        "no loadsub"
      ],
      "url": "/dvmdb/adom/"
    }
  ],
  "session": "{{session}}",
  "verbose": 1
}

Note

The no loadsub option, fields and filter attributes have been used to reduce the volume of the returned data
"no loadsub will prevent to return sub-tables (like the vdom table)
There are two fields attributes!
The first one is for the /dvmdb/adom context and will only return the ADOM name
The second one is within the expand member block and is for the /dvm/adom/{{adom}}/device context (look at the url attribute also in the expand member block).

It will only return the name and the sn of the returned managed devices.

RESPONSE

{
  "id": 3,
  "result": [
    {
      "data": [
        {
          "expand member": {
            "device": [
              {
                "name": "dev_001",
                "oid": 36012,
                "sn": "FGVMMLTM00000001"
              },
              {
                "name": "dev_002",
                "oid": 36013,
                "sn": "FGVMMLTM00000002"
              }
            ]
          },
          "name": "demo_001",
          "oid": 204
        },
        {
          "expand member": {
            "device": [
              {
                "name": "dev_003",
                "oid": 36014,
                "sn": "FGVMMLTM00000003"
              }
            ]
          },
          "name": "demo_002",
          "oid": 311
        },
        {
          "name": "root",
          "oid": 3
        },
        {
          "name": "rootp",
          "oid": 10
        }
      ],
      "status": {
        "code": 0,
        "message": "OK"
      },
      "url": "/dvmdb/adom/"
    }
  ]
}

Note

The demo_001 ADOM manages two devices: dev_001 and dev_002
The demo_002 ADOM manages two devices: dev_003

8.8.4. How to get unauthorized devices?#

An unauthorized or unregistered device is a device which managed to acquire its FortiManager details which started its FGFM tunnel.

However, on the FortiManager side, such device has been accepted but not yet authorized; it has been moved in the root ADOM and placed in the special Unauthorized Devices device group.

Note

the Unauthorized Devices device group is only visible when there are unauthorized devices

The following example shows how to get the list of unregistered or unauthorized devices:

REQUEST

{
  "id": 3,
  "method": "get",
  "params": [
    {
      "fields": [
        "name",
        "mgmt_mode"
      ],
      "filter": [
        "mgmt_mode",
        "==",
        "unreg"
      ],
      "loadsub": 0,
      "url": "/dvmdb/device"
    }
  ],
  "session": "{{session}}",
  "verbose": 1
}

Note

As you can see, to get the unauthorized devices, you have to filter based on the mgmt_mode attribute and the unreg (i. e., unregistered) value

RESPONSE

{
  "id": 3,
  "result": [
    {
      "data": [
        {
          "mgmt_mode": "unreg",
          "name": "dev_001",
          "oid": 34749
        }
      ],
      "status": {
        "code": 0,
        "message": "OK"
      },
      "url": "/dvmdb/device"
    }
  ]
}

Note

That response shows there’s a single unauthorized device named dev_001

8.9. Real Device#

8.9.1. How to add a real device?#

The following example shows how to add the dev_001 in the demo ADOM:

REQUEST

{
  "id": 3,
  "method": "exec",
  "params": [
    {
      "data": {
        "adom": "demo",
        "device": {
          "adm_pass": "fortinet",
          "adm_usr": "admin",
          "ip": "10.210.34.51",
          "mgmt_mode": "fmg",
          "name": "dev_001"
        },
        "flags": [
          "create_task"
        ]
      },
      "url": "/dvm/cmd/add/device"
    }
  ],
  "session": "{{session}}"
}

Note

This API request will be blocking
You will get a response only once the device will be added within FortiManager
The create_task flag is a good practice; FortiManager creates a task that you can refer to in case the add device operation fails
To get a non-blocking operation, you can add the nonblocking flag:
```
"flags": [
  "create_task",
  "nonblocking"
]
```
In that case, FortiManager will return immediately while still creating a task that this time you should monitor to follow its progress
The none flag will just do the add device operation, without creating a task; task will be blocking

Warning

If you use the nonblocking flag, then you have to keep the API session up till the end of the add device operation
The add device operation takes time; if your program logs out right after the API call, but while the add device operation is still in progress, then FortiManager will return a message (visible in the task, provided you used the create_task flag) similar to:
```
Failed to update device information.
```
It is recommended to combine the nonblocking with the create_task flag in order to monitor the task progress and logs out from the API session only once the add operation is successfully completed

RESPONSE

{
  "id": 3,
  "result": [
    {
      "data": {
        "device": {
          "adm_pass": "fortinet",
          "adm_usr": "admin",
          "av_ver": "1.00000(2018-04-09 18:07)",
          "beta": -1,
          "branch_pt": 523,
          "build": 523,
          "conn_mode": 1,
          "conn_status": 1,
          "dev_status": 1,
          "flags": 2097169,
          "hostname": "dev_001",
          "ip": "10.210.34.51",
          "ips_ver": "6.00741(2015-12-01 02:30)",
          "last_checked": 1711025724,
          "maxvdom": 11,
          "mgmt.__data[0]": 3870643,
          "mgmt.__data[4]": 2105184256,
          "mgmt.__data[6]": 1,
          "mgmt_mode": 3,
          "mgmt_uuid": "1981351328",
          "mr": 0,
          "name": "dev_111",
          "oid": 34835,
          "opts": 256,
          "os_type": 0,
          "os_ver": 7,
          "patch": 12,
          "platform_id": 159,
          "platform_str": "FortiGate-VM64",
          "relver_info": "GA",
          "sn": "FGVMMLREDACTED33",
          "source": 1,
          "tab_status": "<unknown>",
          "version": 700,
          "vm_cpu": 1,
          "vm_cpu_limit": 1,
          "vm_mem": 2007,
          "vm_mem_limit": 2147483647,
          "vm_status": 3
        },
        "taskid": 752
      },
      "status": {
        "code": 0,
        "message": "OK"
      },
      "url": "/dvm/cmd/add/device"
    }
  ]
}

Note

If you’re using the following list of flags:

"flags": [
  "create_task",
  "nonblocking"
]

You will get this shorter response:

{
  "id": 3,
  "result": [
    {
      "data": {
        "pid": 31637,
        "taskid": 754
      },
      "status": {
        "code": 0,
        "message": "OK"
      },
      "url": "/dvm/cmd/add/device"
    }
  ]
}

8.9.2. How to add a real device in a Fabric of FortiManager?#

Caught in #1190999.

The following example shows how to add the dev_001 device to a FortiManager Fabric Member:

REQUEST

{
    "id": 16,
    "method": "exec",
    "params": [
        {
            "data": {
                "adom": "vpn_mgmt76",
                "device": {
                    "adm_pass": "v",
                    "adm_usr": "admin",
                    "cluster_worker": "FMG-VMREDACTED69",
                    "ip": "10.8.71.31",
                    "latitude": "5.61402118544992",
                    "location_from": "GUI",
                    "longitude": "-0.179085731506348",
                    "mgmt_mode": "fmgfaz",
                    "name": "vlan171_0031"
                },
                "flags": [
                    "create_task",
                    "nonblocking"
                ]
            },
            "url": "/dvm/cmd/add/device"
        }
    ],
    "session": "..."
}

Note

This request is sent to the FortiManager Fabric Supervisor.

RESPONSE

TBD

8.10. How to change the serial number of a managed device?#

This is for the case where the former device failed and a new one was shipped to replace it.

FortiManager is still having the configuration of the failed device linked to a managed device whose serial number doesn’t correspond to the new shipped device.

It is possible to fix the wrong serial number maintained by FortiManager using the following FortiManager JSON RPC API. The following example shows how to change/replace the serial number of the dev_001 managed device:

REQUEST

{
  "id": 3,
  "method": "exec",
  "params": [
    {
      "data": {
        "sn": "FGVMULREDACTED11"
      },
      "url": "/dvmdb/device/replace/sn/dev_001"
    }
  ],
  "session": "{{session}}"
}

Note

This API request is functionally equivalent to the following FortiManager CLI command:

execute device replace sn dev_001 FGVMULREDACTED11

RESPONSE

{
  "id": 3,
  "result": [
    {
      "status": {
        "code": 0,
        "message": "OK"
      },
      "url": "/dvmdb/device/replace/sn/dev_001"
    }
  ]
}

Warning

Once FortiManager detects a real device with a matching serial number, it will reconnect to the new device.

However, if FortiManager is in auto-update mode (which is the default operating mode), it will retrieve the blank configuration from the new real device, overwriting the production configuration stored for the failed managed device.

To avoid this, disable the auto-update mode before proceeding:

config system admin setting
    set auto-update disable
end

Alternatively, use the new FortiManager RMA feature for managed devices. More details can be found in section How to RMA a managed device?.

8.11. How to promote/authorize a real device?#

Note

The term authorize was introduced in recent FortiManager versions.

In older FortiManager versions, the left tree in the ADOM root for unmanaged devices was labeled Unregistered Devices, with a right-click action named Promote.

Now, the left tree is labeled Unauthorized Devices, and the corresponding right-click action has been updated to Authorize.

The term Promote can be considered synonymous with Authorize.

Warning

You cannot promote/authorize a device and set its meta variables using the meta variables block as shown in multiple sections like in How to add a list of Model Device?.

You have two possible FortiManager API endpoints:

/dvm/cmd/add/device
/dvm/cmd/add/dev-list

These API endpoints can be used for the following purposes:

Adding a Model Device
Adding a real device (not yet connected to FortiManager)
Promoting/Authorizing a real device that is already connected to FortiManager (the focus of this section).

When your FortiGate device appears in the Unauthorized Devices list within the root ADOM of your FortiManager, it means that something has been configured in its system.central-management config block.

If your FortiGate system.central-management config block looks like the following example:

config system central-management
    set type fortimanager
    set fmg <fmg_ip>
    set serial-number <fmg_sn>
end

then you FortiGate already trusts your FortiManager. In this case, you don’t have to provide FortiGate credentials in the FortiManager API request. The following example demonstrates how to promote/authorize the dev_001 unauthorized device in the demo ADOM of the trusted FortiManager:

REQUEST

{
  "id": 3,
  "method": "exec",
  "params": [
    {
      "data": {
        "adom": "demo",
        "device": {
          "device action": "promote_unreg",
          "name": "dev_001"
        },
        "flags": [
          "create_task"
        ]
      },
      "url": "/dvm/cmd/add/device"
    }
  ],
  "session": "{{session}}"
}

Note

The name must be the device name as displayed in the GUI (not the hostname, but the device name).

The device action is quite self-explanatory.

It is always good practice to create a task using the create_task flag. In any case, the /dvm/cmd/add/device endpoint is synchronous and will only return once the device authorization process is complete.

RESPONSE

{
  "id": 3,
  "result": [
    {
      "data": {
        "device": {
          "av_ver": "1.00000(2018-04-09 18:07)",
          "beta": -1,
          "branch_pt": 3470,
          "build": 3470,
          "conf_status": 2,
          "conn_mode": 1,
          "conn_status": 1,
          "dev_status": 0,
          "faz.perm": 15,
          "first_tunnel_up": 1734097542,
          "flags": 2098561,
          "hdisk_size": 30720,
          "hostname": "fgt-002",
          "ip": "10.210.34.124",
          "ips_ver": "6.00741(2015-12-01 02:30)",
          "last_checked": 1734097621,
          "logdisk_size": 30107,
          "managed_sn": "FMG-VMREDACTED56",
          "maxvdom": 12,
          "mgmt.__data[0]": 3870643,
          "mgmt.__data[4]": 2091368448,
          "mgmt.__data[6]": 1,
          "mgmt_if": "port1",
          "mgmt_mode": 3,
          "mgmt_uuid": "8ab0745c-b958-51ef-f5ad-f745a63ac5bd",
          "mr": 6,
          "name": "dev_001",
          "oid": 39795,
          "os_type": 0,
          "os_ver": 7,
          "patch": 2,
          "platform_id": 166,
          "platform_str": "FortiGate-VM64",
          "sn": "FGVMMLREDACTED43",
          "source": 1,
          "tab_status": "<unknown>",
          "tunnel_ip": "169.254.0.4",
          "vdom": [
            {
              "devid": 39795,
              "ext_flags": 1,
              "name": "root",
              "oid": 3,
              "opmode": 1,
              "status": "<unknown>",
              "tab_status": "<unknown>",
              "vdom_type": 1
            }
          ],
          "version": 700,
          "vm.lic_type": 19,
          "vm_cpu": 1,
          "vm_cpu_limit": 4,
          "vm_lic_overdue_since": 0,
          "vm_mem": 1994,
          "vm_mem_limit": 2147483647,
          "vm_status": 3
        },
        "taskid": 2283
      },
      "status": {
        "code": 0,
        "message": "OK"
      },
      "url": "/dvm/cmd/add/device"
    }
  ]
}

If your FortiGate system.central-management config block looks like the following example:

config system central-management
    set type fortimanager
    set fmg <fmg_ip>
end

then you FortiGate doesn’t trust your FortiManager. In this case, you have to provide the FortiGate credentials since the trust establishment will be done during the promote/authorize process. The following example demonstrates how to promote/authorize the dev_001 device in the demo ADOM of the untrusted FortiManager:

REQUEST

{
  "id": 3,
  "method": "exec",
  "params": [
    {
      "data": {
        "adom": "demo",
        "device": {
          "adm_pass": "fortinet",
          "adm_usr": "admin",
          "device action": "promote_unreg",
          "name": "dev_001"
        },
        "flags": [
          "create_task"
        ]
      },
      "url": "/dvm/cmd/add/device"
    }
  ],
  "session": "{{session}}"
}

Note

You can provide the FortiGate credentials by using the adm_usr and the adm_pass attributes for the login and the password, respectively.

The second /dvm/cmd/add/dev-list API endpoint is for promoting/authorizing a list of devices. The two following API requests are similar:

/dvm/cmd/add/device

{
  "id": 3,
  "method": "exec",
  "params": [
    {
      "data": {
        "adom": "demo",
        "device": {
          "device action": "promote_unreg",
          "name": "dev_001"
        },
        "flags": [
          "create_task",
          "nonblocking"
        ]
      },
      "url": "/dvm/cmd/add/device"
    }
  ],
  "session": "{{session}}"
}

/dvm/cmd/add/dev-list

{
  "id": 3,
  "method": "exec",
  "params": [
    {
      "data": {
        "adom": "demo",
        "dev-list": [
          {
            "device action": "promote_unreg",
            "name": "dev_001"
          },
        ],
        "flags": [
           "create_task",
        ]
      },
      "url": "/dvm/cmd/add/device"
    }
  ],
  "session": "{{session}}"
}

These two API requests are asynchronous! A task will be created as specified by the create_task flag, but the requests will return immediately. The authorization process will continue in the background.

To make the /dvm/cmd/add/device API endpoint asynchronous, you need to add the nonblocking flag. However, this is the default behavior for the /dvm/cmd/add/dev-list API endpoint!

Why is this important? Because if you end your API session immediately after either of these API requests, the created task will fail with the message Failed to update device information..

As a best practice, whenever an API request returns a task, you should monitor the task to ensure it completes successfully. At the very least, during task monitoring, the API session will remain active.

8.13. How to get the ADOM a device belongs to?#

There are three methods:

Combine object master with filter
Use the extra info option
Use the _is_member attribute`

8.13.1. How to get the ADOM a device belongs to using object master with filter?#

Caught in #0414003.

You can append the object master to the /dvmdb/device/<device>/ endpoint.

But in this case, you also have to use the filter in an unusual as shown below.

To get the ADOM details the fgt-742-001 belongs to:

REQUEST

{
  "id": 3,
  "method": "get",
  "params": [
    {
      "filter": [
        "adom"
      ],
      "url": "/dvmdb/device/fgt-742-001/object master"
    }
  ],
  "session": "{{session}}",
  "verbose": 1
}

RESPONSE

{
  "id": 3,
  "result": [
    {
      "data": [
        {
          "create_time": 1700207435,
          "desc": "",
          "flags": "no_vpn_console",
          "lock_override": 0,
          "log_db_retention_hours": 1440,
          "log_disk_quota": 0,
          "log_disk_quota_alert_thres": 90,
          "log_disk_quota_split_ratio": 70,
          "log_file_retention_hours": 8760,
          "logview_customize": "",
          "mig_mr": 0,
          "mig_os_ver": "0.0",
          "mode": "gms",
          "mr": 4,
          "name": "dc_emea",
          "obj_customize": "",
          "oid": 165,
          "os_ver": "7.0",
          "restricted_prds": "fos",
          "state": 1,
          "tab_status": "",
          "tz": 2,
          "uuid": "210ecfa4-baed-51ee-a551-2efcb4f9a788",
          "workspace_mode": 0
        }
      ],
      "status": {
        "code": 0,
        "message": "OK"
      },
      "url": "/dvmdb/device/fgt-742-001/object master"
    }
  ]
}

Note

The fgt-742-001 device belongs to the dc_emea ADOM

8.13.2. How to get the ADOM a device belongs to using the extra info option?#

Since #0462768, we can use just the option extra info as shown below.

To get the ADOM details the fgt-742-001 belongs to:

REQUEST

{
  "id": 4,
  "method": "get",
  "params": [
    {
      "fields": [
        "name",
        "extra info"
      ],
      "option": [
        "extra info",
        "no loadsub"
      ],
      "url": "/dvmdb/device/fgt-742-001"
    }
  ],
  "session": "{{session}}",
  "verbose": 1
}

RESPONSE

{
  "id": 4,
  "result": [
    {
      "data": {
        "extra info": {
          "adom": "dc_emea"
        },
        "name": "fgt-742-001",
        "obj ver": -1,
        "oid": 596
      },
      "status": {
        "code": 0,
        "message": "OK"
      },
      "url": "/dvmdb/device/fgt-742-001"
    }
  ]
}

Note

The fgt-742-001 device belongs to the dc_emea ADOM

8.13.3. How to get the ADOM a device belongs to using _is_master attribute?#

Caught in #1182782 (FortiManager 8.0.0).

The following example shows how to check if the dev_001 device and its root VDOM belongs to the demo ADOM:

REQUEST

{
  "id": 3,
  "method": "get",
  "params": [
    {
      "data": {
        "name": "dev_001",
        "vdom": "root"
      },
      "url": "/dvmdb/_is_member/adom/demo"
    }
  ],
  "session": "{{session}}",
  "verbose": 1
}

RESPONSE

{
  "cid": 36,
  "id": 3,
  "result": [
    {
      "data": {
        "is member": 1
      },
      "status": {
        "code": 0,
        "message": "OK"
      },
      "url": "/dvmdb/_is_member/adom/demo"
    }
  ]
}

Note

The is member attribute is set to 1, meaning that the dev_001 device and its root VDOM belongs to the demo ADOM. 0 would mean it doesn’t belong to the demo ADOM.

You can also check for a device group. The following examples show how to check if the dev_grp_001 device group belongs to the demo ADOM:

REQUEST

{
  "id": 3,
  "method": "get",
  "params": [
    {
      "data": {
        "name": "dev_grp_001"
      },
      "url": "/dvmdb/_is_member/adom/demo"
    }
  ],
  "session": "{{session}}",
  "verbose": 1
}

RESPONSE

{
  "cid": 40,
  "id": 3,
  "result": [
    {
      "data": {
        "is member": 1
      },
      "status": {
        "code": 0,
        "message": "OK"
      },
      "url": "/dvmdb/_is_member/adom/demo"
    }
  ]
}

8.14. How to trigger an Install Device Settings?#

To install Device Settings againt devices branch1 and branch2 from the demo ADOM:

REQUEST

{
  "id": 1,
  "method": "exec",
  "params": [
    {
      "data": {
        "adom": "demo",
        "dev_rev_comments": "sr_01233",
        "flags": [
          "none"
        ],
        "scope": [
          {
            "name": "branch1",
            "vdom": "root"
          },
          {
            "name": "branch2",
            "vdom": "root"
          }
        ]
      },
      "url": "/securityconsole/install/device"
    }
  ],
  "session": "{{session}}"
}

Note

dev_rev_comments will be used as the comment for the created Device Revision (see section Device revisions)

RESPONSE

{
  "id": 1,
  "result": [
    {
      "data": {
        "task": 462
      },
      "status": {
        "code": 0,
        "message": "OK"
      },
      "url": "/securityconsole/install/device"
    }
  ]
}

8.15. How to trigger a Quick Install?#

Quick Install is a GUI tool that internally calls the same API as Install Device Settings. For details, see section How to trigger an Install Device Settings?.

The following example shows how to trigger a Quick Install against the dev_001 device in the demo ADOM:

REQUEST

{
  "id": 3,
  "method": "exec",
  "params": [
    {
      "data": {
        "adom": "demo",
        "dev_rev_comments": "A device revision comment",
        "flags": [
          "none"
        ],
        "scope": [
          {
            "name": "dev_001",
            "vdom": "global"
          },
          {
            "name": "dev_001",
            "vdom": "root"
          }
        ]
      },
      "url": "/securityconsole/install/device"
    }
  ],
  "session": "{{session}}"
}

Note

The install covers the root VDOM as well as the global scope of the dev_001 device.

RESPONSE

{
  "id": 3,
  "result": [
    {
      "data": {
        "task": 2681
      },
      "status": {
        "code": 0,
        "message": "OK"
      },
      "url": "/securityconsole/install/device"
    }
  ]
}

8.17. How to delete a device?#

REQUEST:

{
  "id": 1,
  "jsonrpc": "1.0",
  "method": "exec",
  "params": [
    {
      "data": {
        "adom": "root",
        "device": "FGVMUL0000138718",
        "flags": [
          "none"
        ]
      },
      "url": "/dvm/cmd/del/device"
    }
  ],
  "session": "HDUilklPi9ik9UlI3ViL7CviROjqqNyF21PaaYRIfrIsiYwNYVzkzWKIE/bX0Pkj+ejQVE2Il7TMi/XrVxqGwA==",
  "verbose": 1
}

RESPONSE:

{
"id": 1,
"result": [
        {
        "status": {
                "code": 0,
                "message": "OK"
        },
        "url": "/dvm/cmd/del/device"
        }
]
}

You might face situations where some devices don’t belong to any ADOMs (which isn’t normal). Following FortiManager CLI command output illustrates this behavior:

fmg_720_interim # diagnose dvm device list
--- There are currently 2 devices/vdoms managed ---
--- There are currently 1 devices/vdoms count for license ---

TYPE            OID    SN               HA      IP              NAME                                             ADOM                                             IPS                FIRMWARE
unregistered    3853   FGVMULTM21001357 -       10.210.35.102   FGVMULTM21001357                                 root                                             N/A                7.0 MR0 (157)
                |- STATUS: dev-db: unknown; conf: unknown; cond: unregistered; dm: none; conn: unknown; FMGC
                |- vdom:[3]root flags:0 adom:root pkg:[never-installed]
fmgfaz-model    3795                    -                       root_dev_005                                     ???                                              N/A                7.0 MR0 (296)
                |- STATUS: dev-db: unknown; conf: unknown; cond: unknown; dm: unknown; conn: unknown
                |---- warning: device is not assigned to an adom, please delete and add this device again
[...]

You can see that device root_dev_005 is missing its ADOM information.

To delete such a device, just use an empty adom value:

REQUEST:

{
  "id": 3,
  "method": "exec",
  "params": [
    {
      "data": {
        "adom": "",
        "device": "root_dev_005",
        "flags": [
          "create_task"
        ]
      },
      "url": "/dvm/cmd/del/device"
    }
  ],
  "session": "DHfvd10txF6O7Uwciw+6Q4dOm6OQb3E5IukQV/eNVI+uGVK3j3Guqi523eViEkZpgbJ8vgjXBHCajESRmn7XBQ=="
}

RESPONSE:

{
  "id": 3,
  "result": [
    {
      "data": {
        "taskid": 4476
      },
      "status": {
        "code": 0,
        "message": "OK"
      },
      "url": "/dvm/cmd/del/device"
    }
  ]
}

8.18. How to get device meta fields?#

Meta fields are not returned when getting the list of devices or when getting the details of a specific device.

You have to add the option get meta.

You can also use the fields parameter to only return the now exposed meta fields.

The following example shows how to get the meta fields for all devices managed in the demo ADOM:

REQUEST

{
  "id": 1,
  "method": "get",
  "params": [
    {
      "fields": [
        "name",
        "meta fields"
      ],
      "loadsub": 0,
      "option": [
        "get meta"
      ],
      "url": "/dvmdb/adom/demo/device"
    }
  ],
  "session": "{{session}}",
  "verbose": 1
}

RESPONSE

{
  "id": 1,
  "result": [
    {
      "data": [
        {
         "meta fields": {
           "Address": "",
           "Company/Organization": "",
           "Contact Email": "",
           "Contact Phone Number": "",
           "branch_id": "",
           "branch_latitude": "",
           "branch_longitude": "",
           "branch_timezone": "",
           "lan_netmask": "",
           "lan_network": ""
         },
         "name": "dev_001",
         "oid": 1152
       },
       {
         "meta fields": {
           "Address": "",
           "Company/Organization": "",
           "Contact Email": "",
           "Contact Phone Number": "",
           "branch_id": "1",
           "branch_latitude": "48.85",
           "branch_longitude": "2.34",
           "branch_timezone": "28",
           "lan_netmask": "",
           "lan_network": ""
         },
         "name": "dev_002",
         "oid": 1117
       },
       {
         "meta fields": {
           "Address": "",
           "Company/Organization": "",
           "Contact Email": "",
           "Contact Phone Number": "",
           "branch_id": "2",
           "branch_latitude": "40.71",
           "branch_longitude": "-74.00",
           "branch_timezone": "12",
           "lan_netmask": "",
           "lan_network": ""
         },
         "name": "dev_003",
         "oid": 1144
       },
       {
         "meta fields": {
           "Address": "",
           "Company/Organization": "",
           "Contact Email": "",
           "Contact Phone Number": "",
           "branch_id": "",
           "branch_latitude": "",
           "branch_longitude": "",
           "branch_timezone": "",
           "lan_netmask": "",
           "lan_network": ""
         },
         "name": "dev_004",
         "oid": 1111
       }
      ],
      "status": {
        "code": 0,
        "message": "OK"
      },
      "url": "/dvmdb/adom/demo/device"
    }
  ]
}

8.19. Devce Meta Fields#

8.19.1. How to get specific device meta fields?#

Caught in #1068409.

As you can see in How to get device meta fields?, the list of meta fields could be a bit large and if you’re also having a large list of devices, it could take time to obtain your response.

To optimize the overlall process, you can ask for specific meta fields.

The following example shows how to get the mf_001 and mf_002 meta fields for all devices managed in the demo ADOM:

REQUEST

{
  "id": 3,
  "method": "get",
  "params": [
    {
      "fields": [
        "name",
        "meta fields"
      ],
      "loadsub": 0,
      "meta fields": [
        "mf_001",
        "mf_002"
      ],
      "option": [
        "get meta"
      ],
      "url": "/dvmdb/adom/demo/device"
    }
  ],
  "session": "{{session}}",
  "verbose": 1
}

RESPONSE

{
  "id": 3,
  "result": [
    {
      "data": [
        {
          "meta fields": {
            "mf_001": "",
            "mf_002": ""
          },
          "name": "dev_001",
          "oid": 1152
        },
        {
          "meta fields": {
            "mf_001": "",
            "mf_002": ""
          },
          "name": "dev_002",
          "oid": 1117
        },
        {
          "meta fields": {
            "mf_001": "",
            "mf_002": ""
          },
          "name": "dev_003",
          "oid": 1144
        },
        {
          "meta fields": {
            "mf_001": "",
            "mf_002": ""
          },
          "name": "dev_004",
          "oid": 1111
        }
      ],
      "status": {
        "code": 0,
        "message": "OK"
      },
      "url": "/dvmdb/adom/demo/device"
    }
  ]
}

This meta fields attribute isn’t enforced when you want to get specific meta fields for a specific device. For instance, if you try the following example, to get specific meta fields for the dev_001 device in the demo ADOM, then all meta fields will be returned:

REQUEST

{
  "id": 3,
  "method": "get",
  "params": [
    {
      "fields": [
        "name",
        "meta fields"
      ],
      "loadsub": 0,
      "meta fields": [
        "mf_001",
        "mf_002"
      ],
      "option": [
        "get meta"
      ],
      "url": "/dvmdb/adom/demo/device/dev_001"
    }
  ],
  "session": "{{session}}",
  "verbose": 1
}

RESPONSE

{
  "id": 3,
  "result": [
    {
      "data": {
        "meta fields": {
          "Address": "",
          "Company/Organization": "",
          "Contact Email": "",
          "Contact Phone Number": "",
          "mf_001": "val_001",
          "mf_002": "val_002"
        },
        "name": "dev_001",
        "oid": 1152
      },
      "status": {
        "code": 0,
        "message": "OK"
      },
      "url": "/dvmdb/adom/demo/device/dev_001"
    }
  ]
}

If you want to get specific meta fields for one device, then use the workaround consists in using the filter attribute while you keep getting the entire list of device as shown below:

REQUEST

{
  "id": 3,
  "method": "get",
  "params": [
    {
      "fields": [
        "name",
        "meta fields"
      ],
      "filter": [
        "name",
        "==",
        "dev_001"
      ],
      "loadsub": 0,
      "meta fields": [
        "mf_001",
        "mf_002"
      ],
      "option": [
        "get meta"
      ],
      "url": "/dvmdb/adom/demo/device"
    }
  ],
  "session": "{{session}}",
  "verbose": 1
}

RESPONSE

{
  "id": 3,
  "result": [
    {
      "data": [
        {
          "meta fields": {
            "mf_001": "val_001",
            "mf_002": "val_002"
          },
          "name": "dev_001",
          "oid": 1152
        }
      ],
      "status": {
        "code": 0,
        "message": "OK"
      },
      "url": "/dvmdb/adom/demo/device"
    }
  ]
}

8.19.2. How to set device’s meta fields?#

The following example shows how to set some meta fields for the dev_001 device:

REQUEST

{
  "id": 1,
  "method": "set",
  "params": [
    {
      "data": {
        "meta fields": {
          "branch_id": "2",
          "branch_latitude": "48.892449",
          "branch_longitude": "2.240228",
          "branch_mgmt_ip": "192.168.0.120",
          "branch_tz": "28",
          "region_id": "18"
        }
      },
      "url": "/dvmdb/device/dev_001"
    }
  ],
  "session": "{{session}}",
  "verbose": 1
}

Note

Don’t use integer for setting a meta field. All meta fields are strings!
For instance, for the branch_id meta field, the "2" has been used instead of the more intuitive 2 integer.

REQUEST

{
  "id": 1,
  "result": [
    {
      "data": {
        "name": "dev_001"
      },
      "status": {
        "code": 0,
        "message": "OK"
      },
      "url": "/dvmdb/device/dev_001"
    }
  ]
}

8.21. How to get default config for a particular type of device?#

Caught in #0613941, #0953698 and #1026855.

Few FMG JSON API URLs are given:

"url": "pm/config/devicetemplate/{platform}/version/{ver}/mr/{mr}/global/system/interface"
"url": "pm/config/devicetemplate/{platform}/version/{ver}/mr/{mr}/vdom/root/firewall/address"

Note

Note the distinction between global and per-vdom settings.
devicetemplate is like a temporary Device DB db that could be used to serve default config for a specific FortiGate platform + version (definition is from #1026855)

The following example shows another simpler example to get the system. global default config for the FortiGate-1000D platform with 6.2 firmware:

REQUEST

{
  "id": 3,
  "method": "get",
  "params": [
    {
      "url": "/pm/config/devicetemplate/FortiGate-1000D/version/600/mr/2/global/system/global"
    }
  ],
  "session": "{{session}}",
  "verbose": 1
}

RESPONSE

{
  "id": 3,
  "result": [
    {
      "data": {
        "admin-concurrent": "enable",
             "admin-console-timeout": 0,
             "admin-hsts-max-age": 15552000,
             "admin-https-pki-required": "disable",
             "admin-https-redirect": "enable",
                       "admin-https-ssl-versions": [
               "tlsv1-1",
               "tlsv1-2",
               "tlsv1-3"
             ],
        "admin-lockout-duration": 60,
        "admin-lockout-threshold": 3,
        "admin-login-max": 100,
        "...": "..."
    }
    ]
}

If you want to get the entre default config, you can just use the following example:

REQUEST

{
  "id": 3,
  "method": "get",
  "params": [
    {
      "url": "/pm/config/devicetemplate/FortiGate-1000D/version/600/mr/2/global/"
    }
  ],
  "session": "{{session}}",
  "verbose": 1
}

8.22. Device revisions#

8.22.1. How to get the list of device revisions for a particular device?#

Caught in #0392486.

To get the list of device revision for the hub2 managed device:

REQUEST

{
  "id": 1,
  "method": "exec",
  "params": [
    {
      "data": {
        "device": "hub2"
      },
      "url": "/deployment/get/device/revision"
    }
  ],
  "session": "{{session}}"
}

RESPONSE

{
  "id": 1,
  "result": [
    {
      "data": {
        "base_ver": 8,
        "revinfo": [
          {
            "comments": "",
            "error": "",
            "extra_info": "From package(default), Install to vdom(root)",
            "instime": "2020-03-13 10:49:41",
            "instusr": "admin",
            "modtime": "2020-03-13 10:49:41",
            "modusr": "admin",
            "revision": 8,
            "status": 4,
            "tag": "default"
          },
          {
            "comments": "objects",
            "error": "",
            "extra_info": "No package related, Install to vdom(root)",
            "instime": "2020-03-13 10:46:57",
            "instusr": "ips-admin-001",
            "modtime": "2020-03-13 10:46:57",
            "modusr": "ips-admin-001",
            "revision": 7,
            "status": 4,
            "tag": "objects"
          },
        ]
      }
      "status": {
        "code": 0,
        "message": "OK"
      },
      "url": "/deployment/get/device/revision"
    }
  ]
}

Note

The attribute base_ver indicate the revision ID of the device revision (or backup) created at the last installation, auto-update, retrieve or revert operation
We know that after such operation, device db is assumed in sync with real device configuration
It is possible to set the comments attribute when installing a Policy Package (see section How to install a Policy Package?) or triggering an Install Device Settings only (see section How to trigger an Install Device Settings?)

8.22.2. How to get a specific device revision for a particular device?#

Caught in #0392486.

To get the revision number 8 for the hub2 managed devices:

REQUEST

{
  "id": 1,
  "method": "exec",
  "params": [
    {
      "data": {
        "device": "hub2",
        "revision": 8
      },
      "url": "/deployment/checkout/revision"
    }
  ],
  "session": "{{session}}"
}

Warning

The attribute revision should hold an integer and not string.

Tip

Set the attribute revision with -1 if you just want to retrieve the latest device revision

RESPONSE

{
  "id": 1,
  "result": [
    {
      "data": {
        "content": "<device configuration here>",
        "revision": 8
      },
      "status": {
        "code": 0,
            "message": "OK"
      },
      "url": "/deployment/checkout/revision"
    }
  ]
}

8.22.3. How to get the current device database configuration for a particular device?#

Caught in #0392486.

REQUEST:

{
  "id": 1,
  "jsonrpc": "1.0",
  "method": "exec",
  "params": [
    {
      "data": {
        "device": "hub2"
      },
      "url": "/deployment/export/config"
    }
  ],
  "session": "NLMdLZCfYS2JP7nVov25EpJXDqcUMNdfG9TAWVq9kGjg7cTsrw+VtT9DHgNd/FQeDAiVf8Lq7D6DQZN18OQ+mw==",
  "verbose": 1
}

RESPONSE:

{
  "id": 1,
  "result": [
    {
      "data": {
        "content": "<device database configuration here>"
      },
      "status": {
        "code": 0,
        "message": "OK"
      },
      "url": "/deployment/export/config"
    }
  ]
}

8.22.4. How to revert to a specific device revision?#

Caught in #0563988.

We want to revert device foobar to its device revision #2:

REQUEST:

{
  "id": 1,
  "jsonrpc": "1.0",
  "method": "exec",
  "params": [
    {
      "data": {
        "device": "foobar",
        "revision": 2
      },
      "url": "/deployment/revert"
    }
  ],
  "session": "1M8bMiXLk1er7XZWPuMq8sr95FNDYSR0gdfXI1px5tYMJ9nhKMf3AOQURl2orAVKqtopxLu4vA8SxR/5JSrlJFduakw984Kb",
  "verbose": 1
}

RESPONSE:

{
  "id": 1,
  "result": [
    {
      "status": {
        "code": 0,
        "message": "OK"
      },
      "url": "/deployment/revert"
    }
  ]
}

8.22.5. How to import a device revision?#

Starting with FMG 7.0.3 (#0451960), it is possible to import a device revision.

REQUEST:

{
  "id": 3,
  "method": "exec",
  "params": [
    {
      "data": {
        "config": "#config-version=FGVMK6-7.00-FW-build157-000000:opm[...]",
        "device": "dut_fgt_02"
      },
      "url": "deployment/import/config"
    }
  ],
  "session": "SGiB3LWthXfVT3uCwWUZ4nlzfUaWoBiEJFnVlIvMKTQzU6DjK91jAnI1BXWwwRwBGrbyYWc0s+t8dUprk252jeX6p6RHLSKz"
}

Note

The config attribute is taking the cleartext version of the device revision file (no need to base64 encode it)

RESPONSE:

{
  "id": 3,
  "result": [
    {
      "data": {
        "task": 3661
      },
      "status": {
        "code": 0,
        "message": "OK"
      },
      "url": "deployment/import/config"
    }
  ]
}

8.23. How to trigger a retrieve operation?#

8.23.1. Against a single device#

We trigger a retrieve operation for device fgt_dut in ADOM adom_dut:

REQUEST:

{
  "id": 1,
  "jsonrpc": "1.0",
  "method": "exec",
  "params": [
    {
      "data": {
        "adom": "adom_dut",
        "flags": [
          "none"
        ],
        "reload-dev-member-list": [
          {
            "name": "fgt_dut"
          }
        ]
      },
      "url": "/dvm/cmd/reload/dev-list"
    }
  ],
  "session": "P5Yk9twDAS+yPdcC0gkDu+Rk1q3LpNzAQ5Bg4UsvcpbjdQLl2EuBETew1iuqOSncJufexxD69KyaWwP/gCZ8Gg==",
  "verbose": 1
}

RESPONSE:

{
  "id": 1,
  "result": [
    {
      "status": {
        "code": 0,
        "message": "OK"
      },
      "url": "/dvm/cmd/reload/dev-list"
    }
  ]
}

8.23.2. Against multiple devices#

We retrieve from device apac-12-fgt-01 to apac-24-fgt-01 in ADOM demo:

REQUEST:

{
  "id": 3,
  "method": "exec",
  "params": [
    {
      "data": {
        "adom": "demo",
        "flags": [
          "create_task",
          "nonblocking"
        ],
        "reload-dev-member-list": [
          {
            "name": "apac-12-fgt-01"
          },
          {
            "name": "apac-13-fgt-01"
          },
          {
            "name": "apac-14-fgt-01"
          },
          {
            "name": "apac-15-fgt-01"
          },
          {
            "name": "apac-16-fgt-01"
          },
          {
            "name": "apac-17-fgt-01"
          },
          {
            "name": "apac-18-fgt-01"
          },
          {
            "name": "apac-19-fgt-01"
          },
          {
            "name": "apac-20-fgt-01"
          },
          {
            "name": "apac-21-fgt-01"
          },
          {
            "name": "apac-22-fgt-01"
          },
          {
            "name": "apac-23-fgt-01"
          },
          {
            "name": "apac-24-fgt-01"
          }
        ]
      },
      "url": "/dvm/cmd/reload/dev-list"
    }
  ],
  "session": "nv7+Daewp8QrUEIqPGfS3HXL/j4pWYwJNnOHHfh8Z1yd9VeNv1gwIybuqwls9XGRSrybgP2l+i6tu5iWOrYpbw=="
}

Note

The create_task flag will create a task that will allow you to follow the progress of the operation from FortiManager GUI (under System Settings > Task Monitor)
The nonblocking flag will make this API call to return immediately. But you still have to maintain the API session alive otherwise you won’t be able to review the task information.

RESPONSE:

{
  "id": 3,
  "result": [
    {
      "data": {
        "pid": 23223,
        "taskid": 600
      },
      "status": {
        "code": 0,
        "message": "OK"
      },
      "url": "/dvm/cmd/reload/dev-list"
    }
  ]
}

8.24. Firmware upgrade#

Most of the information are available in #0375414.

To debug the upgrade firmware operations we can use following FortiManager CLI commands:

# diagnose debug application fdssvrd 255
# diagnose debug enable
# diagnose debug timestamp enable

8.24.1. How to get the upgrade path?#

This request gives the upgrade path for device hub1 in ADOM DEMO_008 for an upgrade to fortios firmware 6.4.1:

With the introduction of the new Firmware Template (starting with FortiManager 7.0.0), we’re seeing this form of request for getting the upgrade path:

REQUEST

{
  "id": 1,
  "method": "exec",
  "params": [
    {
      "data": {
        "devices": [
          {
            "image": "7.2.2",
            "name": "dev_001"
          }
        ],
        "flags": 16
      },
      "url": "/um/image/upgrade/ext"
    }
  ],
  "session": "{{session}}"
}

RESPONSE

{
  "id": 1,
  "result": [
    {
      "data": {
        "upgrade_path": [
          {
            "name": "dev_001",
            "oid": 183,
            "path": [
              "7.2.2-b1255-F"
            ]
          }
        ]
      },
      "status": {
        "code": 0,
        "message": "OK"
      },
      "url": "\/um\/image\/upgrade\/ext"
    }
  ]
}

Warning

Don’t use:
```
"flags": "f_preview"
```
but:
```
"flags": 16
```
when using the /um/image/upgrade/ext url.

Otherwise, it will trigger an upgrade instead of returning the upgrade path!

8.24.2. How to get list of available firmware for a specific platform?#

Caught in #0645390.

The FortiManager JSON RPC API URL /um/image/version/list will return all the available versions of firmwares for a certain platform.

It includes all the version in our FortiGuard servers (FDS servers) and all the versions from firmware files imported by FortiManager administrators.

REQUEST:

{
  "id": 1,
  "method": "exec",
  "params": [
    {
      "data": {
        "platform": "FortiGate-VM64-KVM",
        "product": "FGT"
      },
      "url": "um/image/version/list"
    }
  ],
  "session": "<session_id>"
}

Note

We can omit the attribute platform; in that case FortiManager will return FortiGate firmwares for all platforms!

RESPONSE:

{
  "id": 1,
  "result": [
    {
      "data": {
        "status": "success",
        "version_list": [
          {
            "platform": "FortiGate-VM64-KVM",
            "product": "FGT",
            "versions": [
              {
                "type": "GA",
                "version": "5.6.2-b1486"
              },
              {
                "type": "GA",
                "version": "5.6.9-b1673"
              },
[...]
              {
                "image_path": "/var/fwm/image/FGVMK6_6.4.6_b1852_FORTINET.out",
                "type": "SPECIAL",
                "version": "6.4.6-b1852"
              },
              {
                "image_path": "/var/fwm/image/FGVMK6_6.4.6_b1851_FORTINET.out",
                "type": "SPECIAL",
                "version": "6.4.6-b1851"
              }
            ]
          }
        ]
      },
      "status": {
        "code": 0,
        "message": "OK"
      },
      "url": "um/image/version/list"
    }
  ]
}

8.24.3. How to get list of firmwares available on FortiManager drive?#

Caught in #0645390.

FortiManager JSON RPC API URL /um/image/list, will return all the firmware files present on FortiManager local disk.

Those firmware files could be the ones imported by the FortiManager administrators and or the ones downloaded from FortiGuard servers (FDS servers).

REQUEST:

{
  "id": 1,
  "jsonrpc": "1.0",
  "method": "exec",
  "params": [
    {
      "data": {
      },
      "url": "/um/image/list"
    }
  ],
  "session": "hMgb/g807bB+Oy94gxC4X2hjbGN+eug9wNFsik9fvgnPjNhvMlcsFoJWaRZ1dA6RC4xUDLwCoDKcCClxzF2Efg==",
  "verbose": 1
}

RESPONSE:

{
  "id": 3,
  "result": [
    {
      "data": {
        "image_list": [
          {
            "build": "b0180",
            "date": "211019",
            "image_path": "/var/fwm/image/FMVM64_7.0.2_b180_FORTINET.out",
            "image_size": 239100126,
            "platform": "FortiManager-VM64",
            "product": "FMG",
            "version": "7.0.2-b0180"
          }
        ],
        "status": "success"
      },
      "status": {
        "code": 0,
        "message": "OK"
      },
      "url": "/um/image/list"
    }
  ]
}

Note

In the above case, FortiManager is only having a single firmware file on its local disk.

8.24.4. How to get list of firmwares available on FortiManager drive for a specific product?#

We can add the attribute system set with a product code like FMG or FGT.

REQUEST:

{
  "id": 3,
  "method": "exec",
  "params": [
    {
      "data": {
        "system": "FMG"
      },
      "url": "/um/image/list"
    }
  ],
  "session": "8/QnXQAREvjPWNqVEv2Qq/cvkLhpdZko8B14EYxTD/MMs8A3a66IFX6qTojKY9ojtPjOXBHIXv1pABZFHZ+zUQ=="
}

RESPONSE:

{
  "id": 3,
  "result": [
    {
      "data": {
        "image_list": [
          {
            "build": "b0180",
            "date": "211019",
            "image_path": "/var/fwm/image/FMVM64_7.0.2_b180_FORTINET.out",
            "image_size": 239100126,
            "platform": "FortiManager-VM64",
            "product": "FMG",
            "version": "7.0.2-b0180"
          }
        ],
        "status": "success"
      },
      "status": {
        "code": 0,
        "message": "OK"
      },
      "url": "/um/image/list"
    }
  ]
}

When there’s no match, FortiManager returns all available firmwares:

REQUEST:

{
  "id": 3,
  "method": "exec",
  "params": [
    {
      "data": {
        "system": "FGT"
      },
      "url": "/um/image/list"
    }
  ],
  "session": "8/QnXQAREvjPWNqVEv2Qq/cvkLhpdZko8B14EYxTD/MMs8A3a66IFX6qTojKY9ojtPjOXBHIXv1pABZFHZ+zUQ=="
}

RESPONSE:

{
  "id": 3,
  "result": [
    {
      "data": {
        "image_list": [
          {
            "build": "b0180",
            "date": "211019",
            "image_path": "/var/fwm/image/FMVM64_7.0.2_b180_FORTINET.out",
            "image_size": 239100126,
            "platform": "FortiManager-VM64",
            "product": "FMG",
            "version": "7.0.2-b0180"
          }
        ],
        "status": "success"
      },
      "status": {
        "code": 0,
        "message": "OK"
      },
      "url": "/um/image/list"
    }
  ]
}

8.24.5. How to upgrade a device?#

The following example shows how to upgrade the dev_001 device, located in the demo ADOM, to firmware version 6.4.3:

REQUEST

{
  "id": 3,
  "method": "exec",
  "params": [
    {
      "data": {
        "adom": "demo",
        "create_task": "enable",
        "device": [
          {
            "name": "dev_001"
          }
        ],
        "flags": [
          "none"
        ],
        "image": {
          "release": "6.4.3"
        }
      },
      "url": "/um/image/upgrade"
    }
  ],
  "session": "{{session}}"
}

Note

flags attribute could be a combination (hence a list) of the following flags:

none
No specific action required. This is the default value if flags attribute is omitted.

f_boot_alt_partition
Boot from alternate partition after upgrade

f_skip_retrieve
FMG won’t retrieve the device configuration after upgrade

f_skip_multi_steps
FMG will skip the multi-step upgrade process

f_skip_fortiguard_img
FMG will let the device downloading the firmware from FortiGuard

RESPONSE

{
  "id": 1,
  "result": [
    {
      "data": {
        "taskid": 869
      },
      "status": {
        "code": 0,
        "message": "OK"
      },
      "url": "/um/image/upgrade"
    }
  ]
}

With the introduction of the new Firmware Template feature in FortiManager 7.0.0, a new type of device upgrade is available. During this process, FortiManager automatically creates a temporary firmware template that exists only for the duration of the upgrade. The following example shows how to upgrade dev_001 and dev_002 from the demo ADOM, using this mechanism:

REQUEST

{
  "id": 3,
  "method": "exec",
  "params": [
    {
      "data": {
        "adom": "demo",
        "create_task": "enable",
        "devices": [
          {
            "image": "7.6.4-b3596-GA",
            "name": "dev_001"
          },
          {
            "image": "7.6.4-b3596-GA",
            "name": "dev_002"
          }
        ],
        "flags": 900
      },
      "url": "/um/image/upgrade/ext"
    }
  ],
  "session": "{{session}}"
}

Note

The attribute create_task will help in creating a task that could be used to monitor the progress of the upgrade process

RESPONSE

{
  "id": 3,
  "result": [
    {
      "data": {
        "key": "adom171_1764607120-1287129235",
        "status": "success",
        "taskid": 34
      },
      "status": {
        "code": 0,
        "message": "OK"
      },
      "url": "/um/image/upgrade/ext"
    }
  ]
}

Note

The return key is the name of the auto-create firmware template that you can expose using the following FortiManager CLI:

diagnose fwmanager profile list

You will get an output similar to the following one:

fwm profile files in adom root(3):

fwm profile files in adom FortiCarrier(104):

fwm profile files in adom demo(171):
adom171_1764607120-1287129235:
{
 "adom_oid": 171,
 "data": {
  "enforced version": [
   {
    "flags": 104,
    "platform": "FortiGate-VM64-KVM",
    "product": 1,
    "upgrade-path": 0,
    "version": "7.6.4-b3596"
   },
   {
    "flags": 104,
    "platform": "FortiGate-VM64-KVM",
    "product": 1,
    "upgrade-path": 0,
    "version": "7.6.4-b3596"
   }
  ],
  "image-source": 0,
  "schedule-end-time": "2025-12-01 20:38",
  "schedule-start-time": "2025-12-01 17:38",
  "schedule-type": 9
 },
 "name": "1764607120-1287129235",
 "scope member": [
  {
   "oid": 173,
   "vdom_oid": 3
  },
  {
   "oid": 181,
   "vdom_oid": 3
  }
 ]
}

8.24.6. How to get the upgrade history?#

Caught in #0919855.

TBD: It should be possible to get upgrade history by using URL um/image/upgrade/report

8.24.7. How to get the Upgrade Report for managed devices?#

Caught in #0919211.

To get the upgrade reports for the fgt-741-001 in the dc_emea ADOM:

REQUEST

{
  "id": 3,
  "method": "get",
  "params": [
    {
      "data": {
        "adom": "dc_emea",
        "devices": [
          {
            "name": "fgt-741-001"
          }
        ],
        "flags": 0,
        "name": "fgt_to_740"
      },
      "url": "um/image/upgrade/report"
    }
  ],
  "session": "{{session}}",
  "verbose": 1
}

RESPONSE

{
  "id": 3,
  "result": [
    {
      "data": {
        "report": [
          [
            {
              "end-time": 1700776054,
              "name": "fgt-741-001",
              "oid": 175,
              "package-status": 0,
              "skip-path": 1,
              "start-time": 1700775638,
              "taskid": 9,
              "tasks": [
                {
                  "current_version": "7.4.1-b2463",
                  "health_check": [
                    {
                      "command": "get system status",
                      "result": "fgt-741-001 $  get system status\nVersion: FortiGate-VM64 v7.4.0,build2360,230509 (GA.F)\nSecurity Level: 1\nFirmware Signature: certified\nVirus-DB: 1.00000(2018-04-09 18:07)\nExtended DB: 1.00000(2018-04-09 18:07)\nExtreme DB: 1.00000(2018-04-09 18:07)\nAV AI/ML Model: 0.00000(2001-01-01 00:00)\nIPS-DB: 6.00741(2015-12-01 02:30)\nIPS-ETDB: 6.00741(2015-12-01 02:30)\nAPP-DB: 6.00741(2015-12-01 02:30)\nINDUSTRIAL-DB: 6.00741(2015-12-01 02:30)\nIPS Malicious URL Database: 1.00001(2015-01-01 01:01)\nIoT-Detect: 0.00000(2022-08-17 17:31)\nSerial-Number: FGVMMLTM22002647\nLicense Status: Valid\nLicense Expiration Date: 2026-05-25\nVM Resources: 1 CPU/4 allowed, 1994 MB RAM\nLog hard disk: Available\nHostname: fgt_001\nPrivate Encryption: Disable\nOperation Mode: NAT\nCurrent virtual domain: root\nMax number of virtual domains: 7\nVirtual domains status: 1 in NAT mode, 0 in TP mode\nVirtual domain configuration: disable\nFIPS-CC mode: disable\nCurrent HA mode: standalone\nBranch point: 2360\nRelease Version Information: GA\nFortiOS x86-64: Yes\nSystem time: Thu Nov 23 22:46:55 2023\nLast reboot reason: warm reboot\n"
                    },
                    {
                      "command": "diagnose sys flash list",
                      "result": "fgt-741-001 $  diagnose sys flash list\nPartition  Image                                     TotalSize(KB)  Used(KB)  Use%  Active\n1          FGVM64-7.04-FW-build2360-230509                  237536    119052   50%  Yes   \n2          EXDB-1.00000                                    1707856    163436   10%  No    \nImage was built at May  9 2023 17:10:46 for b2360\n"
                    },
                    {
                      "command": "diagnose debug config-error-log read",
                      "result": "fgt-741-001 $  diagnose debug config-error-log read\n>>>  \"set\" \"gui-auto-upgrade-setup-warning\" \"disable\" @ global.system.global:command parse error (error -61)\n>>>  \"end\" @ global.system.replacemsg.webproxy.ztna-invalid-cert:failed command (error -56)\n>>>  \"end\" @ global.system.replacemsg.webproxy.ztna-empty-cert:failed command (error -56)\n>>>  \"end\" @ global.system.replacemsg.webproxy.ztna-manageable-empty-cert:failed command (error -56)\n>>>  \"end\" @ global.system.replacemsg.webproxy.ztna-no-api-gwy-matched:failed command (error -56)\n>>>  \"end\" @ global.system.replacemsg.webproxy.ztna-cant-find-real-srv:failed command (error -56)\n>>>  \"end\" @ global.system.replacemsg.webproxy.ztna-fqdn-dns-failed:failed command (error -56)\n>>>  \"end\" @ global.system.replacemsg.webproxy.ztna-ssl-bookmark-failed:failed command (error -56)\n>>>  \"end\" @ global.system.replacemsg.webproxy.ztna-no-policy-matched:failed command (error -56)\n>>>  \"end\" @ global.system.replacemsg.webproxy.ztna-matched-deny-policy:failed command (error -56)\n>>>  \"end\" @ global.system.replacemsg.webproxy.ztna-client-cert-revoked:failed command (error -56)\n>>>  \"end\" @ global.system.replacemsg.webproxy.ztna-denied-by-matched-tags:failed command (error -56)\n>>>  \"end\" @ global.system.replacemsg.webproxy.ztna-denied-no-matched-tags:failed command (error -56)\n>>>  \"end\" @ global.system.replacemsg.webproxy.ztna-no-dev-info:failed command (error -56)\n>>>  \"end\" @ global.system.replacemsg.webproxy.ztna-dev-is-offline:failed command (error -56)\n>>>  \"end\" @ global.system.replacemsg.webproxy.casb-block:failed command (error -56)\n>>>  \"end\" @ global.system.replacemsg.utm.virpatchblk-html:failed command (error -56)\n>>>  \"set\" \"protocol\" \"https\" @ root.system.sdwan.health-check.Default_Office_365:failed command (error -160)\n>>>  \"set\" \"protocol\" \"https\" @ root.system.sdwan.health-check.Default_Google Search:failed command (error -160)\n>>>  \"set\" \"protocol\" \"https\" @ root.system.sdwan.health-check.Default_FortiGuard:failed command (error -160)\n>>>  \"config\" \"virtual-patch\" \"profile\" @ root:command parse error (error -61)\n>>>  \"set\" \"quic\" \"disable\" @ root.firewall.ssl-ssh-profile.deep-inspection.https:command parse error (error -61)\n>>>  \"set\" \"quic\" \"disable\" @ root.firewall.ssl-ssh-profile.deep-inspection.dot:command parse error (error -61)\n>>>  \"set\" \"quic\" \"disable\" @ root.firewall.ssl-ssh-profile.custom-deep-inspection.https:command parse error (error -61)\n>>>  \"set\" \"quic\" \"disable\" @ root.firewall.ssl-ssh-profile.custom-deep-inspection.dot:command parse error (error -61)\n>>>  \"set\" \"quic\" \"disable\" @ root.firewall.ssl-ssh-profile.no-inspection.https:command parse error (error -61)\n>>>  \"set\" \"quic\" \"disable\" @ root.firewall.ssl-ssh-profile.no-inspection.dot:command parse error (error -61)\n>>>  \"set\" \"quic\" \"disable\" @ root.firewall.ssl-ssh-profile.certificate-inspection.https:command parse error (error -61)\n>>>  \"set\" \"quic\" \"disable\" @ root.firewall.ssl-ssh-profile.certificate-inspection.dot:command parse error (error -61)\n>>>  \"config\" \"casb\" \"saas-application\" @ root:command parse error (error -61)\n>>>  \"config\" \"casb\" \"user-activity\" @ root:command parse error (error -61)\n>>>  \"config\" \"switch-controller\" \"ptp\" \"profile\" @ root:command parse error (error -61)\n>>>  \"config\" \"switch-controller\" \"ptp\" \"interface-policy\" @ root:command parse error (error -61)\n"
                    },
                    {
                      "command": "diagnose hardware sysinfo memory",
                      "result": "fgt-741-001 $  diagnose hardware sysinfo memory\nMemTotal:        2042176 kB\nMemFree:         1066608 kB\nMemAvailable:    1047988 kB\nBuffers:             160 kB\nCached:           388312 kB\nSwapCached:            0 kB\nActive:           359264 kB\nInactive:          60800 kB\nActive(anon):     352908 kB\nInactive(anon):    45304 kB\nActive(file):       6356 kB\nInactive(file):    15496 kB\nUnevictable:      194172 kB\nMlocked:               0 kB\nSwapTotal:             0 kB\nSwapFree:              0 kB\nDirty:                 0 kB\nWriteback:             0 kB\nAnonPages:        225808 kB\nMapped:           125624 kB\nShmem:            177536 kB\nSlab:             136612 kB\nSReclaimable:       8460 kB\nSUnreclaim:       128152 kB\nKernelStack:        3340 kB\nPageTables:        20560 kB\nNFS_Unstable:          0 kB\nBounce:                0 kB\nWritebackTmp:          0 kB\nCommitLimit:     1021088 kB\nCommitted_AS:   15306520 kB\nVmallocTotal:   34359738367 kB\nVmallocUsed:           0 kB\nVmallocChunk:          0 kB\nPercpu:              312 kB\nAnonHugePages:         0 kB\nShmemHugePages:        0 kB\nShmemPmdMapped:        0 kB\nCmaTotal:              0 kB\nCmaFree:               0 kB\nHugePages_Total:       0\nHugePages_Free:        0\nHugePages_Rsvd:        0\nHugePages_Surp:        0\nHugepagesize:       2048 kB\nHugetlb:               0 kB\nDirectMap4k:       22400 kB\nDirectMap2M:     2074624 kB\nDirectMap1G:           0 kB\n"
                    },
                    {
                      "command": "diagnose debug crash read",
                      "result": "fgt-741-001 $  diagnose debug crash read\n1: 2023-11-02 14:54:37 from=license sn=FGVMEVETVZR-YYF2 msg=Server replied error code:0\n2: 2023-11-02 14:54:41 the killed daemon is /bin/sflowd: status=0x0\n3: 2023-11-20 22:09:23 the killed daemon is /bin/sflowd: status=0x0\n4: 2023-11-20 22:11:14 the killed daemon is /bin/dhcpcd: status=0x0\n5: 2023-11-20 22:11:24 the killed daemon is /bin/sshd: status=0x100\n6: 2023-11-20 22:14:13 Interface port1 is brought down. process_id=2776, process_name=\"newcli\"\n7: 2023-11-20 22:14:13 Interface port2 is brought down. process_id=2776, process_name=\"newcli\"\n8: 2023-11-20 22:14:13 Interface port3 is brought down. process_id=2776, process_name=\"newcli\"\n9: 2023-11-20 22:14:13 Interface port4 is brought down. process_id=2776, process_name=\"newcli\"\n10: 2023-11-20 22:14:13 Interface port5 is brought down. process_id=2776, process_name=\"newcli\"\n11: 2023-11-20 22:14:13 Interface port6 is brought down. process_id=2776, process_name=\"newcli\"\n12: 2023-11-20 22:14:13 Interface port7 is brought down. process_id=2776, process_name=\"newcli\"\n13: 2023-11-20 22:14:13 Interface port8 is brought down. process_id=2776, process_name=\"newcli\"\n14: 2023-11-20 22:14:13 Interface port9 is brought down. process_id=2776, process_name=\"newcli\"\n15: 2023-11-20 22:14:13 Interface port10 is brought down. process_id=2776, process_name=\"newcli\"\n16: 2023-11-20 22:15:46 from=license sn=FGVMMLTM22002647 msg=License is in grace period\n17: 2023-11-20 22:15:46 the killed daemon is /bin/sflowd: status=0x0\n18: 2023-11-20 22:15:46 the killed daemon is /bin/sshd: status=0x100\n19: 2023-11-20 22:16:24 from=license sn=FGVMMLTM22002647 msg=License status changed to VALID\n20: 2023-11-21 07:21:51 the killed daemon is /bin/sflowd: status=0x0\n21: 2023-11-21 07:44:07 the killed daemon is /bin/csfd: status=0x0\n22: 2023-11-21 07:44:07 the killed daemon is /bin/eap_proxy: status=0x0\n23: 2023-11-23 17:46:53 Interface port1 is brought down. process_id=8008, process_name=\"smit\"\n24: 2023-11-23 17:46:53 Interface port2 is brought down. process_id=8008, process_name=\"smit\"\n25: 2023-11-23 17:46:53 Interface port3 is brought down. process_id=8008, process_name=\"smit\"\n26: 2023-11-23 17:46:53 Interface port4 is brought down. process_id=8008, process_name=\"smit\"\n27: 2023-11-23 17:46:53 Interface port5 is brought down. process_id=8008, process_name=\"smit\"\n28: 2023-11-23 17:46:53 Interface port6 is brought down. process_id=8008, process_name=\"smit\"\n29: 2023-11-23 17:46:53 Interface port7 is brought down. process_id=8008, process_name=\"smit\"\n30: 2023-11-23 17:46:53 Interface port8 is brought down. process_id=8008, process_name=\"smit\"\n31: 2023-11-23 17:46:53 Interface port9 is brought down. process_id=8008, process_name=\"smit\"\n32: 2023-11-23 17:46:53 Interface port10 is brought down. process_id=8008, process_name=\"smit\"\n33: 2023-11-23 18:19:25 the killed daemon is /bin/sflowd: status=0x0\n34: 2023-11-23 19:21:07 the killed daemon is /bin/sflowd: status=0x0\n35: 2023-11-23 22:41:12 Interface port1 is brought down. process_id=3071, process_name=\"httpsd\"\n36: 2023-11-23 22:41:12 Interface port2 is brought down. process_id=3071, process_name=\"httpsd\"\n37: 2023-11-23 22:41:12 Interface port3 is brought down. process_id=3071, process_name=\"httpsd\"\n38: 2023-11-23 22:41:12 Interface port4 is brought down. process_id=3071, process_name=\"httpsd\"\n39: 2023-11-23 22:41:12 Interface port5 is brought down. process_id=3071, process_name=\"httpsd\"\n40: 2023-11-23 22:41:12 Interface port6 is brought down. process_id=3071, process_name=\"httpsd\"\n41: 2023-11-23 22:41:12 Interface port7 is brought down. process_id=3071, process_name=\"httpsd\"\n42: 2023-11-23 22:41:12 Interface port8 is brought down. process_id=3071, process_name=\"httpsd\"\n43: 2023-11-23 22:41:12 Interface port9 is brought down. process_id=3071, process_name=\"httpsd\"\n44: 2023-11-23 22:41:12 Interface port10 is brought down. process_id=3071, process_name=\"httpsd\"\n45: 2023-11-23 22:42:28 the killed daemon is /bin/telnetd: status=0xf\n46: 2023-11-23 22:42:28 the killed daemon is /bin/sflowd: status=0x0\n47: 2023-11-23 22:44:14 the killed daemon is /bin/csfd: status=0x0\n48: 2023-11-23 22:44:14 the killed daemon is /bin/cloudapid: status=0x0\n49: 2023-11-23 22:44:14 the killed daemon is /bin/fsvrd: status=0x0\n50: 2023-11-23 22:44:14 the killed daemon is /bin/uploadd: status=0x0\n51: 2023-11-23 22:44:14 the killed daemon is /bin/fnbamd: status=0x0\n52: 2023-11-23 22:44:14 the killed daemon is /bin/forticron: status=0x0\n53: 2023-11-23 22:44:14 the killed daemon is /bin/snmpd: status=0x0\n54: 2023-11-23 22:44:14 the killed daemon is /bin/eap_proxy: status=0x0\n55: 2023-11-23 22:44:14 the killed daemon is /bin/quard: status=0xf\n56: 2023-11-23 22:44:14 the killed daemon is /bin/autod: status=0x0\n57: 2023-11-23 22:44:14 the killed daemon is /bin/authd: status=0x0\n58: 2023-11-23 22:44:14 the killed daemon is /bin/radvd: status=0x0\n59: 2023-11-23 22:44:14 the killed daemon is /bin/merged_daemons: status=0x0\n60: 2023-11-23 22:44:14 the killed daemon is /bin/clearpass: status=0x0\n61: 2023-11-23 22:44:14 the killed daemon is /bin/ipsmonitor: status=0x0\n62: 2023-11-23 22:44:14 the killed daemon is /bin/foauthd: status=0x0\n63: 2023-11-23 22:44:14 the killed daemon is /bin/fas: status=0x0\n64: 2023-11-23 22:44:14 the killed daemon is /bin/updated: status=0x0\n65: 2023-11-23 22:44:14 the killed daemon is /bin/lldptx: status=0xf\n66: 2023-11-23 22:44:14 the killed daemon is /bin/ntpd: status=0xf\n67: 2023-11-23 22:44:14 the killed daemon is /bin/wad: status=0x0\n68: 2023-11-23 22:44:17 the killed daemon is /bin/fgfmd: status=0x0\n69: 2023-11-23 22:45:51 the killed daemon is /bin/sflowd: status=0x0\nCrash log interval is 3600 seconds\nMax crash log line number: 16384\n"
                    }
                  ],
                  "package-status": 0,
                  "platform": "FortiGate-VM64",
                  "product": 1,
                  "profile_name": "fgt_to_740",
                  "result": 0,
                  "serial": "FGVMMLTM22002647",
                  "sub_tasks": [
                    {
                      "config": {
                        "change": 1,
                        "diff": "config system global\nunset gui-auto-upgrade-setup-warning\nend\nconfig firewall ssl-ssh-profile\nedit \"custom-deep-inspection\"\nconfig https\nunset quic\nend\nconfig dot\nunset quic\nend\nnext\nend\nconfig system sdwan\nconfig health-check\nedit \"Default_FortiGuard\"\nunset protocol\nnext\nedit \"Default_Google Search\"\nunset protocol\nnext\nedit \"Default_Office_365\"\nunset protocol\nnext\nend\nend\n"
                      },
                      "end_revision": 2,
                      "end_time": 1700775993,
                      "end_version": "7.4.0-b2360",
                      "result": 0,
                      "retrieve_end_time": 1700775993,
                      "retrieve_start_time": 1700775952,
                      "start_revision": 1,
                      "start_time": 1700775669,
                      "start_version": "7.4.1-b2463",
                      "task_line": "fgt-741-001(7.4.1-b2463->7.4.0-b2360)"
                    }
                  ],
                  "target_version": "7.4.0-b2360",
                  "upgrade_path": [
                    "7.4.0-b2360"
                  ]
                }
              ]
            }
          ]
        ]
      },
      "status": {
        "code": 0,
        "message": "OK"
      },
      "url": "um/image/upgrade/report"
    }
  ]
}

8.25. Certificates#

8.25.1. How to upload a certificate?#

You need:

A certificate file in PEM format

It should look something like:

A password protected key file in PEM format

It should look something like:

The password used to encrypt the key file

The following example demonstrates how to combine all these elements to create the crt_001 certificate on the managed device dev_001 using the API request below:

REQUEST

{
  "id": 1,
  "method": "add",
  "params": [
    {
      "data": {
        "certificate": "-----BEGIN CERTIFICATE-----\nMIIDRjCCA[...]",
        "name": "crt_001",
        "password": "fortinet",
        "private-key": "-----BEGIN ENCRYPTED PRIVATE KEY-----\[...]"
      },
      "url": "/pm/config/device/branch11/vdom/root/vpn/certificate/local"
    }
  ],
  "session": "{{session}}"
}

RESPONSE

{
  "id": 1,
  "result": [
    {
      "data": {
        "name": "crt_001"
      },
      "status": {
        "code": 0,
        "message": "OK"
      },
      "url": "/pm/config/device/dev_001/vdom/root/vpn/certificate/local"
    }
  ]
}

FortiManager saves this certificate in the dev_001 Device DB. However, in most cases, the certificate needs to be referenced within objects declared in the ADOM DB. This can be accomplished by using the Dynamic Local Certificate object. The section How to assign a Certificate Template to a managed device? explains how to map a device certificate from the Device DB to a Dynamic Local Certificate in the ADOM DB.

8.25.2. How to update an existing certificate?#

The use case could be to renew an existing certificate.

Following example shows how to update the crt_001 certificate on the managed device dev_001 using the API request below:

REQUEST

{
  "id": 3,
  "method": "set",
  "params": [
    {
      "data": {
        "certificate": "-----BEGIN CERTIFICATE-----\nMIIEATCCAumgAwIBAgI[...]",
        "password": "fortinet",
        "private-key": "-----BEGIN ENCRYPTED PRIVATE KEY-----\nMIIFNTBfB[...]"
      },
      "url": "/pm/config/device/dev_001/vdom/root/vpn/certificate/local/crt_001"
    }
  ],
  "session": "{{session}}"
}

RESPONSE

{
  "id": 3,
  "result": [
    {
      "data": {
        "name": "crt_001"
      },
      "status": {
        "code": 0,
        "message": "OK"
      },
      "url": "/pm/config/device/dev_001/vdom/root/vpn/certificate/local/crt_001"
    }
  ]
}

8.25.3. How to show certificate details?#

It’s a new feature from FMG 6.2.4/6.4.1 (#629877).

Now we can get either in the normal or global ADOM the following certificate types:

pm/config/device/<device>/vdom/<vdom>/vpn/certificate/ca
pm/config/device/<device>/vdom/<vdom>/vpn/certificate/local
pm/config/device/<device>/vdom/<vdom>/vpn/certificate/remote
pm/config/device/<device>/global/vpn/certificate/ca
pm/config/device/<device>/global/vpn/certificate/local
pm/config/device/<device>/global/vpn/certificate/remote

And FMG will return something like:

[...]
"_certinfo": {

  "is_ca": 1,
  "issuer": "O = Fortinet Ltd., CN = Fortinet",
  "negsn": 0,
  "serial": "37:38:42:39:38:38:39:37:44:34:39:33:45:31:42:43:44:30:31:31:32:34:38:37:31:42:41:37:46:41:32:39",
  "subject": "O = Fortinet Ltd., CN = Fortinet",
  "validfrom": "2020-04-20 23:09:46  GMT",
  "validto": "2030-04-25 23:09:46  GMT",
  "version": 3
},
[...]

8.26. Device Monitoring#

8.26.1. Generate an IP Pool Mapping#

Caught in #0604135.

To get the IP Pool Mapping for some devices:

REQUEST:

{
  "id": 1,
  "method": "exec",
  "params": [
    {
      "url": "dvmdb/get/ippool-mapping",
      "data": {
        "time": "2019-12-30 01:01:01",
        "devices": [
          {
            "name": "FGT1",
            "vdom": "test2",
          },
          {
            "name": "FGT2",
            "vdom": "",
          },
        ]
      }
    }
  ]
}

If no devices are specified then mapping for all devices will be generated

REQUEST:

{
  "id": 1,
  "method": "exec",
  "params": [
    {
      "url":"dvmdb/get/ippool-mapping",
      "data": {
        "time": "2019-12-30 01:01:01",
        "devices": []
      }
    }
  ]
}

Time must be in the YYYY-MM-DD HH:MM:SS format, and all generated files will be placed in /var/tmp/port_mapping/ and each file will follow the format:

If VDOM specified: <device name>_<vdom name>_mapping.txt

No VDOM specified: <device name>_mapping.txt

8.26.2. How to get kernel routes from a managed fortigate device?#

Following request will encapsulate the FOS REST API call:

GET https://hub1/api/v2/monitor/router/ipv4/select?&vdom=root&count=-1

in a FMG JSON API request using the sys/proxy/json url:

REQUEST:

{
  "id": "10032dca-4fb3-4f29-bd73-308220e1e75f",
  "method": "exec",
  "params": [
    {
      "data": {
        "action": "get",
        "resource":
        "/api/v2/monitor/router/ipv4/select?&vdom=root&count=-1",
        "target": [
          "adom/DEMO/device/hub1"
        ]
      },
      "url": "sys/proxy/json"
    }
  ],
  "session": 55422
}

Note

Note about the HTTP parameters passed in the FOS REST API call:

vdom=root: we want the kernel routes from VDOM root
count=-1: we want all kernel routes

We will get the following response:

{
  "id": "10032dca-4fb3-4f29-bd73-308220e1e75f",
  "result": [
    {
      "data": [
        {
          "response": {
            "action": "select",
            "build": 1579,
            "http_method": "GET",
            "name": "ipv4",
            "path": "router",
            "results": [
              {
                "distance": 10,
                "gateway": "10.210.35.254",
                "interface": "port1",
                "ip_mask": "0.0.0.0/0",
                "ip_version": 4,
                "metric": 0,
                "type": "static"
              },
              {
                "distance": 0,
                "gateway": "0.0.0.0",
                "interface": "port2",
                "ip_mask": "10.101.0.0/24",
                "ip_version": 4,
                "metric": 0,
                "type": "connect"
              },
              {
                "distance": 0,
                "gateway": "0.0.0.0",
                "interface": "port1",
                "ip_mask": "10.210.34.0/23",
                "ip_version": 4,
                "metric": 0,
                "type": "connect"
              }
            ],
            "serial": "FGVMULREDACTED09",
            "status": "success",
            "vdom": "root",
            "version": "v6.4.0"
          },
          "status": {
            "code": 0,
            "message": "OK"
          },
          "target": "hub1"
        }
      ],
      "status": {
        "code": 0,
        "message": "OK"
      },
      "url": "sys/proxy/json"
    }
  ]
}

Even if this is not the case in this output, you will get all kind of kernel routes here (static, connected, bgp, ospf, etc.).

8.26.3. How to get IPSEC tunnel statistics?#

REQUEST:

{
  "id": "4150e0fd-456b-45a0-8fcf-2a52e532dd5a",
  "method": "exec",
  "params": [
    {
      "data": {
        "action": "get",
        "resource": "/api/v2/monitor/vpn/ipsec/select?&global=1",
        "target": [
          "adom/demo/device/fgt_01_1"
        ],
        "timeout": 20
      },
      "url": "sys/proxy/json"
    }
  ],
  "session": 49128
}

It is possible to target multiple device or device groups from different ADOMs:

"target": [
  "adom/demo1/group/emea_branches",
  "adom/demo2/group/mssp_pool"
  "adom/demo3/device/device_001,"
  "adom/demo4/device/device_002,"
  "adom/demo5/group/All_FortiGate"
]

8.27. How to get an Install Preview for a single device?#

It’s a two steps process:

Trigger an install preview operation
Collect the install preview output

8.27.1. Step #1: Trigger an install review operation#

The following example shows how to trigger an install device preview operation for the dev_001 device in the demo ADOM:

REQUEST

{
  "id": 1,
  "method": "exec",
  "params": [
    {
      "data": {
        "adom": "demo",
        "device": "dev_001",
        "flags": [
          "none"
        ],
        "vdoms": [
          "root"
        ]
      },
      "url": "/securityconsole/install/preview"
    }
  ],
  "session": "{{session}}"
}

RESPONSE

{
  "id": 1,
  "result": [
    {
      "data": {
        "task": 71
      },
      "status": {
        "code": 0,
        "message": "OK"
      },
      "url": "/securityconsole/install/preview"
    }
  ]
}

Note

You have to track the progress of the returned task id 71
Once the task is completed, you can proceed with next step

8.27.2. Step #2: Collect the install preview output#

Note

Here FortiManager will report pending changes coming from corresponding device’s Device DB (Install Device Settings operation)
If you want to get all pending changes (ie. the ones from the device’s Device DB along with the ones in the ADOM DB like the objects & policies), then you need to trigger a Policy Package Install preview (See How to get an Install Preview for a single device?)

The following example shows how to obtain the Install Preview output for the dev_001 device in the demo ADOM:

REQUEST

{
  "id": 1,
  "method": "exec",
  "params": [
    {
      "data": {
        "adom": "demo",
        "device": "dev_001"
      },
      "url": "/securityconsole/preview/result"
    }
  ],
  "session": "{{session}}"
}

RESPONSE

{
  "id": 1,
  "result": [
    {
      "data": {
        "message": "config system dhcp server\n    edit 1\n        set status disable\n        set dns-service default\n        set ntp-service default\n        set default-gateway 172.16.2.102\n        set netmask 255.255.255.0\n        set interface \"port3\"\n        config ip-range\n            edit 1\n                set start-ip 172.16.2.1\n                set end-ip 172.16.2.101\n            next\n            edit 2\n                set start-ip 172.16.2.103\n                set end-ip 172.16.2.254\n            next\n        end\n        set timezone-option default\n    next\nend\n"
      },
      "status": {
        "code": 0,
        "message": "OK"
      },
      "url": "/securityconsole/preview/result"
    }
  ]
}

8.28. How to get an Install Preview for multiple devices?#

Starting with FortiManager 7.4.4/7.6.0 (#1027482), it is possible to trigger an Install Preview operation for multiple devices.

The per-device Install Preview tasks will be done in parellel.

It’s still a two steps process:

Trigger the install preview operation, this time by specifying multiple target devices
Collect the install preview output, again by specifying multiple target devices

8.28.1. Step #1: Trigger an install preview for multiple devices#

The following example shows how to trigger an install device preview operation for the dev_001, dev_002 and dev_003 devices in the demo ADOM:

REQUEST

{
  "id": 3,
  "method": "exec",
  "params": [
    {
      "data": {
        "adom": "demo",
        "flags": ["none"],
        "scope": [
          {
            "name": "dev_001",
            "vdom": "root"
          },
          {
            "name": "dev_002",
            "vdom": "root"
          },
          {
            "name": "dev_003",
            "vdom": "root"
          }
        ]
      },
      "url": "/securityconsole/install/preview"
    }
  ],
  "session": "{{session}}"
}

Note

Attribute flags could be none or json
It determines the nature of the output produced in the preview report
none means CLI format
json means JSON format

Warning

There is a bug (#0713778) where using:
```
"flags": "json"
```
or:
```
"flags": ["json"]
```
doesn’t work: the preview report is still CLI based.

The solution is to use this form:
```
"flags": 1
```

RESPONSE

{
  "id": 3,
  "result": [
    {
      "data": {
        "task": 1056
      },
      "status": {
        "code": 0,
        "message": "OK"
      },
      "url": "/securityconsole/install/preview"
    }
  ]
}

Note

You have to track the progress of the returned task id 1056
Once the task is completed, you can proceed with next step

8.28.2. Step #2: Collect the install device preview output#

The following example shows how to obtain the Install Preview output for the dev_001, dev_002 and dev_003 devices in the demo ADOM:

REQUEST

{
  "id": 4,
  "method": "exec",
  "params": [
    {
      "data": {
        "adom": "demo",
        "scope": [
          {
            "name": "dev_001",
            "vdom": "root"
          },
          {
            "name": "dev_002",
            "vdom": "root"
          },
          {
            "name": "dev_003",
            "vdom": "root"
          }
        ]
      },
      "url": "/securityconsole/preview/result"
    }
  ],
  "session": "{{session}}"
}

RESPONSE

{
  "id": 4,
  "result": [
    {
      "data": {
        "message": "[{ \"name\": \"dev_001\", \"oid\": 34872, \"result\": \"=== Preview result ===\\nconfig system interface\\n    edit \\\"port2\\\"\\n        set allowaccess https ping ssh http\\n        set alias \\\"ul_isp1\\\"\\n    next\\nend\\n\"}, { \"name\": \"dev_002\", \"oid\": 35009, \"result\": \"=== Preview result ===\\nconfig system global\\n    set admin-https-ssl-versions tlsv1-1 tlsv1-2 tlsv1-3\\n    set admin-console-timeout 300\\n    set admin-scp enable\\nend\\nconfig system csf\\n    unset fixed-key\\nend\\n\"}, { \"name\": \"dev_003\", \"oid\": 35145, \"result\": \"=== Preview result ===\\nconfig system global\\n    set admin-scp enable\\n    set switch-controller enable\\nend\\nconfig system acme\\n    set interface \\\"port3\\\"\\nend\\nconfig system csf\\n    unset fixed-key\\nend\\n\"}]"
      },
      "status": {
        "code": 0,
        "message": "OK"
      },
      "url": "/securityconsole/preview/result"
    }
  ]
}

Note

The Install Preview ouput for multiple devices is placed in message attribute.

8.29. How to get the platform_id, the platform_name and the ostype from a Serial Number?#

Caught in #0310534 & #0380729.

The get the platform_id, the platform_name and the ostype information for serial number FGT60F0000000001:

REQUEST:

{
  "id": 1,
  "method": "get",
  "params": [
    {
      "url": "/pm/config/adom/root/_data/dvm/device/abbrev/FGT60F000000001"
    }
  ],
  "session": "NjrWJdyknKad+lyg22972u4hQqQLdoo5tqckwtvTFOhg8hyyx2Nmn+1JK0LxfSlRuvyH5gksFqOmmZo5iP61YYy6zamVQ7bQ",
  "verbose": 1
}

Note

You could use any ADOM names.

RESPONSE:

{
  "id": 1,
  "result": [
    {
      "data": [
        {
          "ostype": "FortiGate",
          "platform_id": 19,
          "platform_name": "FortiGate-60F"
        }
      ],
      "status": {
        "code": 0,
        "message": "OK"
      },
      "url": "/pm/config/adom/root/_data/dvm/device/abbrev/FGT60F000000001"
    }
  ]
}

In fact, it even works when using the 6 chars serial number prefix. For instance to get the same information for a FortiWifi-60F whose serial number prefix is FWF60F:

REQUEST:

{
  "id": 1,
  "jsonrpc": "1.0",
  "method": "get",
  "params": [
    {
      "url": "/pm/config/adom/root/_data/dvm/device/abbrev/FWF60F"
    }
  ],
  "session": "9SN/bVFfPl4/1osdflZBcCDS36GchGMXPsip75oPlPBYLJoXzcpAWSzu6ENSTD1t/uj6qdtTJrut7HiTmdJlM0oeYAg+sVAv",
  "verbose": 1
}

RESPONSE:

{
  "id": 1,
  "result": [
    {
      "data": [
        {
          "ostype": "FortiGate",
          "platform_id": 165,
          "platform_name": "FortiWiFi-60F"
        }
      ],
      "status": {
        "code": 0,
        "message": "OK"
      },
      "url": "/pm/config/adom/root/_data/dvm/device/abbrev/FWF60F"
    }
  ]
}

And it works for any supported products. For instance to get the same information for a FortiADC-200D with serial number prefix FAD2HD:

REQUEST:

{
  "id": 3,
  "method": "get",
  "params": [
    {
      "url": "/pm/config/adom/root/_data/dvm/device/abbrev/FAD2HD"
    }
  ],
  "session": "tktYWsKRLlFju8ELx/wIaiY+/f6ZIvZrbNcb3HogTtXQWYCq361STNmIr+s2pkRhu4/u5tNK1bXatrDjVlrQafr5RvN3us9U",
  "verbose": 1
}

RESPONSE:

{
  "id": 3,
  "result": [
    {
      "data": [
        {
          "ostype": "FortiADC",
          "platform_id": 2,
          "platform_name": "FortiADC-200D"
        }
      ],
      "status": {
        "code": 0,
        "message": "OK"
      },
      "url": "/pm/config/adom/root/_data/dvm/device/abbrev/FAD2HD"
    }
  ]
}

8.30. How to get all supported devices?#

Caught in #0310534 & #0380729.

To get all supported FortiADC models (along with their platform_id, platform_name and ostype):

REQUEST:

{
  "id": 3,
  "method": "get",
  "params": [
    {
      "ostype": "FortiADC",
      "url": "/pm/config/adom/root/_data/dvm/device/model"
    }
  ],
  "session": "3fqUh3NhPfG19woQsrjOq29iIikXMrrSd6PjLMGukjdGZTOln5ZZL+e0KW7mtVBEsGrA3R31/9L5Bm4id/qdZ7UuI9BZdGN8",
  "verbose": 1
}

RESPONSE:

{
  "id": 3,
  "result": [
    {
      "data": [
        {
          "ostype": "FortiADC",
          "platform_id": 0,
          "platform_name": "FortiADC-100F"
        },
        {
          "ostype": "FortiADC",
          "platform_id": 1,
          "platform_name": "FortiADC-120F"
        },
        {
          "ostype": "FortiADC",
          "platform_id": 2,
          "platform_name": "FortiADC-200D"
        },
        {
          "ostype": "FortiADC",
          "platform_id": 3,
          "platform_name": "FortiADC-200F"
        },
        {
          "ostype": "FortiADC",
          "platform_id": 4,
          "platform_name": "FortiADC-220F"
        },
        {
          "ostype": "FortiADC",
          "platform_id": 5,
          "platform_name": "FortiADC-300D"
        },
        {
          "ostype": "FortiADC",
          "platform_id": 6,
          "platform_name": "FortiADC-300F"
        },
        {
          "ostype": "FortiADC",
          "platform_id": 7,
          "platform_name": "FortiADC-400D"
        },
        {
          "ostype": "FortiADC",
          "platform_id": 8,
          "platform_name": "FortiADC-400F"
        },
        {
          "ostype": "FortiADC",
          "platform_id": 9,
          "platform_name": "FortiADC-700D"
        },
        {
          "ostype": "FortiADC",
          "platform_id": 10,
          "platform_name": "FortiADC-1000F"
        },
        {
          "ostype": "FortiADC",
          "platform_id": 11,
          "platform_name": "FortiADC-1200F"
        },
        {
          "ostype": "FortiADC",
          "platform_id": 12,
          "platform_name": "FortiADC-1500D"
        },
        {
          "ostype": "FortiADC",
          "platform_id": 13,
          "platform_name": "FortiADC-2000D"
        },
        {
          "ostype": "FortiADC",
          "platform_id": 14,
          "platform_name": "FortiADC-2000F"
        },
        {
          "ostype": "FortiADC",
          "platform_id": 15,
          "platform_name": "FortiADC-2200F"
        },
        {
          "ostype": "FortiADC",
          "platform_id": 16,
          "platform_name": "FortiADC-4000D"
        },
        {
          "ostype": "FortiADC",
          "platform_id": 17,
          "platform_name": "FortiADC-4000F"
        },
        {
          "ostype": "FortiADC",
          "platform_id": 18,
          "platform_name": "FortiADC-4200F"
        },
        {
          "ostype": "FortiADC",
          "platform_id": 19,
          "platform_name": "FortiADC-5000F"
        },
        {
          "ostype": "FortiADC",
          "platform_id": 20,
          "platform_name": "FortiADC-VM"
        }
      ],
      "status": {
        "code": 0,
        "message": "OK"
      },
      "url": "/pm/config/adom/root/_data/dvm/device/model"
    }
  ]
}

Note

supported devices means: FortiManager can managed them (like a FortiGate, FortiSwitch, FortiAP, FortiExtender, FortiProxy, etc.) and/or serve them updates (like a FortiIsolator)
If you don’t know which value to use for the ostype parameter, just omit it; FortiManager will return the complete list of supported devices.

8.32. Private Data Encryption#

Note

There are multiple wordings for the private data encryption key. It could also be refered as referred master encryption key or master encryption password.

8.32.1. How to get the private data encryption status of one device?#

It is as simple as getting the device’s metadata from FortiManager.

We’re getting the device’s metadata of the device fgt_dc2:

8REQUEST:

{
    "id": 1,
    "method": "get",
    "params": [
        {
            "fields": ["name", "private_key", "private_key_status"],
            "loadsub": 0,
            "url": "/dvmdb/device/fgt_dc2"
        }
    ],
    "session": "{{session}}",
    "verbose": 1
}

RESPONSE:

{
  "id": 1,
  "result": [
    {
      "data": {
        "name": "fgt_dc2",
        "oid": 333,
        "private_key": "DBhqwTiSCyhlSPjNh8HdivubClBU4Nytr9BziI3gyCMtSKSvDNLweBMTwJVqcYc1Kz4xTc/5aaNjv0aKeToJCX/G19vC12lVqBDjA90LNXzeNG7Ld2ZUJH512I1NE5y1soFuUCSHBGaHwZr+yz08lICf0EBbEvwYTKK+aQJzchr5lYj+",
        "private_key_status": 2
      },
      "status": {
        "code": 0,
        "message": "OK"
      },
      "url": "/dvmdb/device/fgt_dc2"
    }
  ]
}

If private_key is returned as en empty string and private_key_status is equal to 0, then the master encryption password is not set for this device in FortiManager.

Warning

If private_key and private_key_status are not set, it doesn’t mean that on the real device the private data encryption isn’t set as well.
Both private_key and private_key_status are settings applicable to FortiManager only.

8.32.2. How to verify a private data encryption key?#

Starting with FMG 7.0.5/7.2.1, it is possible to set the master encryption key using the FortiManager JSON RPC API.

Warning

This is not setting the master encryption key on the real device!
This is to set the master encryption key on the device’s metadata in FortiManager in order to make sure it is aligned with the one set on the real device.

We set the private data encryption key for managed device with device OID 333:

REQUEST:

{
  "id" : 1,
  "method" : "exec",
  "params" : [
    {
      "data" : {
        "key" : "0123456789ABCDEF0123456789ABCDEF",
        "device" : 333
      },
      "url" : "/deployment/verify/private/key"
    }
  ],
  "session" : "{{session}}"
}

RESPONSE:

{
  "id": 1,
  "result": [
    {
      "status": {
        "code": 0,
        "message": "OK"
      },
      "url": "/deployment/verify/private/key"
    }
  ]
}

Note

Interesting to note that the above FortiManager JSON RPC API request will produce the following FortiGate CLI execution on the real device:

diagnose debug cli 8
diagnose debug duration 0
diagnose debug enable
diagnose debug console timestamp enable
2022-06-15 09:02:45 0: get system status
2022-06-15 09:02:47 0: execute private-encryption-key verify GFBkGzA5VC6fBgh7eLK9PL/Ntgv5tJlG0toWUQEAay4= vAfV3s3a2X+81SegD8YGlWHiRFU=

8.33. FortiGate-VM#

8.33.1. How to upload a FortiGate-VM license?#

To be tested.

This API call was captured with following FortiManager debug command:

diagnose debug service main 255
diagnose debug timestamp enable
diagnose debug enable

Then by using the FortiManager GUI and right-clicking a managed device under Device Manager and selecting Install VM License:abbr:

{
  "client": "/usr/local/apache2/bin/httpd:22646",
  "id": 1,
  "method": "exec",
  "params": [
    {
      "data": {
        "device": 1241,
        "license": "[.lic license file content]",
        "task": 309,
        "type": 0
      },
      "url": "dmworker/install/license"
    }
  ],
  "session": 13786,
  "src": "127.0.0.1"
}

8.34. Single Pane of Glass#

This is for when FortiManager is managing a FortiAnalyzer.

8.34.1. How to sync a FortiManager ADOM?#

8.34.1.1. When a device is added#

To sync FortiManager ADOM test_002 with managed FortiAnalyzer prod-faz-721-001:

REQUEST:

{
  "id": 3,
  "method": "exec",
  "params": [
    {
      "data": {
        "adom": "test_002",
        "confirm": 1,
        "device": "prod-faz-721-001"
      },
      "url": "/faz/cmd/sync/dvmdb"
    }
  ],
  "session": "VXEUONHY6O2yOlXhm4QWvqxXDDS9uzHC13bh8cWXUh/3zWKg6eUi+h67NCB2erEYFgmdw8LShKN0jX8X0W7KYBW4ZViWHTTQ"
}

RESPONSE:

{
  "id": 3,
  "result": [
    {
      "data": {
        "taskid": 118
      },
      "status": {
        "code": 0,
        "message": "OK"
      },
      "url": "/faz/cmd/sync/dvmdb"
    }
  ]
}

Note

It is important to wait for the task completion before ending the FortiManager JSON RPC API session

8.34.1.2. When a device is deleted#

To sync FortiManager ADOM test_002 with managed FortiAnalyzer prod-faz-721-001:

REQUEST:

{
  "id": 3,
  "method": "exec",
  "params": [
    {
      "data": {
        "adom": "test_002",
        "confirm": 1,
        "device": "prod-faz-721-001",
        "option": [
          "delete device"
        ]
      },
      "url": "/faz/cmd/sync/dvmdb"
    }
  ],
  "session": "OxsmQoqrXFwcBnhPwvSZ25DIZqGhfUtrf46g+6jU10f08+D23ZDoGOhvJBFpu3ltxIJ0er+KpdbS8FYKyL052lGP+49nIe9O"
}

RESPONSE:

{
  "id": 3,
  "result": [
    {
      "data": {
        "taskid": 119
      },
      "status": {
        "code": 0,
        "message": "OK"
      },
      "url": "/faz/cmd/sync/dvmdb"
    }
  ]
}

Note

It is important to wait for the task completion before ending the FortiManager JSON RPC API session

8.35. How to operate a Where Used?#

Some elements of the Device DB are elligible to a Where Used operation.

How to figure out which one?

By trying with the FortiManager GUI.

For instance, it is possible to Where Used a system interface.

The following example describes how to where used the port2.1001 system interface from the dut_fgt_03 managed device:

It is still a three steps process:

Start the Where Used operation to get a token

REQUEST

{
    "id": "1",
    "method": "exec",
    "params": [
        {
            "url": "cache/search/where/used/start",
            "data": {
                "obj": "device/dut_fgt_03/global/system/interface",
                "mkey": "port2.1001"
            }
        }
    ]
    "session": "{{session}}"
}

RESPONSE

{
    "code": 0,
    "data": {
        "result": [
            {
                "data": {
                    "token": "TedkwWWwgWQh0gdmGI81lw=="
                },
                "id": "f24acb25-a6a0-417d-8765-8c75c647e2f7",
                "status": {
                    "code": 0,
                    "message": "OK"
                },
                "url": "/cache/search/where/used/start"
            }
        ]
    },
    "errors": "",
    "message": ""
}

Ask for a summary for the returned token

It will give you the process of the Where Used operation:

REQUEST

{
    "id": "1",
    "method": "exec",
    "params": [
        {
            "url": "cache/search/where/used/get/summary",
            "token": "TedkwWWwgWQh0gdmGI81lw=="
        }
    ],
    "session": "{{session}}"
}

RESPONSE

{
    "code": 0,
    "data": {
        "result": [
            {
                "data": {
                    "percent": 100
                },
                "id": "3a0c5969-2303-4440-8537-630422262e47",
                "status": {
                    "code": 0,
                    "message": "OK"
                },
                "url": "/cache/search/where/used/get/summary"
            }
        ]
    },
    "errors": "",
    "message": ""
}

Once the percent is 100 you can consider the Where Used operation as completed

If percent is different than 100 you have to keep asking for a summary

You can now get the Where Used detail

REQUEST

{
    "id": "0476b81d-f61c-4a55-a5a6-8acc0346fbd1",
    "method": "exec",
    "params": [
        {
            "url": "cache/search/where/used/get/detail",
            "token": "TedkwWWwgWQh0gdmGI81lw=="
        }
    ]
}

RESPONSE

{
    "code": 0,
    "data": {
        "result": [
            {
                "data": {
                    "percent": 100,
                    "total_num": 1,
                    "where_used": [
                        {
                            "data": [
                                {
                                    "attr": "interface",
                                    "category": 140,
                                    "last use": 1,
                                    "mapping_name": "firewall address",
                                    "mattr": "name",
                                    "mkey": "port2.1001 address",
                                    "vdom": {
                                        "name": "root",
                                        "oid": 3,
                                        "type": "unknown type"
                                    }
                                }
                            ],
                            "root": {
                                "name": "dut_fgt_03",
                                "oid": 296
                            }
                        }
                    ]
                },
                "id": "0476b81d-f61c-4a55-a5a6-8acc0346fbd1",
                "status": {
                    "code": 0,
                    "message": "OK"
                },
                "url": "/cache/search/where/used/get/detail"
            }
        ]
    },
    "errors": "",
    "message": ""
}

You can see that port2.1001 system interface is referenced by port2.1001 address firewall address

The above example was for a system interface and because of that, the obj attribute in the very first request (the one starting the Where Used process) was referering to the device’s global scope.

Should you want to Where Used something else like the phase1-interface, you can use a VDOM scope obj as shown below:

{
    "id": "1",
    "method": "exec",
    "params": [
        {
            "url": "cache/search/where/used/start",
            "data": {
                "obj": "device/dut_fgt_03/vdom/root/vpn/ipsec/phase1-interface",
                "mkey": "ol_isp1"
            }
        }
    ],
    "session": "{{session}}"
}

8.37. VPN Monitor#

How to get VPN tunnel details as exposed in the Device Manager > Monitors > VPN Monitor page when you toggle on the Show Table:abbr:

To get the VPN tunnel details for the i-04-hub-02 device in the production ADOM:

REQUEST

{
  "id": 3,
  "method": "exec",
  "params": [
    {
      "data": {
        "action": "get",
        "resource": "/api/v2/monitor/vpn/ipsec?vdom=root",
        "target": [
          "adom/dc_emea/device/i-04-hub-02"
        ]
      },
      "url": "/sys/proxy/json"
    }
  ],
  "session": "{{session}}"
}

Note

Review section How to encapsulate FOS REST API call within FMG JSON RPC API? for how to play with the target attribute if you want to make a single API call targeting multiple managed devices or device groups

REQUEST

{
  "id": 3,
  "result": [
    {
      "data": [
        {
          "response": {
            "action": "",
            "build": 2463,
            "http_method": "GET",
            "name": "ipsec",
            "path": "vpn",
            "results": [
              {
                "comments": "VPN: VPN2 [Created by IPSEC Template]",
                "incoming_bytes": 665578973,
                "name": "VPN2",
                "outgoing_bytes": 616068531,
                "proxyid": [],
                "rgwy": "0.0.0.0",
                "tun_id": "10.0.0.2",
                "tun_id6": "::10.0.0.2",
                "type": "",
                "wizard-type": "custom"
              },
              {
                "comments": "VPN: VPN1 [Created by IPSEC Template]",
                "connection_count": 35,
                "creation_time": 2999411,
                "dialup_index": 0,
                "incoming_bytes": 271578165,
                "name": "VPN1_0",
                "outgoing_bytes": 246820096,
                "parent": "VPN1",
                "proxyid": [
                  {
                    "expire": 3995,
                    "incoming_bytes": 3225536,
                    "outgoing_bytes": 8658008,
                    "p2name": "VPN1",
                    "p2serial": 1,
                    "proxy_dst": [
                      {
                        "port": 0,
                        "protocol": 0,
                        "protocol_name": "",
                        "subnet": "0.0.0.0-255.255.255.255"
                      }
                    ],
                    "proxy_src": [
                      {
                        "port": 0,
                        "protocol": 0,
                        "protocol_name": "",
                        "subnet": "0.0.0.0-255.255.255.255"
                      }
                    ],
                    "status": "up"
                  }
                ],
                "rgwy": "198.18.21.3",
                "tun_id": "10.10.0.1",
                "tun_id6": "::10.0.0.22",
                "type": "dialup",
                "username": "Branch1",
                "wizard-type": "custom"
              },
              {
                "comments": "VPN: VPN1 [Created by IPSEC Template]",
                "connection_count": 35,
                "creation_time": 2999411,
                "dialup_index": 1,
                "incoming_bytes": 271585191,
                "name": "VPN1_1",
                "outgoing_bytes": 246816303,
                "parent": "VPN1",
                "proxyid": [
                  {
                    "expire": 4004,
                    "incoming_bytes": 3224420,
                    "outgoing_bytes": 8654996,
                    "p2name": "VPN1",
                    "p2serial": 1,
                    "proxy_dst": [
                      {
                        "port": 0,
                        "protocol": 0,
                        "protocol_name": "",
                        "subnet": "0.0.0.0-255.255.255.255"
                      }
                    ],
                    "proxy_src": [
                      {
                        "port": 0,
                        "protocol": 0,
                        "protocol_name": "",
                        "subnet": "0.0.0.0-255.255.255.255"
                      }
                    ],
                    "status": "up"
                  }
                ],
                "rgwy": "198.18.11.3",
                "tun_id": "10.10.0.2",
                "tun_id6": "::10.0.0.24",
                "type": "dialup",
                "username": "Branch2",
                "wizard-type": "custom"
              },
              {
                "comments": "VPN: VPN2 [Created by IPSEC Template]",
                "connection_count": 35,
                "creation_time": 2999411,
                "dialup_index": 0,
                "incoming_bytes": 271580039,
                "name": "VPN2_0",
                "outgoing_bytes": 246818469,
                "parent": "VPN2",
                "proxyid": [
                  {
                    "expire": 3991,
                    "incoming_bytes": 3225730,
                    "outgoing_bytes": 8658396,
                    "p2name": "VPN2",
                    "p2serial": 1,
                    "proxy_dst": [
                      {
                        "port": 0,
                        "protocol": 0,
                        "protocol_name": "",
                        "subnet": "0.0.0.0-255.255.255.255"
                      }
                    ],
                    "proxy_src": [
                      {
                        "port": 0,
                        "protocol": 0,
                        "protocol_name": "",
                        "subnet": "0.0.0.0-255.255.255.255"
                      }
                    ],
                    "status": "up"
                  }
                ],
                "rgwy": "198.18.22.2",
                "tun_id": "10.10.64.1",
                "tun_id6": "::10.0.0.23",
                "type": "dialup",
                "username": "Branch1",
                "wizard-type": "custom"
              },
              {
                "comments": "VPN: VPN2 [Created by IPSEC Template]",
                "connection_count": 35,
                "creation_time": 2999411,
                "dialup_index": 1,
                "incoming_bytes": 271580984,
                "name": "VPN2_1",
                "outgoing_bytes": 246816536,
                "parent": "VPN2",
                "proxyid": [
                  {
                    "expire": 3976,
                    "incoming_bytes": 3227004,
                    "outgoing_bytes": 8661972,
                    "p2name": "VPN2",
                    "p2serial": 1,
                    "proxy_dst": [
                      {
                        "port": 0,
                        "protocol": 0,
                        "protocol_name": "",
                        "subnet": "0.0.0.0-255.255.255.255"
                      }
                    ],
                    "proxy_src": [
                      {
                        "port": 0,
                        "protocol": 0,
                        "protocol_name": "",
                        "subnet": "0.0.0.0-255.255.255.255"
                      }
                    ],
                    "status": "up"
                  }
                ],
                "rgwy": "198.18.12.1",
                "tun_id": "10.10.64.2",
                "tun_id6": "::10.0.0.25",
                "type": "dialup",
                "username": "Branch2",
                "wizard-type": "custom"
              },
              {
                "comments": "VPN: VPN1 [Created by IPSEC Template]",
                "incoming_bytes": 658419394,
                "name": "VPN1",
                "outgoing_bytes": 608907495,
                "proxyid": [],
                "rgwy": "0.0.0.0",
                "tun_id": "10.0.0.1",
                "tun_id6": "::10.0.0.1",
                "type": "",
                "wizard-type": "custom"
              }
            ],
            "serial": "FGVM01TM23005392",
            "status": "success",
            "vdom": "root",
            "version": "v7.4.1"
          },
          "status": {
            "code": 0,
            "message": "OK"
          },
          "target": "i-04-hub-02"
        }
      ],
      "status": {
        "code": 0,
        "message": "OK"
      },
      "url": "/sys/proxy/json"
    }
  ]
}

8.39. Create FortiOS API users#

This is for creating FortiOS API users from the FortiManager.

8.40. FortiGate with internal modems#

8.40.1. How to get LTE modem status?#

Caught in #0983359.

The following example shows how to list the status of all LTE modems for a specific device (using the filter attribute) managed device in the demo ADOM:

8.41. How to RMA a managed device?#

FortiManager stores the configuration of the failed unit in the Device Database. When a replacement device is deployed, its serial number will not match the one stored in FortiManager. However, FortiManager allows you to update the serial number of the managed device, effectively treating it as a Model Device. Once the new device connects to FortiManager, it will push the configuration to the matching managed device seamlessly.

FortiManager uses the onboard_rule sub-table of a managed device to designate it as being in an RMA situation.

8.41.1. How to set the RMA status on a managed device?#

This section demonstrates how to operate via API the Swap Device GUI action:

The following example shows how to set the RMA status of the dev_001 managed device in the demo ADOM:

REQUEST

{
  "id": 3,
  "method": "set",
  "params": [
    {
      "data": {
        "adm_pass": "fortinet",
        "adm_usr": "admin",
        "flags": "specify-oldsn",
        "name": "_RMA_FGVMMLREDACTED43",
        "old_sn": "FGVMMLREDACTED43",
        "sn": "FGVMMLREDACTED61",
        "type": "maintenance"
      },
      "url": "/dvmdb/adom/demo/device/dev_001/onboard_rule"
    }
  ],
  "session": "{{session}}"
}

RESPONSE

{
  "id": 3,
  "result": [
    {
      "data": {
        "name": "_RMA_FGVMMLREDACTED43"
      },
      "status": {
        "code": 0,
        "message": "OK"
      },
      "url": "/dvmdb/adom/demo/device/dev_001/onboard_rule"
    }
  ]
}

Note

If you want to remove the RMA status later, use the returned name. This serves as the master key needed to delete the RMA status (refer to section How to delete the RMA status on a managed device?).

8.41.2. How to get the RMA status of a managed device?#

The following example shows how to get the RMA status of the dev_001 managed device in the demo ADOM:

REQUEST

{
  "id": 3,
  "method": "get",
  "params": [
    {
      "url": "/dvmdb/adom/demo/device/dev_001/onboard_rule"
    }
  ],
  "session": "{{session}}",
  "verbose": 1
}

RESPONSE

{
  "id": 3,
  "result": [
    {
      "data": [
        {
          "adm_pass": [
            "ENC",
            "SH2mSBw5WgWZzs9fW+NhuaFzMB4YmSiuBYlY/BbJSzOZ0kppOpw1p2j1YN10SI="
          ],
          "adm_usr": "admin",
          "did": "dev_001",
          "flags": "specify-oldsn",
          "name": "_RMA_FGVMMLREDACTED43",
          "oid": 40239,
          "old_sn": "FGVMMLREDACTED43",
          "seq": 1,
          "sn": "FGVMMLREDACTED61",
          "type": "maintenance"
        }
      ],
      "status": {
        "code": 0,
        "message": "OK"
      },
      "url": "/dvmdb/adom/demo/device/dev_001/onboard_rule"
    }
  ]
}

8.41.3. How to delete the RMA status on a managed device?#

The following example shows how to delete the RMA status of the dev_001 managed device in the demo ADOM:

REQUEST

{
  "id": 3,
  "method": "delete",
  "params": [
    {
      "url": "/dvmdb/adom/demo/device/dev_001/onboard_rule/__RMA_FGVMMLREDACTED43"
    }
  ],
  "session": "{{session}}"
}

RESPONSE

{
  "id": 3,
  "result": [
    {
      "status": {
        "code": 0,
        "message": "OK"
      },
      "url": "/dvmdb/adom/demo/device/dev_001/onboard_rule/__RMA_FGVMMLREDACTED43"
    }
  ]
}

8.42. SASE Controller#

The SASE controller is like a normal device.

The following example shows how to get your existing managed SASE controller:

REQUEST

{
  "id": 3,
  "method": "get",
  "params": [
    {
      "fields": [
        "name",
        "sn",
        "os_type"
      ],
      "filter": [
        "os_type",
        "==",
        "fss"
      ],
      "loadsub": 0,
      "url": "/dvmdb/device"
    }
  ],
  "session": "{{session}}",
  "verbose": 1
}

RESPONSE

{
  "id": 3,
  "result": [
    {
      "data": [
        {
          "name": "FFSASEREDACTED67",
          "oid": 202,
          "os_type": "fss",
          "sn": "FFSASEREDACTED67"
        }
      ],
      "status": {
        "code": 0,
        "message": "OK"
      },
      "url": "/dvmdb/device"
    }
  ]
}

This example shows how to rename it to fss_001:

REQUEST

{
  "id": 3,
  "method": "set",
  "params": [
    {
      "data": {
        "name": "fss_001"
      },
      "url": "/dvmdb/device/FFSASEREDACTED67"
    }
  ],
  "session": "{{session}}"
}

RESPONSE

{
  "id": 3,
  "result": [
    {
      "data": {
        "name": "fss_001"
      },
      "status": {
        "code": 0,
        "message": "OK"
      },
      "url": "/dvmdb/device/FFSASEREDACTED67"
    }
  ]
}

8.43. How to get Fortinet vulnerabilities for your managed devices?#

Starting with FortiMager 7.6.3, you can get the Fortinet vulnerabilities for your managed devices.

Note

For an alternate way to get the Fortinet vulnerabilities, refer to the section How to get the list of vulnerabilities for your managed devices?.

The following example shows how to get the Fortinet vulnerabilities for the dev_001 managed device in the demo ADOM:

REQUEST

{
  "id": 3,
  "method": "get",
  "params": [
    {
      "scope member": [
        {
          "oid": 276
        }
      ],
      "url": "/pm/config/adom/demo/_psirt/data"
    }
  ],
  "session": "{{session}}",
  "verbose": 1
}

Note

276 is the OID of the dev_001 managed device. For more details on retrieving a device’s OID, refer to section How to get a managed device OID?.

RESPONSE

{
  "id": 3,
  "result": [
    {
      "data": {
        "FGVMMLREDACTED42": {
          "build": 8152,
          "device": "dev_001",
          "psirt": [
            {
              "cve": [
                "CVE-2024-52963"
              ],
              "cvss3": {
                "cvss3_base_score": "3.5",
                "cvss3_scoring_vector": "AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L/E:F/RL:W/RC:C&version=3.1"
              },
              "description": "An Out-of-bounds Write in FortiOS IPSEC daemon may allow an unauthenticated attacker to perform a denial of service under certains conditions that are outside the control of the attacker.",
              "impacted_products": {
                "FortiOS": [
                  {
                    "major": "7",
                    "minor": "6",
                    "patch": "0"
                  },
                  {
                    "major": "7",
                    "minor": "4",
                    "patch": "7"
                  },
                  {
                    "major": "7",
                    "minor": "4",
                    "patch": "6"
                  },
                  {
                    "major": "7",
                    "minor": "4",
                    "patch": "5"
                  },
                  {
                    "major": "7",
                    "minor": "4",
                    "patch": "4"
                  },
                  {
                    "major": "7",
                    "minor": "4",
                    "patch": "3"
                  },
                  {
                    "major": "7",
                    "minor": "4",
                    "patch": "2"
                  },
                  {
                    "major": "7",
                    "minor": "4",
                    "patch": "1"
                  },
                  {
                    "major": "7",
                    "minor": "4",
                    "patch": "0"
                  },
                  {
                    "major": "7",
                    "minor": "2",
                    "patch": "10"
                  },
                  {
                    "major": "7",
                    "minor": "2",
                    "patch": "9"
                  },
                  {
                    "major": "7",
                    "minor": "2",
                    "patch": "8"
                  },
                  {
                    "major": "7",
                    "minor": "2",
                    "patch": "7"
                  },
                  {
                    "major": "7",
                    "minor": "2",
                    "patch": "6"
                  },
                  {
                    "major": "7",
                    "minor": "2",
                    "patch": "5"
                  },
                  {
                    "major": "7",
                    "minor": "2",
                    "patch": "4"
                  },
                  {
                    "major": "7",
                    "minor": "2",
                    "patch": "3"
                  },
                  {
                    "major": "7",
                    "minor": "2",
                    "patch": "2"
                  },
                  {
                    "major": "7",
                    "minor": "2",
                    "patch": "1"
                  },
                  {
                    "major": "7",
                    "minor": "2",
                    "patch": "0"
                  },
                  {
                    "major": "7",
                    "minor": "0",
                    "patch": "17"
                  },
                  {
                    "major": "7",
                    "minor": "0",
                    "patch": "16"
                  },
                  {
                    "major": "7",
                    "minor": "0",
                    "patch": "15"
                  },
                  {
                    "major": "7",
                    "minor": "0",
                    "patch": "14"
                  },
                  {
                    "major": "7",
                    "minor": "0",
                    "patch": "13"
                  },
                  {
                    "major": "7",
                    "minor": "0",
                    "patch": "12"
                  },
                  {
                    "major": "7",
                    "minor": "0",
                    "patch": "11"
                  },
                  {
                    "major": "7",
                    "minor": "0",
                    "patch": "10"
                  },
                  {
                    "major": "7",
                    "minor": "0",
                    "patch": "9"
                  },
                  {
                    "major": "7",
                    "minor": "0",
                    "patch": "8"
                  },
                  {
                    "major": "7",
                    "minor": "0",
                    "patch": "7"
                  },
                  {
                    "major": "7",
                    "minor": "0",
                    "patch": "6"
                  },
                  {
                    "major": "7",
                    "minor": "0",
                    "patch": "5"
                  },
                  {
                    "major": "7",
                    "minor": "0",
                    "patch": "4"
                  },
                  {
                    "major": "7",
                    "minor": "0",
                    "patch": "3"
                  },
                  {
                    "major": "7",
                    "minor": "0",
                    "patch": "2"
                  },
                  {
                    "major": "7",
                    "minor": "0",
                    "patch": "1"
                  },
                  {
                    "major": "7",
                    "minor": "0",
                    "patch": "0"
                  },
                  {
                    "major": "6",
                    "minor": "4",
                    "patch": "15"
                  },
                  {
                    "major": "6",
                    "minor": "4",
                    "patch": "14"
                  },
                  {
                    "major": "6",
                    "minor": "4",
                    "patch": "13"
                  },
                  {
                    "major": "6",
                    "minor": "4",
                    "patch": "12"
                  },
                  {
                    "major": "6",
                    "minor": "4",
                    "patch": "11"
                  },
                  {
                    "major": "6",
                    "minor": "4",
                    "patch": "10"
                  },
                  {
                    "major": "6",
                    "minor": "4",
                    "patch": "9"
                  },
                  {
                    "major": "6",
                    "minor": "4",
                    "patch": "8"
                  },
                  {
                    "major": "6",
                    "minor": "4",
                    "patch": "7"
                  },
                  {
                    "major": "6",
                    "minor": "4",
                    "patch": "6"
                  },
                  {
                    "major": "6",
                    "minor": "4",
                    "patch": "5"
                  },
                  {
                    "major": "6",
                    "minor": "4",
                    "patch": "4"
                  },
                  {
                    "major": "6",
                    "minor": "4",
                    "patch": "3"
                  },
                  {
                    "major": "6",
                    "minor": "4",
                    "patch": "2"
                  },
                  {
                    "major": "6",
                    "minor": "4",
                    "patch": "1"
                  },
                  {
                    "major": "6",
                    "minor": "4",
                    "patch": "0"
                  }
                ]
              },
              "ir_number": "FG-IR-24-373",
              "products": {
                "FortiOS": [
                  {
                    "maximum_version": "7.2.10",
                    "minimum_version": "6.4.0",
                    "upgrade_to": "7.2.11"
                  },
                  {
                    "maximum_version": "7.4.7",
                    "minimum_version": "7.4.0",
                    "upgrade_to": "7.4.8"
                  },
                  {
                    "maximum_version": "7.6.0",
                    "minimum_version": "7.6.0",
                    "upgrade_to": "7.6.1"
                  }
                ]
              },
              "risk": 2,
              "summary": "",
              "threat_severity": "Low",
              "title": "Out-of-bounds Write in IPSEC Daemon"
            }
          ],
          "type": "fos",
          "version": "7.4.5"
        }
      },
      "url": "/pm/config/adom/demo/_psirt/data"
    }
  ]
}

You can also ask for the vulnerabilities of all managed devices belonging to the grp_001 device group in the demo ADOM:

REQUEST

{
  "id": 3,
  "method": "get",
  "params": [
    {
      "scope member": [
        {
          "name": "grp_001"
        }
      ],
      "url": "/pm/config/adom/demo/_psirt/data"
    }
  ],
  "session": "{{session}}",
  "verbose": 1
}

RESPONSE

{
  "id": 3,
  "result": [
    {
      "data": {
        "FGVMMLREDACTED40": {
          "build": 8152,
          "device": "dev_001",
          "psirt": [
            {
              "cve": [
                "CVE-2024-52963"
              ],
              "cvss3": {
                "cvss3_base_score": "3.5",
                "cvss3_scoring_vector": "AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L/E:F/RL:W/RC:C&version=3.1"
              },
              "description": "An Out-of-bounds Write in FortiOS IPSEC daemon may allow an unauthenticated attacker to perform a denial of service under certains conditions that are outside the control of the attacker.",
              "impacted_products": {
                "FortiOS": [
                  {
                    "major": "7",
                    "minor": "6",
                    "patch": "0"
                  },
                  {
                    "major": "7",
                    "minor": "4",
                    "patch": "7"
                  },
                  {
                    "major": "7",
                    "minor": "4",
                    "patch": "6"
                  },
                  {
                    "major": "7",
                    "minor": "4",
                    "patch": "5"
                  },
                  {
                    "major": "7",
                    "minor": "4",
                    "patch": "4"
                  },
                  {
                    "major": "7",
                    "minor": "4",
                    "patch": "3"
                  },
                  {
                    "major": "7",
                    "minor": "4",
                    "patch": "2"
                  },
                  {
                    "major": "7",
                    "minor": "4",
                    "patch": "1"
                  },
                  {
                    "major": "7",
                    "minor": "4",
                    "patch": "0"
                  },
                  {
                    "major": "7",
                    "minor": "2",
                    "patch": "10"
                  },
                  {
                    "major": "7",
                    "minor": "2",
                    "patch": "9"
                  },
                  {
                    "major": "7",
                    "minor": "2",
                    "patch": "8"
                  },
                  {
                    "major": "7",
                    "minor": "2",
                    "patch": "7"
                  },
                  {
                    "major": "7",
                    "minor": "2",
                    "patch": "6"
                  },
                  {
                    "major": "7",
                    "minor": "2",
                    "patch": "5"
                  },
                  {
                    "major": "7",
                    "minor": "2",
                    "patch": "4"
                  },
                  {
                    "major": "7",
                    "minor": "2",
                    "patch": "3"
                  },
                  {
                    "major": "7",
                    "minor": "2",
                    "patch": "2"
                  },
                  {
                    "major": "7",
                    "minor": "2",
                    "patch": "1"
                  },
                  {
                    "major": "7",
                    "minor": "2",
                    "patch": "0"
                  },
                  {
                    "major": "7",
                    "minor": "0",
                    "patch": "17"
                  },
                  {
                    "major": "7",
                    "minor": "0",
                    "patch": "16"
                  },
                  {
                    "major": "7",
                    "minor": "0",
                    "patch": "15"
                  },
                  {
                    "major": "7",
                    "minor": "0",
                    "patch": "14"
                  },
                  {
                    "major": "7",
                    "minor": "0",
                    "patch": "13"
                  },
                  {
                    "major": "7",
                    "minor": "0",
                    "patch": "12"
                  },
                  {
                    "major": "7",
                    "minor": "0",
                    "patch": "11"
                  },
                  {
                    "major": "7",
                    "minor": "0",
                    "patch": "10"
                  },
                  {
                    "major": "7",
                    "minor": "0",
                    "patch": "9"
                  },
                  {
                    "major": "7",
                    "minor": "0",
                    "patch": "8"
                  },
                  {
                    "major": "7",
                    "minor": "0",
                    "patch": "7"
                  },
                  {
                    "major": "7",
                    "minor": "0",
                    "patch": "6"
                  },
                  {
                    "major": "7",
                    "minor": "0",
                    "patch": "5"
                  },
                  {
                    "major": "7",
                    "minor": "0",
                    "patch": "4"
                  },
                  {
                    "major": "7",
                    "minor": "0",
                    "patch": "3"
                  },
                  {
                    "major": "7",
                    "minor": "0",
                    "patch": "2"
                  },
                  {
                    "major": "7",
                    "minor": "0",
                    "patch": "1"
                  },
                  {
                    "major": "7",
                    "minor": "0",
                    "patch": "0"
                  },
                  {
                    "major": "6",
                    "minor": "4",
                    "patch": "15"
                  },
                  {
                    "major": "6",
                    "minor": "4",
                    "patch": "14"
                  },
                  {
                    "major": "6",
                    "minor": "4",
                    "patch": "13"
                  },
                  {
                    "major": "6",
                    "minor": "4",
                    "patch": "12"
                  },
                  {
                    "major": "6",
                    "minor": "4",
                    "patch": "11"
                  },
                  {
                    "major": "6",
                    "minor": "4",
                    "patch": "10"
                  },
                  {
                    "major": "6",
                    "minor": "4",
                    "patch": "9"
                  },
                  {
                    "major": "6",
                    "minor": "4",
                    "patch": "8"
                  },
                  {
                    "major": "6",
                    "minor": "4",
                    "patch": "7"
                  },
                  {
                    "major": "6",
                    "minor": "4",
                    "patch": "6"
                  },
                  {
                    "major": "6",
                    "minor": "4",
                    "patch": "5"
                  },
                  {
                    "major": "6",
                    "minor": "4",
                    "patch": "4"
                  },
                  {
                    "major": "6",
                    "minor": "4",
                    "patch": "3"
                  },
                  {
                    "major": "6",
                    "minor": "4",
                    "patch": "2"
                  },
                  {
                    "major": "6",
                    "minor": "4",
                    "patch": "1"
                  },
                  {
                    "major": "6",
                    "minor": "4",
                    "patch": "0"
                  }
                ]
              },
              "ir_number": "FG-IR-24-373",
              "products": {
                "FortiOS": [
                  {
                    "maximum_version": "7.2.10",
                    "minimum_version": "6.4.0",
                    "upgrade_to": "7.2.11"
                  },
                  {
                    "maximum_version": "7.4.7",
                    "minimum_version": "7.4.0",
                    "upgrade_to": "7.4.8"
                  },
                  {
                    "maximum_version": "7.6.0",
                    "minimum_version": "7.6.0",
                    "upgrade_to": "7.6.1"
                  }
                ]
              },
              "risk": 2,
              "summary": "",
              "threat_severity": "Low",
              "title": "Out-of-bounds Write in IPSEC Daemon"
            }
          ],
          "type": "fos",
          "version": "7.4.5"
        },
        "FGVMMLREDACTED42": {
          "build": 8152,
          "device": "dev_002",
          "psirt": [
            {
              "cve": [
                "CVE-2024-52963"
              ],
              "cvss3": {
                "cvss3_base_score": "3.5",
                "cvss3_scoring_vector": "AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L/E:F/RL:W/RC:C&version=3.1"
              },
              "description": "An Out-of-bounds Write in FortiOS IPSEC daemon may allow an unauthenticated attacker to perform a denial of service under certains conditions that are outside the control of the attacker.",
              "impacted_products": {
                "FortiOS": [
                  {
                    "major": "7",
                    "minor": "6",
                    "patch": "0"
                  },
                  {
                    "major": "7",
                    "minor": "4",
                    "patch": "7"
                  },
                  {
                    "major": "7",
                    "minor": "4",
                    "patch": "6"
                  },
                  {
                    "major": "7",
                    "minor": "4",
                    "patch": "5"
                  },
                  {
                    "major": "7",
                    "minor": "4",
                    "patch": "4"
                  },
                  {
                    "major": "7",
                    "minor": "4",
                    "patch": "3"
                  },
                  {
                    "major": "7",
                    "minor": "4",
                    "patch": "2"
                  },
                  {
                    "major": "7",
                    "minor": "4",
                    "patch": "1"
                  },
                  {
                    "major": "7",
                    "minor": "4",
                    "patch": "0"
                  },
                  {
                    "major": "7",
                    "minor": "2",
                    "patch": "10"
                  },
                  {
                    "major": "7",
                    "minor": "2",
                    "patch": "9"
                  },
                  {
                    "major": "7",
                    "minor": "2",
                    "patch": "8"
                  },
                  {
                    "major": "7",
                    "minor": "2",
                    "patch": "7"
                  },
                  {
                    "major": "7",
                    "minor": "2",
                    "patch": "6"
                  },
                  {
                    "major": "7",
                    "minor": "2",
                    "patch": "5"
                  },
                  {
                    "major": "7",
                    "minor": "2",
                    "patch": "4"
                  },
                  {
                    "major": "7",
                    "minor": "2",
                    "patch": "3"
                  },
                  {
                    "major": "7",
                    "minor": "2",
                    "patch": "2"
                  },
                  {
                    "major": "7",
                    "minor": "2",
                    "patch": "1"
                  },
                  {
                    "major": "7",
                    "minor": "2",
                    "patch": "0"
                  },
                  {
                    "major": "7",
                    "minor": "0",
                    "patch": "17"
                  },
                  {
                    "major": "7",
                    "minor": "0",
                    "patch": "16"
                  },
                  {
                    "major": "7",
                    "minor": "0",
                    "patch": "15"
                  },
                  {
                    "major": "7",
                    "minor": "0",
                    "patch": "14"
                  },
                  {
                    "major": "7",
                    "minor": "0",
                    "patch": "13"
                  },
                  {
                    "major": "7",
                    "minor": "0",
                    "patch": "12"
                  },
                  {
                    "major": "7",
                    "minor": "0",
                    "patch": "11"
                  },
                  {
                    "major": "7",
                    "minor": "0",
                    "patch": "10"
                  },
                  {
                    "major": "7",
                    "minor": "0",
                    "patch": "9"
                  },
                  {
                    "major": "7",
                    "minor": "0",
                    "patch": "8"
                  },
                  {
                    "major": "7",
                    "minor": "0",
                    "patch": "7"
                  },
                  {
                    "major": "7",
                    "minor": "0",
                    "patch": "6"
                  },
                  {
                    "major": "7",
                    "minor": "0",
                    "patch": "5"
                  },
                  {
                    "major": "7",
                    "minor": "0",
                    "patch": "4"
                  },
                  {
                    "major": "7",
                    "minor": "0",
                    "patch": "3"
                  },
                  {
                    "major": "7",
                    "minor": "0",
                    "patch": "2"
                  },
                  {
                    "major": "7",
                    "minor": "0",
                    "patch": "1"
                  },
                  {
                    "major": "7",
                    "minor": "0",
                    "patch": "0"
                  },
                  {
                    "major": "6",
                    "minor": "4",
                    "patch": "15"
                  },
                  {
                    "major": "6",
                    "minor": "4",
                    "patch": "14"
                  },
                  {
                    "major": "6",
                    "minor": "4",
                    "patch": "13"
                  },
                  {
                    "major": "6",
                    "minor": "4",
                    "patch": "12"
                  },
                  {
                    "major": "6",
                    "minor": "4",
                    "patch": "11"
                  },
                  {
                    "major": "6",
                    "minor": "4",
                    "patch": "10"
                  },
                  {
                    "major": "6",
                    "minor": "4",
                    "patch": "9"
                  },
                  {
                    "major": "6",
                    "minor": "4",
                    "patch": "8"
                  },
                  {
                    "major": "6",
                    "minor": "4",
                    "patch": "7"
                  },
                  {
                    "major": "6",
                    "minor": "4",
                    "patch": "6"
                  },
                  {
                    "major": "6",
                    "minor": "4",
                    "patch": "5"
                  },
                  {
                    "major": "6",
                    "minor": "4",
                    "patch": "4"
                  },
                  {
                    "major": "6",
                    "minor": "4",
                    "patch": "3"
                  },
                  {
                    "major": "6",
                    "minor": "4",
                    "patch": "2"
                  },
                  {
                    "major": "6",
                    "minor": "4",
                    "patch": "1"
                  },
                  {
                    "major": "6",
                    "minor": "4",
                    "patch": "0"
                  }
                ]
              },
              "ir_number": "FG-IR-24-373",
              "products": {
                "FortiOS": [
                  {
                    "maximum_version": "7.2.10",
                    "minimum_version": "6.4.0",
                    "upgrade_to": "7.2.11"
                  },
                  {
                    "maximum_version": "7.4.7",
                    "minimum_version": "7.4.0",
                    "upgrade_to": "7.4.8"
                  },
                  {
                    "maximum_version": "7.6.0",
                    "minimum_version": "7.6.0",
                    "upgrade_to": "7.6.1"
                  }
                ]
              },
              "risk": 2,
              "summary": "",
              "threat_severity": "Low",
              "title": "Out-of-bounds Write in IPSEC Daemon"
            }
          ],
          "type": "fos",
          "version": "7.4.5"
        }
      },
      "url": "/pm/config/adom/demo/_psirt/data"
    }
  ]
}

Ultimately, you can use the All_FortiGate pre-defined device group to get the vulnerabilities of all managed FortiGate devices in the demo ADOM:

REQUEST

{
  "id": 3,
  "method": "get",
  "params": [
    {
      "scope member": [
        {
          "name": "All_FortiGate"
        }
      ],
      "url": "/pm/config/adom/demo/_psirt/data"
    }
  ],
  "session": "{{session}}",
  "verbose": 1
}

Some other URLs to explore:

/pm/config/adom/{adom}/_psirt/data/fap
/pm/config/adom/{adom}/_psirt/data/fsw
/pm/config/adom/{adom}/_psirt/data/fmg

For instance:

REQUEST

{
  "id": 3,
  "method": "get",
  "params": [
     {
       "url": "pm/config/adom/demo/_psirt/data/fap",
       "scope member": [
         {
           "name": "All_FortiGate"
         }
       ]
     }
  ],
  "session": "{{session}}",
  "verbose": 1
}

8.44. Per-device mapping for a specific managed device#

To get the normalized interfaces mapped to a specific managed device see section How to get the metadata mapped to a specific managed device?.

To get the metadata mapped to a specific managed device see section How to get the metadata mapped to a specific managed device?.

8.45. How to run CLI commands against a managed device?#

Caught in #1155085, #1072897 and #1133627.

Warning

Not yet supported

The following example shows how to run CLI commands against the dev_001 and its root VDOM:

REQUEST

{
  "id": 3,
  "method": "exec",
  "params": [
    {
      "data": {
        "command": [
          "diagnose sys filter addr 10.0.0.1",
          "diagnose sys session list"
        ],
        "device": "dev_001",
        "vdom": "root"
      },
      "url": "/deployment/run/cmd"
    }
  ],
  "session": "{{session}}"
}

RESPONSE

{
  "id": 3,
  "result": [
    {
      "status": {
        "code": -11,
        "message": "No permission for the resource"
      },
      "url": "/deployment/run/cmd"
    }
  ]
}

Note

Not all CLI commands are supported and FortiManager will only authorize the ones matching an internal hardocded list. Few commands that should work:

diagnose vpn ike config list

diagnose sys session filter src 172.16.205.100
diagnose sys session filter dst 172.16.202.2
diagnose sys session list

execute factoryreset-for-central-management

execute replace-device fortiap FP433G0000000001 FP433G0000000002

8.46. Onboarding Rules#

8.46.1. How to create a new onboarding rule?#

Here is a polished version:

The following example shows how to create a new auto-onboarding rule. It matches all devices with the FortiGate-30G platform that present the project_001_psk pre-shared key (PSK). Matching devices are placed in the demo ADOM and are upgraded if they are not already running firmware version 7.4.11. The project_001_tmplgrp template group and the project_001_pkg policy package are then applied to these devices. Finally, their device names are prefixed with dev_.

REQUEST

{
  "id": 3,
  "method": "add",
  "params": [
    {
      "data": {
        "adom": "demo",
        "desc": "Auto Onboarding Rule for Project #00001.",
        "devgrp": "project_001_grp",
        "imgver": "7.4.11-b2878",
        "instcfg": 2,
        "instlic": 0,
        "maxdev": 10,
        "nameprefix": "dev_",
        "platform": "FortiGate-30G",
        "ppkg": "project_001_ppkg",
        "psk": "project_001_psk",
        "ruleid": 0,
        "status": 0,
        "tmplgrp": "project_001_tmplgrp",
        "type": 0
      },
      "url": "/dvmdb/autoreg_rule"
    }
  ],
  "session": "{{session}}"
}

Note

status: 0 means the onboarding rule is enabled; use 1 to disable it.
type: 1 means the API user’s API key is used as the PSK, in which case you must specify the API username with the regadmin attribute; 0 means you provide your own PSK using the psk attribute.
instlic: 1 means the Flex Connector specified by the flexvm attribute is used; 2 is for a BYOL license, in which case you must specify a license pool using the licpool attribute; 0 means the device does not need to be licensed.
instcfg: 1 means FortiManager uses all templates and the Policy Package associated with the device group specified by the devgrp attribute; 2 means you must explicitly select the Template Group (tmplgrp) and the policy package (ppkg`).

RESPONSE

{
  "id": 3,
  "result": [
    {
      "data": {
        "ruleid": 1
      },
      "status": {
        "code": 0,
        "message": "OK"
      },
      "url": "/dvmdb/autoreg_rule"
    }
  ]
}

8.46.2. How to get onboarding rules?#

The following example shows how to get existing onboarding rules:

REQUEST

{
  "id": 3,
  "method": "get",
  "params": [
    {
      "url": "/dvmdb/autoreg_rule"
    }
  ],
  "session": "{{session}}",
  "verbose": 1
}

RESPONSE

{
  "id": 3,
  "result": [
    {
      "data": [
        {
          "adom": "demo",
          "desc": "Auto Onboarding Rule for Project #00001.",
          "devgrp": "project_001_grp",
          "flags": 0,
          "flexvm": null,
          "imgver": "7.4.11-b2878",
          "instcfg": 2,
          "instlic": 0,
          "licpool": null,
          "maxdev": 10,
          "nameprefix": "dev_",
          "oid": 1226,
          "platform": "FortiGate-30G",
          "ppkg": "project_001_ppkg",
          "psk": "project_001_psk",
          "regadmin": null,
          "ruleid": 1,
          "seq": 1,
          "snmask": null,
          "status": 0,
          "tmplgrp": "project_001_tmplgrp",
          "type": 0
        },
        {
          "adom": "demo",
          "desc": "Auto Onboarding Rule for Project #00002.",
          "devgrp": "project_002_grp",
          "flags": 0,
          "flexvm": "",
          "imgver": "7.4.11-b2878",
          "instcfg": 2,
          "instlic": 0,
          "licpool": "",
          "maxdev": 10,
          "nameprefix": "dev_",
          "oid": 1227,
          "platform": "FortiGate-30G",
          "ppkg": "project_002_ppkg",
          "psk": "project_002_psk",
          "regadmin": "",
          "ruleid": 2,
          "seq": 2,
          "snmask": null,
          "status": 0,
          "tmplgrp": "project_002_tmplgrp",
          "type": 0
        }
      ],
      "status": {
        "code": 0,
        "message": "OK"
      },
      "url": "/dvmdb/autoreg_rule"
    }
  ]
}

8.46.3. How to delete an onboarding rule?#

The following example shows how to delete the onboarding rule with ruleid 2:

REQUEST

{
  "id": 3,
  "method": "delete",
  "params": [
    {
      "url": "/dvmdb/autoreg_rule/2"
    }
  ],
  "session": "{{session}}"
}

RESPONSE

{
  "id": 3,
  "result": [
    {
      "status": {
        "code": 0,
        "message": "OK"
      },
      "url": "/dvmdb/autoreg_rule/2"
    }
  ]
}

Device Management

Contents

8. Device Management#

8.1. How to get a managed device OID?#

8.2. How to rename a managed device?#

8.2.1. Using /dvmdb/device/<device>#

8.2.2. Using /dvmdb/adom/<adom>/device/<device>#

8.3. Device status#

8.3.1. Policy Package Status for Managed devices#

8.4. How to refresh a device?#

8.4.1. Refresh one device#

8.4.2. Refresh multiple devices#

8.5. Device timezone#

8.5.1. How to get the list of available timezones?#

8.6. Device coordinates#

8.7. How to get the full device database syntax?#

8.8. How to get the list of devices?#

8.8.1. How to get all managed devices?#

8.8.2. How to get managed devices for a specific ADOM?#

8.8.3. How to get list of managed devices for all ADOMs?#

8.8.4. How to get unauthorized devices?#

8.9. Real Device#

8.9.1. How to add a real device?#

8.9.2. How to add a real device in a Fabric of FortiManager?#

8.10. How to change the serial number of a managed device?#

8.11. How to promote/authorize a real device?#

8.12. Model Device#

8.12.1. How to obtain the list of supported Model Device?#

8.12.2. How to create a Model Device?#

8.12.2.1. Stop using the flags attribute#

8.12.2.2. For a virtual appliance#

8.12.2.3. For a hardware appliance#

8.12.3. How to create a Model Device and add in in a group with a single request?#

8.12.4. How to add a Model Device assigned to a Policy Package?#

8.12.5. How to add a Model Device with firmware enforcement enabled?#

8.12.6. How to add a Model Device with the backup_mode flag enabled?#

8.12.7. How to add a SD-WAN Model Device?#

8.12.8. How to add a list of Model Device?#

8.12.9. Auto-link management#

8.12.9.1. How to enable the auto-link flag on a Model Device?#

8.12.9.2. How to disable the auto-link flag on a Model Device?#

8.12.9.3. Multiplexing example#

8.12.9.4. How to get the list of Model Devices which are ready for auto-link?#

8.12.9.5. How to get the list of Model Devices which are not ready for auto-link?#

8.12.10. How to enable VDOM on a Model Device?#

8.12.11. How to enable the need_reset flag on a model device?#

8.12.12. How to add a model device linked to a pre-Run CLI Template?#

8.12.13. How to get the list of Model Devices?#

8.13. How to get the ADOM a device belongs to?#

8.13.1. How to get the ADOM a device belongs to using object master with filter?#

8.13.2. How to get the ADOM a device belongs to using the extra info option?#

8.13.3. How to get the ADOM a device belongs to using _is_master attribute?#

8.14. How to trigger an Install Device Settings?#

8.15. How to trigger a Quick Install?#

8.16. Device Groups#

8.16.1. How to install device settings against a device group?#

8.16.2. How to create a device group?#

8.16.3. How to add a device in a device group?#

8.16.4. How to add multiple devices in a device group?#

8.16.5. How to add a device group into a device group?#

8.16.6. How to get the device group members?#

8.16.7. How to get all device groups a device belongs to?#

8.16.8. How to delete a device from a device group?#

8.16.9. How to delete multiple devices from a device group?#

8.16.10. How to delete a device group?#

8.17. How to delete a device?#

8.18. How to get device meta fields?#

8.19. Devce Meta Fields#

8.19.1. How to get specific device meta fields?#

8.19.2. How to set device’s meta fields?#

8.20. VDOM operations#

8.20.1. How to enable VDOM?#

8.20.2. How to add a NAT VDOM?#

8.20.2.1. Using /dvmdb/device endpoint#

8.20.2.2. Using /dvmdb/adom endpoint#

8.20.3. How to add a TP VDOM?#

8.20.4. How to assign a VDOM to an ADOM?#

8.20.5. How to assign an interface to a VDOM?#

8.20.6. How to get the interfaces assigned to a VDOM?#

8.20.7. How to create a VDOM link?#

8.12.6. How to add a Model Device with the `backup_mode` flag enabled?#

8.12.11. How to enable the `need_reset` flag on a model device?#

8.20.2.1. Using `/dvmdb/device` endpoint#

8.20.2.2. Using `/dvmdb/adom` endpoint#

8.31.1.3. How to add a Model HA Cluster with `session-pickup` up and `override` enabled?#