fortigate
FortiGate: an infrastructure controller type, version 1. A controller of this type is written under controllers.infrastructure with type: fortigate.
Its connectivity test identifies the system it reaches by system.serial, so that a second controller for the same system is warned of.
Connection
In the controller’s connection:
endpoint(string, required): FortiGate base URL, e.g.https://fw-dc1.example.comapi_user(string): the REST API administrator the token belongs to, so validation can read its admin profile
Auth methods
The controller’s auth.method is one of these. A field marked secret comes only from the secret auth.credentials_ref names; the others are set in auth.config, or in that secret.
api_key
A REST API administrator’s token.
token(string, required, secret)
Capabilities
The controller enables each it uses in its capabilities list.
policy.disable
Disable the firewall policy; enable it again on unfence.
Category: actuator; bound as fence or shield; fencing level network; resource policy.
Validation checks: profile.fwgrp.write.
interface.down
Set the interface administratively down; up again on unfence. Refused for an interface on qfence’s own path to the firewall.
Category: actuator; bound as fence; fencing level network; resource interface.
Advertised once its setup is done: validation.
Validation checks: profile.netgrp.write, not-management-interface.
vlan.down
Set the VLAN interface administratively down; up again on unfence. Refused for a VLAN on qfence’s own path to the firewall.
Category: actuator; bound as fence; fencing level network; resource vlan.
Advertised once its setup is done: validation.
Validation checks: profile.netgrp.write, not-management-interface.
vip.own
Enable the virtual IP for the site that owns the plan.
Category: actuator; bound as service; resource vip.
Validation checks: profile.fwgrp.write.
route.own
Enable the static route for the site that owns the plan.
Category: actuator; bound as service; resource static-route.
Validation checks: profile.netgrp.write.
probe.ping
The firewall’s link monitor finds its servers alive on every interface it watches.
Category: observation; bound as readiness or health; resource link-monitor.
Advertised once its setup is done: validation.
Validation checks: profile.netgrp.read.
probe.service
The firewall’s health check finds the load-balancing real server up.
Category: observation; bound as readiness or health; resource real-server.
Advertised once its setup is done: validation.
Validation checks: profile.fwgrp.read.
policies.list
The firewall policies, by id.
Category: discovery; resource policy.
Validation checks: profile.fwgrp.read.
vips.list
The virtual IPs, by name.
Category: discovery; resource vip.
Validation checks: profile.fwgrp.read.
routes.list
The static routes, by sequence number.
Category: discovery; resource static-route.
Validation checks: profile.netgrp.read.
interfaces.list
The interfaces other than VLANs, by name.
Category: discovery; resource interface.
Validation checks: profile.netgrp.read.
vlans.list
The VLAN interfaces, by name.
Category: discovery; resource vlan.
Validation checks: profile.netgrp.read.
link-monitors.list
The link monitors, by name.
Category: discovery; resource link-monitor.
Validation checks: profile.netgrp.read.
real-servers.list
The real servers of the load-balancing virtual IPs, as <virtual server>/<id>.
Category: discovery; resource real-server.
Validation checks: profile.fwgrp.read.
Addresses
Every address the type contacts. A secret’s scope (-scope-host) is checked against each that receives credentials.
connection.endpoint(porturl, receives credentials): the FortiGate’s REST API, sent its token with every call