mainFetch Configuration - Support: sr #105958, configuring fetchconfig to get the...

 
 

sr #105958: configuring fetchconfig to get the configuration from a fortinet firewall

Submitter:  None
Submitted:  Thu 02 Aug 2007 06:02:31 PM UTC
   
 
Category:  None Priority:  5 - Normal
Severity:  3 - Normal Status:  None
Privacy:  Public Assigned to:  djschaap
Originator Email:  -email is unavailable- Open/Closed:  Open
Operating System:  GNU/Linux
* Mandatory Fields

Add a New Comment Rich Markup
   

Fri 03 Aug 2007 01:57:06 AM UTC, comment #3: 

Mike,

The only FortiGates I have access to are running some version of FortiOS 3.0.  My experience with 2.8 is minimal (no experience with 2.5).  If a simple "show" command after logging in (via ssh, telnet, or console) displays the entire config, fetchconfig should work.

If it doesn't work for you, it may 1) be a different chat sequence (wait for this, send this, etc.) or 2) require a different command to print the config.  If you can capture this sequence (1) or find a working command (2) I'd be happy to merge it into the code.

Two limitations:  Unfortunately, the "changes_only" option in the fetchconfigtab file isn't very useful with FortiGates.  I've found they will print different password/crypto strings each time the config is retrieved.  This is likely a security feature on Fortinet's part, but as a side effect makes it impossible for us to know for sure if the config has changed.

VDOMs are also not handled properly due to a plain "show" command not working as expected (but VDOMs are specific to 3.0 AFAIK).


Doug Schaapveld <djschaap>
Group Member
Thu 02 Aug 2007 08:19:00 PM UTC, comment #2: 

Doug, I'm assigning this to you, ok?

Everton da Silva Marques <evertonm>
Group administrator
Thu 02 Aug 2007 08:17:21 PM UTC, comment #1: 

I can't tell if the FortiGate.pm module will work for
other FortiOS revisions. (What do you think, Doug?)

Though I guess you could give it a try anyway.

There is the following sample configuration in the
file rpm/fetchconfigtab:

default:        fortigate       user=backup,pass=fran
default:        fortigate       timeout=10,keep=5
default:        fortigate       changes_only=0,fetch_timeout=30
default:        fortigate       repository=/var/fetchconfig

Hope this helps.

Cheers,
Everton

Everton da Silva Marques <evertonm>
Group administrator
Thu 02 Aug 2007 06:02:31 PM UTC, original submission:  

I would like to try to use fetchconfig to pull backup configurations from Fortinet firewalls.  I have a couple of questions:

I notice in the docs that you only support FortiOS 3.0.  Will this work on other Foritnet firmware revisions?

Can you give me an example of how to configure the device_table for a Foritnet?

What is the standard repository for a Fortinet configuration?

Thanks,

Mike Boll

Anonymous

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by djschaap (Posted a comment)
  • -email is unavailable- added by evertonm (Posted a comment)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

    Follows 1 latest change.

    Date Changed by Updated Field Previous Value => Replaced by
    2007-08-02 evertonm Assigned toNone djschaap

    Back to the top

    Powered by Savane 3.13-4448.
    Corresponding source code