helpFetch Configuration - Support: sr #105958, configuring fetchconfig to get the...

 
 

sr #105958: configuring fetchconfig to get the configuration from a fortinet firewall

Submitted by:  None
Submitted on:  Thu 02 Aug 2007 06:02:31 PM UTC  
 
Category: NonePriority: 5 - Normal
Severity: 3 - NormalStatus: None
Privacy: PublicAssigned to: Doug Schaapveld <djschaap>
Originator Email: -unavailable-Open/Closed: Open
Operating System: GNU/Linux

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Fri 03 Aug 2007 01:57:06 AM UTC, comment #3:

Mike,

The only FortiGates I have access to are running some version of FortiOS 3.0. My experience with 2.8 is minimal (no experience with 2.5). If a simple "show" command after logging in (via ssh, telnet, or console) displays the entire config, fetchconfig should work.

If it doesn't work for you, it may 1) be a different chat sequence (wait for this, send this, etc.) or 2) require a different command to print the config. If you can capture this sequence (1) or find a working command (2) I'd be happy to merge it into the code.

Two limitations: Unfortunately, the "changes_only" option in the fetchconfigtab file isn't very useful with FortiGates. I've found they will print different password/crypto strings each time the config is retrieved. This is likely a security feature on Fortinet's part, but as a side effect makes it impossible for us to know for sure if the config has changed.

VDOMs are also not handled properly due to a plain "show" command not working as expected (but VDOMs are specific to 3.0 AFAIK).

Doug Schaapveld <djschaap>
Project MemberIn charge of this item.
Thu 02 Aug 2007 08:19:00 PM UTC, comment #2:

Doug, I'm assigning this to you, ok?

Everton da Silva Marques <evertonm>
Project Administrator
Thu 02 Aug 2007 08:17:21 PM UTC, comment #1:

I can't tell if the FortiGate.pm module will work for
other FortiOS revisions. (What do you think, Doug?)

Though I guess you could give it a try anyway.

There is the following sample configuration in the
file rpm/fetchconfigtab:

default: fortigate user=backup,pass=fran
default: fortigate timeout=10,keep=5
default: fortigate changes_only=0,fetch_timeout=30
default: fortigate repository=/var/fetchconfig

Hope this helps.

Cheers,
Everton

Everton da Silva Marques <evertonm>
Project Administrator
Thu 02 Aug 2007 06:02:31 PM UTC, original submission:

I would like to try to use fetchconfig to pull backup configurations from Fortinet firewalls. I have a couple of questions:

I notice in the docs that you only support FortiOS 3.0. Will this work on other Foritnet firmware revisions?

Can you give me an example of how to configure the device_table for a Foritnet?

What is the standard repository for a Fortinet configuration?

Thanks,

Mike Boll

Anonymous

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by djschaap (Posted a comment)
  • -unavailable- added by evertonm (Posted a comment)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follows 1 latest change.

    Date Changed By Updated Field Previous Value => Replaced By
    Thu 02 Aug 2007 08:19:00 PM UTCevertonmAssigned toNone=>djschaap

    Back to the top


    Powered by Savane 3.1-cleanup1