Fortinet FortiGate

Purpose

The FortiGate connector combines a read-only REST API administrator profile with SNMPv3 polling to collect firewall policy, VPN, firmware and interface exposure evidence — the same data source behind the KEV SSL-VPN attack-surface storyline.

Requirements

• FortiOS 7.x with REST API access enabled on the management interface
• A read-only administrator profile for API access
• SNMPv3 enabled for interface and system polling
• Management interface not exposed to the internet, or explicitly accepted as an exception

Permissions

• Administrator with a custom profile granting Read-Only access to Firewall, VPN, Network and Log & Report categories
• SNMPv3 user with authPriv for interface and system OID polling
• API token scoped to the read-only profile, generated under System > Administrators > REST API Admin

Setup

1. 1
   Create a read-only admin profile

   Under System > Admin Profiles, create a profile with Read-Only permission on Firewall, VPN, Network and Log & Report.
2. 2
   Create a REST API administrator

   Create a REST API Admin bound to that profile and restrict its trusted hosts to the AssurIQ collector's address.
3. 3
   Generate the API token

   Generate the API token and store it immediately in AssurIQ's Credential Vault (FortiGate shows it once).
4. 4
   Enable SNMPv3

   Configure an SNMPv3 user with authPriv matching the AssurIQ credential profile.
5. 5
   Add the device to AssurIQ

   Add the FortiGate management IP, API token and SNMPv3 credential under Integrations.
6. 6
   Verify exposure evidence

   Confirm the connector reports whether the management and SSL-VPN interfaces are internet-facing.

Verification

• FortiGate appears in Attack Surface with correct firmware version and internet-facing status
• Firewall policy and VPN configuration evidence appears in Evidence Vault
• AIQ-VM-001 reflects current KEV status for the installed firmware

Data collected

• Firmware version and available updates
• Firewall policy, VPN and interface configuration (read-only)
• Interface exposure (which interfaces face the internet)
• SNMP system and interface metrics

Security model

The REST API administrator profile is Read-Only across all categories and its trusted-host list is restricted to the AssurIQ collector's IP. SNMPv3 uses authPriv encryption. Neither credential can change firewall policy, and both are stored only in the Credential Vault.

Common errors

• AIQ-CRD-001Credentials failing
  Stored credentials were rejected by one or more targets.
• AIQ-SNMP-002SNMP authentication failed
  The credential profile was rejected by the device (bad community string or SNMPv3 auth/priv mismatch).

Troubleshooting

• If the connector reports the management interface as internet-facing unexpectedly, verify the trusted-host and local-in policy configuration on the FortiGate.
• If firmware evidence looks stale, confirm the device has checked in with FortiGuard for the latest advisory data.

Disconnect

1. Remove the FortiGate from AssurIQ Integrations.
2. Delete the REST API Admin and its token, and remove or rotate the SNMPv3 user on the device.