Skip to main content

Integrate Internal Security with Fortinet FortiGate

Mark Glinski
  • Updated

In this article:

    We are currently building support for this integration. Contact your SecurityScorecard sales engineer for more information.

    Take the following integration steps to provide ISS Internal Security with necessary information to communicate with your Fortinet FortiGate firewall product.

    When integrated, Internal Security extracts the following information from FortiGate:

    • System firmware data
    • Anomalies in the system
    • Rate-based intrusion prevention signals
    • Intrusion prevention rules
    • Intrusion prevention global settings
    • Intrusion prevention sensor data
    • FortiGate routing table entry
    • FortiGate subnet data
    • Antivirus profiles
    • Control enforced on applications installed on systems behind FortiGate
    • Antivirus settings
    • Threat traffic
    • FortiGate security rating data
    • WAF Firewall profiles
    • WAF Firewall signatures
    • DNS filter settings and data

    Prepare for your integration

    Before configuring the integration do the following:

    1. Install Internal Security from Integrate360°: Marketplace. See ISS Internal Security module for guidance. 
    2. Make sure you have administrative permissions in FortiGate or access to an administrator.

    The Internal Security integration requires the following configuration values:

    Setting Description
    Access token (API key) A token provides permission to perform the GET request.
    Base product URL

    The public IP address and port number of the FortiGate installation.

    Note: It is only necessary to specify the port number if it is not 80 or 443.
    Note: Contact your internal Support or Engineering team if you are unable to provide the information required for this integration.

    Step 1: Create an API key

    Create a key that will provide Internal Security with read-only access to FortiGate data:

    1. Log into FortiGate.
    2. Select Administrators from the System tab.
    3. Select REST API Admin from the Create New drop-down list.

      iss-fortigate-new-rest-admin.png

    4. Enter a new username and select Create to make a new administrative profile.

      iss-fortigate-create-new-profile.png

    5. Set Read permissions for all access control settings and click OK.

      iss-fortigate-read-perms.png

    6. Select the newly created profile from the drop-down list.

      iss-fortigate-select-profile.png

      Note: Make sure the PKI Group and CORS Allow Origin profile settings are disabled.
    7. In the profile, click Regenerate for API Key.

      iss-fortigate-gen-key.png

    8. Copy the generated key for use in the next step. Then, click Close.

      iss-fortigate-copy-key.png

      Note: Make sure the administrator you created appears in the REST API Administrator table.

      iss-fortigate-new-admin.png

    Step 2: Add a FortiGate integration in Internal Security

    Provide Internal Security with the required information for communicating with FortiGate:

    1. In your Scorecard header, select the Internal Security tab. Then, select Internal Security again.

      iss-iss-internal-security-tab.png

    2. Click Add integrations.
    3. Select Fortinet FortiGate from the drop-down list.
    4. Enter the required information from the preceding step and then click Save Configuration:
      • The access token (API Key in FortiGate)
      • The base product URL for the API
        Note: Make sure to precede the URL with http:// or https://, depending on which protocol applies. Also, It is only necessary to specify the port number for the base product URL if it is not 80 or 443.
        iss-fortigate-ssc-settings.png

    Your new integration appears in a table on the Internal Security page.

    Note: Data for this integration will be available when we finish building support for it. See a list of the Internal Security product integrations we currently support.


    iss-internal-integrations-list-fortigate.png

    Note: Internal Security starts to provide data within 24 hours for each new integration as it syncs with SecurityScorecard's scanning and scoring cycles. 

    Additional documentation and resources

     

    Related articles