Fortinet black logo

online help

6.0.2
7.0.4
7.0.3
7.0.2
7.0.1
7.0.0
6.2.2
6.2.1
6.2.0
6.0.3
6.0.2
6.0.1
6.0.0

Connect FortiGate device via API Token

Connect FortiGate device via API Token

FortiConverter can import configurations through REST-API. Each API request can use an API token to be authenticated.

An API token is generated by creating a new REST API admin on FortiGate GUI.

Requirements

Limitations on FortiGate API Token permission:
  • REST API admin user can not have the super_admin privilege, so we can not manipulate VDOMs or restore the configuration to the device through REST API.

With the restriction from FortiGate design, FortiConverter does not support two features with REST API.

  1. FortiConverter does not support FortiGate-to-FortiGate bulk conversion to the device, which uses API Token to authenticate.
  2. In FortiGate-to-FortiGate Device mode conversion, if you want to convert a multi-vdom configuration, before the conversion, you need to create each VDOM manually on FortiGate GUI and set the scope to global in API administrator profile.

Set up the global scope in the admin profile:
  1. Open the CLI console and make sure the device is in the multiple VDOM mode.
  2. config global

    show system accprofile <your permission profile>

    […]

    set scope global (It should be global)

    […]

Create new REST API admin

Step 1: Create an administrator profile

  1. On the FortiGate GUI, select System > Admin Profiles > Create New.
  2. Create a New Profile.
  3. Enter a profile name and enable all the Read/Write permissions. Please note the profile name, it will be used in Step 2.

  4. Click OK.

Step 2: Create a REST API Admin:

  1. On the FortiGate GUI, select System > Administrators > Create New > REST API Admin.

  2. Enter the API-user's name and select the profile name you created from Step 1.
  3. The trusted host must be specified to ensure that the machine of your FortiConverter installed can reach the FortiGate.

  4. Click OK and an API token will be generated.

  5. Make a note of the API token as it’s only shown once and cannot be retrieved.
  6. Click Close to complete creation of the REST API Admin.

Regenerate an API token for API-user:

In FortiGate GUI, go to System > Administrators.

  1. Edit your REST API admin user
  2. Click Regenerate.

In CLI console, use the CLI command below:

execute api-user generate-key [API user name]

The steps above must be performed from the FortiGate GUI as an administrator with the super_admin profile.
Next: Connecting FortiGate devices

Previous
Next

Connect FortiGate device via API Token

FortiConverter can import configurations through REST-API. Each API request can use an API token to be authenticated.

An API token is generated by creating a new REST API admin on FortiGate GUI.

Requirements

Limitations on FortiGate API Token permission:
  • REST API admin user can not have the super_admin privilege, so we can not manipulate VDOMs or restore the configuration to the device through REST API.

With the restriction from FortiGate design, FortiConverter does not support two features with REST API.

  1. FortiConverter does not support FortiGate-to-FortiGate bulk conversion to the device, which uses API Token to authenticate.
  2. In FortiGate-to-FortiGate Device mode conversion, if you want to convert a multi-vdom configuration, before the conversion, you need to create each VDOM manually on FortiGate GUI and set the scope to global in API administrator profile.

Set up the global scope in the admin profile:
  1. Open the CLI console and make sure the device is in the multiple VDOM mode.
  2. config global

    show system accprofile <your permission profile>

    […]

    set scope global (It should be global)

    […]

Create new REST API admin

Step 1: Create an administrator profile

  1. On the FortiGate GUI, select System > Admin Profiles > Create New.
  2. Create a New Profile.
  3. Enter a profile name and enable all the Read/Write permissions. Please note the profile name, it will be used in Step 2.

  4. Click OK.

Step 2: Create a REST API Admin:

  1. On the FortiGate GUI, select System > Administrators > Create New > REST API Admin.

  2. Enter the API-user's name and select the profile name you created from Step 1.
  3. The trusted host must be specified to ensure that the machine of your FortiConverter installed can reach the FortiGate.

  4. Click OK and an API token will be generated.

  5. Make a note of the API token as it’s only shown once and cannot be retrieved.
  6. Click Close to complete creation of the REST API Admin.

Regenerate an API token for API-user:

In FortiGate GUI, go to System > Administrators.

  1. Edit your REST API admin user
  2. Click Regenerate.

In CLI console, use the CLI command below:

execute api-user generate-key [API user name]

The steps above must be performed from the FortiGate GUI as an administrator with the super_admin profile.
Next: Connecting FortiGate devices

Previous
Next