Quarantine via FortiNAC action

Users can configure an automation stitch with the Quarantine via FortiNAC action with a Compromised Host or Incoming Webhook trigger. When the automation is triggered, the client PC will be quarantined and its MAC address is disabled in the configured FortiNAC.

In this example, the FortiNAC has been configured to join an enabled Security Fabric (see FortiNAC for more information).

The FortiNAC must also be configured to isolate disabled hosts:

• Endpoints connecting to FortiWiFi or wired ports on FortiGate:

  • See the requisite Configure FortiNAC section in the FortiGate Endpoint Management Integration Guide.

• Endpoints connecting to FortiAP:

  • Set the Dead End VLAN. See Model configuration.

• Endpoints connecting to FortiSwitch:

  • Set the Dead End VLAN. See Model configuration.

  • Add the switch to the physical address filtering group. See Systems groups and Modify a group.

To configure a FortiNAC quarantine automation stitch in the GUI:

1. Configure the automation stitch:
   1. Go to Security Fabric > Automation and click Create New.
   2. In the Trigger section, select Incoming Webhook.
   3. In the Action section, select Quarantine via FortiNAC.
   4. Click OK.

      

2. Create a new API user and generate the API key:
   1. Go to System > Administrators and click Create New > REST API Admin.
   2. Configure the settings as needed.

      

   3. Click OK. The New API key window opens.
   4. Copy the key to the clipboard and click Close.
   5. Click OK.
3. Add the API key to the automation stitch:
   1. Go to Security Fabric > Automation and edit the automation stitch created in step 1.
   2. Paste the key in the API admin key field.
   3. Click OK.

      

4. On a Linux PC accessible by the FortiGate, create a cURL request to trigger the automation stitch:

   root@pc56:~# curl -k -X POST -H 'Authorization: Bearer ckx7d9xdzzx14Nztd1Ncr701dpwwy9' --data '{ "srcip": "1.1.1.1", "mac":"00:0C:29:0B:A6:16", "fctuid": "A8BA0B12DA694E47BA4ADF24F8358E2F"}' https://172.17.48.225:4431/api/v2/monitor/system/automation-stitch/webhook/auto_webhook

5. In FortiOS, verify the automation stitch is triggered and the action is executed:
   1. Go to Log & Report > Events and select System Events to confirm that the stitch was activated.
   2. Go to Security Fabric > Automation to see the last time that the stitch was triggered.

      

   In FortiNAC, the Host View shows the status of the client PC. It is quarantined and its MAC address is disabled.

   

To configure a FortiNAC quarantine automation stitch in the CLI:

1. Configure the automation stitch:

   config system automation-action
       edit "auto_webhook_quarantine-fortinac"
           set action-type quarantine-fortinac
       next
   end

   config system automation-trigger
       edit "auto_webhook"
           set event-type incoming-webhook
       next
   end

   config system automation-stitch
       edit "auto_webhook"
           set trigger "auto_webhook"
           set action "auto_webhook_quarantine-fortinac"
       next
   end

2. Create a new API user and generate the API key:

   config system api-user
       edit "g-api-rw-user"
           set api-key ENC SH2SHFEtfJQ9OsfH/keh4kdULAp3V4ps7HkxBuDIzpR4Cmsckaa9wJ6kw28dFQ=
           set accprofile "super_admin"
           set vdom "root"
           config trusthost
               edit 1
                   set ipv4-trusthost 10.6.30.0 255.255.255.0
               next
           end
       next
   end

3. On a Linux PC accessible by the FortiGate, create a cURL request to trigger the automation stitch:

   root@pc56:~# curl -k -X POST -H 'Authorization: Bearer ckx7d9xdzzx14Nztd1Ncr701dpwwy9' --data '{ "srcip": "1.1.1.1", "mac":"00:0C:29:0B:A6:16", "fctuid": "A8BA0B12DA694E47BA4ADF24F8358E2F"}' https://172.17.48.225:4431/api/v2/monitor/system/automation-stitch/webhook/auto_webhook

4. In FortiOS, verify the automation stitch is triggered and the action is executed:

   # diagnose test application autod 2
   csf: enabled    root:yes
   version:1592949233 sync time:Tue Jun 23 15:03:15 2020
   
   total stitches activated: 1
   
   stitch: auto_webhook
           destinations: all
           trigger: auto_webhook
   
                   (id:15)service=auto_webhook
   
           local hit: 1 relayed to: 0 relayed from: 0
           actions:
                   auto_webhook_quarantine-fortinac type:quarantine-fortinac interval:0
                   
   date=2020-06-23 time=15:25:44 logdesc="Internal Message" path="system" name="automation-stitch" action="webhook" mkey="auto_webhook" srcip="1.1.1.1" mac="00:0C:29:0B:A6:16" fctuid="A8BA0B12DA694E47BA4ADF24F8358E2F" vdom="root" service="auto_webhook"
   
   date=2020-06-23 time=15:25:44 logid="0100046600" type="event" subtype="system" level="notice" vd="root" eventtime=1592951144401490054 tz="-0700" logdesc="Automation stitch triggered" stitch="auto_webhook" trigger="auto_webhook" stitchaction="auto_webhook_quarantine-fortinac" from="log" msg="stitch:auto_webhook is triggered."