Helpful ReplyHot!Rest api usage

Page: 12 > Showing page 1 of 2
Author
kartofflarna
New Member
  • Total Posts : 8
  • Scores: 0
  • Reward points: 0
  • Joined: 2015/03/03 04:35:34
  • Status: offline
2017/01/11 06:16:29 (permalink)
0

Rest api usage

Hi,
 
I am setting up a new 30E firewall for a small office and for once I had some time on my hands so I thought I would play around a little bit with the rest API for learning purposes since it would help out with managing other firewalls.
 
So I read through the reference guide http://docs.fortinet.com/d/fortiweb-5.5-restful-api-reference which seems pretty straight forward. However I get stuck right from the bat.
 
testing out the initial example: curl -H "Authorization: YWRtaW46" -k "https://172.22.10.74:90/api/v1.0/System/Network/StaticRoute"
But I get no response.
 
The firewall arrived with fortios v5.4.1 which I think has api v2 so I tried changing the url accordingly but with no difference
I cannot find anywhere to verify which api version my firewall is using, also I am lacking information in the reference guide on weather I have to manually enable the api or not.
 
I'm sure I'm just missing something, can someone here see any obvious signs?
#1
kartofflarna
New Member
  • Total Posts : 8
  • Scores: 0
  • Reward points: 0
  • Joined: 2015/03/03 04:35:34
  • Status: offline
Re: Rest api usage 2017/01/12 23:59:39 (permalink)
0
That was a bad example I'm so frustrated I've been trying around with anything I can find on the web, that particular line and document is for the fortiweb appliance.

I'm starting to doubt the very existance of the rest api on the fortigate, does it exist or did I dream?
#2
kartofflarna
New Member
  • Total Posts : 8
  • Scores: 0
  • Reward points: 0
  • Joined: 2015/03/03 04:35:34
  • Status: offline
Re: Rest api usage 2017/01/13 00:32:43 (permalink)
0
So I found out it is working but I only have access from the browser on 
https://192.168.1.99/api/v2/monitor/system/interface

However I am not able to curl it with:


curl -H "Authorization: YWRtaW46" -k "https://192.168.1.99/api/v2/monitor/system/interface"
 
I get a 401 Authorization required
#3
kartofflarna
New Member
  • Total Posts : 8
  • Scores: 0
  • Reward points: 0
  • Joined: 2015/03/03 04:35:34
  • Status: offline
Re: Rest api usage 2017/01/13 01:35:04 (permalink)
0
All the admin guides I find seem to be off, I dont think the firewall accepts basic authentication, does anyone know the url to create an authentication token?
#4
pcraponi
Gold Member
  • Total Posts : 451
  • Scores: 26
  • Reward points: 0
  • Joined: 2006/07/28 11:43:39
  • Location: Brazil
  • Status: offline
Re: Rest api usage 2017/01/13 05:17:22 (permalink)
0
Hi,
 
Official API documentation is paid.... The product is "Fortinet Developer Network" https://www.fortinet.com/content/dam/fortinet/assets/data-sheets/Fortinet_Developer_Network.pdf
 
But... you can start accessing "/logincheck" on your fortigate device to generate the authentication token for the REST API ;)
 
 
Regards,
Paulo Raponi, NSE8
#5
kartofflarna
New Member
  • Total Posts : 8
  • Scores: 0
  • Reward points: 0
  • Joined: 2015/03/03 04:35:34
  • Status: offline
Re: Rest api usage 2017/01/13 06:07:58 (permalink)
0
hmm okay, will mess around with that some more initial test just gave me 302 error though.
#6
MikePruett
Platinum Member
  • Total Posts : 677
  • Scores: 17
  • Reward points: 0
  • Joined: 2014/01/08 19:39:40
  • Location: Montgomery, Al
  • Status: offline
Re: Rest api usage 2017/01/13 19:02:54 (permalink)
0
The API is wicked awesome and incredibly powerful. You have to have the developer network to get the great prebuilt tools etc that exist (saves you SO MUCH TIME).
 
I witnessed a wonderful demo of it at the Fortinet XTreme Team 2016 USA event.

Mike Pruett
Fortinet GURU
#7
chrisp
New Member
  • Total Posts : 3
  • Scores: 0
  • Reward points: 0
  • Joined: 2016/12/14 07:47:28
  • Status: offline
Re: Rest api usage 2017/04/25 06:51:10 (permalink)
0
the only way to use API is to pay ?
 
do I understand it correctly? 
if not why is it so difficult to find the correct format for curl with authentication?
 
 
 
#8
Baptiste
Gold Member
  • Total Posts : 160
  • Scores: 13
  • Reward points: 0
  • Status: offline
Re: Rest api usage 2017/04/25 07:22:45 (permalink)

FGT 100D 6.0.5 + FTK200
FGT 60E 5.6.7 & 6.0.4
FGT 40C 5.0.13
FAZ VM 6.2.0
FAP 210B/221C/223C/321C/421E
#9
arosenblatt
New Member
  • Total Posts : 13
  • Scores: 0
  • Reward points: 0
  • Joined: 2017/08/14 17:25:27
  • Status: offline
Re: Rest api usage 2017/08/22 12:36:12 (permalink)
0
So, I went to sign up for the FDN since I desperately need this API that doesn't appear to to be mentioned in any of the docs I've read. On the sign-up form is this:

"All new accounts require two Fortinet Sponsors. Sponsors are Fortinet employees that can confirm your identity and validate your need for an FNDN account. Please enter emails of your Sponsors in the fields below."

Are you kidding me?

I need Fortinet employee sponsorship (plus apparently paying, based on the PDF linked earlier in this thread) to gain access to the API docs and tools for the devices we've already purchased? I can't even find mention of the developer network on the main Fortinet web site. 

So, what's the next step here for a pleb like me?
#10
oheigl
Gold Member
  • Total Posts : 259
  • Scores: 10
  • Reward points: 0
  • Joined: 2010/02/18 04:27:05
  • Location: Austria
  • Status: offline
Re: Rest api usage 2017/08/23 00:30:08 (permalink)
5 (1)
Can't you ask your Fortinet Account Manager to provide you with it? I think getting these two sponsors shouldn't be too hard.
Also if you just want to access the API here is a link to a GIT repository where the access is implemented in python (it's managed by a Fortinet employee). Check out the fortiosapi.py regarding the connection to the API, and the testssh.py for examples on how to get information out of it.
I think this will help you more than any docs 
https://github.com/fortinet-solutions-cse/fortiosapi
 
#11
arosenblatt
New Member
  • Total Posts : 13
  • Scores: 0
  • Reward points: 0
  • Joined: 2017/08/14 17:25:27
  • Status: offline
Re: Rest api usage 2017/08/23 11:04:59 (permalink)
0
Alright, I have the API working now in an API tester. How long is the CSRF token good for before it expires?
 
For the person who was originally asking, the docs on the Fortinet site are indeed just plain wrong and it does not use a standard http auth header at all. the PDF linked earlier describes the correct method for authentication but it's not terribly clear in how it does so (and actually seems like it might be self-contradictory, even), so here's the skinny.


Start with a POST to /logincheck that has the fields 'username' and 'secretkey' as the POST data, with their appropriate admin username and password values set. This will return a cookie with the field ccsrftoken (yes, two 'c's). For your next request, ditch the auth post data and set the "X-CSRFTOKEN" http header to be the value of that cookie field, and you should be good to go. 
 
post edited by arosenblatt - 2017/08/23 12:32:21
#12
arosenblatt
New Member
  • Total Posts : 13
  • Scores: 0
  • Reward points: 0
  • Joined: 2017/08/14 17:25:27
  • Status: offline
Re: Rest api usage 2017/08/31 14:59:08 (permalink)
0
Follow-up:

Using my IDE's REST client, I'm able to do the auth process and get my CSRF token just fine. However, when I use cURL to do this programmatically, all of my cookie values come back as "0&260" (this might have actually been "0&0", as "%26" is the url-encoded form of "&"). I'm pretty much stuck now as I can;t seem to determine what's happening here. Any suggestions would be greatly appreciated.
#13
arosenblatt
New Member
  • Total Posts : 13
  • Scores: 0
  • Reward points: 0
  • Joined: 2017/08/14 17:25:27
  • Status: offline
Re: Rest api usage 2017/09/08 13:08:43 (permalink)
0
Well, despite my earlier comment, I'm having issues running GET calls against the API. The docs read as follows:


"If login is successful, the response will contain the authentication token in the APSCOOKIE cookie value. This cookie value must be included in any further requests."
 
They do not say how that value should be included. Also, there is no actual APSCOOKIE cookie value but there is a APSCOOKIE_4055590611 cookie value, which is what I'm using. I've tried sending it as both an X-APSCOOKIE header and as an APSCOOKIE request parameter but I get a 401 each time. 

So, any word on how the API expects it to be provided or are we just supposed to guess?
post edited by arosenblatt - 2017/09/08 16:02:11
#14
oheigl
Gold Member
  • Total Posts : 259
  • Scores: 10
  • Reward points: 0
  • Joined: 2010/02/18 04:27:05
  • Location: Austria
  • Status: offline
Re: Rest api usage 2017/09/11 00:18:56 (permalink)
0
I tried it right now and yeah the APSCOOKIE value has some "random" number attached to it. I sent the cookie value back the same way as I got it, with the full number and can query the monitor API just fine.
I'm not sure how you try it, but if you use for example the python request library and only want to use the monitor API, you don't have to do anything with these values. Just login with a session object and a post request, then send a GET request to the  monitor API.
s.post("https://ip:port/logincheck", data='username=admin&secretkey=password', verify=False)
result = s.get("https://ip:port/api/v2/monitor/firewall/policy/")

#15
ciccio81
New Member
  • Total Posts : 5
  • Scores: 0
  • Reward points: 0
  • Joined: 2016/01/20 14:14:51
  • Status: offline
Re: Rest api usage 2017/11/19 02:51:17 (permalink)
0
Hello everyone, not sure this thread is still active.

I'm experiencing some problems as well with the password based authentication...I get the 3 different cookies, I passed them back in a POST request to close a session:
 
POST /api/v2/monitor/firewall/session/close?vdom=root HTTP/1.1 Host: 10.20.0.1 User-Agent: XXXX Accept: text/html Cookie: ccsrftoken_10656386745237807568="DCE862FD87E523BEE641546449B5AF3C"; APSCOOKIE_10656386745237807568="Era%3D0%26Payload%3DYMNNBUoKmNoiinWPLyZGSE8b++PURX2fjApAJHICiNOs6nJg5nZWzpy6qZbt4oET%0AvqeYC839nOfmZIyC7KEXGHuS43fnJXVJFCZrhCnzkZt66ouxIwbzhgoNsIeeiDpP%0AIO+TLdDC%2FVi80I1EFfGAjYSiQ6Nckwrkh4Oau7Yi6K1Lhv3%2FH13hdi9S79fb5H8u%0A0SdhT0P8kB69%2FY8i7IWudw%3D%3D%0A%26AuthHash%3DbC4cjbd9fNwWXsuBcP2TvWYQH2YA%0A"; ccsrftoken="DCE862FD87E523BEE641546449B5AF3C" Content-Length: 87 Content-Type: application/json {'pro':"TCP", 'saddr':"172.16.4.21", 'daddr':"172.16.4.1", 'sport':2489, 'dport':135}
 
But I get an error back (here the debugging output from FortiOS):
 
[httpsd 282 - 1511087694     info] handle_req_v2_vdom[2522] -- new API request (action='close',path='firewall',name='session',vdom='root',user='admin')
[httpsd 282 - 1511087694    error] is_valid_csrf_token[2845] -- no CSRF token found
[httpsd 282 - 1511087694    error] api_monitor_execute_handler[2400] -- no valid CSRF token found
 
Bear in mind that GET's always get through, even without a CSRF token, so requesting "api/v2/monitor/user/banned/select/" will always work after having successfully submitted credentials to "/logincheck"
 
Did anyone managed to send the 3 cookies back properly?
 
Thanks!
#16
oheigl
Gold Member
  • Total Posts : 259
  • Scores: 10
  • Reward points: 0
  • Joined: 2010/02/18 04:27:05
  • Location: Austria
  • Status: offline
Re: Rest api usage 2017/11/21 00:33:10 (permalink)
0
I think your ccsrftoken cookie is wrong. At least for me it looks something like this, not with an underscore and a number as name:
ccsrftoken="C95D2......4A1D80"
Also GET requests don't need a ccsrftoken, only POST and PUT (configuration changes) requests need to have it.

EDIT: A never mind, seems it's further down and correct, hmmm
#17
markonans
New Member
  • Total Posts : 2
  • Scores: 0
  • Reward points: 0
  • Joined: 2016/10/19 15:05:59
  • Status: offline
Re: Rest api usage 2018/01/15 22:30:04 (permalink)
0
Working commands
curl -k -v -c fgt.txt -d username=admin -d secretkey=PASSWORD "https://192.168.128.2:4443/logincheck"
curl -k --cookie fgt.txt -i -H "Accept: application/json" -H "Content-Type: application/json" -X GET "https://192.168.128.2:4443/api/v2/monitor/router/ipv4/"
#18
nelis99
New Member
  • Total Posts : 2
  • Scores: 0
  • Reward points: 0
  • Joined: 2018/01/08 13:08:29
  • Status: offline
Re: Rest api usage 2018/05/29 10:41:43 (permalink) ☄ Helpfulby SteveG 2018/09/10 05:26:20
0
If anyone is interested here is a powershell call for it as well (@markonans tx for curl example to build from).


$fwaddress = "192.168.1.99"
$postParams = @{username='myadminacct';secretkey='PASSWORD'}
$request = Invoke-WebRequest -Headers $headers -Uri "https://$fwaddress/logincheck" -SessionVariable fgtSession -Method POST -Body $postParams
$headers = New-Object "System.Collections.Generic.Dictionary[[String],[String]]"
$headers.Add('Accept','application/json')
$headers.Add('Content-Type','application/json')
$request = Invoke-WebRequest -Headers $headers -Uri "https://$fwaddress/api/v2/monitor/router/ipv4/" -WebSession $fgtSession -Method GET
write-host $request.Content
post edited by nelis99 - 2018/05/29 10:43:20
#19
alk0v
New Member
  • Total Posts : 1
  • Scores: 0
  • Reward points: 0
  • Joined: 2018/07/10 03:04:37
  • Status: offline
Re: Rest api usage 2018/07/10 03:11:01 (permalink) ☄ Helpfulby SteveG 2018/09/10 05:26:46
0
Hi, all. Next example working with FG-300 v.5.4 and PHP
 
 
$fghost = "myfg.loc";
$fglogin = "admin";
$fgpass = "supersecret";
$url = 'https://'.$fghost.'/logincheck';
$data = array('username'=>$fglogin,'secretkey'=>$fgpass);
$post_data = http_build_query($data);
 
$curl_connection = curl_init($url);
 
curl_setopt($curl_connection, CURLOPT_SSL_VERIFYPEER, FALSE);
curl_setopt($curl_connection, CURLOPT_POST, TRUE);
curl_setopt($curl_connection, CURLOPT_POSTFIELDS, $post_data);
curl_setopt($curl_connection, CURLOPT_RETURNTRANSFER, TRUE);
curl_setopt($curl_connection, CURLOPT_HEADER, TRUE);
 
$response = curl_exec($curl_connection);
 
preg_match_all('/^Set-Cookie:\s*([^;]*)/mi', $response, $matches);
 
$curl_connection = curl_init('https://'.$fghost.'/api/v2/cmdb/firewall/vip/');
curl_setopt($curl_connection, CURLOPT_SSL_VERIFYPEER, FALSE);
curl_setopt($curl_connection, CURLOPT_COOKIE, $matches[1][0]);
$response = curl_exec($curl_connection);

echo ($responce);
 
curl_close($curl_connection);
 
#20
Page: 12 > Showing page 1 of 2
Jump to:
© 2019 APG vNext Commercial Version 5.5