Driver Support Document

Fortinet Fortigate appliances, OS version 3.x, 4.x, 5.x & Ruijie Firewall appliances, OS version 5.x

• Internal Driver Name: Fortigate
• Driver Package: Fortigate.rdp
  
• Driver Tier: 3
• Vendor: Fortinet
• Family: Fortinet Fortigate
• IPv6 Support: Not Supported

Show Tested Devices Grid

Driver Features Support Grid

General Access

Release Notes

Limited Support for FortiManager

FortiManager devices do not support the same kind of configuration as other Fortigate devices. As a result, tasks using configuration mode [Configuration deployment, Password deployment, etc.] are generally not supported on FortiManager platforms.

Feature support in VDOM mode

Some Fortigate devices under VDOM mode to not allow the use of commands that NA uses to run various diagnostics. Some features may not work in VDOM mode as a result.

Disabling context management

Fortigate devics support virtual domains (VDOMs) that can be managed as independent device contexts. The context management feature adds independent device entries for contexts on the device automatically by using the inventory diagnostic. This feature can be disabled by adding the access variable "disable_context" and setting it to true. Disabling the feature will disable any previously created virtual device entries and will result in the inability to directly manage contexts with NA. Changes will take effect the next time the NA Module Status diagnostic task is run.

return to top

Syslog Configuration and Change Detection

Release Notes

Syslog change detection unsupported

The Fortigate does not send syslog messages for admin login/logoff or configuration changes.

return to top

Retrieve Running Configuration

Release Notes

Differences in encryption keys

The device may store hashes of various private keys in the configuration, which change each time the configuration is retrieved. These differences are ignored during post-snapshot comparison, but can not be ignored in the line-by-line comparison of existing configurations. If other differences are in the configuration, these keys will also be shown as different, even though they do not represent a configuration change.

Differences between various protocols

The device reports its configuration slightly differently, when gathered by the available SCP, TFTP, and CLI methods. To obtain consistent results, ensure that the same protocol is used by selecting only those protocols in the Edit Device page.

Skip collection of global configuration

Fortigate devices contain two configuration data blocks, one collected from 'initial' mode at login and one collected in 'global' mode. By default, both are collected though only the initial mode can be deployed back to the device. To skip the collction of the 'global' configuration, set the device access variable 'skip_global' to true.

Do not collect full configuration

Fortigate devices collect the 'full' configuration (including default settings) by default. To disable the 'full' collection, set the device access variable "no_full" to "true". This setting only applies to the CLI- collected configuration.

return to top

Driver Discovery

Release Notes

More prompt causes an unexpected disconnection

Discovery tasks for Javascript drivers handle More prompts by using timeouts, which can cause problems with the third-party SSH client code, which interprets the timeout as a disconnection. There are two options to work around the problem. Setting the RCX option [<option name="Driver/Discovery/UsePollRead">true</option>] in site_options.rcx will effect the workaround for all affected devices. Alternatively, it could be applied to a single device by setting the device access variable "PollRead" to "true".

Wakeup Ctrl-U character can cause discovery to fail

Discovery tasks for Javascript drivers use wakeup characters are sent during device connection, to ensure that the device is responding. Normally, these characters do not echo to the console, but some devices may echo them. In this case, this causes the prompt detection phase to fail, which in turn can cause More prompts to not be handled properly, and discovery may fail. If these characters are echoed from the device [check the session log to see this], then set the device access variable "skip_ctrl_u" to skip the sending of the wakeup characters. Note that setting this option on a previously working device could cause discovery tasks to fail, but it only affects CLI discovery. SNMP discovery is unaffected.

return to top