Fortigate automation with perl or python

Question

Goal
I'm trying to automate a fortigate configuration change for a couple dozen routers and am not winning. Have tried Python's paramiko library, Python fabric and Perl's expect and Rex interfaces/libraries.

Other info
* Routers: Fortigate 60D
* Firmware: v5.0,build0252 (GA Patch 5)
* SSH enabled: True

I can log in over SSH and run these commands manually!

I used the perl expect library with Fortigate 60B's in the past but it no longer works. Before I share the code I want to ask:

Is there some new feature in Fortigate's that prevents this type of automation?

A simple and harmless command to test [ list current dhcp leases ]:

execute dhcp lease-list wifi

Code
Perl/Expect:

my $timeout = 10; 

$ssh->expect($timeout, [ qr/password: /i ]); 
$ssh->send("$passwd\r\n"); 
$ssh->expect($timeout, [ qr/#/i ]); 
$ssh->send("execute dhcp lease-list wifi\r"); 
$ssh->expect($timeout, [ qr/#/i ]); 
$ssh->send("exit\r"); 

$ssh->soft_close();

Output: none

Perl/Rex:

desc "List all dhcp leases";
task "leases", group => "forti", sub {
    my $output = run "execute dhcp lease-list wifi";
    say $output;
};

Output:

[2014-02-11 13:14:48] (30011) - INFO - Running task: leases
[2014-02-11 13:14:48] (30022) - INFO - Connecting to 10.10.10.2 (admin)
[2014-02-11 13:14:49] (30022) - INFO - Connected to 10.10.10.2, trying to authenticate.
Fortigate # Unknown action 0

Fortigate #

Python/paramiko:

ssh = paramiko.SSHClient()
ssh.set_missing_host_key_policy(paramiko.AutoAddPolicy())
ssh.connect('10.10.10.2',username='fake_root',password='fake_pass') 
stdin, stdout, stderr=ssh.exec_command("execute dhcp lease-list wifi")
stdout.readlines()
ssh.close()

Output: none

Python/Fabric:

def view_dhcp_leases():
        print("Viewing dhcp leases")
        run("execute dhcp lease-list wifi")

Output:

[10.10.10.2] Executing task 'view_dhcp_leases'
Viewing dhcp leases
[10.10.10.2] run: execute dhcp lease-list wifi
[10.10.10.2] out: Fortigate # Unknown action 0
[10.10.10.2] out: 
[10.10.10.2] out: Fortigate # 

Done.
Disconnecting from 10.10.10.2 ... done.

Conclusions ...so far

Unknown action 0 means, "I don't know this command [ in this context ]". This command can be run manually at the first prompt. Also, as you can see in the fabric and rex examples: it does authenticate and connect! I conclude that this is by design for security reasons ...and more likely to sell their proprietary management crap.

You may be affected by the issue described here!

salva
– salva

2017-06-14 10:38:45 +00:00
Commented Jun 14, 2017 at 10:38 — salva
– salva, Commented Jun 14, 2017 at 10:38

user3354685 · Accepted Answer · 2014-12-18 13:01:20Z

2

This works for me on a FortiNet Mail Appliance.

from Exscript.util.interact import Account
from Exscript.protocols import SSH2
account = Account('USERNAME', 'PASSWORD')
conn = SSH2()
conn.connect('IP')
conn.login(account)
conn.execute('COMMAND')
conn.send('exit \r')
conn.close()

https://github.com/knipknap/exscript

edited Dec 18, 2014 at 13:01

answered Dec 18, 2014 at 10:50

user3354685

214 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

Andy Moore · Accepted Answer · 2015-10-22 12:49:56Z

2

The following script worked for me against a FortiGate (5.2.4) with Python/Paramiko:

import paramiko
ssh = paramiko.SSHClient()
ssh.set_missing_host_key_policy(paramiko.AutoAddPolicy())
ssh.connect('1.1.1.254',username='admin',password='password')
stdin, stdout, stderr=ssh.exec_command("get system status")
type(stdin)
stdout.readlines()

Andy

answered Oct 22, 2015 at 12:49

Andy Moore

211 bronze badge

2 Comments

f0rd42 Over a year ago

have you ever tried to run paraniko agains 5.2.5 or upwards? looks like it's broken since 5.2.5 (see github.com/paramiko/paramiko/issues/687)

tread Over a year ago

When I try this I get action not supported from a Fortimail server

Max · Accepted Answer · 2014-05-12 13:08:07Z

1

I have 60B.

Please try to run this command from linux terminal.

If you don't have sshpass - you can install it.

sshpass -p 'adminpassword' ssh ip_of_fw -l admin execute dhcp lease-list

edited May 12, 2014 at 13:08

answered May 12, 2014 at 13:01

Max

1,4801 gold badge13 silver badges16 bronze badges

1 Comment

Bubnoff Over a year ago

sshpass does not work either. With the -V option it just gives the license then exits.

Miro · Accepted Answer · 2017-06-13 22:07:13Z

1

If you want to use fabric to run commands on fortigates you need to disable the shell wrapping used by fabric when connecting via SSH:

from fabric.api import run

def get_sys():
   run("get sys status",shell=False)

answered Jun 13, 2017 at 22:07

Miro

111 bronze badge

Comments

maro584 · Accepted Answer · 2019-07-20 06:31:58Z

0

Youc can upgrade an OS version and then use API with P

answered Jul 20, 2019 at 6:31

maro584

113 bronze badges

Collectives™ on Stack Overflow

Fortigate automation with perl or python

5 Answers 5

Comments

2 Comments

1 Comment

Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

5 Answers 5

Comments

2 Comments

1 Comment

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related