Skip to main content
Version: 2.14.1

Fortinet FortiGate Ransomware NGFW Host Isolation Integration

Free integration setupWe’ll install and validate this for you.
Book a setup call

Support Statement​

DISCLAIMER

This documentation is provided "as is" without support for 3rd party software. The level of support for this integration guide is best effort without any SLA on response time. No 3rd party product support can be provided by Superna directly. 3rd party components require support contracts. See EULA for more details.

Overview​

Customers using FortiGate can leverage this integration to issue IP bans using the Incoming Webhook Quarantine feature. This ensures a compromised host cannot continue to attack other infrastructure after a data layer lockout by Data Security Edition.

Limitations​

  • Does not look up the endpoint ID to map to the client IP or end user ID. These entities must already exist or be created in FortiGate.

Solution Overview​

Superna Data Security Edition Zero Trust API is the cornerstone technology used to integrate with SIEM and SOAR platforms. This integration cascades storage threat responses to Fortinet FortiGate to isolate hosts and protect infrastructure. By combining storage protection with network firewall protection, this integration reduces the response time to contain a ransomware threat and improves cyber resilience.

What Is FortiGate?​

FortiGate is a Next-Generation Firewall (NGFW) developed by Fortinet. It acts as a comprehensive security and networking gateway that protects organizational networks from cyberthreats while routing and optimizing internet traffic.

Integration Architecture​

FortiGate integration architecture

Solution Configuration in FortiGate and Defender Zero Trust​

Prerequisites​

  • Installed Data Security Edition subscription product
  • Eyeglass OS appliance version 15.5 — verify with cat /etc/os-release
  • License key for the Zero Trust API
  • FortiGate on-premises

Features​

  • Sends native Incident API calls with severity mapping from Superna to FortiGate
  • Supports Webhook API key integration with Webhook Automations

Configuration in FortiGate​

  1. Log in to the FortiGate console.
  2. Follow the Incoming Webhook Quarantine stitch guide to create an API key and enable the webhook quarantine IP ban policy.
  3. Create an API key and admin profile with the appropriate permissions.
  4. In the FortiGate Automation configuration for the webhook quarantine stitch, edit the automation switch and change the action to IP Ban.

Configuration Steps on Eyeglass Virtual Machine​

High-Level Steps​

  1. Configure FortiGate webhook settings.
  2. Configure Defender Zero Trust Webhooks.
  3. Test the integration with FortiGate.

Install the Integration​

  1. From the Superna support site, download the integration .run file.

  2. Copy the file to the Eyeglass VM using SCP or WinSCP.

  3. Log in to the Eyeglass VM as admin over SSH.

  4. Run the following commands:

    sudo -s

    chmod 777 /path/to/integration.run

    ./integration.run

  5. The installer launches an interactive Text User Interface (TUI). Enter your FortiGate API key and connection details.

  6. Press V to validate the inputs.

  7. Press I to install.

  8. Review any errors. When prompted to start the service, answer Yes.

Configure Defender Zero Trust Webhooks​

  1. Configure the Zero Trust endpoint in the Ransomware Defender Zero Trust tab.

    Recommended Configuration

    Send only Critical and Major events, and only webhooks that set lockout or delayed lockout. The goal is to send findings rather than a list of alarms that do not pinpoint a security incident. Customers can customize based on specific requirements.

  2. The endpoint URL uses localhost and sends webhooks to the application service listening on port 5000:

    http://localhost:5000/webhook

  3. Add the Content-Type header with value application/json to complete the webhook configuration.

  4. Click Save to commit the configuration.

  5. Click Save on the main Webhook configuration page.

How to Test the Integration with FortiGate​

  1. Download the curl command template and open it with a text editor.
  2. Copy all the text.
  3. SSH to the Eyeglass VM as the admin user.
  4. Paste the entire CLI command to the SSH prompt to send sample data to the running Zero Trust application. This sends test data directly to the application to be processed and sent to FortiGate.
  5. Verify that the targeted host's IP address is added to the IP ban list in the FortiGate console.

FortiGate SecOps Administrators Integration Experience​

Once the integration is complete, SecOps administrators can view IP ban events in the FortiGate console. Compromised host IP addresses are quarantined automatically when Superna Data Security Edition detects a critical threat at the storage layer.