What You'll Need
- Administrator access to the FortiGate web interface
- FortiOS 6.2 or later with REST API enabled
- ~5 minutes to complete setup
- Your Clariti account with adapter management permissions
Get Your Credentials
Log in to the FortiGate web interface. Navigate to System > Administrators and select the admin account you want to use for API access (or create a dedicated read-only admin).
Click on the administrator profile, scroll to API Key, and click Generate. FortiOS creates an API key tied to that administrator. Copy the key immediately — it is only displayed once.
For best security, create a dedicated administrator with a Read-Only admin profile and restrict the trusted host to the IP range Clariti uses for outbound requests.
Enter Credentials in Clariti
| Value from vendor console | Paste into Clariti field |
|---|---|
API Key | API Key |
FortiGate hostname or IP | Host |
Verify Connection
Click Test Connection in Clariti. A successful connection returns a green checkmark. The first data sync typically completes within a few minutes.
IPsec VPN Tunnel Status
Clariti checks each configured IPsec VPN tunnel (site-to-site or other permanent tunnels) for a down status and raises a finding naming the tunnel so a dropped branch-office or partner connection is visible without opening the FortiGate UI.
Dial-up / remote-access VPN tunnels are deliberately excluded from this check. A dial-up tunnel (used for remote-access clients or on-demand branch connections) is expected to go up and down as users connect and disconnect — an idle dial-up tunnel with no client currently connected is a normal resting state, not an outage, so Clariti never raises a finding for it. If your FortiGate has no permanent (non-dial-up) tunnels configured, this check simply produces no findings; every other check on this page is unaffected.
An intentionally cold-standby or disaster-recovery tunnel that is only brought up during a failover will also read as "down" during normal operation, since the FortiGate API has no way to distinguish "cold standby" from "failed" — if you run tunnels this way, expect this check to flag them and treat that as expected rather than an alert.
Internet Exposure (Virtual IPs)
Clariti reads the FortiGate's virtual IP (VIP / port forward) table, read-only, with GET /api/v2/cmdb/firewall/vip. The same check runs from the Clariti on-prem connector.
What it means for you: a detected device that a VIP maps the outside to is marked internet-facing, so a likely-exploited vulnerability on it is raised in Fix These First. A device on an internal (private IPv4) address that no VIP maps to, on a FortiGate in NAT mode, is marked not internet-facing, and a vulnerability affecting only such devices is lowered one priority band. The FortiGate itself is always internet-facing. If the VIP table cannot be read in full (the admin profile lacks firewall address/VIP read access, a VIP points at an FQDN, or the FortiGate runs in transparent mode), exposure stays unknown and never lowers a finding. To enable it, give the API admin profile read access to Firewall > Address (which covers virtual IPs).
Troubleshooting
- 401 Unauthorized — The API key may have been regenerated or the administrator account disabled. Generate a new key and update it in Clariti.
- 403 Forbidden — The admin profile may lack read access to the required resources. Assign at least read permissions for System, Network, and User modules — VPN monitor access is required for the IPsec VPN Tunnel Status check above; without it, that check silently stops reporting rather than erroring, so if you scope the API token narrowly, explicitly include VPN monitor read access.
- Timeout — Ensure the FortiGate management interface is reachable from the internet or that appropriate VPN/tunnel access is configured. Clariti retries automatically.