Clariti Docs
Credentials5 minutes· easy

Fortinet FortiGate

Network Security

Connects to FortiGate firewalls to pull connected device inventory and appliance status into Clariti, flags down network interfaces, down IPsec VPN tunnels, and overly-permissive any/any/any firewall policies, and flags expired or soon-to-expire FortiGuard subscription licenses (antivirus, IPS, web filtering).

What Clariti Collects

What You'll Need

  • Administrator access to the FortiGate web interface
  • FortiOS 6.2 or later with REST API enabled
  • ~5 minutes to complete setup
  • Your Clariti account with adapter management permissions

Get Your Credentials

Log in to the FortiGate web interface. Navigate to System > Administrators and select the admin account you want to use for API access (or create a dedicated read-only admin).

Click on the administrator profile, scroll to API Key, and click Generate. FortiOS creates an API key tied to that administrator. Copy the key immediately — it is only displayed once.

For best security, create a dedicated administrator with a Read-Only admin profile and restrict the trusted host to the IP range Clariti uses for outbound requests.

Enter Credentials in Clariti

Value from vendor consolePaste into Clariti field
API KeyAPI Key
FortiGate hostname or IPHost

Verify Connection

Click Test Connection in Clariti. A successful connection returns a green checkmark. The first data sync typically completes within a few minutes.

IPsec VPN Tunnel Status

Clariti checks each configured IPsec VPN tunnel (site-to-site or other permanent tunnels) for a down status and raises a finding naming the tunnel so a dropped branch-office or partner connection is visible without opening the FortiGate UI.

Dial-up / remote-access VPN tunnels are deliberately excluded from this check. A dial-up tunnel (used for remote-access clients or on-demand branch connections) is expected to go up and down as users connect and disconnect — an idle dial-up tunnel with no client currently connected is a normal resting state, not an outage, so Clariti never raises a finding for it. If your FortiGate has no permanent (non-dial-up) tunnels configured, this check simply produces no findings; every other check on this page is unaffected.

An intentionally cold-standby or disaster-recovery tunnel that is only brought up during a failover will also read as "down" during normal operation, since the FortiGate API has no way to distinguish "cold standby" from "failed" — if you run tunnels this way, expect this check to flag them and treat that as expected rather than an alert.

Troubleshooting

  • 401 Unauthorized — The API key may have been regenerated or the administrator account disabled. Generate a new key and update it in Clariti.
  • 403 Forbidden — The admin profile may lack read access to the required resources. Assign at least read permissions for System, Network, and User modules — VPN monitor access is required for the IPsec VPN Tunnel Status check above; without it, that check silently stops reporting rather than erroring, so if you scope the API token narrowly, explicitly include VPN monitor read access.
  • Timeout — Ensure the FortiGate management interface is reachable from the internet or that appropriate VPN/tunnel access is configured. Clariti retries automatically.