Fortinet FortiGate Next Generation Firewall

Infinity XDR Extended Detection & Response/XPR Extended Prevention & Response analyzes the syslogs from FortiGate Next Generation Firewall for malicious activity and enforces the preventive or corrective action through the firewall.

1. Log in to the Infinity XDR/XPR Administrator Portal:

   1. Go to Settings > Integrations.

      

   2. In the Fortigate widget, click Integrate.

   3. Click Download all to download the zip file that includes these certificates:

      • checkpoint-syslogs-cert.pem

      • checkpoint-syslogs-key.pem

      • checkpoint-syslogs-ca.pem

        

   4. Click Close.

      The Fortigate widget status changes to Active.

      

2. Log in to the FortiGate Next Generation Firewall Administrator Portal:

   1. Go to System > Certificates.

      

   2. From the Import list, select Local Certificate:

      

      1. In the Type field, select Certificate.

      2. In the Certificate file field, click and upload the checkpoint-syslogs-cert.pem file.

      3. In the Key file field, click and upload the checkpoint-syslogs-key.pem file.

      4. In the Certificate Name field, type CheckpointSyslogs.

      5. Click OK.

   3. From the Import list, select CA Certificate:

      

      1. In the Type field, select File.

      2. In the Upload field, click and upload the checkpoint-syslogs-ca.pem file.

      3. Click OK.

   4. Click icon in the right top corner to open the CLI terminal and run:

      config log syslogd setting

      Note - If you have used syslogd with another integration, use syslogd2, syslogd3, or syslogd4.

      set status enable

      set format cef

      set server<Production server IP address of the region. For EU, it is 20.76.50.141. For US, it is 20.22.126.247>

      set mode reliable

      set enc-algorithm high

      set certificate CheckpointSyslogs

      Note - Make sure the certificate name matches the name entered in the Certificate Name field. See step 2.b.iv in Integrating the Fortinet FortiGate Next Generation Firewall.

      set port 6514

      end

      

   5. Go to Log & Report > Log Settings in the left pane and make sure the Send logs to syslog toggle button is turned on.

      

3. To check if the integration is successful, in the Infinity XDR/XPR Administrator Portal, click Overview.

   If Fortigate is listed as connected in the Connectivity widget, then the integration is successful. It takes up to one hour to complete the integration.

   

Renewing the Certificate

The certificate expiration notification appears 60 days prior to its expiry. It is recommended that you renew the certificate before it expires.

To renew the certificates:

1. Log in to the Infinity XDR/XPR Administrator Portal:

   1. Go to Settings > Integrations.

   2. In the Fortigate widget, click Integrate.

   3. Click and Download all to download the zip file that includes these certificates:

      • checkpoint-syslogs-cert.pem

      • checkpoint-syslogs-key.pem

      • checkpoint-syslogs-ca.pem

        

      The Fortigate widget status changes to Active.

      

2. Log in to the FortiGate Next Generation Firewall web portal:

   1. Go to System > Certificates.

   2. From the Import list, select Local Certificate:

      

      1. In the Type field, select Certificate.

      2. In the Certificate file field, click and upload the checkpoint-syslogs-cert.pem file.

      3. In the Key file field, click and upload the checkpoint-syslogs-key.pem file.

      4. In the Certificate Name field, type CheckpointSyslogsV2.

      5. Click OK.

   3. From the Import list, select CA Certificate:

      

      1. In the Type field, select File.

      2. In the Upload field, upload checkpoint-syslogs-ca.pem file.

      3. Click OK.

   4. Click icon in the right top corner to open the CLI terminal and run:

      config log syslogd setting

      set certificate CheckpointSyslogsV2

      end

      Note - Make sure the certificate name matches the name entered in the Certificate Name field. See step 2(b(iv)) in Renewing the Certificate.

Disabling the Integration

You can disable the integration to stop Infinity XDR/XPR from reading the FortiGate Next Generation Firewall's syslogs.

1. Log in to the FortiGate Next Generation Firewall web portal and do one of these:

   • Click icon in the right top corner to open the CLI terminal and run:

     config log syslogd setting

     set status disable

     end

   • Go to Log & Report > Log Settings and turn off the Send logs to syslog toggle button.

2. To re-enable the integration:

   1. Log in to the FortiGate Next Generation Firewall web portal.

   2. Click icon in the right top corner to open the CLI terminal and run:

      config log syslogd setting

      set status enable

      set certificate CheckpointSyslogs

      end

   Note - Make sure you use the latest certificate name.

Regenerating the Certificate

If you revoke a certificate, you must regenerate and upload the certificate to the FortiGate Next Generation Firewall web portal within two days.

1. Log in to the Infinity XDR/XPR Administrator Portal:

   1. Go to Settings > Integrations.

   2. In the Fortigate widget, click .

   3. Click Regenerate Certificate.

      The Regenerate Fortigate Integration window appears.

      

   4. Perform steps from 1.c until the end in Integrating the Fortinet FortiGate Next Generation Firewall syslogs with Infinity XDR/XPR.

Deleting the Integration

1. Log in to the Infinity XDR/XPR Administrator Portal:

2. Go to Settings > Integrations.

3. In the Fortigate widget, click .

4. Click Delete.

   The Delete Integration window appears.

   

5. Click Yes.

Configuring IoCs

You can use the Public Blend URL in the Infinity IoC to enforce IoCs on the FortiGate Next Generation Firewall.

To configure IoCs:

1. Log in to the Infinity XDR/XPR Administrator Portal:

   1. Go to Settings > Integrations.

   2. In the Fortigate widget, click and select Configure IoC.

      

      The Configure IoC window appears. It lists three indicator links generated automatically using the All Indicators link from the Public Blend URL in the Infinity IoC.

   3. Click to copy the indicator link.

      

   4. Click Close.

2. Log in to the FortiGate Next Generation Firewall Admin Portal:

   1. Go to Security Fabric > External Connectors.

      

   2. Click Create New.

   3. Scroll down and in the Threat Feeds section, select FortiGuard Category.

      

      The Connector Settings window appears.

      

   4. Do these:

      1. Name - Name of the threat feed.

      2. URI of external resources - URL indicators link copied in the step 1.i.

      3. Turn off the HTTP basic authentication toggle button.

      4. Turn on the Status toggle button.

      5. Click OK.

   5. Repeat steps 2.b through 2.d with these details:

      FortiGate Threat Feed	Configure IoC link (from step 1.i)
      IP Address	IP indicators link
      Malware Hash	File indicators link

      The Threat Feeds widget appears in the External Connectors page.