Skip to content

feat(fortigate): add golden configuration baseline and fortios parser - #64

Merged
michaelelrom merged 1 commit into
itential:mainfrom
michaelelrom:feat/fortigate-golden-config
Aug 12, 2026
Merged

feat(fortigate): add golden configuration baseline and fortios parser#64
michaelelrom merged 1 commit into
itential:mainfrom
michaelelrom:feat/fortigate-golden-config

Conversation

@michaelelrom

@michaelelrom michaelelrom commented Aug 12, 2026

Copy link
Copy Markdown
Collaborator

Summary

  • Adds the fortios Config Manager parser: built on the cisco-ios lexer template (whitespace-delimited words, quoted strings preserved), plus a # comment rule to correctly skip the #-prefixed metadata header lines (#config-version=..., #buildno=...) FortiOS always emits at the top of a config export.
  • Adds the FortiGate - Simple golden configuration tree (deviceType: fortios), covering:
    • Admin session timeout, disallowing HTTPS admin-redirect disable
    • Password policy (status + minimum length)
    • NTP sync to a named server
    • Syslog forwarding
    • Disallowing a wide-open trusthost1 0.0.0.0 0.0.0.0 management ACL
    • Disallowing telnet/HTTP management access on port1
  • Ships with no device bindings.
  • Updates Fortinet/FortiGate/README.md with Configuration Parsers and Golden Configurations sections (TOC, Contents table, asset docs).

Test plan

  • Parser and tree created live via the Config Manager API on a running Itential Platform instance.
  • Confirmed the template parses into the correct nested config-spec structure (config block → set lines) with correct evalMode/severity per line (required/error, disallowed/error, ignored, informational).
  • Confirmed the tree integrates correctly with the platform's compliance batch engine (ran a live compliance batch against it).
  • Reviewer: import both files into a test instance and confirm compliance runs against a real or sample FortiGate config as expected.

Adds the fortios Config Manager parser (cisco-ios lexer template plus
a # comment rule for FortiOS's #-prefixed config-export header lines)
and the FortiGate - Simple golden config tree covering admin session
timeout, password policy, NTP, syslog forwarding, and interface/admin
access hardening. Ships with no device bindings.
@michaelelrom
michaelelrom force-pushed the feat/fortigate-golden-config branch from 2c1204b to 4e68da2 Compare August 12, 2026 21:56
@michaelelrom
michaelelrom merged commit bee93e5 into itential:main Aug 12, 2026
@michaelelrom
michaelelrom deleted the feat/fortigate-golden-config branch August 12, 2026 21:57
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants