Fortigate Prometheus exporter for Kubernetes

This repository demonstrates how to deploy the prometheus exporter on Kubernetes to monitor a fortigate firewall.

· Report Bug · Request Feature

Table of Contents

1. About The Project
2. Getting Started
   • Prerequisites
   • Installation
3. Usage
4. Contributing
5. Contact
6. Projects

About The Project

This project provides a streamlined and efficient way to deploy a FortiGate Prometheus exporter for your Kubernetes environment to monitor a fortigate firewall.

Info: It is possible to monitor multiple fortigates and also only specific metrics

Components:

• FortiGate Prometheus exporter for Kubernetes

(back to top)

Getting Started

The following requirements are necessary to install the project.

System requirements for installation

• A running Kubernetes cluster
• kubectl installed and configured
• git installed and configured
• makefile installed

Already installed within your Kubernetes Cluster

• Prometheus

Fortigate requirements

Please ensure to use a valid and trusted HTTPS server certificate for your firewall.

Note: If you are using a self signed certificate, make sure to use this image: therbert6/fortigate-exporter:0.1-insecure

Installation

The deployment is handled by a Makefile.

1. Clone the repo

   git clone https://github.com/Tim-herbie/k8s_fortigate_exporter.git

2. Ensure that the following Profile exist on your fortigate. You can create it via CLI or UI.

   • Create Access Profile via CLI

     config system accprofile
         edit "monitor"
             # global scope will fail on non multi-VDOM firewall
             set scope global
             set authgrp read
             # As of FortiOS 6.2.1 it seems `fwgrp-permissions.other` is removed,
             # use 'fwgrp read' to get load balance servers metrics
             set fwgrp custom
             set loggrp custom
             set netgrp custom
             set sysgrp custom
             set vpngrp read
             set wifi read
             # will fail for most recent FortiOS
             set system-diagnostics disable
             config fwgrp-permission
                 set policy read
                 set others read
             end
             config netgrp-permission
                 set cfg read
                 set route-cfg read
             end
             config loggrp-permission
                 set config read
             end
             config sysgrp-permission
                 set cfg read
             end
         next
     end
     

   • Create Access Profile via UI

     

3. After that create a new "REST API Admin" under System/Administrators and name it something like prometheus. Note the API Key!
4. You have now completed all preparations! Now it´s time to create the fortigate.env file and enter the URL of your firewall and the API Key.

   Make sure that you configured your fortigate firewall with a valid certificate

   # fortigate.env
   URL=https://fw.example.com
   FORTIGATE_API_TOKEN=my-secure-fortigate-api-token

5. Deployment

   make all

   After this you should be able to see some metrics from your fortigate firewall in Prometheus!

(back to top)

Usage

Prometheus Metrics

Once the Fortigate Prometheus exporter pod is up and running, you should be able to see the metrics in Prometheus.

(back to top)

Contributing

Contributions are what make the open source community such an amazing place to learn, inspire, and create. Any contributions you make are greatly appreciated.

If you have a suggestion that would make this better, please fork the repo and create a pull request. You can also simply open an issue with the tag "enhancement". Don't forget to give the project a star! Thanks again!

1. Fork the Project
2. Create your Feature Branch (git checkout -b feature/AmazingFeature)
3. Commit your Changes (git commit -m 'Add some AmazingFeature')
4. Push to the Branch (git push origin feature/AmazingFeature)
5. Open a Pull Request

(back to top)

Contact

Tim Herbert - [email protected]

Project Link: https://github.com/Tim-herbie/k8s_fortigate_exporter

(back to top)

Projects

Use this space to list resources you find helpful and would like to give credit to. I've included a few of my favorites to kick things off!

• PowerDNS for Kubernetes
• PowerDNS Traefik Sync Tool for Kubernetes
• FortiGate Exporter for Kubernetes
• KeyCloak for Kubernetes

(back to top)