Feature catalog

Every area of the platform, described section by section. Everything here ships in the repository today — no roadmap items, no vaporware.

🔄 Manager ↔ device sync

The heart of the platform: a scheduled read path that keeps the database and git in lock-step with every live appliance, and a minimal-diff write path back to the device.

1

Schedule

Hourly sync + nightly deep inspect, targeted per product

2

Harvest

REST API per section, automatic SSH/CLI fallback

3

Normalize

One canonical snapshot shape for every device kind

4

Ingest

Written to the PostgreSQL device cache

5

Version

JSON tree per device committed & auto-published to git

  • DB-first reads. The UI reads from the local cache, so browsing a fleet is instant; a refresh-live escape hatch re-queries the appliance on demand.
  • Discovery & deep capture. A discovery plan enumerates every section of a device and captures it into the normalized cache — the same plan drives FortiWeb, FortiADC and FortiAnalyzer.
  • Product-aware scheduling. The hourly device_sync and nightly device_inspect actions fan out across the whole fleet, filtered by device kind.
  • Minimal-diff writes. Saving an object pushes only changed fields back to the device, with a dry-run preview and a full audit entry on every write.
  • Drift detection. The harvested config is diffed against git — a drift view surfaces exactly what changed on the box since the last known-good snapshot.
🧭

Because the harvest, normalize, ingest and git-publish steps are shared across products, adding coverage for a new device line reuses the entire pipeline.

🗄️ The database

A PostgreSQL database is the single source of truth — for device configuration, the editable API map, users, audit and every operational record.

  • Device configuration cache — the normalized snapshot of every appliance, so reads never wait on the box.
  • Endpoint registry — the REST URI map lives in the database, not in code: when a firmware upgrade moves an endpoint, an operator repoints it from the UI.
  • Appliance inventory — connection details, product kind and per-device flags; credentials are Fernet-encrypted at rest.
  • Identity & governance — users, roles, API tokens, the audit log and Change Requests are all first-class tables.
  • Live schema tools — an ER diagram of the running schema and read-only introspection views, straight from the app.
  • Enforced TLS — application and replication connections require TLS with mutual certificate verification; cert-less connections are refused.

🛡️ Signatures

Full management of FortiWeb attack signatures and the exceptions that keep them from blocking legitimate traffic.

  • Signature browser — every signature set and rule, searchable across the cached configuration.
  • Per-signature exceptions — add, review and remove exceptions with the object in context.
  • Guided WAF exceptions — a lifecycle (detect → inject → review) with template locks, so exceptions are tracked rather than forgotten.
  • Fleet-wide view — signature posture across every FortiWeb, not one box at a time.

📐 Templates

Reusable, locked templates for policies and exceptions — apply a known-good shape across the fleet instead of hand-editing each device.

  • Policy & exception templates with locks, so a curated baseline can't be accidentally mutated.
  • Clone & migrate — copy a policy or object set across devices with reference resolution and a pre-flight checklist.
  • Lifecycle tracking — templates carry state (applied, drifted, superseded) rather than being fire-and-forget.
  • Naming conventions & taxonomy — rules, section catalogs and field datasheets keep applied objects consistent.

🧭 Web Protection & policies

The FortiWeb management surface, mirroring the appliance GUI with safety rails the console doesn't have.

  • Server Policy table mirroring the FortiWeb menu, with minimal-diff saves.
  • Guided policy clone / migrate across devices: dummy-VIP rules, reference resolution, pre-flight checklist.
  • Safe cascade delete with a full dependency preview before anything is removed.
  • Web Protection area mirroring the FortiWeb 7.6 menu — 166 curated object kinds.

🧩 Generic object editor

One spec-driven form engine edits any registry endpoint — the reason the platform covers ~500 endpoints without 500 bespoke screens.

  • Stacked slide-over panels, create-references-in-place, and a dry-run preview on every write.
  • ~500 registry endpoints editable through the single engine, driven by the database-backed spec.
  • Live API consoles per product with audited, permission-gated writes.
  • Fleet-wide object search across every device's cached configuration.

🌐 Multi-product workspaces

Global, FortiWeb, FortiADC and FortiAnalyzer workspaces with strict, per-browser-tab product scoping.

  • Per-tab product context — each browser tab keeps its own active administrative domain.
  • FortiADC — load-balancer objects, virtual servers, real-server pools, LB lookup, certificate deploy over REST.
  • FortiAnalyzer — full JSON-RPC integration speaking both API dialects, a live registry-bound menu, and Device Manager views.

📦 Device operations

The day-to-day appliance lifecycle, from discovery to firmware.

  • Discovery / rediscovery and deep capture into the normalized cache.
  • Config backups over REST with automatic SSH/CLI fallback, plus a restore vault.
  • Firmware upgrade runbooks and boot-partition management.
  • Built-in SSH console with read-only command presets.
  • Provisioning workflows, hardware inventory and capacity views.

🖧 Supported devices

Three Fortinet product lines today, all harvested into the same database and git source of truth.

FortiWeb

Web Application Firewall
  • Server policies, signatures & exceptions
  • 166 Web Protection object kinds
  • Backup over REST + SSH/CLI
  • Deep capture & cert scans
REST · SSH · tested on 7.6.x

FortiADC

Application Delivery Controller
  • Virtual servers & real-server pools
  • Load-balancer objects & LB lookup
  • Certificate deploy over REST
  • Same git source of truth as FortiWeb
REST · self-signed aware

FortiAnalyzer

Logging & Analytics
  • Full JSON-RPC, both API dialects
  • Device Manager & live registry menu
  • ~3.5k-object config snapshot in git
  • Operational endpoints excluded from harvest
JSON-RPC · tested on 7.6.7
🧩

New device lines drop in through the same discovery → normalize → ingest → git pipeline, and their REST map lives in the editable endpoint registry — no code change to repoint a moved URI.

🗂️ Source of truth & backups

Four independent copies across failure domains, summarized in a live coverage matrix.

  • Git source of truth — every appliance's config harvested into versioned JSON, refreshed hourly, auto-published.
  • System Backup & Restore — database bundles, device vault, one-click code rollback, embedded recovery runbook.
  • Backup coverage matrix — every stream with format, destinations, cadence and a live state badge.
  • External SFTP backup server with per-device browse / compare / search / download.
  • Firmware source of truth — manifest in git, binaries on the backup server, sha256-verified pulls.
  • Git drift view and reports history with an A→B diff viewer.

🔁 High availability

Two-node clustering is part of the installer, not bolted on.

  • Primary / standby with PostgreSQL streaming replication and a role-guarded 5-minute data sync.
  • Replication TLS-enforced with mutual certificate verification against an internal CA.
  • Git-driven reconciler keeps deployments converged with the repository.
  • Cluster status page; node-to-node HTTPS probes authenticated with a shared identity key.

🔐 Security & access

Defense in depth from login to write path.

  • Two-factor authentication, LDAP auth and granular role-based access control.
  • Audit log on every write path; Change Requests with maintenance-window approval gates.
  • Scoped API tokens (read ⊂ write ⊂ admin, owner-capped, product-bound).
  • Secrets encrypted at rest; nonce-based CSP; rate limiting; object locks.
  • Node TLS manager — import or issue from the internal CA, nightly auto-renew, auto-rollback on bad imports.
  • Encryption-in-transit monitoring — every badge backed by a live probe.

⏱️ Automation & self-update

The platform runs and maintains itself.

  • Scheduled actions catalog — config syncs, backups, certificate scans, nightly inspections — per-product targeting.
  • Background jobs with pause / resume / stop.
  • Self-update from the UI via a privileged runner with per-step logs and health verification.
  • Library manager — PyPI update checks plus per-package pip upgrade / rollback with automatic failure rollback.

📜 Certificates

A central certificate manager for the whole fleet.

  • Issuance via ADCS or ACME.
  • Lifecycle policy — revoke-on-supersede, expiry sweeps, SNI policies.
  • Private-key upload over SSH and REST deploy to FortiADC; fleet-wide inventory and live probes.

📈 Observability & analysis

See the fleet and the platform at once.

  • Monitoring dashboard, metrics, infrastructure health and system health pages.
  • FortiView traffic analysis and packet capture.
  • DNS & LB lookup, log collection, flash reports, capacity planning.
  • E-mail notifications, release-notes tracker, in-app documentation viewer.

📊 Reporting & schema

Answer questions without touching SQL.

  • Report Builder — a no-SQL wizard plus 7 built-in reports.
  • Live ER diagram of the schema and database introspection views.

🛠️ Developer & power tools

For the operators who go deep.

  • Lua Studio and Regex Lab with curated example libraries.
  • Plugin system with a sandboxed runtime and examples.
  • API explorer, import-from-backup, baselines and built-in bug reporting.

🚀 Deployment

From a blank host to a running HA pair, guided.

  • Interactive Linux installer — online (any major distro family) or fully air-gapped offline bundles for Debian 12 and RHEL 9.
  • Standalone or 2-node cluster — the secondary joins with a single pasted key and mints its own certificate.
  • systemd units, nginx TLS front, gunicorn, PKI bootstrap and a sysadmin manual with sudoers policy.
  • 700+ unit and integration tests.
Read the install guide →
↑