Parsing Fortinet Configs

Parsing Fortinet FortiGate Configurations

Overview

Use this skill to parse Fortinet FortiGate / FortiOS backup or show full-configuration output into the shared vendor-neutral firewall intermediate schema. It focuses on nested config / edit / set / next / end blocks, including VDOMs, interfaces, zones, firewall addresses and services, policies, central SNAT, VIPs, routes, VPN, HA, profiles, and system settings.

FortiOS behavior is version- and feature-dependent. Preserve unknown blocks in residual_raw, capture VDOM context, and flag policy/NAT/profile constructs that cannot be mapped cleanly to the intermediate schema.

Scope and routing

Use only for FortiGate or FortiOS block syntax. Hand off ASA/FTD access-list, nameif, or object network input to parsing-cisco-configs, PAN-OS XML or set deviceconfig to parsing-palo-configs, and Junos hierarchy or set security to parsing-srx-configs. Verify production-bound results against current device documentation and output. Downstream consumers are the audit, conversion, and diff skills.

Input Format

FortiOS configs use a hierarchical block format:

config 
    edit 
        set  
        set  
        config 
            edit 
                set  
            next
        end
    next
    edit 
        ...
    next
end

Key syntax rules:

• Values with spaces are quoted: set comment "Allow web traffic"
• Multi-value fields use space-separated values: set srcaddr "addr1" "addr2"
• Full block-syntax rules: references/config-format.md

Building the Config Tree

Parse the block format into a nested object tree:

1. Track a stack of current context (section path + edit name)
2. config → push section name
3. edit → push entry name (strip quotes)
4. set → store key-value at current depth
5. next → pop entry
6. end → pop section

Extraction Pipeline

1. Zones and Interfaces

Zones: config system zone → edit with set interface Interfaces: config system interface → edit with set vdom, set ip, set type, set vlanid Additional interface fields to extract:

• set ip6 (inside nested config ipv6 sub-block) — IPv6 address
• set mtu — MTU
• set type aggregate → type: "lag" (with set member for LAG members)
• set type loopback → type: "loopback"
• set type tunnel → type: "tunnel"
• set mode dhcp — DHCP client (no static IP)
• set dhcp-relay-ip — DHCP relay server IPs
• set allowaccess — management access protocols
• set fortilink enable — FortiLink interface (exclude from output along with child interfaces)
• set description
• Subinterface detection: dot-notation (port1.100 → parent=port1) or VLAN-bound (set interface + set vlanid )
• Management interface detection: names matching /^(mgmt\d*|management\d*)/i → is_mgmt: true
• After all interfaces parsed, back-populate lag_members on aggregate interfaces

Critical: Interface-as-Zone Merging FortiGate can use interface names directly as zones in policies (via srcintf/dstintf). If a policy references an interface name not in any zone, treat that interface as its own zone. Merge zones and interfaces: create a zone entry for each interface used as a zone.

Zone Building Priority 3: Unzoned Interfaces After explicit zones and policy-referenced interfaces, create auto-zones for any interface that has an IP address (or is a DHCP client) but was not yet assigned to a zone.

Allowaccess Classification: Classify allowaccess values into management services (ssh, https, http, telnet, ping, snmp, netconf, fgfm, fmg-access, ftm, radius-acct, security-fabric, fabric, capwap, speed-test) and routing protocols (ospf, bgp, rip, isis, bfd). Attach to zones as host_inbound data.

2. Address Objects

Path: config firewall address → edit

Types — detect from set type or infer from fields:

• set type ipmask + set subnet → type: "subnet" (convert mask to CIDR); promote a /32 (or IPv6 /128) result to type: "host"
• set type iprange + set start-ip / set end-ip → type: "range", value: "start-end"
• set type fqdn + set fqdn → type: "fqdn"
• set type geography + set country → type: "geo" (warn: limited cross-platform support)
• set type wildcard + set wildcard → type: "wildcard" (preserve the wildcard value; "network" is NOT a valid schema type) with info warning
• set type wildcard-fqdn + set wildcard-fqdn → type: "fqdn" (convert from wildcard-fqdn with info warning)

Also extract: set comment, set associated-interface. Convert subnet mask notation (255.255.255.0) to CIDR (/24). Auto-detect IP version.

IPv6 Address Objects: config firewall address6 → edit

• set ip6 → type: "subnet" (or "host" if /128)

IPv6 Address Groups: config firewall addrgrp6 → edit

• set member

3. Address Groups

Path: config firewall addrgrp → edit Extract: set member (space-separated quoted names)

4. Service Objects

Path: config firewall service custom → edit Extract from:

• set protocol TCP/UDP/SCTP + set tcp-portrange / set udp-portrange / set sctp-portrange
• set protocol ICMP + set icmptype / set icmpcode
• set protocol IP + set protocol-number → preserve the IP protocol number ` (e.g. GRE=47, ESP=50) as the service object's protocol (the numeric value, or via a warning). Only emit protocol: "any" when set protocol IP genuinely means all IP protocols (no protocol-number, or protocol-number 0`).
• set protocol ICMP6 → protocol: "icmpv6"
• Port range format: 80 or 80-443 or 80:1024-65535 (dst:src)
• Note: A single custom service can set ANY combination of tcp-portrange, udp-portrange, and sctp-portrange simultaneously. Split into separate service objects — one TCP, one UDP, and/or one SCTP — according to which ranges are present.

5. Service Groups

Path: config firewall service group → edit Extract: set member

6. Security Policies

Path: config firewall policy → edit

For each policy extract:

• name — set name (FortiGate uses numeric IDs as primary key, name is optional)
• src_zones — set srcintf (interface or zone names)
• dst_zones — set dstintf
• src_addresses — set srcaddr
• dst_addresses — set dstaddr
• services — set service
• applications — set application (application control IDs/names)
• action — set action accept → "allow", set action deny → "deny"
• log_start — set logtraffic-start enable (start logging is controlled separately from logtraffic)
• logend — set logtraffic all. set logtraffic utm logs UTM/security events only, NOT end-of-session traffic — map to logend: false and note UTM-only logging in metadata.warnings
• disabled — set status disable
• description — set comments
• schedule — set schedule
• source_users — set groups (FSSO groups)

Policy NAT (do NOT emit a policy nat field — the policy schema has no nat field): FortiGate per-policy source NAT (set nat enable, optionally with set ippool enable + set poolname ) must be translated into a nat_rules[] source-NAT entry, NOT a flag on the policy:

• set nat enable alone → source-NAT (interface/egress overload) on the policy's dstintf, scoped to the policy's srcaddr/dstaddr.
• set nat enable + set ippool enable + set poolname → source-NAT using the named IP pool ` (cross-reference config firewall ippool`).
• If the source-NAT intent cannot be resolved to a concrete nat_rules[] entry, preserve it as a metadata.warnings / residual_raw note rather than inventing a policy field.

Default values when fields are omitted from config:

• action defaults to accept (→ "allow")
• logtraffic defaults to utm on accept policies (→ log_end: false; UTM-event logging only)
• status defaults to enable (→ disabled: false)

UTM / Security Profiles — when set utm-status enable:

• set av-profile → antivirus
• set webfilter-profile → URL filtering
• set ips-sensor → IPS/IDP
• set application-list → application control (do NOT emit an application-list security-profile key — it is not a schema-supported profile key; signal app-control presence via security_services.app_id at device level and/or store the profile reference in security_profile_objects / metadata.warnings)
• set ssl-ssh-profile → SSL inspection
• set dnsfilter-profile → DNS filtering
• set emailfilter-profile → email filtering
• set dlp-profile → DLP
• set profile-group → profile group (overrides individual profiles)

7. NAT Rules

Source NAT (IP Pools): config firewall ippool → edit Extract: set startip, set endip, set type (overload, one-to-one, fixed-port-range), set associated-interface — binds pool to specific egress interface

Central SNAT: config firewall central-snat-map → edit Extract the full FortiOS central-SNAT field set so real rules are not missed:

• set srcintf — source interface(s)
• set dstintf — destination/egress interface(s)
• set orig-addr — original (pre-NAT) source addresses
• set dst-addr — destination addresses the rule matches
• set nat enable|disable — whether this entry performs NAT (a disabled entry = no-NAT exemption; preserve it)
• set nat-ippool (also set natippool variant) — translated source pool; absent → egress-interface overload
• set protocol and set orig-port / set nat-port where present — protocol/port scoping

Map to a nat_rules[] source-NAT entry (or a no-NAT exemption when nat disable).

Destination NAT (VIPs): config firewall vip → edit Extract: set extip (original dest), set mappedip (translated dest), set extintf, set portforward enable + set extport / set mappedport Note: VIPs are referenced in policies via set dstaddr

8. Schedules

Recurring: config firewall schedule recurring → edit Extract: set day, set start, set end One-time: config firewall schedule onetime → edit Extract: set start, set end Group: config firewall schedule group → edit Extract: set member

9. Application Mapping (L7 → Canonical)

FortiGate supports L7 application control via set application on policies. These reference FortiOS application IDs or names from the application control database.

Extracting application references from policies:

• set application — space-separated application IDs or names
• set application-list — references an application control list profile (separate from direct app match)

Resolving FortiOS application names to canonical:

| FortiOS Name | Canonical App | Category | |-------------|---------------|----------| | HTTPS | https | web | | HTTP | http | web | | SSH | ssh | remote-access | | RDP | rdp | remote-access | | DNS | dns | network-mgmt | | SMTP | smtp | email | | NTP | ntp | network-mgmt | | SNMP | snmp | network-mgmt | | FTP | ftp | file-transfer | | TFTP | tftp | file-transfer | | SIP | sip | voip | | LDAP | ldap | auth | | Kerberos | kerberos | auth | | SMB | smb | file-transfer | | MySQL | mysql | database | | MSSQL | mssql | database | | PostgreSQL | postgresql | database | | MongoDB | mongodb | database | | Zoom | zoom | collaboration | | Microsoft.Teams | ms-teams | collaboration | | Slack | slack | collaboration | | YouTube | youtube | streaming | | Netflix | netflix | streaming |

On policy output: When set application values are resolved, populate the policy's apps array with { vendor_name: "HTTPS", canonical: "https", confidence: 1.0, category: "web" }. The services array keeps any set service matches separately.

Application control list profiles (config application list) define grouped app-control policies. These do not map 1:1 to application groups — they are UTM profiles that filter applications by category, risk, or specific app ID. The schema has no application-list profile key — represent app-control presence via security_services.app_id (device-level) and store the profile reference in security_profile_objects and/or metadata.warnings. Do not try to decompose the list into individual apps.

Unresolvable apps: FortiOS numeric app IDs without a known name mapping → set confidence: 0.0, preserve the ID as vendor_name, and warn.

9b. Application Groups

FortiOS does not have explicit application groups in the same way PAN-OS does. The closest equivalent is config application group which groups application control signatures.

Path: config application group → edit Extract: set application — member application IDs/names. Resolve each member to canonical. Store in application_groups array.

If a group contains a mix of L7 apps and port-based services, split them appropriately.

10. Security Profile Definitions

Parse full profile objects for reference:

• config antivirus profile
• config webfilter profile
• config ips sensor
• config application list
• config firewall ssl-ssh-profile

11. Routing

• Static routes (IPv4): config router static → edit with set dst, set gateway, set device, set distance
• Static routes (IPv6): config router static6 → edit with same fields using IPv6 prefixes
• BGP: config router bgp — extract:
• set as, set router-id, global set keepalive-timer/set holdtime-timer
• Per-neighbor (in config neighbor): remote-as, description, update-source, password (record presence only — redact the value, never emit it), per-neighbor timers (override global), next-hop-self, soft-reconfiguration, route-reflector-client, status enable|disable
• config network entries (prefix advertisements)
• config redistribute with set status enable|disable
• Warn: route-map/prefix-list references are not converted
• OSPF: config router ospf — extract:
• set router-id, set auto-cost-reference-bandwidth
• config area: area ID, type (stub/nssa with no-summary), default-cost, authentication
• config ospf-interface: area assignment, passive flag, cost, priority, hello/dead intervals, network-type (point-to-point/broadcast), MD5 authentication with key ID (record key presence only — redact the key value)
• config redistribute: source, status, metric, metric-type
• Warn: MD5 keys in cleartext in source config (key values are never emitted in output)
• OSPFv3: config router ospf6 — same structure but uses config ospf6-interface (not ospf-interface)
• Policy routing: config router policy → PBF rules

12. Infrastructure

• Version: Extract from #config-version=: comment line at top of config
• System Global: config system global → extract set hostname
• DNS: config system dns → extract set primary, set secondary, set domain
• NTP: config system ntp with nested config ntpserver → extract server entries
• Admin Users: config system admin → extract access profile (superadmin→super-admin, profadmin→admin), SSH public keys (ssh-public-key1/2/3). Warn when users lack SSH keys.
• HA: config system ha — set mode (a-p/a-a), set group-id, set priority,

set hbdev, set monitor

• Screen/DoS: config firewall DoS-policy + IPS sensor definitions
• Syslog: config log syslogd setting
• DHCP Server: config system dhcp server — extract top-level fields (set default-gateway, set netmask, set interface, set domain, set lease-time, set dns-server1/dns-server2) plus nested config ip-range (start-ip/end-ip) and config reserved-address (mac, ip, description). Derive network CIDR from gateway + netmask.

FortiOS compound proposal parsing for VPN: FortiOS encodes IKE/IPsec proposals as compound strings. Do NOT assume every proposal is a simple encryption-integrity pair

…

Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

• Author: fastrevmd-lab
• Source: fastrevmd-lab/fwskillsshare
• License: Apache-2.0
• Homepage: https://mechub.org

Install and usage instructions live in the source repository linked above.