1.4 Fortinet Security Fabric & Device Integration

Fortinet Security Fabric & Device Integration

Modern enterprise attack surfaces extend across multi-cloud environments, remote endpoints, campus networks, and industrial control systems. The Fortinet Security Fabric is an open, integrated architectural framework that unifies disparate security technologies—including FortiGate firewalls, FortiSwitch access switches, FortiAP wireless access points, FortiAnalyzer logging nodes, FortiClient EMS endpoint managers, FortiManager orchestrators, and FortiSandbox threat appliances—into a single collaborative defense ecosystem.

---

Security Fabric Core Vision & Architectural Principles

The Fortinet Security Fabric addresses the challenges of fragmented point-security solutions by implementing three core operational pillars:

1. Broad Visibility: Complete broad spectrum visibility across the entire digital attack surface, covering physical network switches, wireless APs, hybrid cloud infrastructure (AWS, Azure, GCP), endpoints, and IoT devices.
2. Integrated Detection: Continuous synchronization of threat intelligence across all fabric components. When one sensor (such as FortiSandbox or FortiClient EMS) detects an unknown malware variant or zero-day threat, indicators of compromise (IOCs) are dynamically shared across all member firewalls.
3. Automated Response: Automated threat mitigation capabilities that isolate compromised hosts, revoke access credentials, or update perimeter blocklists within seconds without requiring manual SOC operator intervention.

---

Security Fabric Architecture & Core Topology Roles

A Fortinet Security Fabric relies on a hierarchical tree topology structured around specialized device roles:

1. Root FortiGate

The Root FortiGate serves as the central management anchor and intelligence coordinator for the entire Security Fabric deployment. It performs the following vital functions:

• Topology Rendering: Aggregates physical and logical topology maps across all fabric members, presenting a unified interactive visualization in the FortiOS GUI.
• Device Authorization: Manages explicit cryptographic trust relationships, validating device serial numbers, pre-shared keys, and TLS certificates before authorizing joining devices.
• Telemetry Aggregation: Collects asset information, threat telemetry, vulnerability scores, and user identity states from downstream members.
• Centralized Security Orchestration: Pushes global threat intelligence, coordinates fabric-wide quarantine actions, and synchronizes Security Fabric Single Sign-On (FSSO) telemetry.

2. Downstream FortiGate Units

Subordinate FortiGate appliances deployed at branch offices, internal network segments, or data center edges act as Downstream FortiGate members. Downstream units forward local security telemetry to the Root FortiGate and FortiAnalyzer while enforcing localized security policy rules.

# Configuring CSF (Cooperative Security Fabric) on a Downstream FortiGate via CLI
config system csf
    set status enable
    set fabric-name "Enterprise-Global-Fabric"
    set upstream-ip 10.0.1.1
    set upstream-port 8013
    set secretkey EncryptedFabricKey123!
end

---

FortiTelemetry & Security Fabric Communication (TCP Port 8013)

Inter-device communication within the Security Fabric relies on the FortiTelemetry protocol running securely over TCP port 8013. FortiTelemetry encapsulates heartbeat health monitors, asset discovery attributes, dynamic address synchronization payloads, and threat detection alerts using TLS encryption.

Authorization Workflow & Pending State Transitions

When a downstream FortiGate or fabric member initiates a FortiTelemetry session to the Root FortiGate, the Root device places the requesting unit into a Pending Authorization state. Connection requests are blocked from full fabric participation until an administrator explicitly authorizes the device via the GUI (Security Fabric > Fabric Connectors) or CLI.

# Authorizing a downstream fabric member on the Root FortiGate via CLI
config system csf
    config trusted-list
        edit "FGT-BRANCH-05-SN"
            set action accept
            set ha-member disable
        next
    end
end

---

Fabric Ecosystem Component Integration

The Security Fabric integrates specialized Fortinet solutions into a unified management plane:

• FortiSwitch & FortiLink: FortiGate manages FortiSwitch units natively over FortiLink (utilizing CAPWAP and Layer 2 discovery), extending firewall policy enforcement directly to physical switch ports.
• FortiAP Wireless Access Points: Managed natively by the FortiGate integrated Wireless LAN Controller (WLAN), enforcing WPA3 Enterprise authentication and rogue AP mitigation.
• FortiAnalyzer: Centralizes log collection, event correlation, automated IOC threat hunting, and regulatory compliance reporting over OFTP (TCP port 514 / 8888).
• FortiClient EMS (Endpoint Management Server): Synchronizes endpoint zero trust network access (ZTNA) posture tags, OS patch levels, and vulnerability scores over TCP port 8010.
• FortiSandbox: Receives suspicious file payloads extracted by FortiGate flow or proxy inspection engines, executes dynamic sandboxing analysis, and feeds back malicious threat weights to block future executions.

---

Security Fabric Connectors & Cloud Integrations

Fabric Connectors provide API-driven integration between the Fortinet Security Fabric and third-party infrastructure platforms, including public cloud providers (AWS, Microsoft Azure, Google Cloud Platform), private virtualized environments (VMware vCenter, OpenStack), and Identity Providers (Microsoft Entra ID, Okta).

Dynamic Address Objects

Through Fabric Connectors, FortiGate dynamically imports virtual machine (VM) tags, cloud instance metadata, and security group memberships. Administrators build firewall policies utilizing Dynamic Address Objects, eliminating the need to update static IP address definitions when cloud workloads auto-scale.

config firewall address
    edit "AWS-Web-AutoScale-Group"
        set type dynamic
        set sub-type aws
        set sdn "AWS-Production-Connector"
        set filter "tag:Role=WebServer"
    next
end

---

Automation Stitches: Event Triggers & Automated Response

Automation Stitches are event-driven rules within the Security Fabric that automate administrative workflows and threat mitigation. An Automation Stitch pairs a specific Trigger (security event) with one or more Actions (remediations or notifications).

Core Components of Automation Stitches

1. Triggers:

   • Compromised Host: Failsafe alert triggered by FortiClient EMS or FortiSandbox when an endpoint breaches the risk threshold.
   • FortiSandbox Detection: High-risk malware file execution confirmation.
   • System Event Log: System status events (e.g., HA failover, config change, license expiration).
   • Reboot / High Resource Utilization: CPU/Memory threshold breach or conserve mode entry.

2. Actions:

   • Quarantine Host: Automatically blocks host MAC/IP address on FortiSwitch ports, FortiAP SSIDs, or FortiGate ingress interfaces.
   • IP Ban: Appends malicious source IP address to a temporary or permanent blocklist across all fabric firewalls.
   • Email / Webhook Notification: Sends alert notifications to a Slack/Teams webhook, PagerDuty, or Syslog/SIEM collector.
   • CLI Script Execution: Runs a pre-configured CLI script locally on the Root FortiGate or downstream units.

Automation Stitch CLI Implementation Example

# Step 1: Define the Automation Trigger
config system automation-trigger
    edit "Trigger-Malware-Detected"
        set event-type threat-weight
        set level critical
    next
end

# Step 2: Define the Automation Action
config system automation-action
    edit "Action-Quarantine-Host"
        set action-type quarantine
    next
end

# Step 3: Bind Trigger and Action in an Automation Stitch
config system automation-stitch
    edit "Stitch-Auto-Quarantine"
        set trigger "Trigger-Malware-Detected"
        config actions
            edit 1
                set action "Action-Quarantine-Host"
            next
        end
    next
end

---

Fortinet Security Fabric Component Integration Reference