skills.rest
automateyournetwork
automateyournetworkCOMMUNITY
Explore all skills by this author →
Website𝕏@john_capobiancoGitHub

fortigate-ops

Inspect FortiGate device state including interfaces, routes, IPsec tunnels, and manager drift.

650|182|Updated Feb 19, 2026
Search Tags:#drift detection#firewall#network operations#ipsec#fortigate#fortios#vpn troubleshooting
One-click install
npx skills add https://github.com/automateyournetwork/netclaw --skill fortigate-ops
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: fortigate-ops
Source: https://github.com/automateyournetwork/netclaw/tree/main/workspace/skills/fortigate-ops
Command: npx skills add https://github.com/automateyournetwork/netclaw --skill fortigate-ops

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Network engineers often cannot tell what a FortiGate firewall is actually doing right now versus what FortiManager intended it to do, and IPsec tunnel status is frequently misreported because phase 1 and phase 2 get collapsed into a single ambiguous state.

Core Features & Use Cases

  • Observed device state: Read system status, interfaces, routing tables, and running firewall policies directly from the FortiGate via the FortiOS REST API, always scoped to the answering member and VDOM.
  • Split-phase IPsec reporting: Report phase 1 and phase 2 tunnel status separately, including per-selector detail, so a phase-1-up/phase-2-down selector mismatch is never hidden.
  • Manager-vs-device drift detection: Compare the device's running policy against the FortiManager package to surface out-of-band changes made directly on the box.
  • Use Case: Ask whether a site-to-site VPN tunnel is up and learn that IKE phase 1 is established but one of five phase 2 selectors is down due to a proxy-ID mismatch, then check the routing table for a path to the remote gateway.

Quick Start

Ask the agent to check whether the IPsec tunnel on your FortiGate is up and to report phase 1 and phase 2 status separately.

Frequently Asked Questions about fortigate-ops

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I check if a FortiGate IPsec VPN tunnel is up?▼

Query the device's tunnel state and read phase 1 and phase 2 status separately rather than a single combined status. Phase 1 down indicates an IKE, peer, or routing problem, while phase 1 up with phase 2 down indicates a proxy-ID or selector mismatch.

How to detect out-of-band changes on a FortiGate firewall?▼

Compare the device's running firewall policy against the FortiManager ADOM policy package. Rules present only on the device reveal direct changes made outside the manager, and rules only in the manager indicate a package not yet installed.

What is the difference between FortiGate device state and FortiManager intent?▼

The FortiGate knows what it is currently doing, while FortiManager knows what it was supposed to do. Device-plane queries return observed state like routes and tunnel status, whereas manager-plane queries return intended policy across the estate.

Why does every FortiGate API call return 401 authentication errors?▼

An unlicensed FortiGate refuses REST authentication entirely, returning 401 regardless of token validity, trusthost, or admin profile. Check the system status for a valid license before suspecting the API token.

Can this skill change FortiGate firewall policies?▼

No, it is strictly read-only with no write path. Policy changes must go through FortiManager operations with its approval gates, while this skill only observes and compares device state.

Why does a FortiGate-VM lab show only a few policies and routes?▼

An evaluation-licensed FortiGate-VM is capped at 1 vCPU, 2 GB RAM, 3 interfaces, 3 routes, and 3 firewall policies. A small ruleset on such a device reflects the lab license limit, not the estate's real posture.

Related Skills

Explore More Software Engineering Skills→
phuetzphuetz
30

figma

Automate Figma design workflows via REST API, Plugin API, and MCP server.

Community
Intermediate
dgethingsdgethings

fortimanager-ops

Audit FortiManager ADOM configurations and policy packages via MCP.

Community
Intermediate
psaabpsaab
8

security-matrix

Validate firewall policy enforcement and dataplane throughput with real traffic capture.

Community
Advanced
jezwebjezweb
989

wordpress-setup

Connects to WordPress sites via WP-CLI over SSH or REST API and verifies access.

Community
Intermediate