FortiManager ➔ Gobo Pipeline
Daily Cron Active (05:07 AM)
System Documentation

Fortinet FortiManager to Gobo ETL Automation

Technical architecture, cron execution schedule, data formats, and operation guidelines for extracting Fortinet device inventory & running configurations into the Gobo Framework.

10.6.152.66
FortiManager Primary Target IP
05:07 AM
Daily Execution Trigger
15 Devices
Optimized Batch Chunk Size
JSON-RPC / REST
API Interfaces
Daily Cron Pipeline Architecture
Automated 3-stage sequence executed every morning on root@iinreslvddocker1
STAGE 1 • 05:07 AM

inventory.sh

Authenticates to FortiManager, extracts device catalog to devices.json, formats device list, and splits into 15-device batch chunks.

Output: /gobo/list/devices_*
STAGE 2 • 05:10 AM

Device List Upload

Executes app.py via Python to import raw device inventory metadata directly into Gobo Framework API.

POST /inventory/.../import
STAGE 3 • 05:25 AM

configs.sh

Loops over batched device lists, extracts running configs from FortiManager via /deployment/export/config, and posts payloads to Gobo.

Logs: config_import.log
Script Breakdown
Detailed operation of inventory.sh and configs.sh
📄 inventory.sh 2,779 bytes
  • Authentication: Issues POST request to https://10.6.152.66/jsonrpc (method: /sys/login/user) with user fortiapi.
  • Session Token: Uses jq to extract session key into FORTI_SESSION.
  • Full Dump: Calls /dvmdb/device to get raw JSON list of all managed devices and saves to devices.json.
  • List Generation: Re-queries /dvmdb/device, filters names via jq & awk, writing plain text names to list.txt.
  • Logout: Safely calls /sys/logout to close FortiManager session.
  • Batch Split: Clears /list/* directory and splits list.txt into 15-device chunks (e.g. devices_aa).
📄 configs.sh 2,729 bytes
  • Session Token: Re-authenticates to FortiManager and acquires session token.
  • Directory Loop: Reads each chunk file in /home/zkovacs/fortiapi/gobo/list/.
  • Config Export: For each device in chunk, calls FortiManager endpoint /deployment/export/config.
  • JSON Structuring: Combines device configurations into <chunk>_configs.json matching Gobo import schema.
  • Gobo Import: Invokes gobo-api-client/app.py with GCP service account credentials to post JSON to Gobo.
  • Cleanup & Logout: Logs response to config_import.log, deletes batch JSON, and logs out.
High Availability (HA) Context
Target FortiManager cluster topology and failover behavior
Primary Node (FMG2KET319000049) ACTIVE TARGET

IP: 10.6.152.66

Current target for all script API calls. Handles read/write operations and config exports.

Secondary Node (FMG2KET319000048) STANDBY

IP: 10.186.152.66

Synchronized database copy. Does not process primary management API requests.

Operational Note on Manual Failover Mode: The cluster is configured with Failover Mode: Manual (no Virtual IP / VRRP enabled). Therefore, automatic failovers will not occur unexpected. If an admin manually promotes the secondary unit (10.186.152.66), the script IP must be updated accordingly.
Interactive Data Sample Explorer
Inspect exact data formats generated and processed at each step
{
  "result": [
    {
      "data": [
        {
          "name": "FW-HQ-PRIMARY",
          "devid": "FG100E3917800001",
          "ip": "10.6.10.1",
          "platform_str": "FortiGate-100E",
          "os_ver": 7,
          "os_type": "fos",
          "conn_status": 1,
          "db_status": 0
        },
        {
          "name": "FW-BRANCH-CHICAGO",
          "devid": "FG60E4821900042",
          "ip": "10.12.20.1",
          "platform_str": "FortiGate-60E",
          "os_ver": 7,
          "os_type": "fos",
          "conn_status": 1,
          "db_status": 0
        }
      ]
    }
  ],
  "id": 1
}
FW-HQ-PRIMARY
FW-BRANCH-CHICAGO
FW-BRANCH-DALLAS
FW-BRANCH-MIAMI
FW-BRANCH-SEATTLE
FW-DC-EAST
FW-DC-WEST
FW-STORE-001
FW-STORE-002
FW-STORE-003
FW-STORE-004
FW-STORE-005
FW-STORE-006
FW-STORE-007
FW-STORE-008
FW-STORE-009
FW-STORE-010
# Chunk file: /home/zkovacs/fortiapi/gobo/list/devices_aa (15 lines max)
FW-HQ-PRIMARY
FW-BRANCH-CHICAGO
FW-BRANCH-DALLAS
FW-BRANCH-MIAMI
FW-BRANCH-SEATTLE
FW-DC-EAST
FW-DC-WEST
FW-STORE-001
FW-STORE-002
FW-STORE-003
FW-STORE-004
FW-STORE-005
FW-STORE-006
FW-STORE-007
FW-STORE-008
[
  {
    "devid": "FW-HQ-PRIMARY",
    "configuration": "#config-version=FG100E-7.0.12-build0523\nconfig system global\n    set hostname \"FW-HQ-PRIMARY\"\n    set timezone 04\nend\nconfig system interface\n    edit \"port1\"\n        set ip 10.6.10.1 255.255.255.0\n        set allowaccess ping ssh https\n    next\nend\n"
  },
  {
    "devid": "FW-BRANCH-CHICAGO",
    "configuration": "#config-version=FG60E-7.0.12-build0523\nconfig system global\n    set hostname \"FW-BRANCH-CHICAGO\"\nend\n"
  }
]
# Successfully processed 15-device payload to Gobo API
{
  "status": "success",
  "imported_records": 15,
  "job_id": "dfcc036a-a6b5-4ac8-b69b-7de22a71df79",
  "timestamp": "2026-08-05T05:26:40Z"
}
# Historical Error log when batch size was 35 devices (exceeded HTTP body limit)
<meta http-equiv="content-type" content="text/html;charset=utf-8">
<title>413 Request Entity Too Large</title>
</head>
<body text=#000000 bgcolor=#ffffff>
<h1>Error: Request Entity Too Large</h1>
<h2>Your client issued a request that was too large.</h2>
</body></html>
Incident Analysis & Batch Optimization
Details of the HTTP 413 error and resolution
!
Resolved Issue: HTTP 413 Request Entity Too Large

On 2026-08-05 05:26:28, the execution failed because batch payloads contained 35 full FortiManager configurations. The aggregate JSON file size exceeded the max HTTP POST payload limit imposed by the Gobo API gateway / GCP load balancer.

- split -l 35 /home/zkovacs/fortiapi/gobo/list.txt /home/zkovacs/fortiapi/gobo/list/devices_
+ split -l 15 /home/zkovacs/fortiapi/gobo/list.txt /home/zkovacs/fortiapi/gobo/list/devices_

✔ Resolution: Decreasing batch limit to 15 lines ensures all JSON payloads remain comfortably below the upload size threshold.