fortigate-firewall-operations

name	fortigate-firewall-operations
description	Operational runbook for the FortiGate agent — safe device blocking, firewall policy audits, overly-permissive rule detection, and wireless client troubleshooting.

FortiGate Firewall Operations Runbook

Use these procedures when managing the FortiGate via the MCP tools. Start every investigation with read-only discovery before taking any control action.

Discovery-first triage (always run these before acting)

• system_status — hostname, firmware, serial, uptime
• system_resources — CPU, memory, disk, session count (high sessions = possible flood)
• ha_status — confirm which node is primary before any change
• list_dhcp_leases, list_detected_devices, list_wireless_clients — see who is on the network

Blocking a device (preferred: targeted deny policy)

Do NOT disable infrastructure (SSIDs/APs) to block one device — that hits everyone.

1. Identify the device: list_detected_devices / list_dhcp_leases to get its IP/MAC and confirm it's the right host.
2. Use create_temporary_block_policy to create a targeted deny rule for that address.
3. State the exact source/scope of the block and confirm before creating.
4. To reverse: disable_firewall_policy (or delete) the temporary block policy.

Firewall policy audit

1. list_policies, then get_firewall_policy / get_policy for details.
2. For each policy report: action (accept/deny), NAT on/off, logging on/off, src, dst, service.
3. Flag as risky any policy with action accept AND source all AND destination all — these are overly permissive. Recommend tightening to specific objects.
4. Note any accept policy with logging disabled (blind spot for incident response).

Enabling / disabling policies

• enable_firewall_policy / disable_firewall_policy.
• Disabling an allow policy can break legitimate traffic — summarize what the policy permits and confirm before disabling.

Wireless troubleshooting & control

• list_ssids (VAPs) and list_wireless_clients (filter by SSID/AP/band) to scope the issue.
• To remove one client: disconnect_wireless_client (least-blast-radius option).
• disable_ssid affects EVERY client on that SSID — treat as high-impact. Always confirm, and prefer disconnecting individual clients first.
• Re-enable with enable_ssid.

NAT / objects reference

• list_vips = destination NAT (inbound). list_central_snat + list_ip_pools = source NAT.
• list_addresses / list_address_groups / list_services / list_service_groups for objects before referencing them in a policy.

Error code cheat sheet

• 401 = invalid/expired API token
• 403 = permission denied (token lacks the required profile)
• 404 = object not found
• 409 = already exists

Present results as tables; only dump raw JSON when explicitly asked.