FortiGate Integration Guide

​

Overview

This guide describes how to integrate OneFirewall Alliance (OFA) Threat Feeds into a FortiGate Security Fabric using External Dynamic Lists (EDLs). The integration enables automatic enforcement of security rules based on live threat intelligence from OneFirewall, covering both inbound and outbound traffic.

​

Prerequisites

• Custom Bearer token authentication used by OneFirewall’s API requires FortiOS 6.2.3 or higher.
• Devices running FortiOS prior to 6.2.3 can only ingest unauthenticated feeds, which is incompatible with OneFirewall’s authenticated feed.
• FortiOS 6.4 or 7.x is recommended: secure external connectors with headers, feed auto-refreshing, integration with inbound/outbound policies, and GUI-based management and logging.

​

Step 1: Generate API Token

1. Log into your OneFirewall Alliance profile.
2. Navigate to the API Access section.
3. Generate a JWT token.
4. Save this token securely — it will be used for authenticating feed requests.

​

Step 2: Configure FortiGate External Connector

1. Access your FortiGate device.
2. Go to Security Fabric > External Connectors.
3. Click Create New > Select IP Address Threat Feed.
4. Configure the feed.
5. Set update interval as needed (e.g., every 15 minutes).
6. Save the connector.

​

Step 3: Create Security Policies

Apply the OFA threat intelligence through security policies. This example maps the any keyword to specific network interfaces: