Skip to content

FT: [FortiGate] Support 8.0#463

Open
KarelChanivecky wants to merge 3 commits into
srl-labs:masterfrom
KarelChanivecky:ft_fortigate_8_0_support
Open

FT: [FortiGate] Support 8.0#463
KarelChanivecky wants to merge 3 commits into
srl-labs:masterfrom
KarelChanivecky:ft_fortigate_8_0_support

Conversation

@KarelChanivecky

@KarelChanivecky KarelChanivecky commented May 29, 2026

Copy link
Copy Markdown

Purpose

This PR updates the existing fortinet/fortigate/launch.py launcher to
address several deficiencies in CLI pattern parsing and bootstrap sequencing.

These changes allow the launcher to support a broader set of FOS-derived
products, such as FortiProxy, as well as newer FortiGate versions. The pattern
recognition and command execution logic has been refactored into a table-based
finite state machine to make future feature support easier to add.

This PR does not add new user-facing features. It focuses on making the
existing launcher work reliably across the tested Fortinet images.

Fixes #461

Changes

  • Improve CLI state detection using more version-tolerant regex patterns.
  • Refactor bootstrap_spin() into a table-based finite state machine.
  • Add a command queue mechanism for ordered CLI operations.
  • Handle credential change requests during first login.
  • Handle hostname update flow.
  • Add explicit fatal exits for unrecoverable startup errors.
  • Add state logging to improve debugging.
  • Log all terminal output, not only unmatched output.
  • Detect missing VM images and fail with a clear error.
  • Improve the error message when launch fails because the configured password
    does not satisfy Fortinet password policy requirements.

Testing

Test:

  • Deploy the VM with containerlab.

Assert:

  • Hostname is updated.
  • Credentials are set.
  • The appliance is reachable over SSH.

Tested on:

  • FGT 8.0.0 build0167 GA (Debug)
  • FGT 7.6.6 build3652 GA (Debug)
  • FGT 7.4.12 build2902 GA
  • FGT 7.0.19 build0696 GA
  • FGT 6.4.16 build2098 GA
  • FPX 7.6.6 build1628 GA
  • FPX 7.4.13 build0722 GA (Debug)
  • FPX 7.2.16 build0465 GA
  • FPX 7.0.23 build0222 GA

Notes

  • The default launch.py password was not changed. Some FortiProxy images may
    ship with a stricter default password policy. To launch those images
    successfully, pass a compliant password with the password argument.
  • Internal impl detail: The cmd prompt detection is purposely not handling vdom. For the implemented cmd state, we assume we arrive at global scope, and will end at global scope. Thus, something like "FGT-VM64-KVM (root) (Interim)# " will not be handled.

- Improve CLI state detection. Regex patterns were checked against
  source code ensuring compatibility from 7.0 and accross similar
  product families such as FortiProxy.
- Refactor bootstrap_spin into a table-based FSM.
- Add command queue mechanism.
- Handle credential change request.
- Handle hostname update.
- Add exits on error.
- Add state logging to help with debugging.
- All terminal output is logged. Not just unmatched output.
- Handle missing VM image.
- Better error message when fail to launch due to not meeting password
  policy

Tested on:
- FGT 8.0.0:0167 GA (Debug)
- FGT 7.6.6:3652 GA (Debug)
- FGT 7.4.12:2902 GA
- FGT 7.0.19:0696 GA
- FGT 6.4.16:2098 GA
- FPX 7.6.6:1628 GA
- FPX 7.4.13:0722 GA (Debug)
- FPX 7.2.16:0465 GA
- FPX 7.0.23:0222 GA
@KarelChanivecky KarelChanivecky changed the title FT: [FGT] Support 8.0 FT: [FortiGate] Support 8.0 May 29, 2026
Non admin user terminal prompts are terminated with $ instead of #. Also, the build label in the prompt is limited to STS or Interim values.
@KarelChanivecky

Copy link
Copy Markdown
Author

Please hold. There is a change coming in the default hostname string that will not match the regex in this PR.

@KarelChanivecky

Copy link
Copy Markdown
Author

Please hold. There is a change coming in the default hostname string that will not match the regex in this PR.

Fixed with d077076

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

FortiGate stuck unhealthy after reboot

1 participant