Draft: Ft license support#475
Draft
KarelChanivecky wants to merge 9 commits into
Draft
Conversation
- Improve CLI state detection. Regex patterns were checked against source code ensuring compatibility from 7.0 and accross similar product families such as FortiProxy. - Refactor bootstrap_spin into a table-based FSM. - Add command queue mechanism. - Handle credential change request. - Handle hostname update. - Add exits on error. - Add state logging to help with debugging. - All terminal output is logged. Not just unmatched output. - Handle missing VM image. - Better error message when fail to launch due to not meeting password policy Tested on: - FGT 8.0.0:0167 GA (Debug) - FGT 7.6.6:3652 GA (Debug) - FGT 7.4.12:2902 GA - FGT 7.0.19:0696 GA - FGT 6.4.16:2098 GA - FPX 7.6.6:1628 GA - FPX 7.4.13:0722 GA (Debug) - FPX 7.2.16:0465 GA - FPX 7.0.23:0222 GA
Non admin user terminal prompts are terminated with $ instead of #. Also, the build label in the prompt is limited to STS or Interim values.
Basic support is added by reading from the standard config file location and writing to terminal. Added minimal config nesting detection to prevent the VM from hanging waiting for config scope exit.
Added support for static IP by configuring the VM management interface to use the configured IP of the container. Pass-through is now set as the default mode. This choice was made as the behavior is more intuitive. The host-forwarded mode needs more configuration to get proper default routes working. Updated the README for fortigate Added Fortinet/FortiGate to the list of NOS that set pass-through as default
This resolves routing table conflicts with in case the lab needs default routing.
Copied implementation from SROS. Mostly, their hack to make the server reachable from the VM. This creates a private namespace where the tftp is attached to. TFTP packets directed towards the mgmt network gateway are redirected towards the private namespace. Packets out of the namespace are redirected back to the VM. However, I had to add logic to rewrite the MAC address of these return packets to the MAC of the VM as they would originally be destined towards the MAC of the bridge between the private and root namespaces.
KarelChanivecky
force-pushed
the
ft_license_support
branch
from
09d310c to
fbdb93e
Compare
added 2 commits
June 25, 2026 17:48
Support for configuring the appliance with a license was added. There is failure detection, such that the VM will stop deployment and report an error in such case. All this is achieved through the tftp server in the container. Added a new waiting_for mechanism. This way, we can chose to ignore dispatched states until one of a few specified states to wait for is reached. This handles the fact that after the VM accepts the license the cmd prompt can be reached again although its usage for continuing configuration is no longer reliable.
Refactored the logic into a more generic PassthroughRedirect class. This should enable reusability for other OS implementations.
KarelChanivecky
force-pushed
the
ft_license_support
branch
from
fbdb93e to
3a72f21
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Purpose
To support automatic license configuration in Fortinet devices.
Chained to #467
Details
Enabled using TFTP server in Host-Forwarded and Passthrough mgmt modes. The logic to enable this in pt mgmt mode was copied from nokia/sros implementation where specific traffic with destination to the mgmt gw is instead redirected to a private namespace and redirected back to the VM on the return.
The logic itself for the redirect was refactored into a separate module with the idea of eventually moving it to common modules such that other OSs that want to take advantage of the same procedure can.
The license installation itself happens by uploading via tftp server. The tftp server uses /tftpboot dir and appliance.lic is expected to be present in that dir containing the license info.
Testing
Testing was done using containerlab to mount the license file. The PR enabling this is still in review:
srl-labs/containerlab#3228
Mgmt passthrough is default in the tests.
TEST: Configure a lab topology with a fortigate node where a license is specified. Launch the lab and observe the node logs
EXPECT: License update occurs successfully. Node reaches running healthy state
RESULT: As expected
TEST: Configure a lab topology with a fortigate node where a license is specified. Launch the lab, wait for running healthy state. Restart the node. Observe the logs
EXPECT: License update occurs successfully for each restart. Node always reaches running healthy state
RESULT: As expected
TEST: Configure a lab topology with a fortigate node where a license is specified. The license file is corrupted. Launch the lab and observe the node logs
EXPECT: License update fails, an appropriate warning is displayed in the logs. Node exits
RESULT: As expected
TEST: Configure a lab topology with a fortigate node where a license is specified. Disable mgmt passthrough using env vars. Launch the lab and observe the node logs
EXPECT: License update occurs successfully. Node reaches running healthy state
RESULT: As expected