Feature catalog

The complete list, grouped by area. Everything below ships in the repository today — no roadmap items, no vaporware.

🧭

Policy & WAF management (FortiWeb)

  • Server Policy table mirroring the FortiWeb GUI with minimal-diff saves — only changed fields are written to the device
  • Guided policy clone / migrate across devices: pre-flight checklist, dummy-VIP rules, reference resolution
  • Safe cascade delete with dependency preview
  • Full Signatures editor with per-signature exception management
  • Guided WAF exceptions with template locks and lifecycle tracking (detect → inject → review)
  • Web Protection area mirroring the FortiWeb 7.6 menu — 166 curated object kinds
🧩

Generic object management

  • Spec-driven form engine making ~500 registry endpoints editable through one engine — stacked slide-over panels, create-references-in-place, dry-run preview on every write
  • Endpoint registry in the database: when a firmware upgrade moves a REST URI, the operator fixes it from the UI
  • Live API consoles per product with audited, permission-gated writes
  • Fleet-wide object search across every device's cached configuration
  • Naming-convention rules, section taxonomy, field catalogs, datasheets
🌐

Multi-product workspaces

  • Global, FortiWeb and FortiADC workspaces with per-browser-tab product context and strict data scoping
  • FortiADC: load-balancer objects, virtual servers, real-server pools, LB lookup, certificate deploy over REST
  • FortiAnalyzer: full JSON-RPC integration speaking both API dialects, live registry-bound menu, Device Manager views
📦

Device operations

  • Discovery / rediscovery and deep capture into a normalized local cache (DB-first reads, refresh-live escape hatch)
  • Config backups over REST with automatic SSH/CLI fallback, plus a restore vault
  • Firmware upgrade runbooks and boot-partition management
  • Built-in SSH console with read-only command presets
  • Provisioning workflows, hardware inventory, capacity views
🗂️

Source of truth & backups

  • Git source of truth: every appliance's config harvested into versioned JSON, refreshed hourly, auto-published
  • System Backup & Restore: database bundles, device vault, one-click code rollback, embedded recovery runbook
  • Backup coverage matrix — every stream with format, destinations, cadence and a live state badge
  • External SFTP backup server integration with per-device browse / compare / search / download
  • Firmware source of truth: manifest in git, binaries on the backup server, sha256-verified pulls
  • Git drift view and reports history with an A→B diff viewer
🔁

High availability

  • Two-node primary/standby with PostgreSQL streaming replication and a role-guarded 5-minute data sync
  • Replication TLS-enforced with mutual certificate verification against an internal CA
  • Git-driven reconciler keeps deployments converged with the repository
  • Cluster status page; node-to-node HTTPS probes authenticated with a shared identity key
🔐

Security

  • Local users with two-factor authentication, LDAP auth, granular RBAC
  • Audit log on every write path; Change Requests with maintenance-window approval gates
  • Scoped API tokens (read ⊂ write ⊂ admin, owner-capped, product-bound)
  • Secrets encrypted at rest; nonce-based CSP; rate limiting; object locks
  • Node TLS manager: import or issue from the internal CA, nightly auto-renew, auto-rollback on bad imports
  • Encryption-in-transit monitoring — every badge backed by a live probe
⏱️

Automation & self-management

  • Scheduled actions catalog: config syncs, backups, certificate scans, nightly inspections — per-product targeting
  • Background jobs with pause / resume / stop
  • Self-update from the UI via a privileged runner with per-step logs and health verification
  • Library manager: PyPI update checks plus per-package pip upgrade / rollback with automatic failure rollback
📜

Certificates

  • Central Certificate Manager with issuance via ADCS or ACME
  • Lifecycle policy: revoke-on-supersede, expiry sweeps, SNI policies
  • Private-key upload over SSH and REST deploy to FortiADC; fleet-wide inventory and live probes
📈

Observability & analysis

  • Monitoring dashboard, metrics, infrastructure health and system health pages
  • FortiView traffic analysis and packet capture
  • DNS & LB lookup, log collection, flash reports, capacity planning
  • E-mail notifications, release-notes tracker, in-app documentation viewer
📊

Reporting

  • Report Builder: no-SQL wizard plus 7 built-in reports
  • Live ER diagram of the schema and database introspection views
🛠️

Developer & power tools

  • Lua Studio and Regex Lab with curated example libraries
  • Plugin system with a sandboxed runtime and examples
  • API explorer, import-from-backup, baselines, built-in bug reporting
🚀

Deployment

  • Interactive Linux installer — online (any major distro family) or fully air-gapped offline bundles for Debian 12 and RHEL 9
  • Standalone or 2-node cluster: the secondary joins with a single pasted key and mints its own certificate
  • systemd units, nginx TLS front, gunicorn, PKI bootstrap, sysadmin manual with sudoers policy
  • 700+ unit and integration tests