Draft: Ft license support - #475
Closed
KarelChanivecky wants to merge 16 commits into
Closed
Conversation
- Improve CLI state detection. Regex patterns were checked against source code ensuring compatibility from 7.0 and accross similar product families such as FortiProxy. - Refactor bootstrap_spin into a table-based FSM. - Add command queue mechanism. - Handle credential change request. - Handle hostname update. - Add exits on error. - Add state logging to help with debugging. - All terminal output is logged. Not just unmatched output. - Handle missing VM image. - Better error message when fail to launch due to not meeting password policy Tested on: - FGT 8.0.0:0167 GA (Debug) - FGT 7.6.6:3652 GA (Debug) - FGT 7.4.12:2902 GA - FGT 7.0.19:0696 GA - FGT 6.4.16:2098 GA - FPX 7.6.6:1628 GA - FPX 7.4.13:0722 GA (Debug) - FPX 7.2.16:0465 GA - FPX 7.0.23:0222 GA
Non admin user terminal prompts are terminated with $ instead of #. Also, the build label in the prompt is limited to STS or Interim values.
Basic support is added by reading from the standard config file location and writing to terminal. Added minimal config nesting detection to prevent the VM from hanging waiting for config scope exit.
Added support for static IP by configuring the VM management interface to use the configured IP of the container. Pass-through is now set as the default mode. This choice was made as the behavior is more intuitive. The host-forwarded mode needs more configuration to get proper default routes working. Updated the README for fortigate Added Fortinet/FortiGate to the list of NOS that set pass-through as default
This resolves routing table conflicts with in case the lab needs default routing.
Copied implementation from SROS. Mostly, their hack to make the server reachable from the VM. This creates a private namespace where the tftp is attached to. TFTP packets directed towards the mgmt network gateway are redirected towards the private namespace. Packets out of the namespace are redirected back to the VM. However, I had to add logic to rewrite the MAC address of these return packets to the MAC of the VM as they would originally be destined towards the MAC of the bridge between the private and root namespaces.
KarelChanivecky
force-pushed
the
ft_license_support
branch
from
June 26, 2026 00:45
09d310c to
fbdb93e
Compare
Support for configuring the appliance with a license was added. There is failure detection, such that the VM will stop deployment and report an error in such case. All this is achieved through the tftp server in the container. Added a new waiting_for mechanism. This way, we can chose to ignore dispatched states until one of a few specified states to wait for is reached. This handles the fact that after the VM accepts the license the cmd prompt can be reached again although its usage for continuing configuration is no longer reliable.
KarelChanivecky
force-pushed
the
ft_license_support
branch
from
June 26, 2026 00:48
fbdb93e to
3a72f21
Compare
- Refactored Host-Forwarding and Passthrough logic into reusable nodes - Separated launch.py into VM launch layer, CLI interpretation layer, and command layer
KarelChanivecky
force-pushed
the
ft_license_support
branch
from
July 25, 2026 02:06
3a72f21 to
5ec7df9
Compare
added 7 commits
July 27, 2026 19:16
With the new impl, we spin for 10 seconds at a time in the CLI state machine
It was not possible to get the license setup whith the net ifs in vrf1. Instead, now we do all work in root vrf and change over after lic status changes.
FOS_DISK_SPECS env var was added. The env var is supposed to contain a string with a comma-separated list of disk sizes. The sizes are passed directly to qemu-image create. The number of disks is implied from the number of sizes.
A strong password is used at the first prompt. This password will work on release images with stricter requirements. After login, the policies are relaxed and the actual default password is then configured. An added feature is that the current implementation also makes use of the username value. If the username value is admin, then the default admin is modified. If the username is different, then a new super admin account is created. Finally, the params have been modified such that --username without an additional argument results in an empty password.
This feature allows saving the config applied by the user after machine startup. It stores the config of the VM before applying the startup config. When /get-config file is created, it is removed, and the config save is triggered. At this point, the config is obtained from the VM again and is diffed against the initial config. The resulting delta is any configuration aplied by the startup config and the user.
KarelChanivecky
force-pushed
the
ft_license_support
branch
from
July 30, 2026 04:25
5ec7df9 to
30436ed
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Purpose
To support automatic license configuration in Fortinet devices.
Chained to #467
Details
Enabled using TFTP server in Host-Forwarded and Passthrough mgmt modes. The logic to enable this in pt mgmt mode was copied from nokia/sros implementation where specific traffic with destination to the mgmt gw is instead redirected to a private namespace and redirected back to the VM on the return.
The logic itself for the redirect was refactored into a separate module with the idea of eventually moving it to common modules such that other OSs that want to take advantage of the same procedure can.
The license installation itself happens by uploading via tftp server. The tftp server uses /tftpboot dir and appliance.lic is expected to be present in that dir containing the license info.
Testing
Testing was done using containerlab to mount the license file. The PR enabling this is still in review:
srl-labs/containerlab#3228
Mgmt passthrough is default in the tests.
TEST: Configure a lab topology with a fortigate node where a license is specified. Launch the lab and observe the node logs
EXPECT: License update occurs successfully. Node reaches running healthy state
RESULT: As expected
TEST: Configure a lab topology with a fortigate node where a license is specified. Launch the lab, wait for running healthy state. Restart the node. Observe the logs
EXPECT: License update occurs successfully for each restart. Node always reaches running healthy state
RESULT: As expected
TEST: Configure a lab topology with a fortigate node where a license is specified. The license file is corrupted. Launch the lab and observe the node logs
EXPECT: License update fails, an appropriate warning is displayed in the logs. Node exits
RESULT: As expected
TEST: Configure a lab topology with a fortigate node where a license is specified. Disable mgmt passthrough using env vars. Launch the lab and observe the node logs
EXPECT: License update occurs successfully. Node reaches running healthy state
RESULT: As expected