We have these firewalls. Firewalls have licenses that expire.
We have an RMM (Remote Monitoring and Management), a documentation platform, and a PSA (professional services automation tool). All of these are owned by the same umbrella corporation and should (in theory) communicate with each other.
Your RMM should install an agent on the devices that gathers information and helps you to manage the device; the RMM sends data to the configurations in the PSA, and in our case the documentation platform syncs with either the PSA or the RMM to update the info in the configurations in the documentation platform.
In my experience, managing firewalls as an MSP works best when you’ve got a multi-tenant management platform that lets you access basic features and enable licenses and do updates on all your devices from one platform. For many nice firewalls, that’s a free feature of the device. You can enroll them in the management platform for free.
Not with fucking fortigates. If you want to manage fortigates you need to have a forticloud account that you authenticate to with a fortitoken - their very own special authenticator app and they won’t let you use another authenticator - so that you can get your forticare subscriptions taken care of. They have a multitenant option called fortimanage but it’s fuck off expensive; there are two options for multi tenant management that are less-than-fuck-off expensive but are still not free (the one we’ve considered has an annual cost that’s about what I take home every two weeks). Fortigates can fortifuckthemselves.
So. To manage the fortigate without having to log into an individual forticloud account and use the business owner’s specific fortitoken authentication, we remote into the server and manage the firewall from there.
This is, in industry terms, fucking stupid. (it’s not completely fucking stupid but when you’re managing three hundred fucking firewalls it sure isn’t smart).
Anyway. You can avoid some of that pain in the ass by using your RMM to track network devices so that you can get real time data on how your network devices are doing without having to individually log in to each one. And as a bonus, you can have the RMM send data to the PSA so you don’t even have to log in to the RMM to get basic specs, and information like the expiration date of a firewall license.
Because, let me be crystal fucking clear: I, as the procurement lead, should not be logging in to a client server to access their fucking firewall so that I can see when the license expires. This is WHOLLY ASIDE from the fact that our RMM and my PERSONAL COMPUTER THAT I WORK FROM BECAUSE I DO NOT HAVE A WORK MACHINE do not get along, and whenever I have to log in to a server my dyslexic ass to manually type our gibberish 32 character passwords and then connect MY PERSONAL MACHINE WITH NO ANTIVIRUS OR TRACKING SOFTWARE THAT I DO HACKER SHIT WITH to the client’s server. I don’t like doing this, I shouldn’t be doing this, and when I have to do this it takes forever because I can’t send paste as keystrokes I *KNOW* there is an option to send paste as keystrokes I have replicated this issue with three of my techs and in two support tickets with the vendor my computer hates the system, the system hates me, I have to type the fucking passwords and sure you could say “well just install the latest version of chrome and maybe that’ll fix it” and I say again THIS IS MY PERSONAL MACHINE YOU ARE GETTING OPERA AT BEST AND THE ISSUE OCCURS IN OPERA CHROME EDGE BRAVE AND FIREFOX ON MY MACHINE.
So. It’s a very good thing that there is an RMM Agent that gets installed on network equipment and updates information in our configurations on two separate platforms, right?
Well.
For one thing, I don’t know why some clients have fortigates showing up in their network devices on the RMM and some don’t.
In our documentation platform, I don’t know why some fortigate configs are called “Fortigate FG60 Firewall Client” and some are called “FG60F-FW-CN.” I don’t know why our documentation platform has a search bar that isn’t for search terms, it’s for filters, so when you enter a term in the bar you aren’t searching the whole config for that phrase you are filtering the tenant by five main fields so if “Fortigate” appears in the body text but not in the description, name, product number, or device type it won’t show up when you “search” because you’re not searching you’re filtering.
And I don’t know why our PSA, RMM, and documentation platform, which are all made by the same goddamned company, don’t play nice with each other and will erase information that one populated to the other.
So. I have a client who, to my knowledge, has one fortigate that is expiring in June. I believe this is the case because I searched her tenant for “Fortigate” and found a device that was in service and had an expiration listed as June. To double check that this was correct-ish, I went to our RMM and looked up their site, and their site didn’t list any firewalls in network devices, just a single switch. So I sent a quote for a one year renewal that the client approved yesterday.
APPARENTLY the client ALSO has a DIFFERENT firewall that is expiring today, so after work my coworker asks if I’ve got the order number for the firewall renewal and after much back and forth it turns out my boss ordered the renewal and the order is processing, and I’m like “Hey okay cool that we’re renewing but it looks like you actually renewed two firewalls.” And my boss is like “Yeah they have an FG60” and I’m like fuck, okay, fine, so I search the documentation platform and sure enough, there it is, an FG60 that expires today FUCK. I look at the config and hey that’s not so bad, it’s their backup, and I check with the vendor, even if the license expires they get firewall functionality and VPN functionality. Okay. And it’s their backup, just in case of literal power outages. So I say “okay, I’ve got a quote out to them for the one that renews in June, I didn’t even realize there was another one there, we need a naming convention that will ensure that these show up for any searches of fortigates” and my boss says “The date in the configuration is wrong, the other one expires today too.”
So I sit there and I look at the configuration, and I look at the other configuration, and I look at our RMM, and I ask my boss “Did the date get entered manually and it was incorrect? Is it pulling this info from the RMM?”
And my boss says “The RMM and the documentation platform and the PSA sometimes overwrite each other and change the dates, but also sometimes people enter the number manually.”
So I say “Okay, so just to clarify, the expiration dates listed in our documentation platform are inaccurate and the only way to check the expiration for fortigates is to log on to the server and connect to the firewall and view the expiration date on the firewall itself?”
And my boss says “Yep”
and I didn’t say anything else because I came here because I don’t know what else to say because *I DON’T KNOW HOW TO FIX THIS, I CAN’T MANAGE EXPIRATION DATES IF I CAN’T TRUST THEM TO BE DOCUMENTED IN OUR DOCUMENTATION SYSTEM THAT CONNECTS TO THE FUCKING DEVICE OR APPARENTLY SOMETIMES DOESN’T WHY AREN’T THESE THINGS IN THE FUCKING RMM*