FortiOS 8.0 FortiAI Assistant Technical Insight

<h2>Summary</h2><p>FortiOS 8.0 deeply embeds <strong>FortiAI-Assist</strong> intelligent assistant into the FortiGate operating system for the first time, providing network security administrators with generative AI-powered operational assistance capabilities. This article provides a systematic deep analysis of FortiAI's technical architecture, deployment methods, business workflows, and licensing models based on FortiOS 8.0 official documentation, helping technical teams fully understand this new feature.</p><p><strong>Key Finding</strong>: FortiOS 8.0's FortiAI is not a standalone web application interaction assistant, but a <strong>RAG (Retrieval-Augmented Generation) system</strong> deeply integrated with FortiGate, supporting documentation Q&A, troubleshooting diagnostics, and CLI command generation and execution. The system supports both FortiAI and OpenAI as AI providers, and uses a subscription-based Token billing model.</p><h2>1. Product Positioning and Functional Overview</h2><h3>1.1 FortiAI-Assist Positioning in FortiOS 8.0</h3><p>According to FortiOS 8.0 official documentation:</p><blockquote><p>FortiAI-Assist is now embedded in FortiOS, and FortiOS includes the FortiAI assistant and CLI Code Lab tool to provide RAG-enhanced documentation support, automated diagnostic analysis, and CLI script execution.</p></blockquote><p>FortiAI-Assist is an AI assistance tool launched by Fortinet in FortiOS 8.0, with core positioning including three aspects:</p><figure class="table">

Functional Dimension	Specific Description
RAG-Enhanced Documentation Support	Retrieval-augmented generation based on FortiOS technical documentation, answering administrators' product operation questions
Automated Diagnostic Analysis	Directly reads FortiGate logs or analyzes debug output provided by administrators for troubleshooting
CLI Script Execution	Generates FortiGate CLI commands through natural language, and edits and executes them in CLI Code Lab

</figure><h3>1.2 Comparison with FortiAI in Other Fortinet Products</h3><p>It is important to note that: <strong>FortiOS 8.0's FortiAI has functional differences compared to FortiAI in FortiWeb, FortiADC, and FortiManager</strong>.</p><figure class="table">

Product	FortiAI Form	Main Functions
FortiOS 8.0	Embedded AI Assistant + CLI Code Lab	Documentation Q&A, troubleshooting diagnostics, CLI generation and execution
FortiWeb	Standalone AI Assistant Panel	Log analysis, configuration guidance, IP reputation queries
FortiADC	Standalone AI Assistant Panel	Configuration guidance, log analysis, Text-to-Script
FortiManager	Standalone AI Assistant Panel	Configuration assistance, VPN script generation, IoT device management

</figure><h2>2. Device Deployment Guide (Step by Step)</h2><h3>2.1 Hardware and Licensing Requirements</h3><p>According to official documentation, FortiAI-Assist has clear requirements for hardware and subscriptions:</p><h4>Supported FortiGate Models</h4><figure class="table">

FortiGate Type	Memory Requirement	Subscription Requirement
FortiGate Hardware Devices	More than 2GB RAM	FortiCare Premium Support
FortiGate-VM S-series	More than 2GB RAM	FortiCare Premium OR Enterprise/UTP/ATP Bundle (any one)

</figure><p><strong>Important Limitation</strong>: FortiGate models with memory equal to or less than 2GB <strong>do not support</strong> FortiAI-Assist functionality.</p><h4>Network Requirements</h4><ul><li>FortiGate device must be able to <strong>access the Internet</strong></li><li>For establishing communication with FortiAI cloud service or OpenAI API</li></ul><h3>2.2 Deployment Steps</h3><h4>Step 1: Verify License Status</h4><p>Before enabling FortiAI, confirm that the FortiGate device is registered and bound to a valid FortiCare Premium license:</p><p># Check license status via CLI
diagnose sys license list</p><h4>Step 2: Select and Enable AI Provider</h4><p>FortiOS 8.0 supports two AI providers, administrators can choose based on requirements:</p><p><strong>Method A: Use FortiAI (Fortinet Native AI)</strong></p><ol><li>In the FortiOS GUI top banner, click the <strong>FortiAI</strong> icon</li><li>In the popup <strong>AI Model Selection</strong> dialog, select <strong>FortiAI</strong></li><li>Click <strong>OK</strong> to confirm</li></ol><p>FortiAI provider includes the following features:</p><ul><li><strong>2,000,000 starting Tokens</strong> per device per month</li><li>Additional Tokens can be purchased as needed</li><li>Purchased Tokens are <strong>shared</strong> across all devices under the same FortiCare account</li></ul><p><strong>Method B: Use OpenAI (Third-party AI)</strong></p><ol><li>Click the <strong>FortiAI</strong> icon in the GUI</li><li>Select <strong>OpenAI</strong> and fill in configuration information: API Key, Model name (such as gpt-5.2), Project ID, Organization ID</li></ol><p>Or configure via CLI:</p><p>config system admin
   edit "admin"
       set vdom "root"
       set accprofile "super_admin"
       set gui-llm-provider openai
       set openai-api-key <your-api-key>
       set openai-api-key-part2 <key-part2>
       set openai-model "gpt-5.2"
       set openai-project-id "<project-ID>"
       set openai-org-id "<organization-ID>"
   next
end</p><p><strong>Note</strong>: When using OpenAI, Tokens are billed directly from the OpenAI account, and FortiOS does not provide usage tracking.</p><h4>Step 3: Configure Administrator Access Permissions</h4><p>FortiAI-Assist access permissions are controlled through <strong>Admin Profiles</strong>:</p><p><strong>GUI Configuration Method</strong>:</p><ol><li>Navigate to <strong>System > Admin Profiles</strong></li><li>Double-click the admin profile to edit (such as prof_admin)</li><li>Enable/disable <strong>Allow using AI Assistant</strong></li><li>Click <strong>OK</strong> to save</li></ol><p><strong>CLI Configuration Method</strong>:</p><p>config system accprofile
   edit "admin-withAI"
       set comments "Admin with AI Assistant access"
       set secfabgrp read-write
       # ... other permission settings ...
       set gui-ai-assistant enable
   next
end</p><p><strong>Permission Notes</strong>:</p><ul><li>Even if the admin profile disables AI Assistant, the FortiAI icon <strong>remains visible</strong> in the GUI banner, but administrators cannot submit queries or receive responses</li><li>The super_admin profile <strong>cannot edit</strong> this setting (always allowed)</li><li>FortiAI uses the <strong>same permissions as the logged-in administrator</strong> when calling FortiOS REST API</li></ul><h4>Step 4: (Optional) Enable Data Masking</h4><p>Sensitive data masking is an important privacy protection feature:</p><ol><li>In the FortiAI chat window, click the data masking icon</li><li>When enabled, the following sensitive information will be replaced with placeholders before sending to the AI provider: IP addresses, MAC addresses, Email addresses, Phone numbers, URLs</li></ol><p>Enabled state: Chat window shows <strong>✓</strong> icon; Disabled state: Shows <strong>×</strong> icon</p><h4>Step 5: Access CLI Code Lab</h4><p>CLI Code Lab is FortiAI's companion tool for generating, editing, and executing CLI commands:</p><p><strong>Access Methods</strong>:</p><ul><li>Method 1: Access from GUI banner - Click CLI Console > CLI Code Lab</li><li>Method 2: Access from FortiAI returned commands - When FortiAI returns CLI commands, click the Edit button to open CLI Code Lab</li></ul><p>CLI Code Lab interface includes: <strong>Left pane</strong> (editable CLI command input area), <strong>Right pane</strong> (command execution output area), <strong>Execute button</strong> (execute commands, requires secondary confirmation), <strong>Commit changes button</strong> (save configuration changes)</p><h2>3. Business Process Deep Analysis</h2><h3>3.1 User Interaction Process</h3><p>FortiAI-Assist's user interaction follows a <strong>Q&A → Analysis → Execution</strong> three-stage model:</p><ul><li><strong>Stage 1 - Q&A Interaction</strong>: User inputs natural language queries or instructions</li><li><strong>Stage 2 - System Analysis</strong>: LLM + RAG processing, local data analysis</li><li><strong>Stage 3 - Configuration/Diagnostic Execution</strong>: CLI Code Lab executes commands</li></ul><h3>3.2 System Processing Flow</h3><h4>3.2.1 Documentation-Based Q&A Process</h4><p>When users ask product operation questions, the system uses a <strong>RAG architecture</strong>:</p><ol><li>User query</li><li>Query vectorization (embedding model processing)</li><li>Document retrieval (matching relevant document fragments)</li><li>Context assembly</li><li>LLM generates response</li><li>Returns response with sources</li></ol><p>According to official documentation: "When FortiAI uses FortiAI as the AI provider, the following FortiOS documents are used to provide answers: <strong>FortiOS Administration Guide</strong>, <strong>FortiOS CLI Reference</strong>. FortiAI also checks its answers against the FortiGate to ensure the results are suitable for the specific model."</p><p><strong>RAG Knowledge Base</strong> includes: FortiOS Administration Guide, FortiOS CLI Reference</p><p><strong>Model Validation Mechanism</strong>: Generated responses are cross-validated with the target FortiGate device to ensure generated configuration commands are applicable to that specific model.</p><h4>3.2.2 Diagnostic Analysis Process</h4><p>For troubleshooting scenarios, the system supports a <strong>hybrid analysis mode</strong>:</p><ul><li>User describes problem → FortiAI returns diagnostic CLI commands</li><li>User pastes debug output/log files → FortiAI analyzes and identifies root cause</li></ul><p><strong>Typical Troubleshooting Example</strong>:</p><p>User input: "troubleshoot issue ipsec vpn tunnel to-headoffice is down"</p><p>System returns:</p><p>Your debug is definitive: IKEv2 AUTH fails

• authentication failed
• PSK auth failed: probable pre-shared key mismatch
• initiator receives AUTHENTICATION_FAILED</p><h4>3.2.3 CLI Command Generation and Execution Process</h4><ol><li>User inputs natural language requirement, example: "configure this fgt to block social media"</li><li>LLM generates CLI commands</li><li>User supplements environment information, example: "lan interface port2, update existing policy 1"</li><li>LLM adjusts commands based on context</li><li>User clicks Edit to open CLI Code Lab</li><li>Edit commands in CLI Code Lab and click Execute</li><li>System executes commands after secondary confirmation</li><li>Execution results displayed in right pane</li><li>User clicks Commit changes to save configuration</li></ol><h3>3.3 Session Management Mechanism</h3><h4>Token Consumption and Context</h4><p>According to official documentation: "Because the FortiAI assistant uses session history to inform its responses, queries that are a part of a long session will use more tokens than new conversations."</p><p><strong>Context Management Rules</strong>:</p><ul><li>Historical messages in the same session are sent to the LLM as context</li><li>When message history reaches the limit, it will be <strong>compressed</strong> (may lose some information)</li><li>Compressed history will reduce response accuracy</li><li>LLM <strong>does not remember</strong> content from different sessions</li></ul><p><strong>Recommendation</strong>: When handling unrelated tasks, <strong>create a new session</strong> to get more accurate responses.</p><h4>Chat History Management</h4><figure class="table">

  Function	Description
  Chat History	View historical session list, click to restore and view
  Export Chat	Export current conversation as JSON
  Export Thread	Export complete thread (including timestamps, message IDs, etc.)

  </figure><h2>4. Large Model Architecture Deep Analysis</h2><h3>4.1 Dual AI Provider Architecture</h3><p>FortiOS 8.0's FortiAI adopts a <strong>dual-provider architecture</strong>, providing flexibility choices for administrators:</p><h4>4.1.1 FortiAI Provider (Fortinet Native)</h4><figure class="table">

  Feature	Description
  Token Source	Fortinet cloud service
  Starting Quota	2,000,000 Tokens per device per month
  Additional Purchase	Available, shared across account devices
  RAG Knowledge Base	Built-in FortiOS documentation
  Model Validation	Cross-validation with target device

  </figure><h4>4.1.2 OpenAI Provider (Third-party)</h4><figure class="table">

  Feature	Description
  API Configuration	Need to configure API Key yourself
  Model Selection	Can choose GPT-5.2 and other models
  Billing Method	Billed directly from OpenAI account
  Cost Control	No usage tracking within FortiOS

  </figure><p><strong>CLI Configuration Options</strong>:</p><p>config system admin

   edit <admin-name>
       set gui-llm-provider {fortiai | openai}
       set openai-api-key <password>
       set openai-api-key-part2 <password>
       set openai-model <string>
       set openai-project-id <string>
       set openai-org-id <string>
   next
end</p><h3>4.2 RAG Architecture Analysis</h3><h4>4.2.1 RAG Component Composition</h4><p>FortiAI-Assist's RAG system contains the following core components:</p><figure class="table">

Component	Function Description
Document Library	FortiOS Administration Guide + CLI Reference
Vector Database	Stores vector embeddings of document fragments
Retriever	Matches relevant document fragments based on user query
Generator (LLM)	Generates responses based on retrieval results
Validation Layer	Cross-validates command applicability with target device

</figure><h4>4.2.2 Retrieval Augmentation Mechanism</h4><p><strong>Document Sources</strong>: Official documentation clearly states: "When FortiAI uses FortiAI as the AI provider, the following FortiOS documents are used to provide answers: FortiOS Administration Guide, FortiOS CLI Reference."</p><p><strong>RAG Workflow</strong>:</p><ol><li><strong>Indexing Phase</strong>: Chunking and vectorizing official documentation</li><li><strong>Retrieval Phase</strong>: After user query vectorization, match Top-K relevant fragments with vector database</li><li><strong>Assembly Phase</strong>: Assemble user query + retrieved fragments + system prompt into complete prompt</li><li><strong>Generation Phase</strong>: LLM generates response based on assembled context</li><li><strong>Validation Phase</strong>: Check if generated commands are applicable to target FortiGate model</li></ol><h4>4.2.3 Local Data Analysis Capability</h4><p>Different from pure documentation Q&A, FortiAI also supports <strong>local data analysis</strong>:</p><figure class="table">

Analysis Type	Input Source	Processing Method
Log Analysis	FortiGate local logs	Direct read and analysis
Debug Output	Administrator paste	Parse and identify root cause
Configuration Validation	Target device status	Cross-validate command applicability

</figure><h3>4.3 Deployment Mode Analysis</h3><h4>4.3.1 Cloud Processing Mode</h4><p><strong>Characteristics</strong>:</p><ul><li>LLM inference completed in Fortinet cloud</li><li>Requires Internet connection</li><li>Supports RAG document retrieval</li></ul><h4>4.3.2 Direct Third-party Mode</h4><p><strong>Characteristics</strong>:</p><ul><li>LLM inference completed on OpenAI servers</li><li>No FortiOS documentation knowledge base enhancement</li><li>Need to manage OpenAI account and fees yourself</li></ul><h2>5. Authorization and Billing Model</h2><h3>5.1 Authorization Requirements</h3><p>According to official documentation, FortiAI-Assist authorization requirements are as follows:</p><h4>FortiGate Hardware Devices</h4><figure class="table">

Requirement Item	Specification
Memory Requirement	More than 2GB RAM
Subscription Requirement	FortiCare Premium Support
Starting Tokens	2,000,000 per device per month
Additional Tokens	Purchasable, shared within account devices

</figure><h4>FortiGate-VM S-series</h4><figure class="table">

Requirement Item	Specification
Memory Requirement	More than 2GB RAM
Subscription Requirement	FortiCare Premium OR Enterprise Bundle OR UTP Bundle OR ATP Protection Bundle

</figure><h4>Unsupported Scenarios</h4><figure class="table">

Type	Description
FortiGate models (≤2GB RAM)	Do not support FortiAI functionality
Devices without subscription	Cannot use FortiAI
Trial License	May not be available (depending on specific terms)

</figure><h3>5.2 Token Billing Mechanism</h3><h4>Token Consumption Rules</h4><figure class="table">

Consumption Source	Description
User Input (Prompt)	Counted by character/word count
LLM Output (Response)	Counted by generated text volume
Session History	Longer context means more consumption

</figure><p><strong>Official Explanation</strong>: "When you use the FortiAI assistant, the text in both the prompt (input) and the response (output) is processed as tokens." "Because the FortiAI assistant uses session history to inform its responses, queries that are a part of a long session will use more tokens than new conversations."</p><h4>Token Best Practices</h4><p>Token saving strategies recommended by official documentation:</p><figure class="table">

Strategy	Description	Example
Concise and Specific	Avoid lengthy descriptions	❌ "Can you please help me create a firewall address for 10.0.0.1..."  ✅ "Create firewall addresses for 10.0.0.1 and awesome-domain.com"
Use Filter Conditions	Narrow query scope	Specify specific interface names, time ranges
Use FortiOS Terminology	Precisely match functions	Use "quarantine device" instead of "block this device"
Reuse Session Context	Reduce repetitive explanations	Follow up in the same thread instead of opening new sessions

</figure><h4>Token Exhaustion Handling</h4><p>When monthly Token quota is exhausted:</p><ul><li>FortiAI access is <strong>temporarily suspended</strong></li><li>Need to wait for <strong>next billing cycle reset</strong></li><li>Additional purchased Tokens are not subject to this limit</li></ul><h3>5.3 Billing Comparison of Different AI Providers</h3><figure class="table">

Billing Dimension	FortiAI (Fortinet)	OpenAI
Starting Quota	2,000,000 Tokens/month/device	None (pay-as-you-go)
Additional Purchase	Supported, shared across devices	Purchase API Key yourself
Usage Tracking	Visible within FortiOS	Need to check in OpenAI platform
Overflow Handling	Suspend access	Continue billing/reject requests

</figure><h2>6. Security and Privacy Protection</h2><h3>6.1 Data Masking Mechanism</h3><p>FortiAI supports <strong>sensitive information masking</strong> before sending data to AI providers:</p><h4>Masked Data Types</h4><figure class="table">

Data Type	Masking Example
IP Address	192.168.1.100 → [IP_1]
MAC Address	AA:BB:CC:DD:EE:FF → [MAC_1]
Email Address	user@example.com → [EMAIL_1]
Phone Number	123-456-7890 → [PHONE_1]
URL	https://example.com → [URL_1]

</figure><h4>Masking Control</h4><ul><li><strong>Click icon to toggle</strong> in FortiAI chat window</li><li>✓ icon = Masking enabled</li><li>× icon = Masking disabled</li><li>Recommend <strong>always enabling</strong> in scenarios containing sensitive information</li></ul><h3>6.2 Permission Control</h3><h4>Administrator Permission Isolation</h4><p>"FortiAI calls the FortiOS REST APIs with the same permissions as the logged in administrator."</p><p>This means:</p><ul><li>AI assistant <strong>cannot exceed</strong> admin profile permissions</li><li>Even if high-privilege commands are generated, <strong>execution is still restricted by permissions</strong></li><li>Different administrators see different scopes of responses based on their profiles</li></ul><h4>Admin Profile Configuration</h4><figure class="table">

Configuration Item	Default Value	Description
gui-ai-assistant	disable	AI assistant usage permission
super_admin	Always allowed	Cannot modify this profile

</figure><h2>7. Practical Application Scenario Examples</h2><h3>7.1 Scenario 1: IPsec VPN Tunnel Troubleshooting</h3><p><strong>Topology Background</strong>: Two FortiGates configured with IPsec site-to-site VPN, tunnel status is down</p><p><strong>Troubleshooting Steps</strong>:</p><ol><li>In FortiAI chat window, input: "troubleshoot issue ipsec vpn tunnel to-headoffice is down"</li><li>FortiAI returns diagnostic commands for collecting IKE debug logs</li><li>Administrator executes commands in SSH session, collects log output</li><li>Paste log output back to FortiAI chat window</li><li>FortiAI analyzes logs and returns diagnostic results</li></ol><h3>7.2 Scenario 2: Configure Firewall Policy Using OpenAI</h3><p><strong>Requirement</strong>: Block social media access through web filter</p><p><strong>Operation Steps</strong>:</p><ol><li>Enable OpenAI as AI provider</li><li>Input natural language requirement: "configure this fgt to block social media by webfilter"</li><li>FortiAI returns CLI commands, can supplement information to optimize: "lan interface port2. wan interface port1. update existing policy 1 instead of creating a new one"</li><li>Click <strong>Edit</strong> to open commands in CLI Code Lab</li><li>Edit commands and click <strong>Execute</strong></li><li>System executes after confirmation, output results displayed in right pane</li><li>Click <strong>Commit changes</strong> to save configuration</li></ol><h2>8. Technical Specifications Summary</h2><h3>8.1 System Requirements</h3><figure class="table">

Parameter	Specification
FortiOS Version	8.0.0 and above
Hardware Requirement	FortiGate models with more than 2GB RAM
Network Requirement	Internet access
License Requirement	FortiCare Premium (or equivalent Bundle)

</figure><h3>8.2 CLI Command Summary</h3><h4>Enable AI Assistant Permission</h4><p>config system accprofile
   edit <profile-name>
       set gui-ai-assistant {enable | disable}
   next
end</p><h4>Configure OpenAI Provider</h4><p>config system admin
   edit <admin-name>
       set gui-llm-provider {fortiai | openai}
       set openai-api-key <password>
       set openai-api-key-part2 <password>
       set openai-model <string>
       set openai-project-id <string>
       set openai-org-id <string>
   next
end</p><h3>8.3 Token Quota (FortiAI Provider)</h3><figure class="table">

FortiGate Type	Starting Tokens/Month	Scalability
Hardware Devices	2,000,000	Purchasable, shared across devices
VM S-series	Same as above	Same as above

</figure><h2>9. Summary and Recommendations</h2><h3>9.1 Core Value</h3><p>FortiOS 8.0's FortiAI-Assist brings the following core values to FortiGate administrators:</p><figure class="table">

Value Dimension	Specific Embodiment
Cost Reduction and Efficiency	Natural language interaction lowers CLI learning barrier
Rapid Diagnosis	Automatically analyzes debug output, accelerates fault localization
Configuration Automation	CLI Code Lab enables command generation-editing-execution integration
Security and Control	Permission isolation + data masking ensures operational security

</figure><h3>9.2 Selection Recommendations</h3><figure class="table">

Scenario	Recommended AI Provider	Reason
Need RAG documentation support	FortiAI	Built-in FortiOS knowledge base
High-frequency use, familiar with FortiOS	FortiAI	Token sharing saves costs
Already have OpenAI account	OpenAI	Reuse existing resources
Need GPT advanced models	OpenAI	Can choose GPT-5.2 and other models

</figure><h3>9.3 Notes</h3><ol><li><strong>Token Management</strong>: For high-frequency usage scenarios, recommend enabling data masking and streamlining sessions</li><li><strong>Permission Control</strong>: Recommend disabling AI Assistant for non-administrator accounts</li><li><strong>Network Security</strong>: Ensure HTTPS communication security between FortiGate and AI services</li><li><strong>Compliance Requirements</strong>: When using OpenAI, pay attention to data cross-border compliance</li></ol><h2>References</h2><ol><li>Fortinet. "FortiAI assistant and CLI Code Lab" - FortiOS 8.0.0 New Features. https://docs.fortinet.com/document/fortigate/8.0.0/new-features/018007/fortiai-assistant-and-cli-code-lab</li><li>Fortinet. "FortiAI Assistant for FortiADC 8.0.2" - FortiADC New Features. https://fortinetweb.s3.amazonaws.com/docs.fortinet.com/v2/attachments/6b854031-36c8-11f0-a9d0-d2b0d2e22f7d/fortiadc-v8.0.2-new-features.pdf</li><li>Fortinet. "Protecting GenAI access using application control" - FortiGate Administration Guide. https://docs.fortinet.com/document/fortigate/latest/administration-guide/679448/protecting-genai-access-using-application-control</li><li>Fortinet. "FortiOS 8.0 New Features Overview" - FortiGate / FortiOS. https://docs.fortinet.com/document/fortigate/8.0.0/new-features</li><li>Fortinet. "Using FortiAI" - FortiADC Administration Guide. https://docs.fortinet.com/document/fortiadc/latest/administration-guide/330090/using-fortiai</li></ol>