Mass Creation of object addresses in FGT

[ciscokid1903]

Has anyone created a script for importing a list of IP addresses to create Object Addresses within the FortiGate firewall? Ideally this script would allow for updates etc on a monthly basis. example list IP,Hostname,Interface 111.111.111.111,HOST-1,OUTSIDE 222.222.222.222,HOST-2,OUTSIDE 333.333.333.333,HOST-3,OUTSIDE to produce an output like the following:

 edit HOST-1
 set type ipmask
 set subnet 111.111.111.111/255.255.255.255
 set associated-interface OUTSIDE 
 next
 edit HOST-2
 set type ipmask
 set subnet 222.222.222.222/255.255.255.255
 set associated-interface OUTSIDE 
 next
 edit HOST-3
 set type ipmask
 set subnet 333.333.333.333/255.255.255.255
 set associated-interface OUTSIDE 
 end
 

[ciscokid1903]

Sorry, Wrong Forum. I' ve added this to the FortiGate specific forum.

[RH2]

I use excel and word to create a new text file that I can import as a script I use this to block the latest top 100 attackers ip list from SANS First create an address group that contains all of the address NAMES listed below. We use SANS_TOP_100 and it contains SANS_T100_001, 002, 003, etc. then create an excel spreadsheet with no column names. (each <c> means a new column): line 1: config firewall address line 2: edit SANS_T100_001 <c> @ <c> set subnet <c> 64.236.64.139 <c> 255.255.255.255 <c> @ <c> next line 3: edit SANS_T100_002 <c> @ <c> set subnet <c> 218.64.114.103 <c> 255.255.255.255 <c> @ <c> next line4 through 101: repeat for each address line 102: end each month I past the latest column of addresses over the existing column (happens to be column D) save the spreadsheet and then do a save as and choose a text file format, this will convert all columns to tabs. Open the text file in MSWord Using MSWord I do a search and replace (control-H) (expand the more) button and use " special" to replace all " tab" characters with a space character. replace all double spaces with a single space and continue until no more are found replace all " @ " (space, ampersand, space) with a " paragraph mark" (in special) This will leave you with a text file that reads: line 1: config firewall address line 2: edit SANS_T100_001 line 3: set subnet 64.236.64.139 255.255.255.255 line 4: next line 5: edit SANS_T100_002 line 6: set subnet 218.64.114.103 255.255.255.255 line 7: next line 8 - xxx: etc, etc, etc last line: end save the text file and import it into the firewall as a script. Or copy and paste it as a new script. By assigning all of the addresses to a group and using the address group in your policies, you are able to just update the addresses and not have to update every policy that uses the individual address names.

[markarlsen]

Hi,

I know this is an old post - but I made a TCL-script to create firewall objects when I had the same scenario. I had a bunch of host addresses I needed to create a deny policy for. 

You can read about it on my blog:

http://exceededintransit.net/?p=191 

.. If you want to use more variables, you can create more variables by simply adding a new section to the array. Eg. if you want a variable subnet mask, you could do this:

array set objects {

	10.0.0.0 	"H-DENY-1.1.1.1"      255.255.255.0
	2.2.2.0 	"H-DENY-2.2.2.2"      255.255.254.0
	3.3.3.0 	"H-DENY-3.3.3.3"      255.255.255.128

}

foreach {object_ip object_name object_subnet}

Now you should be able to use the $object_subnet variable as well when creating the object. The config would look like this:

# lookup in array "objects"
foreach {object_ip object_name} [array get objects] {
	puts \n
	puts "edit $object_name"
	puts "set subnet $object_ip $object_subnet"
	puts "next"
}

When creating the array, you should use excel for the production of the rows. You should be able to copy the cells from excel directly to your script.

Regards,

Martin Karlsen