Mass Creation of object addresses in FGT

[ciscokid1903]

Has anyone created a script for importing a list of IP addresses to create Object Addresses within the FortiGate firewall? Ideally this script would allow for updates etc on a monthly basis. example list IP,Hostname,Interface 111.111.111.111,HOST-1,OUTSIDE 222.222.222.222,HOST-2,OUTSIDE 333.333.333.333,HOST-3,OUTSIDE to produce an output like the following:

  edit HOST-1 
  set type ipmask 
  set subnet 111.111.111.111/255.255.255.255 
  set associated-interface OUTSIDE  
  next 
  edit HOST-2 
  set type ipmask 
  set subnet 222.222.222.222/255.255.255.255 
  set associated-interface OUTSIDE  
  next 
  edit HOST-3 
  set type ipmask 
  set subnet 333.333.333.333/255.255.255.255 
  set associated-interface OUTSIDE  
  end 
 

[rwpatterson · Accepted solution]

That doesn' t look to be so difficult. You would still have to manually upload that into your unit though.

[ede_pfau · Accepted solution]

here you are with a rudimentary batch script:

 @echo off
 REM input: textfile addr.txt with IP,name,interface (one per line)
 REM values delimited by commas, comments start with #
 
 REM redirect output to a batch command file for uploading to a Fortigate
 
 
 echo config firewall address
 for /f " eol=# tokens=1-3 delims=,"  %%i in (addr.txt) do CALL :oneaddr %%i %%j %%k
 echo end
 goto :EOF
 
 :oneaddr
 echo edit %2  
 echo set type ipmask  
 echo set subnet %1/32
 set intf=%3  
 if [%3]==[] set intf=ANY 
 echo set associated-interface %intf%   
 echo next

with this input file

# IP,Hostname,Interface 111.111.111.111,HOST-1,OUTSIDE 222.222.222.222,HOST-2 333.333.333.333,HOST-3,OUTSIDE

this output is produced:

config firewall address edit HOST-1 set type ipmask set subnet 111.111.111.111/32 set associated-interface OUTSIDE next edit HOST-2 set type ipmask set subnet 222.222.222.222/32 set associated-interface ANY next edit HOST-3 set type ipmask set subnet 333.333.333.333/32 set associated-interface OUTSIDE next end

[rwpatterson · Accepted solution]

That doesn' t look to be so difficult. You would still have to manually upload that into your unit though.

[Valoni]

rwpatterson wrote:
That doesn' t look to be so difficult. You would still have to manually upload that into your unit though.

is the script below supposed to be run on the FGT unit or the windows PC and why?

@echo off
 REM input: textfile addr.txt with IP,name,interface (one per line)
 REM values delimited by commas, comments start with #
 
 REM redirect output to a batch command file for uploading to a Fortigate
 
 
 echo config firewall address
 for /f " eol=# tokens=1-3 delims=,"  %%i in (addr.txt) do CALL :oneaddr %%i %%j %%k
 echo end
 goto :EOF
 
 :oneaddr
 echo edit %2  
 echo set type ipmask  
 echo set subnet %1/32
 set intf=%3  
 if [%3]==[] set intf=ANY 
 echo set associated-interface %intf%   
 echo next

[ede_pfau · Accepted solution]

here you are with a rudimentary batch script:

 @echo off
 REM input: textfile addr.txt with IP,name,interface (one per line)
 REM values delimited by commas, comments start with #
 
 REM redirect output to a batch command file for uploading to a Fortigate
 
 
 echo config firewall address
 for /f " eol=# tokens=1-3 delims=,"  %%i in (addr.txt) do CALL :oneaddr %%i %%j %%k
 echo end
 goto :EOF
 
 :oneaddr
 echo edit %2  
 echo set type ipmask  
 echo set subnet %1/32
 set intf=%3  
 if [%3]==[] set intf=ANY 
 echo set associated-interface %intf%   
 echo next

with this input file

# IP,Hostname,Interface 111.111.111.111,HOST-1,OUTSIDE 222.222.222.222,HOST-2 333.333.333.333,HOST-3,OUTSIDE

this output is produced:

config firewall address edit HOST-1 set type ipmask set subnet 111.111.111.111/32 set associated-interface OUTSIDE next edit HOST-2 set type ipmask set subnet 222.222.222.222/32 set associated-interface ANY next edit HOST-3 set type ipmask set subnet 333.333.333.333/32 set associated-interface OUTSIDE next end

[Allwyn_Mascarenhas]

ede_pfau wrote:
here you are with a rudimentary batch script:

 @echo off
REM input: textfile addr.txt with IP,name,interface (one per line)
REM values delimited by commas, comments start with #

REM redirect output to a batch command file for uploading to a Fortigate


echo config firewall address
for /f " eol=# tokens=1-3 delims=," %%i in (addr.txt) do CALL :oneaddr %%i %%j %%k
echo end
goto :EOF

:oneaddr
echo edit %2 
echo set type ipmask 
echo set subnet %1/32
set intf=%3 
if [%3]==[] set intf=ANY 
echo set associated-interface %intf% 
echo next

with this input file

# IP,Hostname,Interface 111.111.111.111,HOST-1,OUTSIDE 222.222.222.222,HOST-2 333.333.333.333,HOST-3,OUTSIDE

this output is produced:

config firewall address edit HOST-1 set type ipmask set subnet 111.111.111.111/32 set associated-interface OUTSIDE next edit HOST-2 set type ipmask set subnet 222.222.222.222/32 set associated-interface ANY next edit HOST-3 set type ipmask set subnet 333.333.333.333/32 set associated-interface OUTSIDE next end

Hey thanks for this, just need lil help on transferring it to a txt file. I tried the filename > bulk.txt in your next reply but couldn't get it to work. Where do i add this line?

[Valoni]

ede_pfau wrote:
here you are with a rudimentary batch script:

 @echo off
REM input: textfile addr.txt with IP,name,interface (one per line)
REM values delimited by commas, comments start with #

REM redirect output to a batch command file for uploading to a Fortigate


echo config firewall address
for /f " eol=# tokens=1-3 delims=," %%i in (addr.txt) do CALL :oneaddr %%i %%j %%k
echo end
goto :EOF

:oneaddr
echo edit %2 
echo set type ipmask 
echo set subnet %1/32
set intf=%3 
if [%3]==[] set intf=ANY 
echo set associated-interface %intf% 
echo next

with this input file

# IP,Hostname,Interface 111.111.111.111,HOST-1,OUTSIDE 222.222.222.222,HOST-2 333.333.333.333,HOST-3,OUTSIDE

this output is produced:

config firewall address edit HOST-1 set type ipmask set subnet 111.111.111.111/32 set associated-interface OUTSIDE next edit HOST-2 set type ipmask set subnet 222.222.222.222/32 set associated-interface ANY next edit HOST-3 set type ipmask set subnet 333.333.333.333/32 set associated-interface OUTSIDE next end

what do you mean rudimentary? where do I run this script? the pc or the Fortigate unit? I have over 200 ip addresses I need to add to different vdoms on my unit, do you have any idea how I could go about this?

[ede_pfau]

This is a Windows script, run in a command line window (cmd.exe).

If you have to ask, you probably can't change it - which would be necessary to adopt it to VDOMs.

'Rudimentary' because it's so simple. On a PC because at that time there was no scripting on a FGT. IMHO there's still not a decent shell in FOS.

Just create the output and upload it to the FGT via 'batch command'.

[Valoni]

Im thinking I may need edit the script since your script only has provision for 3 addresses, right?...

I wanted to understand the mechanism, run a windows script using cli and it operates in the Fortigate, which means I have to be logged in to the FGT before running this script right?

[ede_pfau]

No, not at all! Please re-read my posts...

This script is run on a Win PC. The output file (a text file) can be uploaded to the FGT via System > Advanced > Batch command. You will need admin access to the FGT for this, but not for the file creation.

You need to supply the 200 addresses in a CSV file (comma separated values), that is a text file where you put "ip address", comma, "hostname" on one line, with one line per host. My example just held only 3 addresses so not to bore the audience.

[poundy]

My go-to these days for this type of task is powershell. I create a "template" of what I want the commands to look like, and then import my CSV values and create the appropriate commands. I can then copy the commands out of the powershell output results, and paste them into my CLI session to the FGT.

For this task, here's my source command and for-loop that goes thru each line in the CSV file (my example uses c:\temp\test-fgt.csv) and substitutes the values and outputs the string. 

$Sourcecommandtext = " edit `"%hostname%`"  set type ipmask  set associated-interface %interface%  set subnet %IPAddress%/32 next " foreach ($line in (import-csv -path c:\temp\test-fgt.csv )) {  $commandstext = $sourcecommandtext -replace "%hostname%",$line.hostname  $commandstext = $commandstext -replace "%interface%",$line.interface  $commandstext = $commandstext -replace "%IPAddress%",$line.IP  $commandstext }

The output of this is:  

edit "host-1"  set type ipmask  set associated-interface OUTSIDE  set subnet 111.111.111.111/32 next edit "host-2"  set type ipmask  set associated-interface OUTSIDE  set subnet 222.222.222.222/32 next edit "Host-3"  set type ipmask  set associated-interface OUTSIDE  set subnet 333.333.333.333/32 next