Helpful ReplyHot!Mass Creation of object addresses in FGT

Page: < 12 Showing page 2 of 2
Author
poundy
New Member
  • Total Posts : 6
  • Scores: 0
  • Reward points: 0
  • Joined: 2019/06/13 20:58:45
  • Status: offline
Re: RE: Mass Creation of object addresses in FGT 2019/11/06 20:56:17 (permalink)
0
My go-to these days for this type of task is powershell. I create a "template" of what I want the commands to look like, and then import my CSV values and create the appropriate commands. I can then copy the commands out of the powershell output results, and paste them into my CLI session to the FGT.
 
For this task, here's my source command and for-loop that goes thru each line in the CSV file (my example uses c:\temp\test-fgt.csv) and substitutes the values and outputs the string. 
 

$Sourcecommandtext = "
edit `"%hostname%`"
 set type ipmask
 set associated-interface %interface%
 set subnet %IPAddress%/32
next
"
foreach ($line in (import-csv -path c:\temp\test-fgt.csv )) {
 $commandstext = $sourcecommandtext -replace "%hostname%",$line.hostname
 $commandstext = $commandstext -replace "%interface%",$line.interface
 $commandstext = $commandstext -replace "%IPAddress%",$line.IP
 $commandstext
}
The output of this is:
 
edit "host-1"
 set type ipmask
 set associated-interface OUTSIDE
 set subnet 111.111.111.111/32
next

edit "host-2"
 set type ipmask
 set associated-interface OUTSIDE
 set subnet 222.222.222.222/32
next

edit "Host-3"
 set type ipmask
 set associated-interface OUTSIDE
 set subnet 333.333.333.333/32
next
#21
emnoc
Expert Member
  • Total Posts : 5366
  • Scores: 351
  • Reward points: 0
  • Joined: 2008/03/20 13:30:33
  • Location: AUSTIN TX AREA
  • Status: offline
Re: RE: Mass Creation of object addresses in FGT 2019/11/06 22:50:32 (permalink)
0
We (unix guys )  do the same but with awk 
 
 
               awk 'BEGIN { print "config firewall address"}'  >> $TMP
 
                cat $1 | awk ' {  print "edit \x22"$1"\x22" }' >> $TMP
 
                cat $1 | awk ' {  print "set address \x22"$2"\x22" }'  >> $TMP
 
                awk 'BEGIN { print "end"}'  >> $TMP
 
                done
 
And we use a for loop to generate  batch scripts that could be upload thru the fgt or fgtmngr
 
Ken Felix
 
post edited by emnoc - 2019/11/06 22:53:59

PCNSE,  NSE , Forcepoint ,  StrongSwan Specialist
#22
emnoc
Expert Member
  • Total Posts : 5366
  • Scores: 351
  • Reward points: 0
  • Joined: 2008/03/20 13:30:33
  • Location: AUSTIN TX AREA
  • Status: offline
Re: RE: Mass Creation of object addresses in FGT 2019/11/06 23:02:05 (permalink)
0
FWIW, the file variable $TMP is a temp file with the current epoch unix date, this ensure a unique filename. Once you built the batch script you just push them into the FGT.
 
Save a lot type and especially if you can get the host object output in a tab-separated format. 
 
e.g 
 
www1  1.1.1.1
www2  1.1.1.2
www3  1.1.1.3
 

PCNSE,  NSE , Forcepoint ,  StrongSwan Specialist
#23
Valoni
New Member
  • Total Posts : 7
  • Scores: 0
  • Reward points: 0
  • Joined: 2019/11/06 06:59:48
  • Status: offline
Re: RE: Mass Creation of object addresses in FGT 2019/11/07 03:39:14 (permalink)
0
ede_pfau
No, not at all! Please re-read my posts...
 
This script is run on a Win PC. The output file (a text file) can be uploaded to the FGT via System > Advanced > Batch command. You will need admin access to the FGT for this, but not for the file creation.
 
You need to supply the 200 addresses in a CSV file (comma separated values), that is a text file where you put "ip address", comma, "hostname" on one line, with one line per host. My example just held only 3 addresses so not to bore the audience.




Can I use excel sheet to compute the addresses, wih two columns, the IP and the Hostname?
#24
ede_pfau
Expert Member
  • Total Posts : 6097
  • Scores: 490
  • Reward points: 0
  • Joined: 2004/03/09 01:20:18
  • Location: Heidelberg, Germany
  • Status: offline
Re: RE: Mass Creation of object addresses in FGT 2019/11/07 03:40:37 (permalink)
0
yes, save as "CSV". Can be used with both my script or the PowerShell script.

Ede

" Kernel panic: Aiee, killing interrupt handler!"
#25
Valoni
New Member
  • Total Posts : 7
  • Scores: 0
  • Reward points: 0
  • Joined: 2019/11/06 06:59:48
  • Status: offline
Re: RE: Mass Creation of object addresses in FGT 2019/11/07 06:33:39 (permalink)
0
okay, thanks.  one more thing, I need this done on a particular vdom as an object, I do not need the interface option. Will this script still do the job?
#26
ede_pfau
Expert Member
  • Total Posts : 6097
  • Scores: 490
  • Reward points: 0
  • Joined: 2004/03/09 01:20:18
  • Location: Heidelberg, Germany
  • Status: offline
Re: RE: Mass Creation of object addresses in FGT 2019/11/07 08:17:52 (permalink)
0
Use this for a 2-parameter file:
@echo off
REM input: textfile addr.txt with IP,name (one per line)
REM values delimited by commas, comments start with #

REM redirect output to a batch command file for uploading to a Fortigate


echo config firewall address
for /f " eol=# tokens=1-2 delims=," %%i in (addr.txt) do CALL :oneaddr %%i %%j
echo end
goto :EOF

:oneaddr
echo edit %2
echo set type ipmask
echo set subnet %1/32
echo next


Ede

" Kernel panic: Aiee, killing interrupt handler!"
#27
Valoni
New Member
  • Total Posts : 7
  • Scores: 0
  • Reward points: 0
  • Joined: 2019/11/06 06:59:48
  • Status: offline
Re: RE: Mass Creation of object addresses in FGT 2019/11/07 08:26:22 (permalink)
0
thanks but I need it to transition directly to the vdom  not configure globally.
#28
ede_pfau
Expert Member
  • Total Posts : 6097
  • Scores: 490
  • Reward points: 0
  • Joined: 2004/03/09 01:20:18
  • Location: Heidelberg, Germany
  • Status: offline
Re: RE: Mass Creation of object addresses in FGT 2019/11/07 08:52:02 (permalink)
0
OK, sorry,
@echo off
REM input: textfile addr.txt with IP,name (one per line)
REM values delimited by commas, comments start with #

REM redirect output to a batch command file for uploading to a Fortigate
 
echo config vdom
echo edit VDOMNAME

echo config firewall address
for /f " eol=# tokens=1-2 delims=," %%i in (addr.txt) do CALL :oneaddr %%i %%j
echo end
echo end
goto :EOF

:oneaddr
echo edit %2
echo set type ipmask
echo set subnet %1/32
echo next

 
where VDOMNAME is the name of your VDOM.

Ede

" Kernel panic: Aiee, killing interrupt handler!"
#29
poundy
New Member
  • Total Posts : 6
  • Scores: 0
  • Reward points: 0
  • Joined: 2019/06/13 20:58:45
  • Status: offline
Re: RE: Mass Creation of object addresses in FGT 2019/11/07 19:11:35 (permalink)
0
I can't really understand why people need to modify this script for a particular VDOM, or can't do that themselves.... All it really requires is editing the vdom in question before you start, then pasting the commands that a script produces (or a subset, if it produced an EDIT earlier). 
#30
KPS
Silver Member
  • Total Posts : 99
  • Scores: 1
  • Reward points: 0
  • Joined: 2017/03/08 05:40:39
  • Status: offline
Re: Mass Creation of object addresses in FGT 2019/11/07 22:46:21 (permalink)
0
Hi!
 
I dont't know, what you exactly want to achieve (finally), but perhaps, it's worth to look at the new "Farbric-Connector-Feeds" in 6.2
 
You can dynamically feed in lists of ip addresses as http-download and use these lists as address objects in policies.
 
...just in case...
#31
emnoc
Expert Member
  • Total Posts : 5366
  • Scores: 351
  • Reward points: 0
  • Joined: 2008/03/20 13:30:33
  • Location: AUSTIN TX AREA
  • Status: offline
Re: Mass Creation of object addresses in FGT 2019/11/07 23:29:16 (permalink)
0
Also if you need to build azure dc range lists or similar you can do the following
 
http://socpuppet.blogspot.com/2017/03/how-to-extract-ms-azure-dc-and-batch-of.html
 
if your doing consecutive items in bulk you can also do something similar
 
http://socpuppet.blogspot.com/2012/11/fortigate-firewall-cfg-script-to-speed.html
 
Great for new deployments and where items are consecutive in nature.
 
Ken Felix

PCNSE,  NSE , Forcepoint ,  StrongSwan Specialist
#32
Page: < 12 Showing page 2 of 2
Jump to:
© 2019 APG vNext Commercial Version 5.5