Helpful ReplyHot!Object Naming convension

Author
CoSax
New Member
  • Total Posts : 12
  • Scores: 0
  • Reward points: 0
  • Joined: 2017/04/21 10:40:09
  • Status: offline
2017/09/08 10:55:31 (permalink)
0

Object Naming convension

I have a basic question: From your experience, what would you recommend as a naming convention for the objects (hosts, networks, ports etc) in a fortigate firewall that is more practical and makes it easier later to support and resolve problems?
 
Your feedback will be appreciated!
#1
emnoc
Expert Member
  • Total Posts : 4216
  • Scores: 237
  • Reward points: 0
  • Joined: 2008/03/20 13:30:33
  • Status: offline
Re: Object Naming convension 2017/09/08 11:16:29 (permalink) ☄ Helpfulby CoSax 2017/09/12 23:11:37
0
IMHO and to help in audits
 
1: name them the same as local dns
 
2: stick to all upper or lower case
 
3: try to avoid spaces
 
e.g
 
WINHOST01 AAA
vrs
WINHOST01AAA
 
4: standardize the naming convention  no matter what method you go by
 
 
e.g GEO or region or purpose
 
 
 EQXCH3WEBSRV001
 EQXNY2WEBSRV001
 EQXNY2LDAPMS001
 
 
5: Keep aware of the maximum character name value ( 63 )
 
  
 
 
 
Ken
 

PCNSE6,PCNSE7, ACE, CCNP,FCNSP,FCESP,Linux+,CEH,ECSA,SCSA,SCNA,CISCA email/web
#2
ede_pfau
Expert Member
  • Total Posts : 5220
  • Scores: 326
  • Reward points: 0
  • Joined: 2004/03/09 01:20:18
  • Location: Heidelberg, Germany
  • Status: offline
Re: Object Naming convension 2017/09/09 02:05:01 (permalink)
0
6. stick to ASCII!

Ede

" Kernel panic: Aiee, killing interrupt handler!"
#3
emnoc
Expert Member
  • Total Posts : 4216
  • Scores: 237
  • Reward points: 0
  • Joined: 2008/03/20 13:30:33
  • Status: offline
Re: Object Naming convension 2017/09/10 10:58:55 (permalink)
0

6. stick to ASCII!

 
Be cautious  of ASCII 
 
e.g
 
FGT01 (address) # edit +#@333
The string contains XSS vulnerability characters

value parse error before '+#@333'
Command fail. Return code -173

FGT01 (address) # edit +#
The string contains XSS vulnerability characters

value parse error before '+#'
Command fail. Return
 
FGT01 (address) # edit #456
The string contains XSS vulnerability characters

value parse error before '#456'
Command fail. Return code -173



 
 
All are  ASCII but they will not work
 
;)

 

PCNSE6,PCNSE7, ACE, CCNP,FCNSP,FCESP,Linux+,CEH,ECSA,SCSA,SCNA,CISCA email/web
#4
CoSax
New Member
  • Total Posts : 12
  • Scores: 0
  • Reward points: 0
  • Joined: 2017/04/21 10:40:09
  • Status: offline
Re: Object Naming convension 2017/09/12 05:02:18 (permalink)
0
thanks for the input.
How about networks, interfaces, services, vips ??
 
 
#5
Kenundrum
Silver Member
  • Total Posts : 102
  • Scores: 6
  • Reward points: 0
  • Joined: 2008/05/15 10:25:50
  • Location: Rhode Island, US
  • Status: online
Re: Object Naming convension 2017/09/12 06:14:45 (permalink) ☄ Helpfulby CoSax 2017/09/12 23:10:51
0
I will typically put the object type in the name to make it easier to distinguish what you are looking at. For example you might have an interface, vlan, and zone all named internal- so the interface would be internal, then internalVLAN, and internalZONE to separate them. I will put VIP at the end of VIPs to distinguish between the original object and the VIP to that object. Sometimes you have a VPN that connects two networks that are similar function, so i'll put VPN at the end of the vpn interface name. Address groups have group at the end to distinguish them.
To put it together in an example you have a network that just connects backup servers in two locations. You have the BackupVLAN which comprises the BackupZONE. It talks over the BackupVPN to another location. You have traffic rules that allow from BackupServersGroup in BackupZONE to BackupVPN.
It sounds redundant, but it makes it easier to distinguish things when looking at the config file since there is no icon coding there- you can easily tell if a policy is going to a vip, or address, or address group.
Definitely agree with emnoc- keep addresses to what the dns/hostnames are for individual devices both for sanity and auditing. Use the comment field to specify that it's a certain user if you want to. I also name addresses that are entire subnets something different to indicate that like servernetwork or usernetwork. 
As far as case sensitivity is concerned- the fortigate is case sensitive and Capital letters come before lowercase ones, so if you have an address item with a lowercase letter first, it will appear after all the other capitalized ones in the gui.

NSE4 (at Accelerate2017!)
Some FGT500Ds, 60Ds at work
FWF60E, FWF80CM, FGT60C, and FWF60B at home
#6
emnoc
Expert Member
  • Total Posts : 4216
  • Scores: 237
  • Reward points: 0
  • Joined: 2008/03/20 13:30:33
  • Status: offline
Re: Object Naming convension 2017/09/12 07:30:06 (permalink)
0
One cool things on NAMING, you can always rename  firewall.adress and adrgp . So if you later change your format or need to bring objects into standard, it is easy todo.
 
Ken
 

PCNSE6,PCNSE7, ACE, CCNP,FCNSP,FCESP,Linux+,CEH,ECSA,SCSA,SCNA,CISCA email/web
#7
Jump to:
© 2017 APG vNext Commercial Version 5.5