Mass removal of custom devices

[TomBruno]

Hi All

For a customer I support we allow their users access to the network by collecting all their MAC addresses and adding them as Custom Devices to the FortiGate. Currently the firewall has nearly 6500 MAC address entries. We have been told we can delete any entry not seen for 3 months. and Friday is 3 months since the last reboot and there are nearly 3000 devices "last seen" on oct 18th that we can delete. 

Currently my method for deleting an entry is going to Device Inventory, going to edit it, removing all the custom groups, saving it and then deleting the entry. With the slow load times we see on this fortigate, this could mean hours of manually deleting entries. (I can highlight up to about 20/30 to delete manually, but have to go into each entry to remove the Custom Groups beforehand)

Would anyone have any advice to make these deletions a bit easier/speedier?

FortiGate Model: 1500D

Firmware: v5.4.8,build1183 (GA)

Thanks in advance

[Seppel]

Save config, edit the config file (remove the devices), and restore the config to the fortigate.

but this works only with a reboot.

regards

[emnoc]

I would explore a  expect script and seed file . Maybe add the device and time and then use some awk and grep and look for any  value older than  XYX and  script it out. Also maybe the  api reference guide might have some options.

This is why doing these options are  task heavy and you need to  deploy some types of timer or expirations.

Ken Felix

[TomBruno]

Seppel wrote:

Save config, edit the config file (remove the devices), and restore the config to the fortigate.

but this works only with a reboot.

regards

I only work in the GUI so sorry if I am way off. But from what I have seen of the config, it isn't clear in there when each device was last seen. I wouldn't know which devices had been unseen by the fortigate for 3 months and which ones were still in use. 

If I wasn't clear before, I want to delete entries that are stagnant, that haven't accessed the network in 3 months. I only know how to see that information in the GUI, I am not sure the config holds that info.

[Seppel]

please us

diag user device list

then you can see last seen info each device. but i think without a little script it is impossible to do your request.

  vd root/0  00:00:00:00:00:00  gen 1881573  req S/2     created 122209s  gen 1872859  seen 114541s  ******  gen 296777     ip 172.16.254.2  src mac     type 20 'Other Network Device'  src configured  id 0  gen 3002289     host 'ws-test'  src configured

regards.

[rwpatterson]

Did I hear script?

Give me a sample with a few lines and explain to me what I'm looking at and I'll see what I can do. Feel free to change the IP addresses or MAC addresses to 'x's for security purposes.

Please, I prefer not to have a screen shot. CLI would be better.