Technical Tip: Adding or removing IP addresses and port ranges to/from a predefined internet service using the internet service extension

Description

This article describes a technical tip for defining and using the Internet Service Extension feature.
As a reminder, this feature allows adding and/or removing IP address(es) and port range(s) to/from an existing predefined internet service entry.
Using an extension type internet service comes to edit a predefined internet service entry and add/remove IP address(es) and port range(s) to/from it.

Scope

FortiGate.

Solution

Note that, while internet service database objects are globally defined, the internet service extension is a VDOM-level feature.
Example: extensions are configured and applied only on a VDOM-level basis.

Adding an IP address/port range to a predefined Internet Service entry.

As per the documentation, creating an internet service extension requires configuring IP or IP ranges, protocol number, port or port ranges via the CLI (this cannot be done at the GUI for now).

Based on this, adding an IP address range of 10.10.10.0-10.10.10.0 with a TCP port range of 8080-8081 to the predefined Internet Service 'Google-Gmail' in VDOM 'VD-1' can then be done using the following command set.

1. Retrieve the identifier of the 'Google-Gmail' Internet Service (65646). 

diagnose internet-service id | grep Google-Gmail

ID: 65646 name: "Google-Gmail"

FGT (global) #

2. Define the IP address range '10.10.10.0-10.10.10.0' using a firewall address object.

config firewall address
    edit "ISDB-Range-1"
        set type iprange
        set start-ip 10.10.10.0
        set end-ip 10.10.10.0
    next
end

3. Extend the 'Google-Gmail' internet service using the 'internet-service-extension' command.

config firewall internet-service-extension
    edit 65646
        set comment ''
            config entry
                edit 1
                    set protocol 6
                        config port-range
                            edit 1
                                set start-port 8080
                                set end-port 8081
                            next
                        end
                    set dst "ISDB-Range-1"
                next
            end
    next
end

4. Once the configuration change is applied, the following message is displayed to indicate what needs to be done to make the change effective.

Warning:
Configuration will only be applied after rebooting or using the '#execute internet-service refresh' command.

5. Refresh the internet service database using the 'exec internet-service refresh' global-level command.

Since v7.2, the command has changed to the following:

exec internet-service refresh
Internet Service database is refreshed.

Since v7.2, the command has changed to the following:

execute internet-service4 refresh

6. Verify a new entry was effectively added at the VDOM level to the predefined 'Google-Gmail' internet service.

diagnose firewall internet-service-extension list

List internet service in kernel(custom):
name=Google-Gmail id=65646 reputation=5 Known and verified safe sites such as Gmail, Amazon, eBay, etc. singularity=0 flags=0x0 protocol=6 port=8080-8081
addr ip range(1): 10.10.10.0-10.10.10.0

7. Referring to the extended 'Google-Gmail' internet service in a VDOM level firewall policy can be done as per the following command.

config firewall policy
    edit 1
        …
            set internet-service enable
            set internet-service-id 65646
        …
    next
end

Removing an IP address/port range from a predefined Internet Service entry.

Unlike the addition, the removal of an IP address/port range from a predefined internet service cannot be done at the CLI but requires to be done at the GUI.

1. Open the internet service database of VDOM 'VD-1' and search for the 'Google-Gmail' internet service (65646).
   
   

 

2. Edit the 'Google-Gmail' internet service and remove all protocol entries for IP address range '1.1.1.0-1.1.1.0' from it by changing the IP address range 'Status' from enabled to disabled.

 

3. Display the internet service extension of the VDOM 'VD-1' using the 'internet-service-extension' command.