Technical Tip: How to perform bulk addition/modification with a Web Filter and DNS profile

Description

This article describes how to perform Bulk addition/modification to a Web Filter or DNS profile.

Scope

FortiGate.

Solution

1. Find the urlfilter-table number in the web-filter profile.
2. Add the static URL filter entries in the url-filter table.
   
   

For example:

Take the 'default' Web Filter profile, which has the urlfilter-table number 4.

config webfilter profile
    edit "default"
        config web
            set urlfilter-table 4
        end
end

Add the static URL entry using the following commands:

config webfilter urlfilter
    edit 4
        set name "Auto-webfilter-urlfilter_s70j6jcw9"
            config entries
                edit 1                   <----- Can repeat this entry for other domain, Use 0 (zero) automatic number.
                    set url "static.com" <----- Domain name.
                    set action allow     <----- Action can be exempt, block, allow (no log), monitor(with log).
                next
            end
    next
end

The Excel document attached (CLI_static_urlfilter_template.zip) can be used to generate the CLI configuration for the static URL Web Filter.

1. Fill in 'Static URL Table #'. In the example above, this is the url-filter table number 4. Enter 4.
2. Fill in the URL in the URLs column. The list of URLs can be copied and pasted from a file. Fill in the corresponding action under the Action column.

3. Copy the generated CLI configuration.

4. Paste it into Notepad to verify the configuration. Copy the CLI configuration, but do not copy the double quotes("). 

5. Open the FortiGate CLI and paste the CLI commands.

If there is already a URL filter set or in use, just copy the output that starts at "config entries" and add it to the in-use URL filter.

Sample Output:

As there are two existing URL filters that are already in use, select which filter is in use for the web filter profile set on the policy.

In this sample, 'Auto-webfilter-urlfilter_skzni2n84' is in use on the web filter profile.

config webfilter urlfilter
    edit 1
        set name "Auto-webfilter-urlfilter_skzni2n84"

Then paste the spreadsheet output that starts on 'config entries'.

Sample output:

        config entries

            edit 0
                set url google.com
                set action exempt
            next
        end
    next
end

Note: The spreadsheet does not have the option to set the type to 'wildcard' and uses type 'simple' by default. If a wildcard type is in use, edit it on the URL filter GUI or CLI after loading the bulk URL filter entry.

The same applies to the DNS filter, but the table name is 'domain-filter-table'.

config dnsfilter profile

    edit "default"

        set comment "Default dns filtering."

            config domain-filter

                set domain-filter-table 1

            end

end

config dnsfilter domain-filter
    edit 1
        set name "default"
        set comment "Default dns filtering."

            config entries

                edit 1

                    set domain "test.com"
                    set action allow
                next
            end
    next
end