Batch add object to multiple firewall policies?

Hello,

Thank you for using the Community Forum. I will seek to get you an answer or help. We will reply to this thread with an update as soon as possible.

Thanks,

Hello,

We are still looking for someone to help you.

We will come back to you ASAP.

Regards,

Such function, as far as I am aware, isn't natively available in FortiOS. (caveat: I cannot comment about FortiManager, maybe it does have some magic up its sleeve)

It definitely can be scripted with the REST API, but you'd need to write it yourself.

A rough sketch:

1, Get list of policies that contain address object "my-address" in sources or destinations. Return only policyID/srcaddr/dstaddr (to confirm match).

GET /api/v2/cmdb/firewall/policy/?filter==srcaddr==my-address,dstaddr==my-address&format=policyid|srcaddr|dstaddr

2, Make a list of policy IDs where my-address is among the sources (srcaddr; code depends on your language of choice)

3, Iterate through the list of IDs with a POST request to append "new-address" to these policies:

POST /api/v2/cmdb/firewall/policy/<policyid>/srcaddr
{"name": "new-address"}

4, Repeat #2 for destinations (dstaddr)

5, repeat #3 to update the destination address lists in the matching policies:

POST /api/v2/cmdb/firewall/policy/<policyid>/dstaddr
{"name": "new-address"}

Done.

The eventual removal can be automated with:

 DELETE /api/v2/cmdb/firewall/policy/<policyid>/srcaddr/<address-object-name>/

As you can see, this takes a bit of effort, so I wouldn't bother if the number of policies to update is low.

A slightly easier, though a bit more primitive approach could be a bulk edit in a good enough text editor.

1, Create the new address object as usual

2, Back up the config and edit the backup file

3, Do a bulk-replace of all instances of:

"<old-address-object>"

...with:

"<old-address-object>" "<new-address-object>"

I would recommend doing this with manual confirmations for each occurence, since this will likely have some false positive matches. (the object being mentioned in non-relevant places that should not be touched, such as its own definition)

3, Restore the configuration (reboot needed)
Alternative-3, Yank just the "config firewall policy" section of the modified backup (+any other section you modified), and copy-paste it over the existing config in CLI/SSH. Assuming it contains only the relevant modifications, it will update the relevant policies and leave the others untouched.