Explorer

Solved

fortigate simulation tool

4 replies
19083 views

Hello everyone,

Is there a simulation tool in FortiGate where

1) you provide a source ip/port and a destination ip/port and service (maybe more parameters)

2) the tool returns you what policy, security profiles, etc and actions would be applied acoording to the current settings?

Thanks for your help,

FortiGate

abarushkaAnswer

Staff

Hello,

It exists and it is built-in in FortiOS (CLI/GUI). Please find the details about CLI tool following the link below:

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Trace-which-firewall-policy-will-match-based-on-IP/ta-p/195038

Please find the details about GUI tool following the link below:

https://docs.fortinet.com/document/fortigate/7.0.5/administration-guide/497952/policy-views-and-policy-lookup

abarushkaAnswer

Staff

Hello,

It exists and it is built-in in FortiOS (CLI/GUI). Please find the details about CLI tool following the link below:

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Trace-which-firewall-policy-will-match-based-on-IP/ta-p/195038

Please find the details about GUI tool following the link below:

https://docs.fortinet.com/document/fortigate/7.0.5/administration-guide/497952/policy-views-and-policy-lookup

joh2kAuthor

Explorer

Thanks. I get "Unkonwn action 0"

Fortigate1 $ diag firewall iprope lookup 10.187.1.100 12345 8.8.8.8 53 udp port2 Unknown action 0

Maybe I need to be administrator? I am on a readonly user

Debbie_FTNT

Staff & Editor

Hey joh2k,

yes, for the whole 'diagnose' commands you need to be an administrator; the diagnose commands can be pretty powerful and are thus locked behind admin privileges.

I believe you might still be able to use the policy lookup tool in FortiGate GUI though, as long as you have read permissions for that.

The administration guide link my colleague provided above contains a section about the Policy Lookup tool in FortiGate GUI.

I hope this helps!

Sign up

Login with SSO

Login to the community

Login with SSO