Skip to main content
journeyman
journeyman
New Member
June 6, 2017
Solved

How to find unused firewall address objects from the cli?

  • June 6, 2017
  • 1 reply
  • 13788 views

Is it possible to return a list of unused firewall addresses in the cli?

This is directly related to the Ref column in the GUI. However the ref column can not be sorted or filtered.

So the question might be if the ref count can be seen in the cli somehow?

 

I am aware of diag sys checkused, but the opposite is required here.

It would be possible to write a script to do this but obviously if the functionality exists already that would be better.

 

Backstory, firmware is 4.3 and we've hit the address table limit. Our immediate need is to free some addresses prior to a firmware upgrade.

    Best answer by emnoc

    It shouldn't be that hard, take the above earlier example & direct it to a file.

     

    Police it and then use a find/replace and append the "diag sys checkused firewall.address.name  " to each line

     

    e.g

     

    echo -e "config  vdom\n edit root\n show firewall address | grep edit "  |  ssh 11.1.1.6  | awk '{ print $2 }' > file

     

    vi the file and  add the diag sys checkused and the grep statement you want.

     

    Now build a bulk  script and run that back thru a ssh sesson

     

     

    for A in  ` cat file ` ;

        do echo "diag sys checkused firewall.address.name  $A ";

    done

     

    Your file would look like  this ( example ) before we apply the pipe and grep strings

     

    diag sys checkused firewall.address.name  "10.11.1.22" diag sys checkused firewall.address.name  "10.11.1.23" diag sys checkused firewall.address.name  "10.11.1.24" diag sys checkused firewall.address.name  "10.11.1.25" diag sys checkused firewall.address.name  "10.11.1.26" diag sys checkused firewall.address.name  "10.11.1.27" diag sys checkused firewall.address.name  "10.11.1.28" diag sys checkused firewall.address.name  "10.11.1.29" diag sys checkused firewall.address.name  "10.11.1.30" diag sys checkused firewall.address.name  "10.11.1.41" diag sys checkused firewall.address.name  "10.11.1.42" diag sys checkused firewall.address.name  "10.11.1.46" diag sys checkused firewall.address.name  "10.11.1.47" diag sys checkused firewall.address.name  "10.11.1.48" diag sys checkused firewall.address.name  "10.11.1.49" diag sys checkused firewall.address.name  "10.11.1.50" diag sys checkused firewall.address.name  "10.11.1.51" diag sys checkused firewall.address.name  "10.11.1.52" diag sys checkused firewall.address.name  "10.11.1.53"

     

    Now just run that and grep for "entry used by" or lack of and that would be the  address object NOT IN USE. You could probably run a expect script or echo that file back into the  firewall

     

    So your final  file would look like this;

     

    config vdom   edit root

    diag sys checkused firewall.address.name  "10.11.1.22"  | grep used diag sys checkused firewall.address.name  "10.11.1.23"   | grep used diag sys checkused firewall.address.name  "10.11.1.24"   | grep used

    and so on for all objects by name.

     

    Now just run  that  named file and unix-cat it back in;

     

    cat A | ssh kfelix@myfirewalllexample.com

     

    And yes print table will provide you the max values ;

     

    http://socpuppet.blogspot...s-print-tablesize.html

     

    FWIW: if you have no multi-vdom than the  above examples would be simpler. You could also do like you said match it to src/dstaddr but checkused on the "named" object will display where it's used at.

     

    YMMV on  what method you use & the  script type,   but just run it thru checkused. I would also run duplicate checks ( yes , the outfit I'm working in had engineer install the same OBJECT twice, three or more ). Than you can  reduce any duplicates but that's a little bit to advance for me to explain how we find that ;)

     

     

    GoodLuck

    Ken

    1 reply

    emnoc
    emnoc
    New Member
    June 6, 2017

    diag sys checkused  is what I would use and script it

     

     

    e.g  ( build a list of objects )

     

    echo -e "config  vdom\n edit root\n show firewall address | grep edit "  |  ssh 11.1.1.16  | awk '{ print $2 }'

     

     

    Than take that list and loop it thru with the diag system checkuse and find what comes back with nada.

     

    Ken

     

    journeyman
    journeymanAuthor
    New Member
    June 6, 2017

    I ran checkused on all objects using a single plink session (which took 20 minutes to run on a 60C). Unfortunately I forgot that plink logging does not include the input so working out which objects have no match is not easy, and didn't feel like writing a script that logged into the FGT 500 times.

    Scripting against an offline copy of the configuration file which was my initial approach is also not so easy (build a list of objects like above; return those not matched in firewall.policy.srcaddr or dstaddr; ditto check addrgrp).

    Manual check of the GUI is the fastest way to clear some space even if it is subject to error.

     

    Thanks for your suggestions and primarily for "confirming" (by omission) that there is no straight forward way.

     

    BTW the problem was first found when adding a new object and got 

    return code -361
    That seems to relate directly to the maximum values. I also found an interesting command
    print tablesize
    which lists the table limits but not the current object count.

    emnoc
    emnocAnswer
    New Member
    June 6, 2017

    It shouldn't be that hard, take the above earlier example & direct it to a file.

     

    Police it and then use a find/replace and append the "diag sys checkused firewall.address.name  " to each line

     

    e.g

     

    echo -e "config  vdom\n edit root\n show firewall address | grep edit "  |  ssh 11.1.1.6  | awk '{ print $2 }' > file

     

    vi the file and  add the diag sys checkused and the grep statement you want.

     

    Now build a bulk  script and run that back thru a ssh sesson

     

     

    for A in  ` cat file ` ;

        do echo "diag sys checkused firewall.address.name  $A ";

    done

     

    Your file would look like  this ( example ) before we apply the pipe and grep strings

     

    diag sys checkused firewall.address.name  "10.11.1.22" diag sys checkused firewall.address.name  "10.11.1.23" diag sys checkused firewall.address.name  "10.11.1.24" diag sys checkused firewall.address.name  "10.11.1.25" diag sys checkused firewall.address.name  "10.11.1.26" diag sys checkused firewall.address.name  "10.11.1.27" diag sys checkused firewall.address.name  "10.11.1.28" diag sys checkused firewall.address.name  "10.11.1.29" diag sys checkused firewall.address.name  "10.11.1.30" diag sys checkused firewall.address.name  "10.11.1.41" diag sys checkused firewall.address.name  "10.11.1.42" diag sys checkused firewall.address.name  "10.11.1.46" diag sys checkused firewall.address.name  "10.11.1.47" diag sys checkused firewall.address.name  "10.11.1.48" diag sys checkused firewall.address.name  "10.11.1.49" diag sys checkused firewall.address.name  "10.11.1.50" diag sys checkused firewall.address.name  "10.11.1.51" diag sys checkused firewall.address.name  "10.11.1.52" diag sys checkused firewall.address.name  "10.11.1.53"

     

    Now just run that and grep for "entry used by" or lack of and that would be the  address object NOT IN USE. You could probably run a expect script or echo that file back into the  firewall

     

    So your final  file would look like this;

     

    config vdom   edit root

    diag sys checkused firewall.address.name  "10.11.1.22"  | grep used diag sys checkused firewall.address.name  "10.11.1.23"   | grep used diag sys checkused firewall.address.name  "10.11.1.24"   | grep used

    and so on for all objects by name.

     

    Now just run  that  named file and unix-cat it back in;

     

    cat A | ssh kfelix@myfirewalllexample.com

     

    And yes print table will provide you the max values ;

     

    http://socpuppet.blogspot...s-print-tablesize.html

     

    FWIW: if you have no multi-vdom than the  above examples would be simpler. You could also do like you said match it to src/dstaddr but checkused on the "named" object will display where it's used at.

     

    YMMV on  what method you use & the  script type,   but just run it thru checkused. I would also run duplicate checks ( yes , the outfit I'm working in had engineer install the same OBJECT twice, three or more ). Than you can  reduce any duplicates but that's a little bit to advance for me to explain how we find that ;)

     

     

    GoodLuck

    Ken

    Terms & ConditionsAccessibility statement