policy install date

6 replies
12753 views

Hi Guys, I' ve been googling for a while but no luck. I have a need to find out the date on which last firewall policy configuration changes were done. Currently I' m doing this by comparing firewall' s full-configuration daily backups. Also, in GUI system>maintenance I can find the date last backup was done. Is there a nice CLI or GUI way to know when was the configuration saved? Fortigate saves changes automatically, so last save should mean last changes? Thanks!

ede_pfau

SuperUser

Yes, exactly. But I don' t think you could get the list of recent saved configs via SNMP or such. Seen a post on the net where a guy uses plink (putty link) to grab the config from his mgmt host. You could do that periodically, compare to last config, discard if equal and save and log if not.

mykolasbAuthor

New Member

Thanks, I' m doing the same right now - comparing backups. I mean - is there a way to check on device itself? Checkpoint FW' s have this Revision Control function under SmartDashboard, maybe something similar exists for Fortigates?

ede_pfau

SuperUser

I' m running 4.3.x. On the Dashboard, System Information widget, System Configuration, click ' [Revisions]' . Check 2 configs then you have a ' Diff' button. So you can get a clue what was changed last. Date and rev. number are given in the list. BTW, as the diff is line-wise, it' s not easy to grasp in which context the change was made. I do the diffs manually in a program that shows the whole config (like windiff) which is much easier.

emnoc

New Member

You want the FortiManager. That' s what it' s designed todo and setup revision and change control management Also altenatively, you could set a date/time on the fwpolicy comment field.

rwpatterson

New Member

Under ' Log & Report' , there is an option to send a scheduled email indicating if there is a configuration change. At least it' s here in 4.2.x land...

rwpatterson

New Member

Sample message:

Message meets Alert condition  date=2013-06-13 time=09:21:28 devname=(my_fortigate)-1 device_id=FGT1KA26065xxxxx log_id=0104032127 type=event subtype=admin pri=notice  vd=root user=" rpatters"  ui=GUI(192.168.60.160) seq=328 sintf=" Wireless VLANs"  dintf=" port1"  saddr=" VLAN.148.guest"  daddr=" Server"   act=accept nat=no iptype=ipv4 schd=" always"  svr=" Allow.services"  msg=" User rpatters changed IPv4 firewall policy 328 from GUI(192.168.60.160)"

Sign up

Login with SSO

Login to the community

Login with SSO