Run "show" or "get" commands via script in FMG

From within a FortiManager CLI TCL script? How would that be done?

Here is my FMG TCL script. It has two sections. The first section uses "config firewall address" and creates a new address object. That works great. The second section, tries to use "show firewall policy". It returns nothing in the output (but it doesn't error either).

puts [exec_ondb "/adom/./pkg/default" "
config firewall address
edit TEST_OBJECT
set subnet 2.2.2.2/32
next
end
" "# "]

puts [exec_ondb "/adom/./pkg/default" "
show firewall policy
" "# "]

Here's is the script results:

-------Executing time: Thu Aug 1 17:30:39 2024-----------
Starting log (Run on device)
DEBUG INFO:
TCL command exec_ondb: target = /adom/./pkg/default
config firewall address
edit TEST_OBJECT
set subnet 2.2.2.2/32
next
end
#
DEBUG INFO:
TCL command exec_ondb: target = /adom/./pkg/default
#
config firewall address
edit TEST_OBJECT
set subnet 2.2.2.2/32
n ext
end
show firewall policy

----------------End of Log-------------------------

I have written several scripts (outside of FMG) that utilize the FMG API. They were great except that they are outside of FMG. It is highly desirable to run scripts from within FMG because:

1) FMG CLI/TCL scripts are easily exported and imported from one FMG to another FMG.

2) The scripts are self contained within FMG which makes them an integral part of the FMG solution as a whole.

3) Customers are much more comfortable with scripts when they run inside of the FMG product.

4) FMG as a "single pane of glass" is the best place for scripts to run. The scripts are self contained within FMG so that FMG backup, upgrades and accessibility is all handled by FMG features themselves.

So it is a real shame that show commands don't work. It is also a real shame that "exec fmpolicy print-adom-package" type commands cannot be run from within CLI/TCL scripts because that would solve the problem most beautifully.

Another nice way to solve the problem would be to let FMG TCL scripts exececute the curl command. That would allow FMG TCL scripts to access the FMG API. That would be way coo!!!!

** UPDATE **: I developed a work around that allows FMG CLI commands to be run from within TCL scripts. See this article. Also, I developed a work around that allows FMG TCL scripts to send emails. See this article.