Skip to main content
A
Anonymous_User
Contributor
June 4, 2010
Question

searching through firewall rules?

  • June 4, 2010
  • 2 replies
  • 2546 views
I have inherited a fortigate and I am trying to find a nice, clean way to list firewall rules that apply to a network address (or any hosts therein). There are A LOT of rules currently, so doing it manually would probably take a few days. Is there some method to essentially grep through rules that would be applied to a host within (say) 10.1.2.0/24 ?

    2 replies

    rwpatterson
    rwpatterson
    New Member
    June 4, 2010
    Welcome to the forums. The only way that comes to mind (for me) would be to make a backup in clear text (no password). First scan for the IP address. That will provide you the address name. Then scan for that name again through the config. Each policy should then be shown by number with each hit. If the address name is in a group, then you' ll have to scan through again with that group name as well. Hope that helps.
    abelio
    SuperUser
    abelio
    SuperUser
    June 4, 2010
    hello, There' s another additional approach: the easy way: you could use embbeded filter feature for search within the GUI; If you know the object' s name you could do searches using filters for sorce, destination, whatever, i.e example: attached figure. the advanced or more complicated way: use CLI diagnose command diagnose checkused <path.object.mkey> <tablename> i.e: diag sys checkused firewall.vip:name <VIP-NAME> " grep" command became available in fortios 4.2 thanks to god... regards,
    Terms & ConditionsAccessibility statement