Technical Tip: Grouping ISDB objects

[ksolovjova]

Description	This article describes that it when trying to add Internet Services to a group to use them in a policy, it may fail with an 'Entry not found in datasource' error.
Scope	FortiGate v6.2, v6.4, v7.0, v7.2, v7.4, v7.6.
Solution	The most common cause of this is a typo or non-matching capitalization when configuring members for the internet-service-group. Another common cause is the built-in 'direction' attribute of the Internet Service may not be compatible with the 'direction' configured in the Internet Service Group. More details about the direction consideration can be found on Technical Tip: Internet Service Grouping in relation to direction. By default, the newly created internet-service-group is 'both': show full firewall internet-service-group 1000 config firewall internet-service-group     edit "1000"         set direction both     next end Direction can be changed: config firewall internet-service-group     edit 1000         set direction ? source           As source when applied. destination      As destination when applied. both             Both directions when applied. Internet Services also have destination attributes: diagnose internet-service id-summary 327681 Version: 00007.03429 ... Internet Service: 327681(Microsoft-Web)... Direction: dst Or: diagnose internet-service id-summary 327903 Version: 00007.03429 ... Internet Service: 327903(Microsoft-Office365.Published.Allow) Direction: both Internet Services with directions 'both' can be added to groups with directions 'destination' and 'source'. For example, if the group direction is 'both', it is possible to add only Microsoft-Office365.Published.Allow ('both'), but not Microsoft-Web ('dst') to it. However, if changing the type to 'destination', it is possible to add both services.  This configuration can be done only from the CLI. Note: Starting from FortiOS v7.6.0, direction can be configured using the GUI as well. Go to Policy & Objects -> Internet Service Database -> Select Internet Service Group -> Create new. Related article: Technical Tip: Internet Service Grouping in relation to direction