Technical Tip: Use TCL Script in FortiManager to set source IP in FortiGate config by fetching FortiGate interface IP addresses

[farhanahmed]

Description

This article describes how to use a TCL script in FortiManager to fetch FortiGate interface IP addresses and set the source IP for FortiAnalyzer logging config in FortiGate. Settings source IP is helpful in case connectivity is through a VPN tunnel.

The script can be run for multiple FortiGates at the same time.

Scope

FortiManager.

Solution

1. To enable the TCL script, configure the following CLI settings in FortiManager.

config system admin setting

(setting) set show_tcl_script enable

(setting) end

2. Go to Device Manager -> Scripts,  select type TCL Script, and select 'Create new'.

Create the below TCL script:

#!
proc do_cmd {cmd} {
puts [exec "$cmd\n" "# " 15]
}
do_cmd "config system interface"
#
# FortiGate interface to fetch the IP address
#
do_cmd "edit port1"
set query [exec "show\n" "# "]
set output [split $query \n]
#
# Fetching the interface IP address
#
regexp {(?:\d+\.\d+\.\d+\.\d+){1}} $output ip
do_cmd "end"
#
# Setting the source IP
#
do_cmd "config log fortianalyzer setting"
do_cmd "set status enable"
do_cmd "set source-ip $ip"
do_cmd "end"

The script will fetch the IP address from the FortiGate interface (set on line#9 of the script above) and set it as the source-ip.

Note:

For FortiGate(s) with VDOMs enabled, a different script will be required.

#!
proc do_cmd {cmd} {
puts [exec "$cmd\n" "# " 15]
}
do_cmd "config global" <----- 'config global' is required for FortiGate(s) with VDOMs.
do_cmd "config system interface"
#
# FortiGate interface to fetch the IP address
#
do_cmd "edit port1"
set query [exec "show\n" "# "]
set output [split $query \n]
#
# Fetching the interface IP address
#
regexp {(?:\d+\.\d+\.\d+\.\d+){1}} $output ip
do_cmd "end"
#
# Setting the source IP
#
do_cmd "config log fortianalyzer setting"
do_cmd "set status enable"
do_cmd "set source-ip $ip"
do_cmd "end"

3.  Check the FortiGate, there is no source IP set yet:

get log fortianalyzer setting

Check the same under FortiManager -> Device Manager.

4. Check the IP address on Port1 of FortiGate:

Check under FortiManager -> Device Manager:

5. Run the script under the Device Manager -> Scripts, select the script and select 'Run Script':

Select the FortiGate and select the right arrow:

Select Run Now:

Select OK:

The script is running:

Script ran successfully:

Note:
If there are any errors, refer to the below document to troubleshoot TCL scripts:

Technical Tip: How to troubleshoot TCL Scripts failed in FortiManager

6. FortiGate(s) now have set the source-ip to the FortiGate interface (port1 in this example) IP address:

Check under FortiManager-> Device Manager:

Related documents:

Technical Tip: How to troubleshoot TCL Scripts failed in FortiManager

Tcl scripts