Custom Internet Service

[MarkR]

Hi,

We manage our 800D (v5.6.3) through ForitManager (v6.0.4) and I want to create a Custom Internet Service (IS-C) entry so I can use it in a policy.

I can create it using the CLI Configuration (@Fortinet, thank you for the updating the interface, much easier now), Firewall -> internet-service custom -> + Create (and follow the next steps). But the custom entry won't show up in the list when I want to create a policy (I see the ISDB, but custom has 0 entries), even if I update (install wizard) the firewall with the new config.

I see that the IS-C is uploaded to the firewall and is found at the Fortigate itself (from the read-write FortiGate GUI it can be selected, see included picture). 

Below to update from FortiManager

Install Preview Device: H01xxxxxxxxA Virtual Domain: global, TDCG config vdom edit TDCG config firewall internet-service-custom edit "ISC-test" set comment "\'\'" config entry edit 1 set dst "TEST_Laptop_Mark" set protocol 6 next end config entry edit 1 config port-range edit 1 set start-port 443 set end-port 443 next end next end next end end

Somehow the FortiManger doesn't load the Internet Services entries from the FortiGate, can anyone else confirm my findings?

And now the "wierd" part of this story.. If I do a change/creating of a policiy, and I do a re-install policy, the change is correctly pushed but the IS-C I created is gone/removed from the FortiGate..

Below the policy update (I only change the name of polcy 57).

Install Preview Device: H01xxxxxxxA Virtual Domain: vdom1 config vdom edit vdom1 config firewall policy edit 57 set name "Allow Internet Traffic" next end end config vdom edit vdom1 config firewall internet-service-custom purge end end

You can see it does a purge in internet-servce-custom, so fortimanager knows it is in there and because it is not used it is removed. 

Hope someone can verify this, thanks in advanced

Regards,

Mark

[chall_FTNT]

You would need to perform a retrieve (only if auto-update didn't learn of this change) and then perform an import (to ensure that Policy & Objects is updates … this part is not automatic).

[MarkR]

Hi Chall,

Thanks for your response, but I found out it is much easier (took me a while to figure it out).

I clearly missed the option to add Internet Service from the Display Options (Policy & Objects > Tools > Display Options), could be that this was added in the latest version of FMG.

After adding it a new entry "Internet Service" below Firewall Objects appeared. I was able to add a Custom Internet Service object using this option in FMG-GUI (just like adding a Addresses/Services/etc.) and voila I was able to use it in a policy.