Hi,
I have a script to block IP's for a given reason for Fortigate 400f, I am able to create addresses and apply to address group. However, I want to apply a form or rotation to avoid large address group.
I am able to clear up the members in the address group, however, I also want to remove the addresses. I know this can be done individually as an API call. But is there a way to bulk remove? I would likely be looking to remove 500 addresses as part of the rotation and I would not want to go down the route by removing one per API call
Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
Hello Dallustallus,
Thank you for using the Community Forum. I will seek to get you an answer or help. We will reply to this thread with an update as soon as possible.
Thanks,
Hello,
Could you please indicate to us under which firmware your FortiGate is running?
Regards,
Hi, Sorry for the delay.. I am running version 7.4.1
Many Thanks
Dale
Thank you.
I found this threat:
https://github.com/FortiPower/PowerFGT?tab=readme-ov-file#address-group
Could you please tell me if it helped?
Regards,
Thank you.
I have had a look at it, it looks like it is only removing 1 member of a group, rather than multiple members.
As an example you can add multiple addresses to a group by:
POST: https://{{IP}}/api/v2/cmdb/firewall/addrgrp/Test_API/member
Body: [{"name": "45.132.194.7/32"},{"name": "68.235.44.69/32"}]
To remove a member:
DELETE: https://{{IP}}:8443/api/v2/cmdb/firewall/addrgrp/Test_API/member/45.132.194.7%2F32
No Body
What I cannot do is use DELETE https://{{IP}}:8443/api/v2/cmdb/firewall/addrgrp/Test_API/member/
And provide Body to define what members to remove. If I attempt using either:
[{"name": "45.132.194.7/32"},{"name": "68.235.44.69/32"}]
or
[{"name": "45.132.194.7/32","q_origin_key": "45.132.194.7/32"},{"name": "68.235.44.69/32","q_origin_key": "68.235.44.69/32"}]
as a body, it just deletes all members of that group.
I Hope that makes sense?
Many Thanks
Dale
Hi Dale,
I honestly do not know the API that well; someone has to do more research on it or knows it better to comment on it.
I can recommend an alternative, it may work for you - Threads feeds.
Thread feeds take an IP list (literally a text file with a bunch of IPs on it) and insert it to FortiGate as a usable address object inside a deny policy.
I'm making the guess you already have such a list that is curated by you.
You're trying to tell the FortiGate to reflect that list in address objects and address group objects. If that existing list is available to download for the FortiGate, it might make things and scripting easier (obsolete in that case).
If you use these objects split in various policies however, you may have to use multiple thread feeds, or be better off with restAPI.
Best regards,
Markus
Hi Dallus,
You can use
Get-FGTFirewallAddressGroup -name "My Address Group" | Remove-FGTFirewallAddressGroupMember -member FGT2, FGT3
and it will be remove multiple member on the sametime
(the script use PUT Method after remove member for the list), there is no API call for only remove a member of the group
Hello,
Oh yes it makes sense :)! I will try to find somebody :)!
Regards,
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
User | Count |
---|---|
1517 | |
1013 | |
749 | |
443 | |
209 |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.