How can I find a highest policy Id used on a vdom firewall policy? As they are not ordered in any particular way
Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
Hello,
Greetings!
I believe, you would like to know which Policy would be having more weightage. If not, kindly explain your exact requirement.
Please be advised that, the Policy ID does not matter however the order does. The Policy on the top of the list take precedence and traffic matches down the list (Top to Bottom).
In order to know the Policy ID, you can add the Column called "ID" in Firewall Policy.
Have a nice day!
Thanks Klint,
I am concerned more about the actual policy ID then about the order. However I am happy to follow some best practices in here. I am automating policy provisioning and I want to make sure that I use a new policy ID that is the highest currently used policyID +1.
The background is that I do have policies configured for given vdom in inconsistent way...
For example just a part of the output from show firewall policy
edit 1445
edit 1446
edit 200201
edit 200202
etc
Now when I create a new policy I want to be able to find the highest used policyID on that device/vdom and add 1 and use it for configuring the policy.
Is there a way to know the highest used policy ID?
Or maybe another way to handle it?
Maybe I can find in a simpler was the first available policy ID?
Created on 09-22-2022 04:30 AM Edited on 09-22-2022 04:31 AM
Hi,
on the FGT CLI you can create a new policy with the ID "0". This will always use a free ID slot in your policy set.
config firewall policy
edit 0
...
Hope this helps.
Regards
Nils
Welcome and my pleasure.
As mentioned by Nils, "edit 0" will take the next available slot that is, if there Policy ID 15 which is the highest/last one created, this "edit 0" will automatically take ID 16 for that new Firewall Policy.
And, there is no option to check the highest Policy ID directly on FortiGate however, starting 7.0.2 (https://docs.fortinet.com/document/fortigate/7.0.0/new-features/862475/export-firewall-policy-list-t...) there is an option to export the Firewall Policies to CSV or JSON format and there, you can filter things accordingly and check.
Hope this helps.
Have a nice day!
Regards,
Klint George
Just be aware that even there are big holes in the middle like skipping from "edit 1999" to "edit 3000", the "edit 0" doesn't find the one available like "edit 2000". It finds literally the highest+1 among those all policies.
Toshi
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
User | Count |
---|---|
1517 | |
1013 | |
749 | |
443 | |
209 |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.