How to find unused firewall address objects from the cli?

[journeyman]

Is it possible to return a list of unused firewall addresses in the cli?

This is directly related to the Ref column in the GUI. However the ref column can not be sorted or filtered.

So the question might be if the ref count can be seen in the cli somehow?

I am aware of diag sys checkused, but the opposite is required here.

It would be possible to write a script to do this but obviously if the functionality exists already that would be better.

Backstory, firmware is 4.3 and we've hit the address table limit. Our immediate need is to free some addresses prior to a firmware upgrade.

[emnoc]

diag sys checkused  is what I would use and script it

e.g  ( build a list of objects )

echo -e "config  vdom\n edit root\n show firewall address | grep edit "  |  ssh 11.1.1.16  | awk '{ print $2 }'

Than take that list and loop it thru with the diag system checkuse and find what comes back with nada.

Ken

[journeyman]

I ran checkused on all objects using a single plink session (which took 20 minutes to run on a 60C). Unfortunately I forgot that plink logging does not include the input so working out which objects have no match is not easy, and didn't feel like writing a script that logged into the FGT 500 times.

Scripting against an offline copy of the configuration file which was my initial approach is also not so easy (build a list of objects like above; return those not matched in firewall.policy.srcaddr or dstaddr; ditto check addrgrp).

Manual check of the GUI is the fastest way to clear some space even if it is subject to error.

Thanks for your suggestions and primarily for "confirming" (by omission) that there is no straight forward way.

BTW the problem was first found when adding a new object and got

return code -361

That seems to relate directly to the maximum values. I also found an interesting command

print tablesize

which lists the table limits but not the current object count.

[emnoc · Accepted solution]

It shouldn't be that hard, take the above earlier example & direct it to a file.

Police it and then use a find/replace and append the "diag sys checkused firewall.address.name  " to each line

e.g

echo -e "config  vdom\n edit root\n show firewall address | grep edit "  |  ssh 11.1.1.6  | awk '{ print $2 }' > file

vi the file and  add the diag sys checkused and the grep statement you want.

Now build a bulk  script and run that back thru a ssh sesson

for A in  ` cat file ` ;

    do echo "diag sys checkused firewall.address.name  $A ";

done

Your file would look like  this ( example ) before we apply the pipe and grep strings

diag sys checkused firewall.address.name  "10.11.1.22" diag sys checkused firewall.address.name  "10.11.1.23" diag sys checkused firewall.address.name  "10.11.1.24" diag sys checkused firewall.address.name  "10.11.1.25" diag sys checkused firewall.address.name  "10.11.1.26" diag sys checkused firewall.address.name  "10.11.1.27" diag sys checkused firewall.address.name  "10.11.1.28" diag sys checkused firewall.address.name  "10.11.1.29" diag sys checkused firewall.address.name  "10.11.1.30" diag sys checkused firewall.address.name  "10.11.1.41" diag sys checkused firewall.address.name  "10.11.1.42" diag sys checkused firewall.address.name  "10.11.1.46" diag sys checkused firewall.address.name  "10.11.1.47" diag sys checkused firewall.address.name  "10.11.1.48" diag sys checkused firewall.address.name  "10.11.1.49" diag sys checkused firewall.address.name  "10.11.1.50" diag sys checkused firewall.address.name  "10.11.1.51" diag sys checkused firewall.address.name  "10.11.1.52" diag sys checkused firewall.address.name  "10.11.1.53"

Now just run that and grep for "entry used by" or lack of and that would be the  address object NOT IN USE. You could probably run a expect script or echo that file back into the  firewall

So your final  file would look like this;

config vdom   edit root

diag sys checkused firewall.address.name  "10.11.1.22"  | grep used diag sys checkused firewall.address.name  "10.11.1.23"   | grep used diag sys checkused firewall.address.name  "10.11.1.24"   | grep used

and so on for all objects by name.

Now just run  that  named file and unix-cat it back in;

cat A | ssh kfelix@myfirewalllexample.com

And yes print table will provide you the max values ;

http://socpuppet.blogspot...s-print-tablesize.html

FWIW: if you have no multi-vdom than the  above examples would be simpler. You could also do like you said match it to src/dstaddr but checkused on the "named" object will display where it's used at.

YMMV on  what method you use & the  script type,   but just run it thru checkused. I would also run duplicate checks ( yes , the outfit I'm working in had engineer install the same OBJECT twice, three or more ). Than you can  reduce any duplicates but that's a little bit to advance for me to explain how we find that ;)

GoodLuck

Ken

[journeyman]

Thank you. I now have a simple working solution.

As mentioned, the way I was running the checkused script made it very hard to identify which objects are unused.

But you have provided the clue I needed to make it work. I did not realise you could pipe diag sys checkused through grep (and I can't see why you did), but when you pipe through grep you can count the results and that is very useful. Then every input line has a matching output line and it is simple to match and find the zeros.

"diag sys checkused firewall.address.name object-name | grep -c used" > file

> plink file firewall > results

> awk NF results | paste file - | grep -e " 0$"

diag sys checkused firewall.address.name object-name | grep -c used firewall # 0 The output is not beautiful but it positively identifies the objects we can delete. Bonus, this can be applied to any objects in the configuration.

Note that semi obviously, I'm working under Windows using Gnu utils, slight syntax differences. We use an awk script that returns an entire configuration block, similar to eg. sh firewall address so the way we build the checkused script differs. We also recently removed any spaces in firewall address object names to simplify scripts like this, so we don't need to quote.

We also have a handful of duplicates it seems. Oops :)