Mass Creation of object addresses in FGT

[ciscokid1903]

Has anyone created a script for importing a list of IP addresses to create Object Addresses within the FortiGate firewall? Ideally this script would allow for updates etc on a monthly basis. example list IP,Hostname,Interface 111.111.111.111,HOST-1,OUTSIDE 222.222.222.222,HOST-2,OUTSIDE 333.333.333.333,HOST-3,OUTSIDE to produce an output like the following:

  edit HOST-1 
  set type ipmask 
  set subnet 111.111.111.111/255.255.255.255 
  set associated-interface OUTSIDE  
  next 
  edit HOST-2 
  set type ipmask 
  set subnet 222.222.222.222/255.255.255.255 
  set associated-interface OUTSIDE  
  next 
  edit HOST-3 
  set type ipmask 
  set subnet 333.333.333.333/255.255.255.255 
  set associated-interface OUTSIDE  
  end 
 

[rwpatterson · Accepted solution]

That doesn' t look to be so difficult. You would still have to manually upload that into your unit though.

[ede_pfau · Accepted solution]

here you are with a rudimentary batch script:

 @echo off
 REM input: textfile addr.txt with IP,name,interface (one per line)
 REM values delimited by commas, comments start with #
 
 REM redirect output to a batch command file for uploading to a Fortigate
 
 
 echo config firewall address
 for /f " eol=# tokens=1-3 delims=,"  %%i in (addr.txt) do CALL :oneaddr %%i %%j %%k
 echo end
 goto :EOF
 
 :oneaddr
 echo edit %2  
 echo set type ipmask  
 echo set subnet %1/32
 set intf=%3  
 if [%3]==[] set intf=ANY 
 echo set associated-interface %intf%   
 echo next

with this input file

# IP,Hostname,Interface 111.111.111.111,HOST-1,OUTSIDE 222.222.222.222,HOST-2 333.333.333.333,HOST-3,OUTSIDE

this output is produced:

config firewall address edit HOST-1 set type ipmask set subnet 111.111.111.111/32 set associated-interface OUTSIDE next edit HOST-2 set type ipmask set subnet 222.222.222.222/32 set associated-interface ANY next edit HOST-3 set type ipmask set subnet 333.333.333.333/32 set associated-interface OUTSIDE next end

[emnoc]

We (unix guys )  do the same but with awk 

               awk 'BEGIN { print "config firewall address"}'  >> $TMP                 cat $1 | awk ' {  print "edit \x22"$1"\x22" }' >> $TMP                 cat $1 | awk ' {  print "set address \x22"$2"\x22" }'  >> $TMP                 awk 'BEGIN { print "end"}'  >> $TMP                 done And we use a for loop to generate  batch scripts that could be upload thru the fgt or fgtmngr Ken Felix 

[emnoc]

FWIW, the file variable $TMP is a temp file with the current epoch unix date, this ensure a unique filename. Once you built the batch script you just push them into the FGT.

Save a lot type and especially if you can get the host object output in a tab-separated format. 

e.g 

www1  1.1.1.1

www2  1.1.1.2

www3  1.1.1.3

[Valoni]

ede_pfau wrote:

No, not at all! Please re-read my posts...

This script is run on a Win PC. The output file (a text file) can be uploaded to the FGT via System > Advanced > Batch command. You will need admin access to the FGT for this, but not for the file creation.

You need to supply the 200 addresses in a CSV file (comma separated values), that is a text file where you put "ip address", comma, "hostname" on one line, with one line per host. My example just held only 3 addresses so not to bore the audience.

Can I use excel sheet to compute the addresses, wih two columns, the IP and the Hostname?

[ede_pfau]

yes, save as "CSV". Can be used with both my script or the PowerShell script.

[Valoni]

okay, thanks.  one more thing, I need this done on a particular vdom as an object, I do not need the interface option. Will this script still do the job?

[ede_pfau]

Use this for a 2-parameter file:

@echo off
 REM input: textfile addr.txt with IP,name (one per line)
 REM values delimited by commas, comments start with #
 
 REM redirect output to a batch command file for uploading to a Fortigate
 
 
 echo config firewall address
 for /f " eol=# tokens=1-2 delims=," %%i in (addr.txt) do CALL :oneaddr %%i %%j
 echo end
 goto :EOF
 
 :oneaddr
 echo edit %2 
 echo set type ipmask 
 echo set subnet %1/32
 echo next

[Valoni]

thanks but I need it to transition directly to the vdom  not configure globally.

[ede_pfau]

OK, sorry,

@echo off
 REM input: textfile addr.txt with IP,name (one per line)
 REM values delimited by commas, comments start with #
 
 REM redirect output to a batch command file for uploading to a Fortigate

echo config vdom

echo edit VDOMNAME

echo config firewall address
for /f " eol=# tokens=1-2 delims=," %%i in (addr.txt) do CALL :oneaddr %%i %%j
echo end
echo end

goto :EOF

:oneaddr
echo edit %2
echo set type ipmask
echo set subnet %1/32
echo next

where VDOMNAME is the name of your VDOM.

[poundy]

I can't really understand why people need to modify this script for a particular VDOM, or can't do that themselves.... All it really requires is editing the vdom in question before you start, then pasting the commands that a script produces (or a subset, if it produced an EDIT earlier). 

[ciscokid1903]

Thank you for this Ede. In your example, where is the output generated?