Mass Creation of object addresses in FGT

[ciscokid1903]

Has anyone created a script for importing a list of IP addresses to create Object Addresses within the FortiGate firewall? Ideally this script would allow for updates etc on a monthly basis. example list IP,Hostname,Interface 111.111.111.111,HOST-1,OUTSIDE 222.222.222.222,HOST-2,OUTSIDE 333.333.333.333,HOST-3,OUTSIDE to produce an output like the following:

  edit HOST-1 
  set type ipmask 
  set subnet 111.111.111.111/255.255.255.255 
  set associated-interface OUTSIDE  
  next 
  edit HOST-2 
  set type ipmask 
  set subnet 222.222.222.222/255.255.255.255 
  set associated-interface OUTSIDE  
  next 
  edit HOST-3 
  set type ipmask 
  set subnet 333.333.333.333/255.255.255.255 
  set associated-interface OUTSIDE  
  end 
 

[rwpatterson · Accepted solution]

That doesn' t look to be so difficult. You would still have to manually upload that into your unit though.

[ede_pfau · Accepted solution]

here you are with a rudimentary batch script:

 @echo off
 REM input: textfile addr.txt with IP,name,interface (one per line)
 REM values delimited by commas, comments start with #
 
 REM redirect output to a batch command file for uploading to a Fortigate
 
 
 echo config firewall address
 for /f " eol=# tokens=1-3 delims=,"  %%i in (addr.txt) do CALL :oneaddr %%i %%j %%k
 echo end
 goto :EOF
 
 :oneaddr
 echo edit %2  
 echo set type ipmask  
 echo set subnet %1/32
 set intf=%3  
 if [%3]==[] set intf=ANY 
 echo set associated-interface %intf%   
 echo next

with this input file

# IP,Hostname,Interface 111.111.111.111,HOST-1,OUTSIDE 222.222.222.222,HOST-2 333.333.333.333,HOST-3,OUTSIDE

this output is produced:

config firewall address edit HOST-1 set type ipmask set subnet 111.111.111.111/32 set associated-interface OUTSIDE next edit HOST-2 set type ipmask set subnet 222.222.222.222/32 set associated-interface ANY next edit HOST-3 set type ipmask set subnet 333.333.333.333/32 set associated-interface OUTSIDE next end

[KPS]

Hi!

I dont't know, what you exactly want to achieve (finally), but perhaps, it's worth to look at the new "Farbric-Connector-Feeds" in 6.2

You can dynamically feed in lists of ip addresses as http-download and use these lists as address objects in policies.

...just in case...

[emnoc]

Also if you need to build azure dc range lists or similar you can do the following

http://socpuppet.blogspot.com/2017/03/how-to-extract-ms-azure-dc-and-batch-of.html

if your doing consecutive items in bulk you can also do something similar

http://socpuppet.blogspot.com/2012/11/fortigate-firewall-cfg-script-to-speed.html

Great for new deployments and where items are consecutive in nature.

Ken Felix