Policy restructuring

[Mac1]

Hello,

Are you ready for a challenge? :)

I am working on policy restructuring. The setup consists of 35 FGTs running 6.4.11, FMG running 6.4.10, single ADOM with VDOMs. Company has recently implemented AlgoSec FireFlow to automate the policy changes. Due to number of policies I would like to automate the process as much as possible.

I received a request to:

- restructure the policies, group individual objects used in rules then replace the individual objects with groups

- rename the objects in FMG and FGTs so they rely on DNS or CMDB as the source of truth

- reduce/eliminate open any-any rules to become PCI-compliant

The challenges:

- unfortunately the policies grew organically over the years with no control

- naming convention does not exist, it is impossible to find common denominator that could be used to automate i.e. the creation of groups. I realize that ideally it would help to rename objects based on i.e. DNS queries, I have seen some FMG scripts that would help. Sadly it turned out that DNS and CMDB are not in a good shape and are being scheduled for fixing as well.

- 35 FGTs, some have >3000 rules, thousands of objects --> automation is necessary

- whilst FGM policy is not good, it works, grouping should not open up unwanted traffic or cause an outage

Done so far:

- to eliminate some complexity everything was upgraded. Multiple ADOMs and FGTs have been consolidated into one ADOM with all FGTs

- eliminated any duplicates, shadow rules, dynamic objects

- developed header and footer policies

- synced the DBs between FMG and AlgoSec, removed any inconsistencies

- explored the features available in AlgoSec. AppViz can potentially help but only if I sit down with system owners and ask them to define all of the traffic flows used by their applications - I expect to receive a lot of push back due to number of apps

While I have ideas regarding the any-any rules, right now I am wondering on the best way to approach the grouping and replacement part. I am testing a combination of FMG scripts, built-in functions, Notepad++ and Excel. I am not good at Python. I have not explored the Fortinet Developer Network.

Since recreating the policies for each FGT from the scratch may be impossible, I thought about (using Notepad++ and Excel) i.e.:

- export existing ADOM with fmpolicy

- start by grouping source objects used on per rule basis, each rule would use a group instead of individual objects

- create generic names for the groups, then compare the content of the groups. If i.e. policy ID 1 has the same source objects as policy ID 2 but different destinations then rename to the target group name manually (due to lack of naming convention)

- in the end develop a way to replace the generic groups with target group

- import new config to FMG

I am kind of stuck. Has anyone done anything similar? I realize there is no silver bullet but do you have any ideas how to automate the steps? Or maybe you have a better idea? Manual adjustments of each rule are not realistic I think.

[gfleming]

Honestly this sounds like something over and above what a support forum can provide. I would suggest reaching out to a Fortinet partner about getting some professional services to assist you.