Requested 5.2.X Features

[seadave]

I'm running a 100D with 5.2.2  We will be upgrading to a 300D later this year.  Overall, I think 5.2.2 is a good release, but there are some improvements that I think would benefit users.

We have some Objects\Addresses\Groups with over 100 domains.  When you attempt to add a new domain to one of those lists, it prompts you to add at the bottom which tends to scroll off the bottom of the screen.  Better to prompt at the top of the list so it can be seen.

It would be incredibly helpful to be able to import and export lists in CSV or TAB format for review.  (Native Excel would be even better!).  This would help with bulk edits (as long as you could import them back in also!) and make it much easier to maintain large lists and spot discrepancies.  I'm specifically speaking of Addresses Groups lists, and Static URL Filter lists in Web Filters.

In 4.3.18, I was able to both block and allow specific files by name or pattern.  In 5.2.2 I'm only able to block.  There is no option to allow now which creates a lot of extra work and can create some security gaps.  Based on documentation I have read, if I want to block .EXEs but allow specific ones from specific hosts for example, I only have the option to use the "set exempt dlp" option under the "webfilter urlfilter" option.  This is odd, and why are the exemptions for the various scanning engines not viewable in the GUI?  Only a global "Exempt".  This creates a lot of extra work.  It is also not clear to me if this will even work because DLP is processed before Web Filtering based on the Life of a Packet explanation in the Handbook.

[emnoc · Accepted solution]

I'll address the following................

It would be incredibly helpful to be able to import and export lists in CSV or TAB format for review.  (Native Excel would be even better!).  This would help with bulk edits (as long as you could import them back in also!) and make it much easier to maintain large lists and spot discrepancies.  I'm specifically speaking of Addresses Groups lists, and Static URL Filter lists in Web Filters.

You have script function that would allow for this currently. You can use a cfg maker to make the  appropiate configuration and run the bulk script function from the webGui. Any errors will be quickly indicated.

config > advanced  script

[emnoc · Accepted solution]

I'll address the following................

It would be incredibly helpful to be able to import and export lists in CSV or TAB format for review.  (Native Excel would be even better!).  This would help with bulk edits (as long as you could import them back in also!) and make it much easier to maintain large lists and spot discrepancies.  I'm specifically speaking of Addresses Groups lists, and Static URL Filter lists in Web Filters.

You have script function that would allow for this currently. You can use a cfg maker to make the  appropiate configuration and run the bulk script function from the webGui. Any errors will be quickly indicated.

config > advanced  script

[seadave]

emnoc-

Thanks I've used that before, but I can get that from the show command in the CLI.  What I'm suggesting is that instead of seeing this:

config webfilter urlfilter

edit 1

set name "URL_List"

config entries

edit 6

set url "/dl.google/."

set type regex

set exempt dlp

next

edit 8

It would be so much easier to see this:

"/dl.google/."   regex  exempt  "dlp"

I think you would need "s around the URL and filter exemptions to account for escapable characters and commas.

I would hazard to guess that most of us are not the best scripters.  Being able to arrange items in an Excel table is grade school level computer work and would be available to pretty much everyone who needed it for that purpose.  I also think the ability to spot configuration deviation when items are laid out in a table are also of value.

Thanks

emnoc wrote:

I'll address the following................

It would be incredibly helpful to be able to import and export lists in CSV or TAB format for review.  (Native Excel would be even better!).  This would help with bulk edits (as long as you could import them back in also!) and make it much easier to maintain large lists and spot discrepancies.  I'm specifically speaking of Addresses Groups lists, and Static URL Filter lists in Web Filters.

You have script function that would allow for this currently. You can use a cfg maker to make the  appropiate configuration and run the bulk script function from the webGui. Any errors will be quickly indicated.

config > advanced  script

[emnoc · Accepted solution]

I think you have to be creative & use some parser and scripting language. I'm sure a season perl, bash/csh, scripting guy could hack something up.

Take your earlier example. You could maybe use awk and export the ack- variable $values$ and make the cfg using a configuration script.

( a ruff ideal ,,,, haven't play around or given it alot of thought at this point  )

( the sample file entry per line )

cat mycsv.txt "/dl.google/."   regex  exempt  "dlp"

Now we export the awk variables

export VAL1=`awk ' { print $1 } ' mycsv.txt`

export VAL2=`awk ' { print $2 } ' mycsv.txt`

export VAL3=`awk ' { print $3 } ' mycsv.txt` export VAL4=`awk ' { print $4 } ' mycsv.txt`

And then pass this to a cfg maker script similar to the following in a loop that reads each lines in and process the variables

do   echo "edit 6"   echo   "set url $VAL1"   echo  "set type $VAL2"   echo   "set exempt $VAL4"   echo   "next"

done

Maybe what fortinet could do is to build a script tool for processing flat comma or space separated file entries for common items

url list

address listing

addressgroups

Or you would need to make your own cfgmaker tools  similar to this;

http://socpuppet.blogspot...g-script-to-speed.html

[seadave]

I fully get what you are trying to say.  If you can script, you can do anything.  I fully admit, despite being in IT for over 20 years this is one of my weak points.  I'm just not a good coder.  I'm a mile wide on many different techs and deeper on particular things such as VMWare, Fortinet, switching, etc.  I can do many things well, and many things that others seem to have trouble figuring out, but coding is not one of those things unfortunately (not that I haven't tried).  So my point is why make it difficult?  For those 90% of us that aren't good with regex, awk, or perl, allow us to export and import via tables using a simple template and a gui page (browse select file, import/export, save file).  I've worked with many other systems that require input of lists and this is not a novel concept.

If you script all of the time, the type of solution you propose can flow like water from your brain.  For me it is like hitting a brick wall, causes frustration, and requires a few days of time (which is always in short supply) digging though web pages and help commands.  Then when I finally get it to work, I don't have a need to use it for another 6 to 12 months and it gets buried with all of the other day to day madness that compromises daily IT work.

So your solution is elegant and I'm sure would work, but why can't Fortinet just make it easy to begin with?  The storage market is a good example of this.  There are a hundred different SAN vendors, but they are vendors such as Dell Equallogic that focused on implementation simplicity from the start and it shows.  I would say the Forti Configurator is a good step in this direction.

All that being said, I'll consider your example and see if that will work considering I have no other option as this time.

emnoc wrote:

I think you have to be creative & use some parser and scripting language. I'm sure a season perl, bash/csh, scripting guy could hack something up.

Take your earlier example. You could maybe use awk and export the ack- variable $values$ and make the cfg using a configuration script.

( a ruff ideal ,,,, haven't play around or given it alot of thought at this point  )

( the sample file entry per line )

cat mycsv.txt "/dl.google/."   regex  exempt  "dlp"

Now we export the awk variables

export VAL1=`awk ' { print $1 } ' mycsv.txt`

export VAL2=`awk ' { print $2 } ' mycsv.txt`

export VAL3=`awk ' { print $3 } ' mycsv.txt` export VAL4=`awk ' { print $4 } ' mycsv.txt`

And then pass this to a cfg maker script similar to the following in a loop that reads each lines in and process the variables

do   echo "edit 6"   echo   "set url $VAL1"   echo  "set type $VAL2"   echo   "set exempt $VAL4"   echo   "next"

done

Maybe what fortinet could do is to build a script tool for processing flat comma or space separated file entries for common items

url list

address listing

addressgroups

Or you would need to make your own cfgmaker tools  similar to this;

http://socpuppet.blogspot...g-script-to-speed.html