Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
biltjc
New Contributor

Show Policy in CLI

Hello,

 

I used with Juniper to show a policy list based on search criterias.

I'd like to do the same with my fortigate but I don't find how to do.

 

I'm doing : get firewall policy

But the result is only ID's.

 

Is there a way to get policy ?

12 REPLIES 12
ede_pfau
SuperUser
SuperUser

Try 'show firewall policy | grep <something>' or even 'show full firewall policy | grep <something>'.

With newer versions of FortiOS grep can take options:

gate # show | grep -X
grep: invalid option -- X
Usage: grep [-invcABC] PATTERN
Options:
        -i      Ignore case distinctions
        -n      Print line number with output lines
        -v      Select non-matching lines
        -c      Only print count of matching lines
        -A      Print NUM lines of trailing context
        -B      Print NUM lines of leading context

        -C      Print NUM lines of output context

Ede Kernel panic: Aiee, killing interrupt handler!
Ede Kernel panic: Aiee, killing interrupt handler!
biltjc
New Contributor

Thank you for your reply.

 

grep find some lines in the policy but I only have 'set dstaddr server_A' by example.

How could I show the whole policy containing that server ?

Maybe is it impossible ?

ede_pfau
SuperUser
SuperUser

'grep' is not context sensitive - it doesn't know about how many lines belong to a policy. The best you can do is to use 'grep -C  20' or so to show 20 lines around the match.

 

If you need detailed inspection I recommend to download the config and load it in an editor. But that is not context aware neither.

Ede Kernel panic: Aiee, killing interrupt handler!
Ede Kernel panic: Aiee, killing interrupt handler!
biltjc
New Contributor

I know what I can do or not now.

It's a pity there is no CLI function to get policy.

 

Thanks a lot for your help.

 

norouzi
Contributor

Do not compare Fortinet and Juniper ;)

Just kidding

 

In the CLI you can use "?" whenever you want.

show firewall policy

or:

 

config firewall policy

show

end

 

biltjc
New Contributor

Thank you for the tip norouzi

emnoc
Esteemed Contributor III

And if you the exact policy id# than you can do a "show firewall policy <the #>" . Yes it's similar to a juniper  but does not have the display set or match capabilities.

PCNSE 

NSE 

StrongSwan  

PCNSE NSE StrongSwan
SgtMalicious
New Contributor III

I had the same problem as you coming from ScreenOS. You may be interested in this: [link]https://forum.fortinet.com/tm.aspx?m=104633[/link]

amitkor
New Contributor

On the other hand, fortigate has better GUI ^^

Announcements

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Labels
Top Kudoed Authors