Show Policy in CLI

[biltjc]

Hello,

I used with Juniper to show a policy list based on search criterias.

I'd like to do the same with my fortigate but I don't find how to do.

I'm doing : get firewall policy

But the result is only ID's.

Is there a way to get policy ?

[ede_pfau]

Try 'show firewall policy | grep <something>' or even 'show full firewall policy | grep <something>'.

With newer versions of FortiOS grep can take options:

gate # show | grep -X
grep: invalid option -- X
Usage: grep [-invcABC] PATTERN
Options:
        -i      Ignore case distinctions
        -n      Print line number with output lines
        -v      Select non-matching lines
        -c      Only print count of matching lines
        -A      Print NUM lines of trailing context
        -B      Print NUM lines of leading context

        -C      Print NUM lines of output context

[biltjc]

Thank you for your reply.

grep find some lines in the policy but I only have 'set dstaddr server_A' by example.

How could I show the whole policy containing that server ?

Maybe is it impossible ?

[ede_pfau]

'grep' is not context sensitive - it doesn't know about how many lines belong to a policy. The best you can do is to use 'grep -C  20' or so to show 20 lines around the match.

If you need detailed inspection I recommend to download the config and load it in an editor. But that is not context aware neither.

[biltjc]

I know what I can do or not now.

It's a pity there is no CLI function to get policy.

Thanks a lot for your help.

[norouzi]

Do not compare Fortinet and Juniper ;)

Just kidding

In the CLI you can use "?" whenever you want.

show firewall policy

or:

config firewall policy

show

end

[biltjc]

Thank you for the tip norouzi

[emnoc]

And if you the exact policy id# than you can do a "show firewall policy <the #>" . Yes it's similar to a juniper  but does not have the display set or match capabilities.

[SgtMalicious]

I had the same problem as you coming from ScreenOS. You may be interested in this: [link]https://forum.fortinet.com/tm.aspx?m=104633[/link]

[amitkor]

On the other hand, fortigate has better GUI ^^