Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
AlexFerenX
New Contributor III

Show details of a custom ISDB entry

Hi!

I created followed filtered IS, based on ISDB entry:

 

 

fgt-1 # show firewall internet-service-name is_Microsoft_Azure_China
config firewall internet-service-name
edit "is_Microsoft_Azure_China"
set type location
set internet-service-id 327786
set country-id 156
next
end

 

 

 

Since I don't know its ISDB entry Id, I cannot use "diagnose internet-service id" to show IP/ports included by IS using CLI. (I can do using GUI). Is there an equivalent CLI command for non-predefined ISDB entries?

6 REPLIES 6
dbhavsar
Staff
Staff

Hello @AlexFerenX ,

 

This diagnostics command in this article might help you: https://community.fortinet.com/t5/FortiGate/Technical-Tip-Common-Internet-Service-Database-Feature-a... 

DNB
AlexFerenX
New Contributor III

Hi@dbhavsar that KB doesn't help at all - please reread the question.

AlexFerenX
New Contributor III

Bump!

AlexC-FTNT
Staff
Staff

"Since I don't know its ISDB entry Id" >> but you have the ISDB id used in the policy you pasted here. What else are you refering to? 

There is no specific ISDB ID for ("service" + "country") so you will not find a specific ID for a combination like this.

You can use the command in the article referenced above to filter these entries. For example:
diag internet-service id 327786 | grep country(156)

 

You can further search in notepad for specific ports, but looking at this specific service, almost 33000 entries out of 34646 are created for ALL ports: port(1-65535)

 

The command for specific ports has been removed - as you can also see in that article. Likely because it was quite irrelevant.

 

Edit: there are no other "magic" commands for ISDB except the ones listed in the article that was already referenced. In other words: if it's not there, it does not exist.


- Toss a 'Like' to your fixxer, oh Valley of Plenty! and chose the solution, too00oo -
AlexFerenX

> there are no other "magic" commands for ISDB except the ones listed in the article that was already referenced. In other words: if it's not there, it does not exist.

 

then, that’s design oversight - what’s available in GUI should also be using CLI - especially when dealing with voluminous content.

 

 

 

 

AlexC-FTNT

The command WAS available in CLI as well until version 6.0 (as the article describes).

But (my guess) is that pushing that much information in CLI will hang the unit (there were such cases). Therefore the command was removed on purpose.


- Toss a 'Like' to your fixxer, oh Valley of Plenty! and chose the solution, too00oo -
Announcements

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Labels
Top Kudoed Authors