Hi!
I created followed filtered IS, based on ISDB entry:
fgt-1 # show firewall internet-service-name is_Microsoft_Azure_China
config firewall internet-service-name
edit "is_Microsoft_Azure_China"
set type location
set internet-service-id 327786
set country-id 156
next
end
Since I don't know its ISDB entry Id, I cannot use "diagnose internet-service id" to show IP/ports included by IS using CLI. (I can do using GUI). Is there an equivalent CLI command for non-predefined ISDB entries?
Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
Hello @AlexFerenX ,
This diagnostics command in this article might help you: https://community.fortinet.com/t5/FortiGate/Technical-Tip-Common-Internet-Service-Database-Feature-a...
Created on 07-29-2024 11:35 PM Edited on 07-30-2024 03:11 AM
Hi@dbhavsar that KB doesn't help at all - please reread the question.
Bump!
"Since I don't know its ISDB entry Id" >> but you have the ISDB id used in the policy you pasted here. What else are you refering to?
There is no specific ISDB ID for ("service" + "country") so you will not find a specific ID for a combination like this.
You can use the command in the article referenced above to filter these entries. For example:
diag internet-service id 327786 | grep country(156)
You can further search in notepad for specific ports, but looking at this specific service, almost 33000 entries out of 34646 are created for ALL ports: port(1-65535)
The command for specific ports has been removed - as you can also see in that article. Likely because it was quite irrelevant.
Edit: there are no other "magic" commands for ISDB except the ones listed in the article that was already referenced. In other words: if it's not there, it does not exist.
Created on 08-16-2024 08:19 AM Edited on 08-16-2024 08:22 AM
> there are no other "magic" commands for ISDB except the ones listed in the article that was already referenced. In other words: if it's not there, it does not exist.
then, that’s design oversight - what’s available in GUI should also be using CLI - especially when dealing with voluminous content.
The command WAS available in CLI as well until version 6.0 (as the article describes).
But (my guess) is that pushing that much information in CLI will hang the unit (there were such cases). Therefore the command was removed on purpose.
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
User | Count |
---|---|
1545 | |
1030 | |
749 | |
443 | |
210 |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.