Show details of a custom ISDB entry

[AlexFerenX]

Hi!

I created followed filtered IS, based on ISDB entry:

fgt-1 # show firewall internet-service-name is_Microsoft_Azure_China
config firewall internet-service-name
edit "is_Microsoft_Azure_China"
set type location
set internet-service-id 327786
set country-id 156
next
end

Since I don't know its ISDB entry Id, I cannot use "diagnose internet-service id" to show IP/ports included by IS using CLI. (I can do using GUI). Is there an equivalent CLI command for non-predefined ISDB entries?

[dbhavsar]

Hello @AlexFerenX ,

This diagnostics command in this article might help you: https://community.fortinet.com/t5/FortiGate/Technical-Tip-Common-Internet-Service-Database-Feature-a... 

[AlexFerenX]

Hi@dbhavsar that KB doesn't help at all - please reread the question.

[AlexFerenX]

Bump!

[AlexC-FTNT]

"Since I don't know its ISDB entry Id" >> but you have the ISDB id used in the policy you pasted here. What else are you refering to? 

There is no specific ISDB ID for ("service" + "country") so you will not find a specific ID for a combination like this.

You can use the command in the article referenced above to filter these entries. For example:
diag internet-service id 327786 | grep country(156)

You can further search in notepad for specific ports, but looking at this specific service, almost 33000 entries out of 34646 are created for ALL ports: port(1-65535)

The command for specific ports has been removed - as you can also see in that article. Likely because it was quite irrelevant.

Edit: there are no other "magic" commands for ISDB except the ones listed in the article that was already referenced. In other words: if it's not there, it does not exist.

[AlexFerenX]

> there are no other "magic" commands for ISDB except the ones listed in the article that was already referenced. In other words: if it's not there, it does not exist.

then, that’s design oversight - what’s available in GUI should also be using CLI - especially when dealing with voluminous content.

[AlexC-FTNT]

The command WAS available in CLI as well until version 6.0 (as the article describes).

But (my guess) is that pushing that much information in CLI will hang the unit (there were such cases). Therefore the command was removed on purpose.