dumping fwpolicies into a xls or csv format

emnoc · ‎03-10-2014

Anybody seen any cool tools that will grab fwpolicies and dump them into a format to import into xls, or csv or any other method?

PCNSE

NSE

StrongSwan

TuncayBAS · ‎10-04-2016

Yes offcourse

I use fortigate rest api document.

http://www.tuncaybas.com/FOS_JSON_REST_API_523.pdf

Get all policy for 5.2 :

[link]https://192.168.0.1:443/api/cmdb?request=[/link]{'action':'select','path':'firewall','name':'policy','datasource':true,'skip':true,'with_meta':true}

Get all policy for 5.4 :

https://192.168.0.1:443/a..2/cmdb/firewall/policy/

This results json format.

{
  "http_method":"GET",
  "results":[
    {
      "policyid":7,
      "q_origin_key":"7",
      "name":"fatura-pc-deny",
      "uuid":"53e964d2-36b8-51e6-a95c-9c146a1da1c8",
      "srcintf":[
        {
          "name":"lan",
          "q_origin_key":"lan"
        }
      ],
      "dstintf":[
        {
          "name":"wan1",
          "q_origin_key":"wan1"
        }
      ],
      "srcaddr":[
        {
          "name":"all",
          "q_origin_key":"all"
        }
      ],

and parse with .net (or use other language).

Tuncay BAS RZK Muhendislik Turkey NSE 4 5 6 FCESP v5

View solution in original post

jtfinley · ‎03-25-2014

Anybody seen any cool tools that will grab fwpolicies and dump them into a format to import into xls, or csv or any other method?

Sounds like a cool programming project. SNMP query a Fortigate and create a visual map of all interfaces & FW Policies

emnoc · ‎03-26-2014

Yeah i' m working on it as I type. My perl scripting is not that good, but I cannibalize a script that works with junos that does just that. Stay tuned :) fwiw; my goal is to writ out policyid#, src/dst and interfaces/address. The problem I see is pertaining to the address-book and when we have multiple services.

PCNSE

NSE

StrongSwan

SgtMalicious · ‎04-17-2014

I updated my policy viewer script with an option to dump all of the firewall policies in a tab delimited format. http://bit.ly/1kB2wV0

ShrewLWD · ‎04-17-2014

Sebastian of firewall guru fame posted on this topic here.. http://firewallguru.blogspot.com/2014/04/exporting-firewall-rules-to-csv.html?m=1

emnoc · ‎04-21-2014

thanks

PCNSE

NSE

StrongSwan

Andre_Backs · ‎05-11-2014

Woudn' t it be great if FG used XML for the firewall policies And since we are on the subject, wouldn' t it be nice if you could split out the policy sections (like firewall policy, system interface, pretty much all those things that ar between config ... and end) into seperate files and be joined back together at import time ?

ABB@ProBiblio Fortigate 200D (slave master)

emnoc · ‎05-11-2014

FWIW their' a script for netscreen that actually does just what your asking. It dumps a ns config into various parts ( policy, nat, interfaces,et...) Also google source projects had this; https://code.google.com/p/aclparser/

PCNSE

NSE

StrongSwan

Andre_Backs · ‎05-12-2014

Hi Emnoc, I looked at the site, but it seems to be an empty office :-) I saw a PERL script the other day, but that dumps into plain csv. It does not (as fas as I could tell) take in account that some fields are not always used, i.e. use a factory default value and do not show up in an edit / next clause. That leaves your csv garbled if you open it in Excel.

ABB@ProBiblio Fortigate 200D (slave master)

emnoc · ‎05-12-2014

Here' s the NS2html site http://ns2html.sourceforge.net/download.html These where used back in the day when netscreens where very popular and scripts where need to parse cfg files. And here' s " nipper" http://blog.tevora.com/enterprise-applications/how-to-parse-firewall-configs-with-nipper-2/ Nipper doesn' t support fortigates :)

PCNSE

NSE

StrongSwan