fortios-xutils

Very experimental miscellaneous and extra utilities for fortios (fortigate).

Features

Parse and dump a structured JSON file from fortios CLI's "show *configuration" outputs
Search an item or items from JSON files generated as a parsed result from fortios CLI's "show *configuration" outputs, using JMESPath query
Collect nework information from the JSON files and generate a structured JSON files gives that network information
Compose multiple network JSON files into a network file
Analyze and dump firewall policy table as a pandas data for further analysis
Search firewall policy matches given ip address
Find the network paths from network JSON file by ip address (src and dst) to figure out which firewall nodes to configure

CLI Usage

See fortios_xutils --help.

ssato@x1-carbon-gen6% PYTHONPATH=src python3 ./src/fortios_xutils/cli.py --help
Usage: cli.py [OPTIONS] COMMAND [ARGS]...

  CLI frontend entrypoint.

Options:
  -v, --verbose
  --help         Show this message and exit.

Commands:
  firewall-policy-save    Make and save firewall policy table...
  firewall-policy-search  Search firewall policy table generated by...
  network-collect         Make and save network data collected from the
                          JSON...

  network-compose         Compose network files collected from the
                          fortigate...

  network-find-paths      Search paths from the source `src_ip` to the...
  parse                   Parse fortigate CLI's "show *configuration*...
  search                  Search an item or items from JSON file generated...
ssato@x1-carbon-gen6% for sc in parse search network-collect network-compose firewall-policy-save firewall-policy-search; do echo "# $sc"; PYTHONPATH=src python3 ./src/fortios_xutils/cli.py $sc --help; done
# parse
Usage: cli.py parse [OPTIONS] [FILEPATHS]...

  Parse fortigate CLI's "show *configuration* outputs and generate a
  structured JSON file. FILEPATHS is a list of file paths or a glob pattern
  gives that.

  Examples:

      $ fortios_xutils parse -O /tmp/0 \
      > tests/res/show_configs/fortigate_cli_show_sample_*.txt
      $ ls /tmp/0
      fortigate-01  fortigate-02
      $ ls /tmp/0/fortigate-01:
      all.json                         firewall_address.json
      firewall_addrgrp.json            firewall_policy.json
      firewall_service_category.json   firewall_service_custom.json
      firewall_service_group.json      metadata.json
      system_global.json               system_interface.json
      system_object-tagging.json       system_replacemsg-group.json
      system_settings.json
      $ jq '.' /tmp/0/fortigate-01/system_interface.json
      [
        {
          "edit": "dmz",
          "vdom": "root",
          "status": "down",
          "type": "physical",
          "role": "dmz",
          "snmp-index": "1"
        },
        {
          "edit": "port1",
          "vdom": "root",
          "ip": [
            "192.168.122.10",
            "255.255.255.0"
          ],
              ... (snip) ...

Options:
  -O, --outdir TEXT  Output dir to save parsed results [out/ relative to input
                     filepath]

  --help             Show this message and exit.
# search
Usage: cli.py search [OPTIONS] [FILEPATHS]...

  Search an item or items from JSON file generated previously by 'parse' sub
  command. FILEPATHS is a list of file paths or a glob pattern gives that.

  Examples:

      $ # List ip addresses of system interfaces.
      $ fortios_xutils search \
      > -P "configs[?config=='system interface'].edits[].ip" \
      > tests/res/parsed/fortigate-01/all.json
      [
          [
              "192.168.122.10",
              "255.255.255.0"
          ],
          [
              "192.168.1.10",
              "255.255.255.0"
          ]
      ]
      $

Options:
  -P, --path TEXT  JMESPath expression to query
  --help           Show this message and exit.
# network-collect
Usage: cli.py network-collect [OPTIONS] [FILEPATHS]...

  Collect and save network data from the parsed and structured fortigate's
  configuration files in JSON formats. FILEPATHS is a list of path of the
  JSON file, the parsed results of fortigate CLI's "show \*configuration"
  outputs.

  Examples:

      $ fortios_xutils network-collect tests/res/parsed/*/all.json
      $ head -n 10 tests/res/parsed/fortigate-01/networks.yml
      metadata:
        type: metadata
        input: tests/res/parsed/fortigate-01/all.json
        prefix: 24
        timestamp: 2020-05-12_04_58_57
        version: '1.0'
      nodes:
      - id: fortigate-01
        name: fortigate-01
        type: firewall
      $

Options:
  -O, --outdir TEXT  Dir to save results
  -P, --prefix TEXT  Max network prefix [24]
  --help             Show this message and exit.
# network-compose
Usage: cli.py network-compose [OPTIONS] [FILEPATHS]...

  Compose network files collected from the fortigate CLI's configurations
  from multiple fortigate hosts using the preivous network-collect command,
  into a network file.

  Examples:

      $ fortios_xutils network-compose \
      > tests/res/parsed/fortigate-0*/networks.yml \
      > -o tests/res/networks/all.yml
      $ head -n 10 tests/res/networks/all.yml
      metadata:
        inputs:
        - tests/res/parsed/fortigate-01/all.json
        - tests/res/parsed/fortigate-02/all.json
        timestamp: 2020-05-12_05_02_49
        version: '1.0'
      nodes:
      - id: fortigate-01
        name: fortigate-01
        type: firewall
      $

Options:
  -o, --outpath TEXT  Path of the outpath file to save network JSON data
  --help              Show this message and exit.
# firewall-policy-save
Usage: cli.py firewall-policy-save [OPTIONS] [FILEPATHS]...

  Make and save firewall policy table (:class:`pandas.DataFrame` object).

  Examples:

      $ fortios_xutils firewall-policy-save \
      > -o /tmp/0/test.pickle.gz \
      > tests/res/parsed/fortigate-01/all.json
      $ file /tmp/0/test.pickle.gz
      /tmp/0/test.pickle.gz: gzip compressed data, was "test.pickle"  ...
      $

Options:
  -O, --outdir TEXT  Dir to save results [same dir input files exist]
  --help             Show this message and exit.
# firewall-policy-search
Usage: cli.py firewall-policy-search [OPTIONS] FILEPATH

  Search firewall policy table generated by 'firewall-policy-save' command,
  by ip address. FILEPATH is a file path to the pandas dataframe file
  generated by 'firewall-policy-save' command.

  Examples:

      $ fortios_xutils firewall-policy-search \
      > --ip 192.168.122.3 /tmp/0/test.pickle.gz
      [
        {
          "edit": "20",
          "name": "Monitor_Servers_02",
          "uuid": "3da73baa-dacb-48cb-852c-c4be245b4609",
          "srcintf": "port1",
          "dstintf": "",
          "srcaddr": "host_192.168.122.1",
          "dstaddr": "network_192.168.122.0/24",
          "action": "accept",
          "schedule": "always",
          "service": [
            "HTTPS",
            "HTTP"
          ],
          "inspection-mode": "",
          "nat": "",
          "srcaddrs": [
            "192.168.122.1/32"
          ],
          "dstaddrs": [
            "192.168.122.0/24"
          ],
          "comments": ""
        }
      ]

Options:
  -i, --ip TEXT  Specify an IP address to search
  --help         Show this message and exit.
ssato@x1-carbon-gen6%

tigre-bleu/fortios-xutils

fortios-xutils

Features

CLI Usage