fgpoliciestocsv

Description

A simple script to extract policies from a FortiGate configuration file to CSV

Features

The script comes in two languages : Perl and Python.
The Python one is only a port of the Perl one, originally developped by Sebastian Knoop-Troullier aka 'firewallguru' and published on his blog http://firewallguru.blogspot.fr/2014/04/exporting-firewall-rules-to-csv.html

Usage

Python version

Pass the configuration file to the script with the -i option.
The processed output is available in the 'policies-out.csv' (default) or in the specified file with the -o option.
Two similar python script were added allowing to export also address (IPv4 unicast only for now) or groups

Perl version

Pass the configuration file to the script this is the only supported argument.
The processed output is available in the 'policies-out.csv' file.

Options

Python

$ python fgpoliciestocsv.py  -h
Usage: fgpoliciestocsv.py [options]

Options:
  -h, --help            show this help message and exit
  -i INPUT_FILE, --input-file=INPUT_FILE
                        <INPUT_FILE>: Fortigate configuration file. Ex:
                        fgfw.cfg
  -o OUTPUT_FILE, --output-file=OUTPUT_FILE
                        <OUTPUT_FILE>: output csv file (default './policies-
                        out.csv')
  -n, --newline         <NEWLINE> : insert a newline between each policy for
                        better readability
  -s, --skip-header     <SKIP_HEADER> : do not print the csv header

Perl

$ perl fgpoliciestocsv.pl <configuration_file.cfg>

Example

$ cat example.cfg
config firewall policy
     edit 1
         set srcintf "internal"
         set dstintf "wan1"
             set srcaddr "all"
             set dstaddr "all"
         set action accept
         set schedule "always"
             set service "ANY"
         set logtraffic-app disable
         set webcache enable
         set nat enable
     next
end

$ python fgpoliciestocsv.py -i example.cfg

$ cat policies-out.csv
id;srcintf;dstintf;srcaddr;dstaddr;action;schedule;service;logtraffic-app;webcache;nat
1;internal;wan1;all;all;accept;always;ANY;disable;enable;enable

Notes

For a policy, an empty value in the 'action' column might mean 'deny', as this is implicit in a FortiGate configuration file.

Requirements

• python >= 2.4
• perl

Copyright and license

fgpoliciestocsv is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version. fgpoliciestocsv is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

See the GNU General Public License for more details. You should have received a copy of the GNU General Public License along with fgpoliciestocsv. If not, see http://www.gnu.org/licenses/.

Fortinet holds every rights about the FortiGate brand. I'm not affiliated nor employed by them.

Credits

• Sebastian Knoop-Troullier aka 'firewallguru'