topic Re: R80.10 - Where Used object in Firewall & Security Management

R80.10 - Where Used object

Arthur_DENIS1 — Thu, 08 Mar 2018 16:15:04 GMT

Hi,

I try to find a way to do a "Where used" object in one policy package only.

There is existing way to do this ?

Or maybe an enhancement request to perform a "where used policy X" inside a "where used object Y" ?

Thanks for your help!

Re: R80.10 - Where Used object

Robert_Decker — Thu, 08 Mar 2018 18:01:14 GMT

are you asking for API-wise?

Robert.

Re: R80.10 - Where Used object

Danny — Fri, 09 Mar 2018 07:21:23 GMT

I'm using the Policies tab inside of the -Where used- window for this.

Re: R80.10 - Where Used object

Norbert_Bohusch — Fri, 09 Mar 2018 07:32:57 GMT

I assume he wants to filter for a specific policy package and not see all usages.

Re: R80.10 - Where Used object

Robert_Decker — Fri, 09 Mar 2018 07:57:39 GMT

I'm not familiar with such filter.

Re: R80.10 - Where Used object

Norbert_Bohusch — Fri, 09 Mar 2018 08:03:42 GMT

That's because there is none 😉

But I assume that's what Arthur is searching for.

Re: R80.10 - Where Used object

Arthur_DENIS1 — Fri, 09 Mar 2018 08:14:23 GMT

Yes this is the point !

So no way to do this, you confirm my assumption

Re: R80.10 - Where Used object

JasonDC — Fri, 09 Mar 2018 14:09:56 GMT

In R77.30 you used to be able to do a per policy lookup of objects, however in R80.10 its merged with results from all policies. I have brought this up as an issue and requested through our SE to have the feature returned to the product.

Re: R80.10 - Where Used object

Arthur_DENIS1 — Fri, 09 Mar 2018 15:26:17 GMT

Nice !

I'm not alone

Can you please keep us informed when you get an announcement date for these "new" feature ?

Re: R80.10 - Where Used object

Robert_Decker — Fri, 09 Mar 2018 20:46:39 GMT

please let me understand, do you want yes/no answer whether object x is contained in policy package y, or full details in which contexts is it used?

Re: R80.10 - Where Used object

Arthur_DENIS1 — Mon, 12 Mar 2018 10:33:09 GMT

Yes I want a yes/no checkbox.

As in R77.30, I wand to find "Where used" object x for a specific policy and not for all policies.

Re: R80.10 - Where Used object

Robert_Decker — Mon, 12 Mar 2018 12:10:27 GMT

I can give you a Management API script (R80.10) to accomplish this, if you are interested.

Robert.

Re: R80.10 - Where Used object

Arthur_DENIS1 — Mon, 12 Mar 2018 12:47:52 GMT

With pleasure! I'm really interested by this, and I except that i'm not alone

Arthur

Re: R80.10 - Where Used object

Robert_Decker — Mon, 12 Mar 2018 16:00:31 GMT

Here you go: this is only an example bash script that you run on your R80.10 management server.

It uses Management API to query if object X exists in access rulebase Y in policy package Z.

Of course, you can improve this script as you wish. It works fine on my machine.

There is a little trick here - in order to tell API to perform an exact search, it should recieve object's UID, not its name. It is retrieved from the first API command.

JQ=${CPDIR}/jq/jq
OBJECT_NAME=$1
mgmt_cli -r true show objects offset 0 limit 1 in.1 name in.2 $OBJECT_NAME --format json > $OBJECT_NAME.json
OBJECT_COUNT=$($JQ -r ".total" $OBJECT_NAME.json)
if [ $OBJECT_COUNT -ne 1 ]; then
echo 'The requested object does not exist. Aborting!'
exit 1
fi
OBJECT_UID=$($JQ -r ".objects[0].uid" $OBJECT_NAME.json)
PACKAGE_NAME=$2
RULEBASE_NAME=$3
mgmt_cli -r true show access-rulebase package "$PACKAGE_NAME" name "$RULEBASE_NAME" offset 0 limit 1 filter $OBJECT_UID --format json > $OBJECT_NAME.json
OBJECT_COUNT=$($JQ -r ".total" $OBJECT_NAME.json)
if [ $OBJECT_COUNT -ne 0 ]; then
echo 'The requested object exists in policy package.'
else
echo 'The requested object does not exists in policy package.'
fi

Hope this helps,

Robert.

Re: R80.10 - Where Used object

Arthur_DENIS1 — Wed, 14 Mar 2018 16:28:18 GMT

Successfully tested, thanks a lot!

Hope this feature come back in the next version via SmartConsole

Re: R80.10 - Where Used object

Tomer_Sole — Thu, 15 Mar 2018 04:06:06 GMT

Hi, as for the UI -

Option 1:

1. right click the object and choose "where used..."

2. click the Policies tab

3. sort by the policy name - this will group all the results for a specific given policy.

Option 2:

search the name of the object in the search bar of the rulebase in a given policy. It will search groups that hold this object as well.

I understand that this isn't exactly like in R77.30, and we will add this request to our backlog, but what do you think about these approaches for now?

Re: R80.10 - Where Used object

Arthur_DENIS1 — Thu, 15 Mar 2018 08:41:34 GMT

Yes I used this, but this is not really easy...

About option 1: when we sort by policy name, we cannot sort in the same time by rule number.....

With more than 500 object usage, this is not really easy to find what want...

About option 2: It will search groups that hold this object and the network that include this object.

A lot of useless result....

These approaches is the only way to proceed, but not really easy to use.

The best way to do this right now is the script provided by Robert Decker !

I'm waiting to get back this feature in next release !!

Re: R80.10 - Where Used object

Tomer_Sole — Thu, 15 Mar 2018 09:37:39 GMT

thank you for this feedback.

Re: R80.10 - Where Used object

JasonDC — Fri, 04 May 2018 15:47:54 GMT

Agree with all of this.

Option 1: Resorts by policy but reorders the row numbers, which makes it frustrating to filter to the proper rows in large policies.

Option 2: I'm looking for a quick list view, not going over each row line by line.

*One additional item with the new object explorer. When doing a search for a specific host IP, I sometimes get all the networks that match before the exact match host. It will be covered up and need to press the ellipses button to expand to find the exact match.