Fortinet Document Library

Version:

Version:


Table of Contents

Administration Guide

Download PDF
Copy Link

Allow creation of ISDB objects with regional information

Geographic-based Internet Service Database (ISDB) objects allow users to define a country, region, and city. These objects can be used in firewall policies for more granular control over the location of the parent ISDB object. ISDB objects are now referenced in policies by name instead of ID.

To apply a location-based ISDB object to a policy in the GUI:
  1. Create the ISDB object:
    1. Go to Policy & Objects > Internet Service Database > Create New.
    2. For Type, select Geographic Based, and configure the other settings as needed.
    3. Click OK.

  2. View the IP ranges in the location-based internet service:
    1. Go to Policy & Objects > Internet Service Database .
    2. In the table, hover over the object created in step 1 and click View/Edit Entries. The list of IPs is displayed:

    3. Click Return.
  3. Add the ISDB object to a policy:
    1. Go to Policy & Objects > Firewall Policy. Create a new policy or edit an existing policy.
    2. For Destination, click Internet Service and select the ISDB object created in step 1.
    3. Configure the other settings as needed.

    4. Click OK.
To apply a location-based ISDB object to a policy in the CLI:
  1. Create the ISDB object:
    config firewall internet-service-name
        edit "test-locaction-isdb-1"
            set type location
            set internet-service-id 65536
            set country-id 840
            set region-id 283
            set city-id 23352
        next
    end
  2. View the IP ranges in the location-based internet service:
    # diagnose internet-service id 65536 | grep "country(840) region(283) city(23352)"
  3. Add the ISDB object to a policy:
    config firewall policy
        edit 99
            set name "Demo_Policy"
            set srcintf "wan2"
            set dstintf "wan1"
            set srcaddr "all"
            set internet-service enable
            set internet-service-name "test-locaction-isdb-1"
            set action accept
            set schedule "always"
            set logtraffic all
            set logtraffic-start enable
            set auto-asic-offload disable
            set comments "1"
            set nat enable
        next
    end

Allow creation of ISDB objects with regional information

Geographic-based Internet Service Database (ISDB) objects allow users to define a country, region, and city. These objects can be used in firewall policies for more granular control over the location of the parent ISDB object. ISDB objects are now referenced in policies by name instead of ID.

To apply a location-based ISDB object to a policy in the GUI:
  1. Create the ISDB object:
    1. Go to Policy & Objects > Internet Service Database > Create New.
    2. For Type, select Geographic Based, and configure the other settings as needed.
    3. Click OK.

  2. View the IP ranges in the location-based internet service:
    1. Go to Policy & Objects > Internet Service Database .
    2. In the table, hover over the object created in step 1 and click View/Edit Entries. The list of IPs is displayed:

    3. Click Return.
  3. Add the ISDB object to a policy:
    1. Go to Policy & Objects > Firewall Policy. Create a new policy or edit an existing policy.
    2. For Destination, click Internet Service and select the ISDB object created in step 1.
    3. Configure the other settings as needed.

    4. Click OK.
To apply a location-based ISDB object to a policy in the CLI:
  1. Create the ISDB object:
    config firewall internet-service-name
        edit "test-locaction-isdb-1"
            set type location
            set internet-service-id 65536
            set country-id 840
            set region-id 283
            set city-id 23352
        next
    end
  2. View the IP ranges in the location-based internet service:
    # diagnose internet-service id 65536 | grep "country(840) region(283) city(23352)"
  3. Add the ISDB object to a policy:
    config firewall policy
        edit 99
            set name "Demo_Policy"
            set srcintf "wan2"
            set dstintf "wan1"
            set srcaddr "all"
            set internet-service enable
            set internet-service-name "test-locaction-isdb-1"
            set action accept
            set schedule "always"
            set logtraffic all
            set logtraffic-start enable
            set auto-asic-offload disable
            set comments "1"
            set nat enable
        next
    end