Skip to content

Fortinet: changing the logic for creating zones (VDOM mode) #69

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Jul 4, 2022
Merged

Fortinet: changing the logic for creating zones (VDOM mode) #69

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
75 changes: 42 additions & 33 deletions FortinetMigration/FortiGateConverter.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3557,8 +3557,6 @@ public void Add_ParentLayer(CheckPoint_Package package, List<FgCommand> fgComman
cpRuleLayer.Rules.Add(cpSubRuleZone);
}

bool isIntfContainsAny = false;

NewFortigateAnalizStatistic._fullrullPackcount = fgCommandsList.Count;
foreach (FgCommand fgCommandE in fgCommandsList)
{
Expand Down Expand Up @@ -3616,20 +3614,20 @@ public void Add_ParentLayer(CheckPoint_Package package, List<FgCommand> fgComman
{
fgSrcIntfs = fgCommand_Set.Value.Trim('"').Split(new string[] { "\" \"" }, StringSplitOptions.None).ToArray();

if (Array.IndexOf(fgSrcIntfs.Select(s => s.ToLowerInvariant()).ToArray(), "any") > -1)
{
isIntfContainsAny = true;
}
//if (Array.IndexOf(fgSrcIntfs.Select(s => s.ToLowerInvariant()).ToArray(), "any") > -1)
//{
// isIntfContainsAny = true;
//}
}

if (fgCommand_Set.Field.Equals("dstintf"))
{
fgDstIntfs = fgCommand_Set.Value.Trim('"').Split(new string[] { "\" \"" }, StringSplitOptions.None).ToArray();

if (Array.IndexOf(fgDstIntfs.Select(s => s.ToLowerInvariant()).ToArray(), "any") > -1)
{
isIntfContainsAny = true;
}
//if (Array.IndexOf(fgDstIntfs.Select(s => s.ToLowerInvariant()).ToArray(), "any") > -1)
//{
// isIntfContainsAny = true;
//}
}


Expand Down Expand Up @@ -4108,41 +4106,52 @@ public void Add_ParentLayer(CheckPoint_Package package, List<FgCommand> fgComman

//if Src or Dst Intf DO NOT contain ANY then we create sub-layers
//otherwise policy is plain
if (!isIntfContainsAny)
List<CheckPoint_Rule> newRootRulesList = new List<CheckPoint_Rule>();
foreach (CheckPoint_Rule rootRule in rootRulesList)
{
package.ParentLayer.Rules.AddRange(rootRulesList);
if (!rootRule.Name.Contains("any"))
{
newRootRulesList.Add(rootRule);
}
}
package.ParentLayer.Rules.AddRange(newRootRulesList);

foreach (string key in extraZonesMap.Keys)

foreach (string key in extraZonesMap.Keys)
{
if (key.Contains("any"))
{
AddCpObjectToLocalMapper(key, extraZonesMap[key]);
AddCheckPointObject(extraZonesMap[key]);
continue;
}
AddCpObjectToLocalMapper(key, extraZonesMap[key]);
AddCheckPointObject(extraZonesMap[key]);
}

_warningsList.AddRange(extraZonesWarnMsgsList);
_warningsList.AddRange(extraZonesWarnMsgsList);

foreach (string key in rootLayersMap.Keys)
foreach (string key in rootLayersMap.Keys)
{
if (key.Contains("any"))
{
CheckPoint_Layer cpLayer = rootLayersMap[key];
continue;
}
CheckPoint_Layer cpLayer = rootLayersMap[key];

CheckPoint_Rule cpRuleCU = new CheckPoint_Rule();
if(!OptimizeConf) NewFortigateAnalizStatistic._cleanupServicesRuleCount++;
NewFortigateAnalizStatistic._totalServicesRulesCount++;
cpRuleCU.Name = "Sub-Policy Cleanup";
cpRuleCU.Layer = cpLayer.Name;
CheckPoint_Rule cpRuleCU = new CheckPoint_Rule();
if (!OptimizeConf) NewFortigateAnalizStatistic._cleanupServicesRuleCount++;
NewFortigateAnalizStatistic._totalServicesRulesCount++;
cpRuleCU.Name = "Sub-Policy Cleanup";
cpRuleCU.Layer = cpLayer.Name;

cpLayer.Rules.Add(cpRuleCU);
cpLayer.Rules.Add(cpRuleCU);

package.SubPolicies.Add(cpLayer);
validatePackage(package);
}
package.SubPolicies.Add(cpLayer);
validatePackage(package);
}
else
foreach (CheckPoint_Rule ruleAdd in realRulesList)
{
foreach (CheckPoint_Rule ruleAdd in realRulesList)
{
ruleAdd.Layer = package.ParentLayer.Name;
package.ParentLayer.Rules.Add(ruleAdd);
}
ruleAdd.Layer = package.ParentLayer.Name;
package.ParentLayer.Rules.Add(ruleAdd);
}

var cpRuleFake = new CheckPoint_Rule();
Expand Down