Skip to content

v1.4.0 — Path-tracing truth

Choose a tag to compare

View all tags
@charlesaspe charlesaspe released this 04 Jul 16:33
v1.4.0
3ed2adc
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

The policy your automation couldn't see

trace_path now tells the whole truth about a flow — and closes a class of silent failure where firewall policies referencing the FortiGate Internet Service Database (ISDB) were invisible to the tracer. A flow governed by an Internet-Service block policy used to report "no matching firewall policy found." Now it returns a real blocked/permit verdict naming the policy.

What's new

  • ISDB resolution over REST — Internet-Service references are resolved to their IP ranges via the FortiOS monitor API (referenced services only; explicit truncation flag on huge feeds; degrades gracefully). No SSH.
  • Policies stored as data — dst_isdb/src_isdb on policies; resolved feeds become :ISDBService graph nodes.
  • Every policy on the path — Cisco ACLs on transit devices are now evaluated at each hop (not just at the firewall), via one shared matcher on protocol and port.
  • A typed reachability verdict — trace_path carries {result, reasons, blocked_by, risks, return_path} to any MCP client: reachable / blocked / partial / unknown, with open findings on the path surfaced as risks, and honest reasons for anything it couldn't verify — never a clean-by-omission answer.
  • Flow-shaped tracing — optional src_ip / protocol / dst_port, plus run_id to trace a past run for pre/post-change path comparison.
  • Return-path awareness — a reverse walk flags asymmetric routing and stateless-ACL return holes.

Backward-compatible: all new trace_path arguments are optional. 1047 tests; deterministic model snapshots unchanged.

Assets 2
Loading