2023年4月29日 星期六

Python Script for Append BanIP Groups form CSV file (FortiGate Firewall)

 Demo

[root@centos7 tmp]# cat test.py 

#!/usr/bin/python3

from netmiko import Netmiko

from csv import DictReader

import time

import os

import csv

os.chdir('/tmp')

csvfile = open('list.csv', 'r')

data = csv.DictReader(csvfile)



fw_01 ={'host':'192.168.100.254',

'username':'admin',

'password':'admin',

'device_type':'fortinet',

}


print(f"connecting to the device")

net_connect = Netmiko(**fw_01)

print("device is connected")


for i in data:

    #print(i['ip'])

    banip=(i['ip'])

    #time.sleep(2)

    print(banip)

    config = ['config firewall address',

         f'edit Ban-{(banip)}',

                 f'set associated-interface port2',

f'set subnet {banip} 255.255.255.255',

                 'next',

         'end'

    ]


    send_config =net_connect.send_config_set(config)

    print(send_config)

    config = ['config firewall addrgrp',

                 f'edit AutoBan',

                 f'append member Ban-{banip}',

                 'next',

                 'end'

    ]

    send_config =net_connect.send_config_set(config)

    print(send_config)


[root@centos7 tmp]# 



====================================



[root@centos7 tmp]# ./test.py

connecting to the device

device is connected

201.189.210.1

config firewall address

FortiGate-VM64 (address) # edit Ban-201.189.210.1

new entry 'Ban-201.189.210.1' added

FortiGate-VM64 (Ban-201.189.210.1) # set associated-interface port2

FortiGate-VM64 (Ban-201.189.210.1) # set subnet 201.189.210.1 255.255.255.255

FortiGate-VM64 (Ban-201.189.210.1) # next

FortiGate-VM64 (address) # end

FortiGate-VM64 # 

config firewall addrgrp

FortiGate-VM64 (addrgrp) # edit AutoBan

FortiGate-VM64 (AutoBan) # append member Ban-201.189.210.1

FortiGate-VM64 (AutoBan) # next

FortiGate-VM64 (addrgrp) # end

FortiGate-VM64 # 

[root@centos7 tmp]# cat list.csv 
ip
201.189.210.1
[root@centos7 tmp]# 



pip3 install netmiko==3.4.0
pip3 install cryptography==3.4.8

Reference

https://www.kareemccie.com/2021/12/python-script-for-creating-address_7.html

2023年4月2日 星期日

Zabbix Template Net MTR (JSON Report on CentOS7)

 https://www.meinekleinefarm.net/zabbix-template-net-mtr-my-traceroute/


依據上面這個 URL 的做法是需要安裝 mtr 這個套件,但在 CentOS 7 用 yum 

去裝這個套件,確是無法用 JSON 格式輸出 Report ,所以是需要去下載 

source code compiler

https://bitwizard.nl/mtr/files/

如果透過 yum / dnf 下載到的 mrt 就支援 JSON格式輸出,則應該可以使用

這個 Zabbix Template 以下畫面的輸出,我是在 Rocky Linux release 9.1 ,

透過  source code compiler 

去模擬我在 CentOS7 上面碰到的問題,在此留個筆記.




[root@zabbix mtr-0.94]# cat /etc/rocky-release

Rocky Linux release 9.1 (Blue Onyx)

[root@zabbix mtr-0.94]# 


[root@zabbix mtr-0.94]# dnf info mtr

Last metadata expiration check: 0:20:09 ago on Sun 02 Apr 2023 07:24:42 PM CST.

Installed Packages

Name         : mtr

Epoch        : 2

Version      : 0.94

Release      : 4.el9

Architecture : x86_64

Size         : 191 k

Source       : mtr-0.94-4.el9.src.rpm

Repository   : @System

From repo    : anaconda

Summary      : Network diagnostic tool combining 'traceroute' and 'ping'

URL          : https://www.bitwizard.nl/mtr/

License      : GPLv2

Description  : MTR combines the functionality of the 'traceroute' and 'ping' programs

             : in a single network diagnostic tool.

             : 

             : When MTR is started, it investigates the network connection between the

             : host MTR runs on and the user-specified destination host. Afterwards it

             : determines the address of each network hop between the machines and sends

             : a sequence of ICMP echo requests to each one to determine the quality of

             : the link to each machine. While doing this, it prints running statistics

             : about each machine.

             : 

             : MTR provides two user interfaces: an ncurses interface, useful for the

             : command line, e.g. for SSH sessions; and a GTK interface for X (provided

             : in the mtr-gtk package).


[root@zabbix mtr-0.94]# 


它是支援 JSON格式輸出的.

===================================

模擬我在 CentOS7 

上面碰到的問題


build options:
--------------
libasan :
ipv6    :yes
ipinfo  :yes
ncurses :no
gtk     :no
jansson :no
cap     :
libs    :-lm 
cflags  :-g -O2 -Wall -Wno-pointer-sign


====================================

dnf --enablerepo=crb install jansson-devel


[root@zabbix mtr-0.94]# pwd
/usr/local/src/mtr-0.94
[root@zabbix mtr-0.94]# ./configure 
checking for gcc... gcc
checking whether the C compiler works... yes
checking for C compiler default output file name... a.out
checking for suffix of executables... 
checking whether we are cross compiling... no
checking for suffix of object files... o
checking whether we are using the GNU C compiler... yes
checking whether gcc accepts -g... yes
checking for gcc option to accept ISO C89... none needed
checking whether gcc understands -c and -o together... yes
checking how to run the C preprocessor... gcc -E
checking for grep that handles long lines and -e... /usr/bin/grep
checking for egrep... /usr/bin/grep -E
checking for ANSI C header files... yes
checking for sys/types.h... yes
checking for sys/stat.h... yes
checking for stdlib.h... yes
checking for string.h... yes
checking for memory.h... yes
checking for strings.h... yes
checking for inttypes.h... yes
checking for stdint.h... yes
checking for unistd.h... yes
checking minix/config.h usability... no
checking minix/config.h presence... no
checking for minix/config.h... no
checking whether it is safe to define __EXTENSIONS__... yes
checking for a BSD-compatible install... /usr/bin/install -c
checking whether build environment is sane... yes
checking for a thread-safe mkdir -p... /usr/bin/mkdir -p
checking for gawk... gawk
checking whether make sets $(MAKE)... yes
checking whether make supports the include directive... yes (GNU style)
checking whether make supports nested variables... yes
checking dependency style of gcc... gcc3
checking whether make supports nested variables... (cached) yes
checking build system type... x86_64-pc-linux-gnu
checking host system type... x86_64-pc-linux-gnu
checking for gcc... (cached) gcc
checking whether we are using the GNU C compiler... (cached) yes
checking whether gcc accepts -g... (cached) yes
checking for gcc option to accept ISO C89... (cached) none needed
checking whether gcc understands -c and -o together... (cached) yes
checking for pkg-config... /usr/bin/pkg-config
checking pkg-config is at least version 0.9.0... yes
checking size of unsigned char... 1
checking size of unsigned short... 2
checking size of unsigned int... 4
checking size of unsigned long... 8
checking arpa/nameser_compat.h usability... yes
checking arpa/nameser_compat.h presence... yes
checking for arpa/nameser_compat.h... yes
checking curses.h usability... yes
checking curses.h presence... yes
checking for curses.h... yes
checking cursesX.h usability... no
checking cursesX.h presence... no
checking for cursesX.h... no
checking error.h usability... yes
checking error.h presence... yes
checking for error.h... yes
checking fcntl.h usability... yes
checking fcntl.h presence... yes
checking for fcntl.h... yes
checking linux/icmp.h usability... yes
checking linux/icmp.h presence... yes
checking for linux/icmp.h... yes
checking linux/errqueue.h usability... yes
checking linux/errqueue.h presence... yes
checking for linux/errqueue.h... yes
checking ncurses.h usability... yes
checking ncurses.h presence... yes
checking for ncurses.h... yes
checking ncurses/curses.h usability... yes
checking ncurses/curses.h presence... yes
checking for ncurses/curses.h... yes
checking netinet/in.h usability... yes
checking netinet/in.h presence... yes
checking for netinet/in.h... yes
checking socket.h usability... no
checking socket.h presence... no
checking for socket.h... no
checking sys/cdefs.h usability... yes
checking sys/cdefs.h presence... yes
checking for sys/cdefs.h... yes
checking sys/limits.h usability... no
checking sys/limits.h presence... no
checking for sys/limits.h... no
checking sys/socket.h usability... yes
checking sys/socket.h presence... yes
checking for sys/socket.h... yes
checking stdio_ext.h usability... yes
checking stdio_ext.h presence... yes
checking for stdio_ext.h... yes
checking for sys/types.h... (cached) yes
checking sys/xti.h usability... no
checking sys/xti.h presence... no
checking for sys/xti.h... no
checking values.h usability... yes
checking values.h presence... yes
checking for values.h... yes
checking for __fpending... yes
checking for fcntl... yes
checking for error... yes
checking for getopt_long... yes
checking for floor in -lm... yes
checking for GTK... yes
checking for JANSSON... yes
checking for library containing initscr... -lncurses
checking for cap_set_proc in -lcap... yes
checking for socket... yes
checking for gethostbyname... yes
checking for res_query... yes
checking for dn_expand in -lresolv... yes
checking whether errno is declared... yes
checking for socklen_t... yes
checking for time_t... yes
checking for C flags to get more warnings... -Wall -Wno-pointer-sign
build options:
--------------
libasan :
ipv6    :yes
ipinfo  :yes
ncurses :yes
gtk     :yes
jansson :yes
cap     :yes
libs    :-lncurses -lm 
cflags  :-g -O2 -Wall -Wno-pointer-sign
--------------
checking that generated files are newer than configure... done
configure: creating ./config.status
config.status: creating Makefile
config.status: creating config.h
config.status: config.h is unchanged
config.status: executing depfiles commands
[root@zabbix mtr-0.94]#  make ; make install 
......
....


[root@zabbix sbin]# ./mtr -r -c1 8.8.8.8
Start: 2023-04-02T19:24:51+0800
HOST: zabbix                      Loss%   Snt   Last   Avg  Best  Wrst StDev
  1.|-- _gateway                   0.0%     1    4.3   4.3   4.3   4.3   0.0
  2.|-- h254.s98.ts.hinet.net      0.0%     1    8.5   8.5   8.5   8.5   0.0
  3.|-- tpe4-3302.hinet.net        0.0%     1   30.1  30.1  30.1  30.1   0.0
  4.|-- tylc-3032.hinet.net        0.0%     1   10.5  10.5  10.5  10.5   0.0
  5.|-- tyfo-3335.hinet.net        0.0%     1    9.9   9.9   9.9   9.9   0.0
  6.|-- 72.14.213.90               0.0%     1   11.2  11.2  11.2  11.2   0.0
  7.|-- 108.170.244.65             0.0%     1   11.5  11.5  11.5  11.5   0.0
  8.|-- 209.85.142.121             0.0%     1    9.7   9.7   9.7   9.7   0.0
  9.|-- ???                       100.0     1    0.0   0.0   0.0   0.0   0.0
 10.|-- dns.google                 0.0%     1   10.4  10.4  10.4  10.4   0.0
[root@zabbix sbin]# 


[root@zabbix sbin]# traceroute 8.8.8.8
traceroute to 8.8.8.8 (8.8.8.8), 30 hops max, 60 byte packets
 1  _gateway (192.168.100.1)  3.650 ms  14.042 ms  13.834 ms
 2  h254.s98.ts.hinet.net (168.95.98.254)  7.892 ms  8.167 ms  7.875 ms
 3  tpe4-3302.hinet.net (168.95.23.110)  8.596 ms  9.152 ms  8.853 ms
 4  tylc-3032.hinet.net (220.128.9.242)  9.591 ms  9.412 ms  9.572 ms
 5  tylc-3336.hinet.net (220.128.9.21)  11.692 ms tylc-3336.hinet.net (220.128.9.25)  9.989 ms tyfo-3335.hinet.net (220.128.9.13)  11.288 ms
 6  72.14.209.178 (72.14.209.178)  9.986 ms  9.095 ms 72.14.215.0 (72.14.215.0)  9.884 ms
 7  108.170.244.33 (108.170.244.33)  9.409 ms 108.170.244.65 (108.170.244.65)  10.704 ms *
 8  209.85.243.196 (209.85.243.196)  9.898 ms dns.google (8.8.8.8)  8.605 ms 209.85.245.64 (209.85.245.64)  14.529 ms

[root@zabbix sbin]# ./mtr -r -c1 -w -b -p -j 8.8.8.8
{
    "report": {
        "mtr": {
            "src": "zabbix",
            "dst": "8.8.8.8",
            "tos": 0,
            "tests": 1,
            "psize": "64",
            "bitpattern": "0x00"
        },
        "hubs": [
            {
                "count": 1,
                "host": "_gateway (192.168.100.1)",
                "Loss%": 0.0,
                "Snt": 1,
                "Last": 34.426,
                "Avg": 34.426,
                "Best": 34.426,
                "Wrst": 34.426,
                "StDev": 0.0
            },
            {
                "count": 2,
                "host": "h254.s98.ts.hinet.net (168.95.98.254)",
                "Loss%": 0.0,
                "Snt": 1,
                "Last": 13.442,
                "Avg": 13.442,
                "Best": 13.442,
                "Wrst": 13.442,
                "StDev": 0.0
            },
            {
                "count": 3,
                "host": "tpe4-3302.hinet.net (168.95.23.110)",
                "Loss%": 0.0,
                "Snt": 1,
                "Last": 10.539,
                "Avg": 10.539,
                "Best": 10.539,
                "Wrst": 10.539,
                "StDev": 0.0
            },
            {
                "count": 4,
                "host": "tylc-3032.hinet.net (220.128.9.242)",
                "Loss%": 0.0,
                "Snt": 1,
                "Last": 10.711,
                "Avg": 10.711,
                "Best": 10.711,
                "Wrst": 10.711,
                "StDev": 0.0
            },
            {
                "count": 5,
                "host": "tyfo-3335.hinet.net (220.128.9.185)",
                "Loss%": 0.0,
                "Snt": 1,
                "Last": 45.341,
                "Avg": 45.341,
                "Best": 45.341,
                "Wrst": 45.341,
                "StDev": 0.0
            },
            {
                "count": 6,
                "host": "72.14.213.90",
                "Loss%": 0.0,
                "Snt": 1,
                "Last": 11.993,
                "Avg": 11.993,
                "Best": 11.993,
                "Wrst": 11.993,
                "StDev": 0.0
            },
            {
                "count": 7,
                "host": "108.170.244.65",
                "Loss%": 0.0,
                "Snt": 1,
                "Last": 11.377,
                "Avg": 11.377,
                "Best": 11.377,
                "Wrst": 11.377,
                "StDev": 0.0
            },
            {
                "count": 8,
                "host": "209.85.142.121",
                "Loss%": 0.0,
                "Snt": 1,
                "Last": 11.746,
                "Avg": 11.746,
                "Best": 11.746,
                "Wrst": 11.746,
                "StDev": 0.0
            },
            {
                "count": 9,
                "host": "dns.google (8.8.8.8)",
                "Loss%": 0.0,
                "Snt": 1,
                "Last": 12.678,
                "Avg": 12.678,
                "Best": 12.678,
                "Wrst": 12.678,
                "StDev": 0.0
            }
        ]
    }
}
[root@zabbix sbin]#



==========================================

[root@zabbix mtr-0.94]# mtr -help

Usage:
 mtr [options] hostname

 -F, --filename FILE        read hostname(s) from a file
 -4                         use IPv4 only
 -6                         use IPv6 only
 -u, --udp                  use UDP instead of ICMP echo
 -T, --tcp                  use TCP instead of ICMP echo
 -I, --interface NAME       use named network interface
 -a, --address ADDRESS      bind the outgoing socket to ADDRESS
 -f, --first-ttl NUMBER     set what TTL to start
 -m, --max-ttl NUMBER       maximum number of hops
 -U, --max-unknown NUMBER   maximum unknown host
 -P, --port PORT            target port number for TCP, SCTP, or UDP
 -L, --localport LOCALPORT  source port number for UDP
 -s, --psize PACKETSIZE     set the packet size used for probing
 -B, --bitpattern NUMBER    set bit pattern to use in payload
 -i, --interval SECONDS     ICMP echo request interval
 -G, --gracetime SECONDS    number of seconds to wait for responses
 -Q, --tos NUMBER           type of service field in IP header
 -e, --mpls                 display information from ICMP extensions
 -Z, --timeout SECONDS      seconds to keep probe sockets open
 -M, --mark MARK            mark each sent packet
 -r, --report               output using report mode
 -w, --report-wide          output wide report
 -c, --report-cycles COUNT  set the number of pings sent
 -j, --json                 output json
 -x, --xml                  output xml
 -C, --csv                  output comma separated values
 -l, --raw                  output raw format
 -p, --split                split output
 -t, --curses               use curses terminal interface
     --displaymode MODE     select initial display mode
 -n, --no-dns               do not resolve host names
 -b, --show-ips             show IP numbers and host names
 -o, --order FIELDS         select output fields
 -y, --ipinfo NUMBER        select IP information in output
 -z, --aslookup             display AS number
 -h, --help                 display this help and exit
 -v, --version              output version information and exit

See the 'man 8 mtr' for details.
[root@zabbix mtr-0.94]#