SRL Network and Firewall Functions

`is_ip()`

Definition and usage

Validates an IPv4 or IPv6 address.

Syntax

is_ip(value)

Parameter values

Parameter	Allowed type	Required	Description
`value`	mixed	Yes	Address text.

Return value

Return type	`boolean`
Output	true for a valid individual IP address.

Examples

Example 1

is_ip("192.0.2.1")

Expected return value: true

Example 2

is_ip("10.0.0.0/24")

Expected return value: false

Back to top

`is_cidr()`

Definition and usage

Validates IPv4 or IPv6 CIDR text.

Syntax

is_cidr(value)

Parameter values

Parameter	Allowed type	Required	Description
`value`	mixed	Yes	CIDR text.

Return value

Return type	`boolean`
Output	true for a valid CIDR.

Examples

Example 1

is_cidr("10.0.0.0/24")

Expected return value: true

Example 2

is_cidr("10.0.0.1")

Expected return value: false

Back to top

`cidr_contains()`

Definition and usage

Tests whether an individual IP belongs to a CIDR.

Syntax

cidr_contains(cidr, ip)

Parameter values

Parameter	Allowed type	Required	Description
`cidr`	string	Yes	Container CIDR.
`ip`	string	Yes	Subject IP.

Return value

Return type	`boolean`
Output	true when the IP is inside the CIDR.

Examples

Example 1

cidr_contains("10.0.0.0/24", "10.0.0.10")

Expected return value: true

Example 2

cidr_contains("10.0.0.0/24", "10.0.1.10")

Expected return value: false

Back to top

`network_includes()`

Definition and usage

Tests complete IP, CIDR, or range containment for one or many values.

Syntax

network_includes(container, subject)

Parameter values

Parameter	Allowed type	Required	Description
`container`	mixed	Yes	IP, CIDR, range, or collection of containers.
`subject`	mixed	Yes	IP, CIDR, range, or collection that must be fully contained.

Return value

Return type	`boolean`
Output	true only when every subject value is covered.

Examples

Example 1

network_includes("10.0.0.0/24", "10.0.0.10")

Expected return value: true

Example 2

network_includes(split("10.0.0.0/24,192.0.2.1", ","), "10.0.1.0/24")

Expected return value: false

Back to top

`port_includes()`

Definition and usage

Tests complete port or port-range containment.

Syntax

port_includes(containerPorts, subjectPorts)

Parameter values

Parameter	Allowed type	Required	Description
`containerPorts`	mixed	Yes	Port, range, ALL, or collection of containers.
`subjectPorts`	mixed	Yes	Port, range, or collection that must be covered.

Return value

Return type	`boolean`
Output	true only when every subject port is included.

Examples

Example 1

port_includes("1-1024", "443")

Expected return value: true

Example 2

port_includes("80 443", "8000")

Expected return value: false

Back to top

`isInternetOutboundPolicy()`

Definition and usage

Returns whether a prepared FortiGate policy-like object is confirmed to be outbound or internet-bound.

Syntax

isInternetOutboundPolicy(policy)

Parameter values

Parameter	Allowed type	Required	Description
`policy`	configuration node	Yes	A firewall policy or another parsed policy-like object. Use this inside a policy loop, or pass this explicitly.

Return value

Return type	`boolean`
Output	true when destination-side internet-service, interface/zone classification, or an allowed destination fallback confirms public internet reachability.

Examples

Example 1

isInternetOutboundPolicy(this)

Expected return value: true for an internet-bound policy in the current loop

Example 2

foreach config.firewall.proxy-policy as $policy { if (isInternetOutboundPolicy($policy)) { ... } }

Expected return value: Evaluates each proxy policy with the same outbound semantics

Example 3

isInternetOutboundPolicy(config.firewall.policy.10)

Expected return value: Evaluates one prepared policy object directly

Behavior:

Supported sections include firewall policy/policy6, local-in-policy/local-in-policy6, DoS-policy/DoS-policy6, security-policy, proxy-policy, shaping-policy, interface-policy/interface-policy6, and other parsed policy-like sections with equivalent destination fields.
Destination interface fields map from dstintf and common destination/egress aliases. When no destination-specific field exists, interface or intf is used for local-in, DoS, and interface-policy objects.
Destination address fields map from dstaddr, dstaddr6, dst, dst6, destination, and common destination-address or destination-IP aliases. Source fields are never used as outbound evidence.
internet-service enable and internet-service6 enable confirm outbound traffic immediately. internet-service-src and internet-service6-src are source-side and are deliberately ignored.
A destination interface or zone whose network_type contains internet confirms outbound traffic. network_type may be a scalar or list. external, any, and undefined do not mean internet.
Address fallbacks run only for an any, missing, unresolved, any-type, or undefined-type destination interface. They recognise all/all6, FQDN and wildcard-FQDN objects, nested address groups, and public IP, subnet, or range coverage.
Private-only destinations return false. A range that spans both private and public address space returns true; private overlap does not hide its public coverage.
A known external-only third-party destination remains false unless destination-side internet-service evidence confirms internet use. Expensive address expansion is skipped after interface or internet-service confirmation.

Back to top

`isInternetInboundPolicy()`

Definition and usage

Returns whether a prepared FortiGate policy-like object is confirmed to be inbound from the internet.

Syntax

isInternetInboundPolicy(policy)

Parameter values

Parameter	Allowed type	Required	Description
`policy`	configuration node	Yes	A firewall policy or another parsed policy-like object. Use this inside a policy loop, or pass this explicitly.

Return value

Return type	`boolean`
Output	true when source-side internet-service, interface/zone classification, or an allowed source fallback confirms public internet origin.

Examples

Example 1

isInternetInboundPolicy(this)

Expected return value: true for an internet-originating policy in the current loop

Example 2

foreach config.firewall.local-in-policy as $policy { if (isInternetInboundPolicy($policy)) { ... } }

Expected return value: Evaluates each local-in policy with the same inbound semantics

Example 3

isInternetInboundPolicy(config.firewall.policy.10)

Expected return value: Evaluates one prepared policy object directly

Behavior:

Supported sections include firewall policy/policy6, local-in-policy/local-in-policy6, DoS-policy/DoS-policy6, security-policy, proxy-policy, shaping-policy, interface-policy/interface-policy6, and other parsed policy-like sections with equivalent source fields.
Source interface fields map from srcintf and common source/ingress aliases. When no source-specific field exists, interface or intf is used as the receiving interface for local-in, DoS, and interface-policy objects.
Source address fields map from srcaddr, srcaddr6, src, src6, source, and common source-address or source-IP aliases. Destination fields are not independently sufficient inbound evidence.
internet-service-src enable and internet-service6-src enable confirm inbound traffic immediately. Destination-side internet-service and internet-service6 are deliberately ignored.
A source interface or zone whose network_type contains internet confirms inbound traffic. network_type may be a scalar or list. external, any, and undefined do not mean internet.
Address fallbacks run only for an any, missing, unresolved, any-type, or undefined-type source interface. They recognise all/all6, FQDN and wildcard-FQDN objects, nested address groups, and public IP, subnet, or range coverage.
Private-only sources return false. A range that spans both private and public address space returns true; private overlap does not hide its public coverage.
A known private or external-only source returns false and cannot be overridden by VIP, public-destination, NAT, or destination internet-service context. Expensive address expansion is skipped after interface or source internet-service confirmation.

Back to top

`getAddressType()`

Definition and usage

Resolves the configured type of an address object or reference.

Syntax

getAddressType(value)

Parameter values

Parameter	Allowed type	Required	Description
`value`	mixed	Yes	Address object, name, or reference list.

Return value

Return type	`string or list`
Output	Resolved address type information.

Examples

Example 1

getAddressType("LAN_NET")

Expected return value: ipmask

Example 2

getAddressType(this.srcaddr)

Expected return value: Type information for source references

Back to top

`getAllIpAddressNames()`

Definition and usage

Recursively expands IP-family address references to object names.

Syntax

getAllIpAddressNames(value)

Parameter values

Parameter	Allowed type	Required	Description
`value`	mixed	Yes	Address name, object, group, or list.

Return value

Return type	`list`
Output	Unique referenced IP address object names.

Examples

Example 1

getAllIpAddressNames(this.srcaddr)

Expected return value: ["LAN_NET", "VPN_POOL"]

Example 2

join(getAllIpAddressNames("Office_Group"), ", ")

Expected return value: LAN_NET, WiFi_NET

Back to top

`getAllIpAddresses()`

Definition and usage

Recursively expands IP-family address references to concrete values.

Syntax

getAllIpAddresses(value)

Parameter values

Parameter	Allowed type	Required	Description
`value`	mixed	Yes	Address name, object, group, or list.

Return value

Return type	`list`
Output	Resolved IP, CIDR, or range values.

Examples

Example 1

getAllIpAddresses(this.dstaddr)

Expected return value: ["10.0.0.0/24"]

Example 2

network_includes(getAllIpAddresses(this.srcaddr), "10.0.0.10")

Expected return value: true when covered

Back to top

`getAllAddressFqdnNames()`

Definition and usage

Recursively expands FQDN address references to object names.

Syntax

getAllAddressFqdnNames(value)

Parameter values

Parameter	Allowed type	Required	Description
`value`	mixed	Yes	Address name, object, group, or list.

Return value

Return type	`list`
Output	Referenced FQDN object names.

Examples

Example 1

getAllAddressFqdnNames(this.dstaddr)

Expected return value: ["Vendor_API"]

Example 2

count(getAllAddressFqdnNames(this.dstaddr))

Expected return value: Number of FQDN objects

Back to top

`getAllAddressFqdns()`

Definition and usage

Recursively expands FQDN address references to configured domain values.

Syntax

getAllAddressFqdns(value)

Parameter values

Parameter	Allowed type	Required	Description
`value`	mixed	Yes	Address name, object, group, or list.

Return value

Return type	`list`
Output	FQDN and wildcard-FQDN values.

Examples

Example 1

getAllAddressFqdns("Vendor_API")

Expected return value: ["api.example.com"]

Example 2

join(getAllAddressFqdns(this.dstaddr), ", ")

Expected return value: api.example.com, *.cdn.example.com

Back to top

`getAllAddressGeographyNames()`

Definition and usage

Expands geography address references to object names.

Also accepted: getalladdressgeographys(), getalladdressgeographies()

Syntax

getAllAddressGeographyNames(value)

Parameter values

Parameter	Allowed type	Required	Description
`value`	mixed	Yes	Address name, object, group, or list.

Return value

Return type	`list`
Output	Referenced geography object names.

Examples

Example 1

getAllAddressGeographyNames(this.dstaddr)

Expected return value: ["Allowed_Countries"]

Example 2

count(getAllAddressGeographyNames(this.dstaddr))

Expected return value: Number of geography objects

Back to top

`getAllAddressDeviceNames()`

Definition and usage

Expands device address references to object names.

Syntax

getAllAddressDeviceNames(value)

Parameter values

Parameter	Allowed type	Required	Description
`value`	mixed	Yes	Address name, object, group, or list.

Return value

Return type	`list`
Output	Referenced device object names.

Examples

Example 1

getAllAddressDeviceNames(this.srcaddr)

Expected return value: ["Managed_Laptops"]

Example 2

any(getAllAddressDeviceNames(this.srcaddr), "Unknown_Device")

Expected return value: true when referenced

Back to top

`getAllAddressDevices()`

Definition and usage

Expands device address references to configured device values.

Syntax

getAllAddressDevices(value)

Parameter values

Parameter	Allowed type	Required	Description
`value`	mixed	Yes	Address name, object, group, or list.

Return value

Return type	`list`
Output	Resolved device values.

Examples

Example 1

getAllAddressDevices("Managed_Laptops")

Expected return value: Configured device identifiers

Example 2

count(getAllAddressDevices(this.srcaddr))

Expected return value: Number of resolved devices

Back to top

`getAllServicePortNames()`

Definition and usage

Recursively expands service references to custom service names.

Also accepted: getallportsnames()

Syntax

getAllServicePortNames(value)

Parameter values

Parameter	Allowed type	Required	Description
`value`	mixed	Yes	Service name, object, group, or list.

Return value

Return type	`list`
Output	Unique referenced service names.

Examples

Example 1

getAllServicePortNames(this.service)

Expected return value: ["HTTPS", "DNS"]

Example 2

join(getAllServicePortNames("Web_Services"), ", ")

Expected return value: HTTP, HTTPS

Back to top

`getAllServicePorts()`

Definition and usage

Recursively expands service references to all configured ports.

Also accepted: getallports()

Syntax

getAllServicePorts(value)

Parameter values

Parameter	Allowed type	Required	Description
`value`	mixed	Yes	Service name, group, object, or list.

Return value

Return type	`list`
Output	Combined TCP, UDP, SCTP, ICMP, or ALL port tokens as applicable.

Examples

Example 1

getAllServicePorts(this.service)

Expected return value: ["443", "53"]

Example 2

port_includes(getAllServicePorts("ALL_TCP"), "443")

Expected return value: true when covered

Back to top

`getAllServiceTcpPorts()`

Definition and usage

Expands service references to TCP ports only.

Also accepted: getalltcpports()

Syntax

getAllServiceTcpPorts(value)

Parameter values

Parameter	Allowed type	Required	Description
`value`	mixed	Yes	Service name, group, object, or list.

Return value

Return type	`list`
Output	Resolved TCP ports and ranges.

Examples

Example 1

getAllServiceTcpPorts("HTTPS")

Expected return value: ["443"]

Example 2

port_includes(getAllServiceTcpPorts(this.service), "8443")

Expected return value: true when covered

Back to top

`getAllServiceUdpPorts()`

Definition and usage

Expands service references to UDP ports only.

Also accepted: getalludpports()

Syntax

getAllServiceUdpPorts(value)

Parameter values

Parameter	Allowed type	Required	Description
`value`	mixed	Yes	Service name, group, object, or list.

Return value

Return type	`list`
Output	Resolved UDP ports and ranges.

Examples

Example 1

getAllServiceUdpPorts("DNS")

Expected return value: ["53"]

Example 2

count(getAllServiceUdpPorts(this.service))

Expected return value: Number of UDP port tokens

Back to top

`getAllServiceSctpPorts()`

Definition and usage

Expands service references to SCTP ports only.

Also accepted: getallsctpports()

Syntax

getAllServiceSctpPorts(value)

Parameter values

Parameter	Allowed type	Required	Description
`value`	mixed	Yes	Service name, group, object, or list.

Return value

Return type	`list`
Output	Resolved SCTP ports and ranges.

Examples

Example 1

getAllServiceSctpPorts("SCTP_App")

Expected return value: ["36412"]

Example 2

count(getAllServiceSctpPorts(this.service))

Expected return value: Number of SCTP port tokens

Back to top

`cert_days_remaining()`

Definition and usage

Calculates whole days until an X.509 certificate expires.

Syntax

cert_days_remaining(certificateBase64)

Parameter values

Parameter	Allowed type	Required	Description
`certificateBase64`	string	Yes	PEM or base64 certificate content from a firewall certificate object.

Return value

Return type	`number or empty`
Output	Whole days remaining, or an empty value when parsing fails.

Examples

Example 1

cert_days_remaining(this.certificate)

Expected return value: 42

Example 2

cert_days_remaining("invalid")

Expected return value: empty

Back to top

`getRecommendedFortiOSRelease()`

Definition and usage

Looks up Fortinet's current recommended FortiOS release for a normalized firewall model.

Syntax

getRecommendedFortiOSRelease(firewallModel)

Parameter values

Parameter	Allowed type	Required	Description
`firewallModel`	string	Yes	A ConfigSentry model value such as appliance.hardware, FortiGate 60F, FWF51G, FGR60F3G4G, or FortiGate VM64 AWS.

Return value

Return type	`object`
Output	An object with available, model, recommended_release, engineering_support_passed, and source_product_text fields. Unknown models and unavailable data return available=false instead of a guessed recommendation.

Examples

Example 1

getRecommendedFortiOSRelease(appliance.hardware).recommended_release

Expected return value: The recommended version, such as 7.6.6

Example 2

getRecommendedFortiOSRelease("FortiGate 30E").engineering_support_passed

Expected return value: true when Fortinet marks End of Engineering Support Passed = Y

Behavior:

Recommendations are read from the Audits database populated by the daily Fortinet scraper.
FortiGate, FortiWiFi, FortiGateRugged, combined chassis entries, and recognised VM variants are normalized to ConfigSentry model names.
Always test available before treating recommended_release as authoritative.

Back to top

`getDuplicateAddressObjectResults()`

Definition and usage

Produces per-object results for duplicate address detection using a single indexed scan.

Syntax

getDuplicateAddressObjectResults(addresses)

Parameter values

Parameter	Allowed type	Required	Description
`addresses`	collection	Yes	Usually config.firewall.address.

Return value

Return type	`list of result objects`
Output	Each row contains status, entry_name, and duplicate_names. The first object in a duplicate group is info; later objects and non-duplicates are pass.

Examples

Example 1

getDuplicateAddressObjectResults(config.firewall.address)

Expected return value: One result row per address object

Example 2

join(array_column(getDuplicateAddressObjectResults(config.firewall.address), "entry_name"), ", ")

Expected return value: All evaluated address names

Behavior: Supports ipmask, iprange, fqdn, wildcard-fqdn, and geography signatures. Dynamic and built-in address objects are excluded from duplicate findings.

Back to top

`getDuplicateServiceObjectResults()`

Definition and usage

Produces per-object results for duplicate custom-service detection using a single indexed scan.

Syntax

getDuplicateServiceObjectResults(services)

Parameter values

Parameter	Allowed type	Required	Description
`services`	collection	Yes	Usually config.firewall.service.custom.

Return value

Return type	`list of result objects`
Output	Each row contains status, entry_name, and duplicate_names. The first object in a duplicate group is info; later objects and non-duplicates are pass.

Examples

Example 1

getDuplicateServiceObjectResults(config.firewall.service.custom)

Expected return value: One result row per custom service

Example 2

count(getDuplicateServiceObjectResults(config.firewall.service.custom))

Expected return value: Number of evaluated custom services

Behavior: Signatures use protocol, protocol-number, TCP/UDP/SCTP ranges, ICMP type, and ICMP code.

Back to top

`getShadowedFirewallPolicyMatches()`

Definition and usage

Finds earlier enabled firewall policies that fully cover the supplied policy.

Syntax

getShadowedFirewallPolicyMatches(policy)

Parameter values

Parameter	Allowed type	Required	Description
`policy`	configuration node	Yes	Usually this while looping config.firewall.policy.

Return value

Return type	`list`
Output	Human-readable labels for matching earlier policies, in policy order.

Examples

Example 1

getShadowedFirewallPolicyMatches(this)

Expected return value: ["policy 10 (broad-web)"]

Example 2

count(getShadowedFirewallPolicyMatches(this))

Expected return value: 0 when the policy is not shadowed

Behavior: The helper caches policy coverage for the current execution context and evaluates interface, address, service, schedule, status, and special policy semantics.

Back to top