A firewall matrix is useful for approval and change management, but it is not a FortiGate configuration. Before converting an Excel sheet into CLI, each row needs to be normalized, validated and translated into objects that FortiOS can reference.

1. Prepare the Excel firewall matrix

Keep one requested policy per row. For the current DeepCodeAgent beta, the useful columns are Name, Source, Destination, Protocol, Port, Src Interface, Dst Interface and Action. IPv4 hosts and CIDR networks are supported in the current scope.

Download the supported firewall matrix Excel template →

2. Validate before generating FortiGate CLI

Do not treat a spreadsheet as trusted configuration input. A typo such as an invalid subnet, an out-of-range port or an unintended ANY destination can become a deployment problem. DeepCodeAgent audits these fields and separates errors from warnings before enabling generation.

3. Compare with the existing FortiGate configuration

If you have an authorized plain-text FortiOS backup, load it before generation. The current beta inventories supported address objects, custom services and selected firewall-policy fields. This makes it possible to reuse existing objects instead of creating unnecessary duplicates.

4. Generate the delta CLI

The output is intentionally a delta: only supported objects that are missing are generated, while matching existing objects can be referenced by their current names. When a loaded configuration exposes occupied policy IDs, DeepCodeAgent skips those IDs when allocating new ones.

config firewall address
    edit "DCA_10-10-10-0_24"
        set subnet 10.10.10.0 255.255.255.0
    next
end

config firewall policy
    edit 1002
        set name "Allow_HTTPS_App"
        ...
    next
end

5. Review the delta and rollback

Generated CLI is not an automatic deployment recommendation. Check the live target configuration, policy order, interfaces, existing names and all security requirements before applying it. The generated rollback removes only the supported objects and policy IDs that the delta created; it does not restore every possible FortiGate side effect or external change.

Excel to FortiGate CLI checklist

• One requested firewall rule per row
• Source and destination verified
• Protocol and ports reviewed
• Correct incoming and outgoing interfaces
• Existing FortiGate configuration loaded when available
• No unresolved object-name conflicts
• Policy IDs verified against the live device
• Delta and rollback reviewed by an administrator