Fortinet Firewall Command Line Overview
1. You can use SSH, Telnet, or serial console
2. The configuration of CLI is hierarchical, as shown below:
Config system interface
Edit "internal"
Set vdom "root"
Set ip 192.168.100.99 255.255.255.0
Set allowaccess ping https ssh snmp http telnet
Set type physical
Next
End
3. The command line hierarchy has the following keywords:
Config
Edit
Next
End
Exit
Abort
4. Use "?" You can query the instructions available at the current level
5. Use to make up the current command
6. Example of setting IP: for wan2:
FortiGate-60 # config system interface
(interface) # edit wan2
(wan2) # set ip 192.177.11.12 255.255.255.248
(wan2) # end
FortiGate-60 #
7. You can use the "get" command to display parameters and current values:
(internal) # get
Name: internal
Vdom: root
Cli-conn-status: 0
Mode: static
Dhcp-relay-service:
Dhcp-relay-ip:
Dhcp-relay-type:
Ip: 192.168.96.254 255.255.255.0
Allowaccess: ping HTTPS HTTP telnet
8. You can display the current configuration with the "show" command:
FGT50B3 # config system interface
FGT50B3 (interface) # edit internal
FGT50B3 (internal) # show
Config system interface
Edit "internal"
Set vdom "root"
Set ip 192.168.100.99 255.255.255.0
Set allowaccess ping https ssh snmp http telnet
Set type physical
Next
End
9. You can use the "show full-configuration" command to display the current full configuration:
FGT50B3 # config system interface
FGT50B3 (interface) # edit internal
FGT50B3 (internal) # show full-configuration
Config system interface
Edit "internal"
Set vdom "root"
Set mode static
Set dhcp-relay-service disable
Unset dhcp-relay-ip
Set dhcp-relay-type regular
Set ip 192.168.100.99 255.255.255.0
Set allowaccess ping https ssh snmp http telnet
Set gwdetect disable
Unset detectserver
Set ha-priority 0
Set pptp-client disable
Set arpforward enable
Set broadcast-forward disable
Set bfd global
Set l2forward disable
Set icmp-redirect enable
Set vlanforward enable
Set stpforward disable
Set ident-accept disable
Set ipmac disable
Set subst disable
Set log disable
Set fdp disable
Set ddns disable
Set status up
Set netbios-forward disable
Set wins-ip 0.0.0.0
Set type physical
Set tcp-mss 0
Set inbandwidth 0
Set outbandwidth 0
Set description''
Set alias''
Set l2tp-client disable
Config ipv6
Set autoconf disable
Set ip6-address:: / 0
Unset ip6-allowaccess
Set ip6-default-life 1800
Set ip6-hop-limit 0
Set ip6-link-mtu 0
Set ip6-manage-flag disable
Set ip6-max-interval 600
Set ip6-min-interval 198
Set ip6-other-flag disable
Set ip6-reachable-time 0
Set ip6-retrans-time 0
Set ip6-send-adv disable
End
Set idle-timeout 0
Unset macaddr
Set mtu-override disable
Next
End
10. Execute some commands, such as:
Execute factoryreset
Execute ping
Execute backup
Execute traceroute
Execute reboot
