FortiGate CLI commands cheat sheet (FortiOS)

Show firmware version, serial number, FortiGuard engine versions and other system information.

Words can be shortened to any unique prefix, so g sy stat runs the same command.

Show CPU and memory use, average network usage, sessions, session setup rate and uptime.

Show the processes using the most CPU and memory.

Delay is in seconds (default 5), lines defaults to 20 and iterations defaults to unlimited.

Show the configuration of a path, listing only values changed from the defaults.

Show the configuration of a path including every default value.

Fortinet docs often shorten it to show full.

Search the configuration and print each match inside its full config block.

grep works on get, show and diagnose output and also takes -i (ignore case), -n, -A, -B and -C.

Enter a configuration object or table; the prompt changes to show the scope.

Create or open a table entry.

In numbered tables such as firewall policies, edit 0 creates a new entry that gets the next free ID when saved.

Set a field value inside the current object or entry.

On list fields set replaces the whole list. Use append to add an item and unselect to remove one.

Save the current table entry and stay in the table to edit another one.

Save the changes and leave the current config scope.

Leave the current edit or config command without saving changes.

Console settings; set output standard turns off the --More-- paging of long output.

set output more turns paging back on. Finish with end.

Configure physical, VLAN and other interfaces, including IP address and admin access.

Typical block: edit port2, set ip ..., set allowaccess ping https ssh, next, end. Removing https or ssh from the interface you manage through cuts off your session.

Show hardware details and counters for a physical port.

Show the ARP table.

Show every route in the active routing table with its type, source and outgoing interface.

Show the routing table entry that matches a destination.

Add or change IPv4 static routes.

Typical block: edit 0, set dst 198.51.100.0 255.255.255.0, set gateway 192.0.2.1, set device port1, next, end. dst defaults to 0.0.0.0 0.0.0.0, which makes a default route.

Create IPv4 address objects such as subnets, ranges and FQDNs.

Start with edit <name>. For a hostname use set type fqdn and set fqdn www.example.com.

Group address objects so a policy can use them together.

set member replaces the list; use append member to add one object.

Create or edit firewall policies.

Common fields: name, srcintf, dstintf, srcaddr, dstaddr, action, schedule, service, nat, logtraffic and status.

Copy a table entry, such as a firewall policy, to a new ID.

Run it inside config firewall policy, then end. Not every table supports clone.

Show which firewall policy would match a given flow, without sending traffic.

Policy type (policy or proxy) was added in 7.4.1. Use the real ingress interface. Policy ID 0 means the implicit deny.

List IPsec tunnels with peer address, selectors up and rx/tx packet and error counts.

selectors(total,up) 1/1 with rising rx and tx counters means phase 2 is up and passing traffic.

Show phase 1 status for each gateway: IKE version, peer, IKE and IPsec SA counts and lifetimes.

Add name <phase1-name> to show one gateway.

Show phase 2 tunnels with selectors, SPIs and traffic counters.

Add name <phase1-name> to show one tunnel.

Show a summary of the IKE daemon and its SA counts.

Clear the IKE SAs for one gateway so the tunnel renegotiates.

Warning: Traffic over that tunnel stops until it renegotiates. Without name <phase1-name> it clears every IKE gateway, dropping all IPsec tunnels.

Turn on full IKE negotiation debugging.

Follow with diagnose debug enable. Stop with diagnose debug disable and diagnose debug reset.

Ping an IP address or hostname from the FortiGate.

Set the source address used by later execute ping commands.

execute ping-options view-settings shows the current options; execute ping-options reset restores defaults.

Set how many pings execute ping sends.

Trace the path from the FortiGate to an IP address or hostname.

Capture packets on an interface (or any) with a tcpdump-style filter.

Use none for no filter. Verbose 4 adds interface names; 6 adds the full Ethernet payload. Leave out the count to run until Ctrl+C. Timestamp l is local time, a is UTC. Hardware-offloaded traffic may not show.

Remove any existing debug flow filter.

Trace only packets to or from an address.

Other filters: saddr, daddr, port, sport, dport, proto and negate. Use filter6 for IPv6.

Include kernel function names in the trace output.

Add timestamps to debug output on the console.

Start printing debug output to the console.

Trace the next packets that match the filter, showing route lookup, policy match and NAT.

Traffic offloaded to NP6 or NP7 processors is not traced; test with ICMP or disable offload. Keep traces short: output is also logged to FortiAnalyzer or FortiCloud if connected.

Stop the flow trace.

Stop printing debug output.

Reset all debug levels to their defaults.

Run it after every debug session so no debug keeps running in the background.

Clear the session filter before setting a new one.

Limit session list and session clear to matching sessions.

Keys include src, dst, sport, dport, proto, policy, sintf, dintf and vd. Run several filter lines to combine them. Filters apply only to your current CLI session.

List sessions that match the filter, or every session if no filter is set.

Show session table statistics.

Clear the sessions that match the current filter.

Warning: With no filter set it clears every session on the FortiGate and drops all connections, including yours. Check the filter with diagnose sys session list first.

Show HA mode, cluster members, which unit is primary and why, and sync status.

If every member reports itself as primary, the cluster is split (heartbeat lost).

Show configuration checksums for every cluster member; matching values mean the configs are in sync.

Run it from the global scope on a FortiGate with VDOMs.

Show detailed checksums on the unit you are logged in to, to find which part is out of sync.

Back up the configuration to a TFTP server.

Other targets: ftp, sftp, usb and management-station. A password encrypts the backup file.

Load a configuration file from a TFTP server.

Warning: Replaces the running configuration and restarts the FortiGate, so traffic stops during the reboot.

Run a large set of diagnostic commands and print the output for a support case or a baseline.

Log the session in your SSH client; the output is long.

Restart the FortiGate.

Warning: All traffic and VPNs stop until the unit is back up. Asks for confirmation.

Shut down the FortiGate.

Warning: The unit stays off until someone powers it on locally. Asks for confirmation.

Reset the FortiGate to its factory default configuration.

Warning: Erases the whole configuration, including interfaces, policies, VPNs and admin accounts. Back up first. Asks for confirmation.

Reset to factory defaults but keep interface, VDOM and static route settings.

Warning: Erases policies, objects, VPNs and other settings. Back up first.