FortiGate CLI Cheat Sheet
Operational and troubleshooting commands organized from the supplied FortiGate FGT CLI Cheat Sheet v2.0.
FortiGate FGT CLI Cheat Sheet v2.0
IPSEC
get vpn ipsec tunnel summary	
diagnose vpn ike gateway list name <name>
The important field from this particular command is status. The status field has a discrete output that can be either connected or established.
- Established means Phase 1 is up and running.
- Connecting means Phase 1 is down.
diagnose sniffer packet any 'host 10.189.0.182 and port 500' 4 0 l
IPSEC Troubleshooting
IKE/IPSec show commands:
diagnose vpn tunnel list
diagnose vpn ike gateway list
get vpn ipsec tunnel summary
get vpn ipsec tunnel details
get vpn ipsec tunnel summary
get vpn ipsec tunnel name <name>
IPSec debugs:
diagnose debug reset
diagnose vpn ike log-filter clear
diagnose vpn ike log-filter dst-addr4 x.x.x.x ------------where x.x.x.x is the remote gatewayIP
diagnose debug app ike -1
diagnose debug enable
Disable the debugs once done:
diag debug disable
diag debug rest
More… (ADVPN)
diag debug reset
diag debug application ike -1
diag debug console timestamp enable
diag debug en
More… (ADVPN)
diagnose debug reset
diagnose vpn ike log-filter clear
diagnose vpn ike log-filter mdst-addr4 <hub-ip> <spoke-ip>
diagnose debug application ike -1
diagnose debug console timestamp enable
diagnose debug enable
IPSec and Default routes
DPD
2\. Try enabling DPD, Sometimes, due to routing issues or other network issues, the communication link between a FortiGate unit and a VPN peer or client may go down.
It is possible to configure DPD per phase1-interface as follows (default settings are shown):
#config vpn ipsec phase1-interface
edit <Tunnel Name>
set dpd [disable | on-idle | on-demand]
set dpd-retryinterval 20
set dpd-retrycount 3
next
end
Set dpd options:
Disable: Disable Dead Peer Detection.
On-idle: Trigger Dead Peer Detection when IPsec is idle.
On-demand: Trigger Dead Peer Detection when IPsec traffic is sent but no reply is received from the peer.
Check IPSec Tunnel Uptime (look for “created”)
diagnose vpn ike gateway list
Flush/Tear Down
diag vpn ike gateway flush name <shortcutname>
Interface
SDWAN
diagnose sys sdwan member
diagnose sys sdwan service
diagnose firewall proute list
Troubleshooting SDWAN
#Get the SDWAN Configuration -
show router bgp
show router route-map
show vpn ipsec phase1-interface
show vpn ipsec phase2-interface
show sys sdwan
#Get the SDWAN information -
get router info bgp summary
get router info bgp neighbors <192.168.200.61> advertised-routes
get router info bgp neighbors <192.168.200.125> received-routes
get router info routing-table all
get vpn ipsec tunnel summary
diagnose vpn tunnel list
diagnose vpn ike gateway list name <HUB1-VPN1>
diagnose vpn ike gateway list name <HUB1-VPN2>
diagnose sys sdwan health-check status
diagnose sys sdwan member
diagnose sys sdwan service
#Check health-check
diagnose sys sdwan health-check status
#Check service
diagnose sys sdwan service
#Check SDWAN Member
diagnose sys sdwan member
#Check IP address list
diagnose ip address list
#Check policy route
diagnose firewall proute list
CLI Log Display
execute log filter reset
execute log filter dump <<< shows settings
execute log filter device <<< where to pull the logs from
execute log filter category <ENTER> <<< will display options
execute log display <<< will display logs
Policy Base Routing (proute)
diag firewall proute list
BFD Static Routes
Static Routes
# get router info bfd neighbor
# get router info bfd requests
# diagnose sniffer packet any "port 3784" 4
# diagnose debug app bfdd -1
# diagnose debug enable
BFD BGP
Link Monitor
When a link monitor fails, only the routes that are specified in the link monitor are removed from the routing table, instead of all the routes with the same interface and gateway.
If no routes are specified, then ALL of the routes are removed. Only IPv4 routes are supported.
When the link monitor fails, only the routes to the specified subnet using interface agg1 and gateway 172.16.203.2 are removed.
To configure the link monitor:
config system link-monitor
edit "22"
set srcintf "agg1"
set server "10.1.100.22"
set gateway-ip 172.16.203.2
set route "23.2.2.2/32" "172.16.202.0/24"
next
end
License Force
execute update-now
Troubleshoot Update:
diagnose debug application update -1
diagnose debug enable
diagnose autoupdate version
execute update-now
Rolling Back FGT FortiOS
Rolling back the device is simply booting to the previous partition, which has the old firmware and config file. You may boot to the new firmware again if you choose.
The commands to do so are as follows
diag sys flash list <----------------------------------list partitions and see if they are active.
exec set-next-reboot <primary|secondary> <-----------indicate what partition to boot from (1= primary, 2 = secondary)
exec reboot
If this doesn't help then you can boot up from other partition as well
Troubleshooting Cheatsheet
get sys performance status
get system ha status
CLI Sniffer
Good examples of sniffer and diag debug flow
diag sniffer packet wan1 'src host 10.109.16.137 and dst host 172.26.48.21' 1 3
Note
When 'src' and 'dst' are used, the 'host' word is optional as it is applied by default.
It is also possible to use 'net' as keyword for a broader result
diag sniffer packet wan1 'src 10.109.16.137 and net 172.26.48.0/20' 1 3
However, when filtering for bidirectional traffic, either use 'host' or CIDR notated 'host' arguments:
diag sniffer packet wan1 'host 10.109.16.137 and host 172.26.48.0/20' 1 3
RH
dia sniffer packet HUB1-VPN1 "host 192.168.3.3" 4 0 a
dia sniffer packet HUB1-VPN1-2 "host 192.168.3.3" 4 0 a
dia sniffer packet VPN1 "host 192.168.3.3" 4 0 a
dia sniffer packet VPN1-2 "host 192.168.3.3" 4 0 a
RH
diag sniffer packet port2 "host 192.168.1.1 and icmp" 1 0 a
diag sniffer packet port3 "host 8.8.8.8 and icmp" 6 0 a
diagnose sniffer packet internal2 "dst host 10.20.20.1 and udp port 514" 6 30
dia sniffer packet any udp 4 0 1
interfaces=[port3] filters=[ host 10.78.100.4 and icmp ] [FPC03] 2019-01-08 20:24:18.275389 port3 -- 172.23.2.80 -> 10.78.100.4: icmp: echo request 0x0000 0000 0c07 ac00 704c a500 0002 0800 4500 ......pL......E. 0x0010 003c 54bb 0000 7e01 cb4c ac17 0250 0a4e .<T...\~..L...P.N 0x0020 6404 0800 d4ed 0001 786d 6162 6364 6566 d.......xmabcdef 0x0030 6768 696a 6b6c 6d6e 6f70 7172 7374 7576 ghijklmnopqrstuv 0x0040 7761 6263 6465 6667 6869 wabcdefghi [FPC03] 2019-01-08 20:24:22.814071 port3 -- 172.23.2.80 -> 10.78.100.4: icmp: echo request 0x0000 0000 0c07 ac00 704c a500 0002 0800 4500 ......pL......E. 0x0010 003c 54bd 0000 7e01 cb4a ac17 0250 0a4e .<T...\~..J...P.N 0x0020 6404 0800 d4ea 0001 7870 6162 6364 6566 d.......xpabcdef 0x0030 6768 696a 6b6c 6d6e 6f70 7172 7374 7576 ghijklmnopqrf
Verbose levels in detail
1: print header of packets.
2: print header and data from IP of packets.
3: print header and data from Ethernet of packets.
4: print header of packets with interface name.
5: print header and data from IP of packets with interface name.
6: print header and data from Ethernet of packets with interface name.
Basic sniffing command:
All packet sniffing (packet capture) commands start like this
diag sniffer packet <interface> <'filter'> <verbose> <count> a
<interface> can be an interface name or 'any' for all interfaces.
<'filter'> is a very powerful filter functionality which will be described in more detail.
<verbose> means the level of verbosity as described already.
<count> the number of packets the sniffer reads before stopping.
a – timestamps the packets with the absolute UTC time.
l - (small letter L) timestamps the packets with LOCAL time on the unit.
(blank/no letter) – relative to the beginning of the capture.
Verbose levels in detail
1: print header of packets.
2: print header and data from IP of packets.
3: print header and data from Ethernet of packets.
4: print header of packets with interface name.
5: print header and data from IP of packets with interface name.
6: print header and data from Ethernet of packets with interface name.
HA (High Availability)
FGCP
Synchronizing the configuration
FGCP uses a combination of incremental and periodic synchronization to make sure that the configuration of all cluster units is synchronized to that of the primary unit.
The following settings are not synchronized between cluster units
- The FortiGate host name
- GUI Dashboard widgets
- HA override
- HA device priority
- The virtual cluster priority
- The HA priority setting for a ping server (or dead gateway detection) configuration
- The system interface settings of the HA reserved management interface
- The HA default route for the reserved management interface, set using the ha-mgmt-interface-gateway option of the config system ha command
Most subscriptions and licenses are not synchronized, as each FortiGate must be licensed individually. FortiToken Mobile is an exception; they are registered to the primary unit and synchronized to the secondary units.
The primary unit synchronizes all other configuration settings, including the other HA configuration settings.
All synchronization activity takes place over the HA heartbeat link using TCP/703 and UDP/703 packets.
Master:
config system ha
set mode a-p
set group-name "ExampleCluster"
set password <yourpassword>
set hbdev "port1" 50 "port2" 50
set priority 200
set override enable
end
Slave:
config system ha
set mode a-p
set group-name "ExampleCluster"
set password <yourpassword>
set hbdev "port1" 50 "port2" 50
set priority 100
set override enable
end
Explanation of Commands:
- set mode a-p: Sets the HA mode to active-passive.
- set group-name "ExampleCluster": Names the HA cluster.
- set password <yourpassword>: Sets the password for HA communication.
- set hbdev "port1" 50 "port2" 50: Configures the heartbeat interfaces and their priorities.
- set priority 200 (for master) and set priority 100 (for slave): Sets the priority for master and slave units.
- set override enable: Ensures the unit with the highest priority becomes the master.
HA (High Availability) Trouble shooting
Collect the following outputs from the primary Fortigate
get system ha status
diag sys ha checksum cluster
# After the above two commands, please run the following command to trigger a checksum recalculate
diagnose sys ha checksum recalculate
# And about 2 minutes after the above command take the following commands again:
get system ha status
diag sys ha checksum cluster
#Recalculate Checksum
diagnose sys ha checksum recalculate
#Manually Sync Configs
execute ha synchronize config
#To Switch to the backup HA unit
exec ha manage 0 admin
#Checking routing vs kernel routing
Get router info routing-table all
Get router info kernel
How to show GUI CLI Syntax
diag debug cli 7
diag debug enable
diag debug disable
FOS Troubleshooting Class
https://fortinet.egnyte.com/fl/mEH44FrnmF
Fortinet SD-WANtroubleshooting.pptx
Switch Controller Topology View
execute switch-controller get-physical-conn standard
execute switch-controller get-conn-status
execute switch-controller get-sync-status all
Crash Logs
diagnose debug crashlog read
TAC Report
execute tac report
Display output
Config system console
set output more >>>> display one page at a time
set output standard >>>> display will keep scrolling
Sessions
List all sessions
diag system session list
Filter on a session
diagnose sys session filter src 10.10.30.37
Show filter settings:
diagnose sys session filter
Auto Backup / Revisions / Save
config system global
set revision-backup-on-logout enable
BGP
Routing Tables
get router info routing-table all
get router info routing-table database
get router into bgp network x.x.x.x
get router info routing-table database vrf 0
get router info routing-table details x.x.x.x
get router info bgp neighbors
get router info bgp summary
Route-Maps
BGP Graceful Restart
BGP Troubleshooting
Debug all BGP messages
diagnose debug console timestamp enable
diagnose ip router bgp all enable
diagnose ip router bgp level info
diagnose debug enable
FortiGate Routing Protocol Numbers
In the context of FortiGate's routing table, the protocol numbers are different from the IP protocol numbers. Here are the protocol numbers used by FortiGate for various routing protocols:
BGP (Border Gateway Protocol)\\: \proto=11\
OSPF (Open Shortest Path First)\\: \proto=10\
RIP (Routing Information Protocol)\\: \proto=8\
Static Routes\\: \proto=1\
Connected Routes\\: \proto=0\
IS-IS (Intermediate System to Intermediate System)\\: \proto=12\
EIGRP (Enhanced Interior Gateway Routing Protocol)\\: \proto=13\
IGRP (Interior Gateway Routing Protocol)\\: \proto=14\
These protocol numbers are used internally by FortiGate to identify the source of the routes in the routing table.
Debug flow/traffic
Also for debuging particular traffic, you can use below debug flow.
Run below commands before initiating ping -
diag debug disable
diag debug reset
diag debug flow show function-name enable
diagnose debug flow filter addr 192.168.1.3
#diagnose debug flow filter proto 1
diag debug flow trace start 100
diag debug enable
Also try
diag debug flow filter
daddr 192.168.200.10
diag debug flow trace start 100
diag debug en
After this you can do a traceroute/ping to specified destination "172.17.43.91";
To stop debug use below commands
diag deb dis
diag deb reset.
ARP Table
Get system arp
LDAP
Summary of commands…
diagnose debug enable
diagnose debug application fnbamd 255
diagnose test authserver ldap Vlad-AD-object administrator 12345678
More details…
The correct User DN would looks like
cn=administrator,cn=users,dc=vlad-ad,dc=local
To test your LDAP object and see if it's working properly , the following CLI command can be used :
FGT# diagnose test authserver ldap <LDAP servername> <username> <password>
Where <LDAP servername> = name of LDAP object on Fortigate (not actual LDAP server name!)
For username/password you may use any from the AD, but it is recommended (at least at the first stage) to test credentials you have used in the LDAP object itself. If this credentials will fail then any other will fail as well as the FortiGate will not be able to bind to the LDAP server
CLI Example
FGT# diagnose test authserver ldap Vlad-AD administrator 12345678
Advanced troubleshooting
FGT# diagnose debug enable
FGT# diagnose debug application fnbamd 255
....to stop this debug type
FGT# diagnose debug application fnbamd 0
...and then run an LDAP authentication test
FGT# diagnose test authserver ldap Vlad-AD administrator 12345678
Reboot
Execute reboot
Interface Stats
get hardware nic wan1
Software Switch
config system switch-interface
edit <name>
Set vdom root
set member <port1> <port2>
end
Hardware Switch
config system virtual-switch
edit "lan"
set physical-switch "sw0"
config port
edit "port1"
FG - Grep / find
FG-VM # show | grep -f <key-word>
Usage: grep [-invfcABC] PATTERN
Options
-i Ignore case distinctions
-n Print line number with output lines
-v Select non-matching lines
-f Print fortinet config context
-c Only print count of matching lines
-A Print NUM lines of trailing context
-B Print NUM lines of leading context
-C Print NUM lines of output context
FG-VM #
FG - Memory
dia hardware sysinfo conserve
dia hardware sysinfo memory
Endpoint
dia endpoint registration list
dia use device list
SSL Cert
exec vpn certificate local generate default-ssl-ca
WiFi
SterlingFW1 $ config wireless-controller vap
SterlingFW1 (vap) $ edit "Guest"
SterlingFW1 (Guest) $ set passphrase \\\\\\\\\\
SterlingFW1 (Guest) $ next
SterlingFW1 (vap) $ end
Restore factory defaults
There may be a need to reset the FortiGate to its original defaults; for example, to begin with a fresh configuration. There are two options when restoring factory defaults.
The first resets the entire device to the original out-of-the-box configuration
You can reset using the CLI by entering the command
execute factoryreset
When prompted, type y to confirm the reset.
Alternatively, in the CLI you can reset the factory defaults but retain the interface and VDOM configuration.
Use the command
execute factoryreset2
FAZ/FG - Troubleshooting
FG - VM CLI
config system interface
edit port1
set ip 10.10.20.3 255.255.255.0
set allowaccess ping https ssh fgfm
end
config router static
edit 1
set gateway 10.10.20.1
set device "port1"
next
end
config system dns
set primary 208.91.112.53
set secondary 208.91.112.52
Connect to FortiManager
config system central-management
set type fortimanager
set fmg 192.168.0.1
end
SNMP
Putty1
diagnose debug application snmpd -1
diagnose debug console timestamp enable
Putty2
diagnose sniffer packet any "port 161 or port 162" 6 0 a
FortiAP - To enable CLI access from the FG GUI to the AP
config wireless-controller wtp-profile
edit FAP221C-default
set allowaccess telnet
end
6k FPC Sync
diagnose sys confsync showchsum | grep all
diagnose sys confsync status | grep insync
In this command output insync=1 means the FPC is synchronized with the management board and insync=0 means the FPC is not synchronized.
Slot reboot
Exec load-balance slot reboot <>
Switch to a slot
Exec load-balance slot manage <>
Check VDOM index
diagnose sys vd list | grep <>
Set to only get MB index (must be on MB)
diag load-balance set slot current
diagnose sys vd list | grep <>
Set to get all indexes (Must be on MB)
diag load-balance set slot default
diagnose sys vd list | grep <>
Find Master FPC
get sys status
Sniffer Mode Configs
config firewall sniffer
edit 1
set status enable
set logtraffic all
set interface "port12"
set application-list-status enable
set application-list "sniffer-profile"
set ips-sensor-status enable
set ips-sensor "sniffer-profile"
set dsri disable
set av-profile-status enable
set av-profile "sniffer-profile"
set webfilter-profile-status enable
set webfilter-profile "sniffer-profile"
set spamfilter-profile-status disable
set dlp-sensor-status disable
set ips-dos-status enable
config anomaly
edit "tcpsynflood"
set status enable
set log enable
set action pass
next
edit "tcpportscan"
set status enable
set log enable
set action pass
next
edit "tcpsrcsession"
set status enable
set log enable
set action pass
next
edit "tcpdstsession"
set status enable
set log enable
set action pass
next
edit "udpflood"
set status enable
set log enable
set action pass
next
edit "udpscan"
set status enable
set log enable
set action pass
next
edit "udpsrcsession"
set status enable
set log enable
set action pass
next
edit "udpdstsession"
set status enable
set log enable
set action pass
next
edit "icmpflood"
set status enable
set log enable
set action pass
next
edit "icmpsweep"
set status enable
set log enable
set action pass
next
edit "icmpsrcsession"
set status enable
set log enable
set action pass
next
edit "icmpdstsession"
set status enable
set log enable
set action pass
next
edit "ipsrcsession"
set status enable
set log enable
set action pass
next
edit "ipdstsession"
set status enable
set log enable
set action pass
next
edit "sctpflood"
set status enable
set log enable
set action pass
next
edit "sctpscan"
set status enable
set log enable
set action pass
next
edit "sctpsrcsession"
set status enable
set log enable
set action pass
next
edit "sctpdstsession"
set status enable
set log enable
set action pass
next
##########################################
Wireless Mesh (WiFi)
MAC IP address: 192.168.1.1/24
FAP IP: ssh admin\@192.168.1.2
Configs on the leaf AP
cfg -a MESHAPTYPE=1
cfg -a MESHAPSSID=fortinet-mesh
cfg -a MESHAPPASSWD=20Fortinet20!
cfg -c
Addition information
If FortiGate is not on the same network as the FortiAP
1\. Log in to the FortiAP directly (IP address: 192.168.1.2) with username admin and
no password, and specify the IP address of the controlling FortiGate
2\. Specify the IP address of the controlling FortiGate
cfg -a ACIPADDR1=0.0.0.0
cfg -c
#where 0.0.0.0 is the address of the FortiGate
##########################################
Reboot All managed FortiSwitches
execute switch-controller switch-action restart swtp all
##########################################
Show MAC address on a FortiSwitch
diagnose switch mac list | grep e4\:f0:42:53:02