Working on Fortigate CLI instead of GUI has lots of advantages, some of them are:

And now, when you are sold on benefits of using CLI in Fortigate, let me share useful tips on working with CLI I learned over the years.

Once you enter any configuration subtree by using config command, you can issue get to see settings for this subtree. For example, going to config sys interface, then edit port1 to enter port1 interface subtree, you can run get and see ALL the settings for this port. It will be at least 3 times more than is shown in GUI.

Fortigate configuration is huge, thousands of lines, no one can remember where every setting is located, nor should. You can search all the configuration with the grep command. For example, say we need to know what HTTPS port was configured for admin access, but we don’t know where it is placed neither how exactly it is named. No problem, just search for admin, like this:

But that is not the whole power of grep - now we want to see the exact configuration location to go and change it. You can use -f for that to show the context of the search term. To continue the example above, let’s find the subtree for the HTTPS GUI admin port:

Now, we can change this GUI management port easily on CLI.

Even more to that, the command show displays only non-default settings, that is, the settings we changed. But grep knows to search even configs not visible neither in GUI, nor in CLI! Just use # show full | grep <config we want to see>.

And of course, you can use grep with ANY output producing command, like diagnose and get, not only show.

grep search is case sensitive by default, but we can add -i option to makeit case insensitive.

Another useful option is -n which will show line numbers of each foundconfiguration line.

We have some basic Linux movements available, which makes editing long commands much faster.

Using set inside any config subtree replaces any existing values there, which may be not what you meant. Fortigate have other options for us.

To APPEND to the exiting values, leaving them intact, use append instead of set. Let’s see an example. Say we have a firewall address group containing 5 addresses, like this:

And we want to add another member TEST7 to this list. If we use set member TEST7 this will put TEST7 as the member but will also remove the other members. To actually add to the list, we use append:

After which, the address group will look:

Next is unselect keyword - it deletes from the list members you give it.For example above, let’s delete just members TEST2 and TEST5:

This will have the effect:

Next in line is unset - when you want to keep the containing object (say address group), but clear it from all of its members. Example is due, let’s remove all members from the address group (this will NOT delete those objects from Fortigate, just from the address group):

The address group will now look like:

Output paging is on by default, but if you want to see the full command output, for example when saving console output to a log file, this gets in the way as it peppers each output window with --More--. We can disable this paging:

To bring paging back:

Fortigate commands can be and many times are lengthy, how about showing routing table - get router info routing all? Typing such commands over and over again wastes time. The command alias will help us here. Unlike in Cisco world, unfortunately, there are some limitations:

To configure alias we use config system alias command. Let’s create an alias for displaying routing table.

Now, to use the alias:

Every user-defined setting you enter has some limitation, be it on its numerical value range, or string/name length. It disappoints to carefully type a long and descriptive name for a new address or url filter just to get it discarded with the error "The string is too long".

To see limitations of all the settings in the current config subtree, just run tree inside the config mode:

CLI browser applet in the Fortigate has option to save the output (after it was dsiplayed) to a file. Find this in the upper right corner of the GUI. For those cases when you don’t have luxury of fully fledged SSH client.

On any standalone SSH client though, there is always an option to enable logging of the session output to a text file, so use it accordingly, probably disabling the paging as per above.

When you need to run a command (or series of commands) and be off, you can save time by running Fortigate CLI command(s) via ssh tunnel without interactively logging in to the firewall. This is a feature of SSH protocol, not specific to Fortigate. Additionally, by piping the output of CLI command to the local shell we can do powerful post-processing which is not possible on the Fortigate CLI.

When creating a new entry in config submode, many times you have to specify this entry running number. If you give the existing entry number, you will not add, but edit this existing entry. You have to provide unused entry number to create a new entry. These running numbers are for Fortigate reference only, they do not signify order of the entries. So not to come up with big unused number, use edit 0 and this will create a new entry with the next available running number.

Using move from to destination allows us to rearrange entries inside the relevant config submode. We have to use entry’s running numbers for source and destination. Let’s say we want to move security policy rule 22 higher than rule number 13:

With delete entry-number command in config submode we can delete the given entry.

This command deletes the WHOLE table you are currently in. Most configurationsettings in Fortigate are collected in tables. E.g. all security rules arecontained in the firewall policy table. In rare cases when you need to deleteall the entries in such tables, the command purge does just that.

Let’s delete, for example, all security rules of the firewall:

The result is empty rulebase:

To rename a named object, enter the appropriate config submode and run rename current-name to new-name. E.g.:

This feature (Workspace Mode) was introduced in FortiOS 6.2 and makes possibleto combine multiple CLI commands into a batch, which is later committed in onego as a single action. This (finally) allows us to, for example, change WANfacing IP address of the interface and its default gateway without losing accessto the Fortigate. But this feature deserves more than a short-tip treatment andso I wrote a post about it -Fortigate new Workspace Mode to commit changes in a batch - with an example of changing default gateway

Follow me on https://www.linkedin.com/in/yurislobodyanyuk/ not to miss what I publish on Linkedin, Github, blog, and more.