FortiGate

Cheat Sheet - General for FortiOS 7.2

Network
Interface Information
diag ip address list List of IPs on FGT interfaces
diag firewall iplist list List of IPs on VIP
diag firewall ippool list List of IP on pools
diag netlink interface list List IF with MTU & device id

Network Troubleshooting

System get hardware nic [port] Interface Information

diag ip arp list / get system arp ARP table
General System Commands
exec clear system arp table Clears ARP table
get system status General system information
exec ping x.x.x.x
exec tac report Generates report for support Ping utility
exec ping-options [option]
tree Lists all commands
exec traceroute x.x.x.x
<command> ? / tab Use ? or tab in CLI for help Traceroute utility
exec traceroute-options [option]
<command> | grep [filter] Grep command to filter outputs
exec telnet x.x.x.x [port] Telnet utility
diag debug cli 8 Shows webGUI changes in CLI
Integrated Iperf Utility
Process Information diag traffictest server-intf
get system performance status General performance infos diag traffictest client-intf
Iperf test directly run from
Process list diag traffictest port [port] FortiGate
diag sys top [sec] [number] diag traffictest run -c
Sort with P (CPU) / M (Memory)
[public_iperf_server_ip]
diag debug crashlog history Crash statistics
diag debug crashlog read Crash log General Routing Troubleshooting
get router info routing-table all Routing table

Traffic Processing get router info routing-table Shows Routing decision for
details x.x.x.x specified Destination-IP
General Debugging
get router info routing-table Routing table with inactive
Realtime debugger for different database routes
diag debug appl [appl] [level]
applications
get router info kernel Forwarding information base
diag test appl [appl] [test_level] Monitor proxy operations
diag firewall proute list List of policy-based routes
diag debug console timestamp
Enables timestamp in console diag ip rtcache list List of route cache
enable
Overview of dynamic routing
Enable/disable output for “diag get router info protocols
diag debug [enable/disable] protocol configuration
debug” or “diag ip” commands
exec router restart Restart of routing process
diag debug reset Reset debug levels
diag sys link-monitor Shows link monitor status / per
Firewall Session Troubleshooting status/interface/launch interface / for WAN LLB

diag sys session filter Filter for session list

diag sys session list (expect) Lists all (or expected) sessions High Availability
diag sys session clear Clear all / filtered sessions HA General

Session and memory statistics, exec ha manage [index] [admin] Jump to cluster member
diag sys session stat
drops, clashes get sys ha status Information about HA status
diag firewall iprope clear 100004 Resets counter for all or specific diag sys ha history read Details about past HA events
[<id>] firewall policy id
diag sys ha dump-by vcluster Show cluster member uptime
Packet Sniffer diag sys ha reset-uptime Reset cluster member uptime
diag sniffer packet [any/<if>] Packet sniffer. Use filters! diag debug appl hatalk -1 Debugging of HA-Talk/-Sync
‘[filter]’ [verbose] [count] Verbose levels 1-6 for different diag debug appl hasync -1 protocol
[timestamp] output
exec ha ignore-hardware-revision Set ignore status for different
GUI: Network > Diagnostics > Packet Capture is newly status / enable / disable HW revisions
Packet Capture available in webUI. exec ha failover status View failover status
Device stays in failover state
Flow Trace exec ha failover set <cluster_id> regardless of condition. Triggers
Use filters to narrow down trace a HA failover on master device.
diag debug flow filter [filter]
results
diag debug flow show iprop en Cluster Synchronisation
diag debug flow show fun en Show config checksums of all
Debug command for traffic flow diag sys ha checksum cluster
diag debug flow trace start cluster member
[count]
diag sys ha checksum Detailed config checksum for a
GUI: Network > Diangostics > Flow trace is newly available in show [vdom] VDOM
Debug Flow webUI.
diag sys ha checksum Recalculation of config
recalculate checksums

Version 1.0 Page 1

 FortiGate
Cheat Sheet - Firewalling for FortiOS 7.2

UTM Services
FortiGuard Distibution Network (FDN) Logging
update.fortiguard.net Generates dummy log
URLs to access the FortiGuard diag log test
service.fortiguard.net messages
Distribution Network (FDN)
securewf.fortiguard.net exec log list List log file information
diag fdsm image-list / image- Download firmware image list diag test app miglogd 6 Show log queue and fails
update-matrix and update-matrix
Traffic Shaper
Signature Update
diag firewall shaper traffic-shaper
Traffic shaper list / statistics
diag autoupdate status Summary of Fortiguard settings list / stats
diag autoupdate versions Detailed versions of packages diag firewall shaper per-ip-shaper Per IP traffic shaper list /
list / stats statistics
diag test update info Update & license information

diag debug appl update -1 Realtime debugging for

SIP
updating process with manual
exec update-now update diag sys sip status SIP session helper status
diag sys sip-proxy stats list SIP ALG session status
Antivirus
diag sys sip-proxy calls list/clear List/Clear active SIP calls
diag antivirus database-info Antivirus database information
diag debug appl sip -1 Realtime Debugger for SIP
diagnose antivirus test … Different tests for AV engine

IPS
Authentication
diag ips anomaly list Lists statistics of DoS-Policies
Authentication
diag ips packet status IPS packet statistics
diag firewall auth filter … Filter for authentication list
diag test appl ipsmonitor 2 Enable / disable IPS engine
diag firewall auth list List of authenticated user
diag test appl ipsmonitor 5 Toggle bypass status
diag test authserver
diag test appl ipsmonitor 99 Restart all IPS processes [auth-protocol] [server] [user] Authentication test
[password]
Web- & Email-Filter
Debugging of local
diag debug appl authd -1
diag debug rating Webfilter/AS Server information authentication protocol
diag webfilter fortiguard Debugging of remote
Statistics of FortiGuard requests diag debug appl fnbamd -1
statistics list authentication protocol

diag webfilter fortiguard cache

List content of webfilter cache FortiToken
dump
diag test appl urlfilter 1 Lists webfilter test commands diag fortitoken info Current FortiToken status

diag debug urlfilter src-addr exec fortitoken activate [Forti-

Manual FortiToken activation
x.x.x.x Filter and Realtime Debugging TokenSN]
for Webfiltering
diag debug appl urlfiter -1 diag deb appl forticldd 255 FortiToken activation debugging
diag emailfilter fortishield servers Displays FortiShield server list diag fortitoken debug enable FortiToken debugging
diag emailfilter fortishield stat list Statistics of FortiShield requests exec fortitoken-mobile import Recover Trial FortiToken (delete
0000-0000-0000-0000-0000 existing Trial Token before)
DNS-Filter
FSSO
Shows server used for DNS-
diag test appl dnsproxy 3 diag debug authd fsso filter Filter for FSSO user list
Filtering
diag debug authd fsso list List of FSSO authenticated user
diag debug authd fsso
List of FSSO collector agents
Firewall Policy server-status

Device Detection diag debug fsso-polling … Info for clientless polling FSSO

exec update-src-vis Update device detection DB Debugging of clientless polling

diag debug appl fssod -1
FSSO
diag user device list / clear Show / clear detected devices
Explicit Proxy
Internet Service Database (ISDB)
diag wad user list/clear List / clear of explicit proxy user
diag internet-service-name list Lists summary/details for
<internet-service-id> specific Internet Service diag wad filter … Filtering / listing of web proxy
diag wad session list sessions
diag internet-service info Reverse ISDB lookup for
<vdom><proto><port><ip><prio> specific IP, protocol or port diag test appl wad 104 DNS statistics for explicit proxy
diag internet-service match Reverse ISDB lookup for diag test appl wad 110 Current proxy user
<vdom> <ip> <netmask> specific IP
Enables output of subsequent
diag test appl wad 112
commands
FQDN
diag test appl wad 2200 Maximum number of users
diag test application dnsproxy 6 Dump FQDN cache
diagnose firewall fqdn list-all List all FQDN

Version 1.0 Page 2

 FortiGate
Cheat Sheet - Networking for FortiOS 7.2

VPN
IPsec VPN Security Rating
diag debug appl ike 63 Debugging of IKE negotiation Manually run security rating
diag report-runner trigger
report
diag vpn ike log filter Filter for IKE negotiation output
diag vpn ike gateway list Phase 1 state
diag vpn ike gateway flush Delete Phase 1 Wireless, Switch, FortiExtender
diag vpn tunnel list Phase 2 state Access Point (CLI commands on Access Point)
diag vpn tunnel flush Delete Phase 2 cfg –a Change IP from DHCP to static
get vpn ike gateway Detailed gateway information ADDR_MODE=DHCP|STATIC on FortiAP

get vpn ipsec tunnel details Detailed tunnel information cfg –a

Set static IP on FortiAP
AP_IPADDR=”xxx.xxx.xxx.xx”
get vpn ipsec stats tunnel Detailed tunnel statistics
cfg –a AP_NET-
Set subnet mask on FortiAP
diag vpn ipsec status Shows IPSEC crypto status MASK=”255.255.255.0”
cfg –a IPGW=”yyy.yyy.yyy.yyy” Set gateway on FortiAP
cfg –a Specify IP of Wireless Controller
BGP, OSPF AC_IPADDR_1=”zzz.zzz.zzz.zzz” on FortiAP
BGP cfg –s / -c List / Save config on FortiAP
get router info bgp summary BGP summary of BGP status cfg -x Reset to factory default
get router info bgp neighbors Information on BGP neighbors
Wireless Controller
diag ip router bgp all enable Real-time debugging for BGP
diag ip router bgp level info protocol exec wireless-controller restart- Restart wireless controller
acd daemon
exec router clear bgp all Restart of BGP session
exec wireless-controller reset-wtp Restart FortiAPs
OSPF diag wireless-controller
List rogue APs
wlac -c ap-rogue
get router info ospf status OSPF status
exec wireless-controller spectral-
get router info ospf interface Information on OSPF interfaces
scan <wtp-id> <radio-id > <on |
Start or stop spectrum analysis
get router info ospf neighbor Information on OSPF neighbors off> <duration> <channel>
<report-interval>
get router info ospf database Summary / Details of all LSDB
brief / router lsa entries diag wireless-controller wlac -c rf-
sa <wtp-id> <radio-id>
get router info ospf database self- Information on LSAs originating <channel> Show spectrum analysis results
originate from FortiGate get wireless-controller spectral-
diag ip router ospf all enable Real-time debugging of OSPF info <wtp-id> <radio-id>
diag ip router ospf level info protocol
exec router clear ospf process Restart of OSPF session Switch Controller
diag switch-controller switch-info Managed FortiSwitch MAC
mac-table address list
SD-WAN & Security Fabric diag switch-controller switch-info Managed FortiSwitch port
port-stats statistics
SD-WAN
diag switch-controller switch-info
diag sys sdwan member Provide Interface details Trunk information
trunk
diag sys sdwan health-check diag switch-controller switch-info Dumps MCLAG related
State of SLAs
status | filter <name/member> mclag information from FortiSwitch
diag sys sdwan service <rule-id> SD-WAN-Rule-State exec switch-controller get-conn- Get FortiSwitch connection
diag sys sdwan intf-sla-log <intf- status status
Link Traffic History
name> exec switch-controller diagnose- Get FortiSwitch connection
diag sys sdwan sla-log <sla> connection diagnostics
SLA-Log on specific interface
<link_id>
FortiExtender
diag test appl lnkmtd 0/1/2 Statistics of link-monitor
get extender sys-info [FXT SN] Check the FortiExtender status
Real-time debugger of link-
diag debug appl link-mon -1
monitor get extender modem-status [FXT Get the detailed modem status
SN] of the FortiExtender
Security Fabric FortiExtender debugging, collect
diag debug appl extenderd -1
diag sys csf upstream / information for about 5 minutes
List of up/downstream devices
downstream exec extender reset-fortiextender Restart managed FortiExtender
MAC/IP list of connected FGT exec extender restart-
diag sys csf neighbor list Restart AC daemon
devices fortiextender-daemon
diag test appl csfd 1 Display security fabric statistics
Modem
diag debug appl csfd -1 Real-time debugger
diag sys modem detect Detect attached modem
diag automation test
Test stitches in the CLI
<stitch_name> Debugger for modem
diag debug appl modemd 3
commands
Endpoint
diag endpoint record list Endpoint records on FortiGate

Version 1.0 Page 3

Cheat Sheet – Other FortiGate
for FortiOS 7.2

System
Default Device Information Hardware Acceleration
admin / no password Default login config firewall policy Disable session offloading per
set auto-asic-offload disable firewall policy
Default IP on port1, internal or
192.168.1.99 config vpn ipsec phase-1-int Disable VPN offloading per
management port
set npu-offload disable Phase 1
9600/8-N-1
Default serial console settings
hardware flow control disabled
HQIP Hardware Check
Factory Reset
Download Hardware Quick
exec factoryreset Reset whole configuration
https://support.fortinet.com → Inspection Package (HQIP)
exec factoryreset-shutdown Reset config and shutdown Download → HQIP Images to scan hardware for
possible faults
Reset with retaining admin,
exec factoryreset2
interfaces and static routing
exec factoryreset keepvmlicense Reset whole config but license
General Information
Firmware Update Fortinet Links
Show config errors after Documentation, Cookbooks,
diag debug config-error-log read docs.fortinet.com
firmware upgrades Release Notes
community.fortinet.com Knowledge Base, User Forum
VDOMs
www.fortiguard.com FortiGuard Website
sudo global/ vdom-name Sudo-command to access
support.fortinet.com Support Site (Login required)
diag / exec / show / get global / VDOM settings directly
Fortinet Developer Network
fndn.fortinet.net
(Login required)
Transparent Mode
blog.boll.ch Boll Blog
diag netlink brctl name host Bridge MAC table

Workspace Mode FortiGate most used ports

exec config-transaction Start/abort/commit of TCP/443, TCP & UDP/53 TCP &
start/abort/commit Workspace Mode FortiGuard Queries
UDP/8888
diag sys config-transaction status State of Workspace Mode TCP/389, UDP/389 LDAP, PKI Authentication
(enabled/disabled) TCP/636, UDP/636 LDAPS
diag sys config-transaction show Shows all active Workspace Contract Validation, FortiToken,
txn-info Modes TCP/443
Firmware Updates
diag sys config-transaction show Pending CLI commands of TCP/443, TCP/8890 AV and IPS Update
txn-cli-commands Workspace Mode
UDP/500, ESP IPSEC VPN
UDP/500, UDP/4500 IPSEC VPN with NAT-Traversal
Hardware TCP/514 FortiManager, FortiAnalyzer

Hardware Information TCP/1812 RADIUS Authentication

TCP/1813 RADIUS Accounting
diag hardware sysinfo cpu CPU information
UDP/5246, UDP/5247 CAPWAP
Conserve Mode details.
diag hardware sysinfo conserve “Mem”: Memory / “FD”: File TCP/8001 FSSO
descriptor TCP/8013 Compliance and Security Fabric
diag hardware sysinfo memory Memory size, utilization ETH Layer 0x8890, 0x8891,
HA Heartbeat / Sync
Hardware test (available only on 0x8893
diag hardware test suite all
newer models)
get hardware status ASIC and NP information
get vpn status ssl hw- Show HW acceleration status
acceleration-status for SSL VPN
get hardware nic [port] Physical interface information
get system interface Signal information for Copper or
physical / transceiver SFP/SFP+ interfaces

Disk Operation
diag sys logdisk usage Logdisk usage information
diag hardware deviceinfo disk List disks with partitions
exec disk list List the disks and partitions
exec disk scan [ref_int] Run a disk check operation
Format the specified partitions
exec disk format [ref_int]
or disks and reboots the system
Formatting the log disk, reboot
exec formatlogdisk
included

Version 1.0 Page 4