Fortigate CLI

-


show is about configuration

get is about status

filter use grep


grep -f will do grep per configuration section context and pinpoint the grepped word with arrows " <----" 


show full-configuration system interface <port>

show system interface <port > 


execute ping-options ?

execute ping-options adaptive-ping <enable|disable>

execute ping-options data-size <bytes>

execute ping-options df-bit {yes | no}

execute ping-options pattern <2-byte_hex>

execute ping-options interface <auto | interface_name>
execute ping-options interval <seconds>

execute ping-options repeat-count <repeats>

execute ping-options source {auto | <source-intf_ip>}

execute ping-options timeout <seconds>

execute ping-options tos <service_type>

execute ping-options ttl <hops>

execute ping-options validate-reply {yes | no}

execute ping-options view-settings

execute ping-options use-sdwan <yes | no>

execute ping-options reset




1. get router info routing-table all
    get router info routing-table database
    diag firewall proute list

2. diag sys top 
    diag sys kill

3. get system status
    get system performance status     ---- can find system uptime
    get system arp

4. execute log filter category xxx
    exe log filter field srcip x.x.x.x
    execute log filter free-style "((srcip 172.16.1.1) or (dstip 172.16.1.2)) and (dstport 80 443 50-60)"
    exe log display

5. config system global
    set admin-https-redirect

6. config system global
    set admin-lockout-duration 300   << 5 mins
    set admin-lockout-threshold 5      << default is 3

7. config log disk setting   << not available on VM.
    set maxium-log-age 30     << days 

8. config system global
    set admin-maintainer disable     << disable maintenance account which is serial#

9. two factor authentication with email or sms, the option only appear in GUI after config is done from CLI. 
    config system admin
    edit admin1
    set two-factor email
    set email-tp admin1@gmail.com
    or
    set two-factor sms
    set sm-phone 11234567

10. get system session list
      diag sys session list
      diag sys session filter src x.x.x.x  << set up a filer first, other all sessions will be cleared.
      diag sys session clear

11. diag hardware sysinfo conserve 
      config ips global
      set fail-open

12. diag test application ipsmonior

13. diag hardware sysinfo slab
      diag hardware sysinfo memory

14. Operation mode
      config system settings
      set opmode nat or transparent

15. execute ping-options
      execute ping-options reset
      exe ping-options view-settings
      exe traceroute 

16. Test

17. get hardware nic <int_name>

18. diag sys top


get hardware cpu


Comments

Post a Comment

Popular posts from this blog

Firepower FMC and FTD troubleshooting

-
 1. Display real time log on FMC or FTD: pigtail for example: pigtail | grep 192.168.2.20                      pigtail | grep sftunnel 2. Restart communication channel manage_procs.pl run it from  the sensor only, run it from FMC will reset all sensors' channel. This scripts are nice to be used when the FMC and FTD have communication problems like heartbeats are not received, policy deployment is failing or events are not received > expert ************************************************************** NOTICE - Shell access will be deprecated in future releases          and will be replaced with a separate expert mode CLI. ************************************************************** admin@FTD:~$ sudo su Password: root@FTD:/home/admin# manage_procs.pl ****************  Configuration Utility  **************  1   Reconfigure Correlator  2   Reconfigure and flush Correlator  3    Restart Comm. channel  4   Update routes  5   Reset all routes  6   Validate Network  0   Exit *****
Read more

ASA IKEv1 VPN troubleshooting Steps and Tips

-
  1. Phase I proposal mismatch  Run show crypto isakmp sa  Initiator: MM_WAIT_MSG2 Responder: No info  Most likely this is phase1 proposal mismatch, verify IKEv1 policy, other symptoms:   Initiator log: Information Exchange processing failed All configured IKE versions failed to establish the tunnel Initiator debug: Received an un-encrypted NO_PROPOSAL_CHOSEN notify message, dropping Responder log: Error processing payload: Payload ID Responder debug:  All SA proposals found unacceptable 2. IKE version mismatch:  Run  show crypto isakmp sa  no info at both initiator and responder Initiator log: Removing peer from correlator table failed, no match! Reason: User Requested  All configured IKE versions failed to establish the tunnel Initiator debug: Oakley begin quick mode PHASE 1 COMPLETED IKE Initiator sending 1st QM pkt Removing peer from correlator table failed, no match! Session is being torn down. Reason: User Requested Responder log: Tunnel Rejected: Conflicting protocols specified
Read more

Firepower 2100/1100 FTD/ASA initial setup, reimage, upgrade.

-
  Chassis FXOS and FTD share same management IP (default 192.168.45.45) Chassis FXOS (192.168.45.45) and ASA ()use different management IP although on same physical interface. SSH to FXOS/FTD are on FTD CLI prompt, go to FXOS using the  connect fxos  command Console to Chassis is on FXOS CLI prompt, go to FTD using the  connect ftd  command The Firepower 1100 does not support the FXOS Firepower Chassis Manager; only a limited CLI is supported for troubleshooting purposes. The Firepower 2100 runs an underlying operating system called the Firepower eXtensible Operating System (FXOS).  If you run ASA on Firepower 2100, ASA can be in the following modes: Appliance mode (the default after ASA 9.13)—Appliance mode lets you configure all settings in the ASA. Only advanced troubleshooting commands are available from the FXOS CLI. See the  FXOS troubleshooting guide  for more information. Firepower Chassis Manager is not supported . ciscoasa# connect fxos [admin] Connecting to fxos. Connected
Read more