Fortinet FortiOS CLI Reference User Manual
Hirdetés
Hirdetés
FortiOS™
CLI Reference for FortiOS 5.0
FortiOS™ CLI Reference for FortiOS 5.0
December 2, 2015
01-509-99686-20150226
Copyright© 2015 Fortinet, Inc. All rights reserved. Fortinet®, FortiGate®, FortiCare® and
FortiGuard®, and certain other marks are registered trademarks of Fortinet, Inc., in the U.S. and other jurisdictions, and other Fortinet names herein may also be registered and/or common law trademarks of Fortinet. All other product or company names may be trademarks of their respective owners. Performance and other metrics contained herein were attained in internal lab tests under ideal conditions, and actual performance and other results may vary. Network variables, different network environments and other conditions may affect performance results.
Nothing herein represents any binding commitment by Fortinet, and Fortinet disclaims all warranties, whether express or implied, except to the extent Fortinet enters a binding written contract, signed by Fortinet’s General Counsel, with a purchaser that expressly warrants that the identified product will perform according to certain expressly-identified performance metrics and, in such event, only the specific performance metrics expressly identified in such binding written contract shall be binding on Fortinet. For absolute clarity, any such warranty will be limited to performance in the same ideal conditions as in Fortinet’s internal lab tests. In no event does Fortinet make any commitment related to future deliverables, features or development, and circumstances may change such that any forward-looking statements herein are not accurate. Fortinet disclaims in full any covenants, representations, and guarantees pursuant hereto, whether express or implied. Fortinet reserves the right to change, modify, transfer, or otherwise revise this publication without notice, and the most current version of the publication shall be applicable.
Technical Documentation
Knowledge Base
Customer Service & Support
Training Services
FortiGuard
Document Feedback docs.fortinet.com
kb.fortinet.com
support.fortinet.com
training.fortinet.com
fortiguard.com
Contents
Managing Firmware with the FortiGate BIOS .............................................. 20
Page 3
Fortinet Technologies Inc.
Page 4 FortiOS™ - CLI Reference for FortiOS 5.0
Fortinet Technologies Inc.
Page 5 FortiOS™ - CLI Reference for FortiOS 5.0
Fortinet Technologies Inc.
Page 6 FortiOS™ - CLI Reference for FortiOS 5.0
config aggregate-address, config aggregate-address6 ................................ 355
Fortinet Technologies Inc.
Page 7 FortiOS™ - CLI Reference for FortiOS 5.0
config {imap | imaps | mapi | pop3 | pop3s | smtp | smtps} ........................... 465
config {gmail | msn-hotmail | yahoo-mail}...................................................... 466
Fortinet Technologies Inc.
Page 8 FortiOS™ - CLI Reference for FortiOS 5.0
Fortinet Technologies Inc.
Page 9 FortiOS™ - CLI Reference for FortiOS 5.0
Fortinet Technologies Inc.
Page 10 FortiOS™ - CLI Reference for FortiOS 5.0
Configuring users for password authentication ............................................. 709
Configuring peers for certificate authentication............................................. 709
Fortinet Technologies Inc.
Page 11 FortiOS™ - CLI Reference for FortiOS 5.0
Fortinet Technologies Inc.
Page 12 FortiOS™ - CLI Reference for FortiOS 5.0
Fortinet Technologies Inc.
Page 13 FortiOS™ - CLI Reference for FortiOS 5.0
Fortinet Technologies Inc.
Page 14 FortiOS™ - CLI Reference for FortiOS 5.0
Fortinet Technologies Inc.
Page 15 FortiOS™ - CLI Reference for FortiOS 5.0
Fortinet Technologies Inc.
Page 16 FortiOS™ - CLI Reference for FortiOS 5.0
Fortinet Technologies Inc.
Page 17 FortiOS™ - CLI Reference for FortiOS 5.0
Fortinet Technologies Inc.
Page 18 FortiOS™ - CLI Reference for FortiOS 5.0
Introduction
This document describes FortiOS™ 5.0 CLI commands used to configure and manage a
FortiGate unit from the command line interface (CLI).
How this guide is organized
Most of the chapters in this document describe the commands for each configuration branch of the FortiOS™ CLI. The command branches and commands are in alphabetical order.
This document also contains the following sections:
Managing Firmware with the FortiGate BIOS describes how to change firmware at the console
during FortiGate unit boot-up.
What’s new describes changes to the 5.0 CLI.
config chapters describe the config commands.
execute describes execute commands.
describes get commands.
describes the tree command.
Availability of commands and options
Some FortiOS™ CLI commands and options are not available on all FortiGate units. The CLI displays an error message if you attempt to enter a command or option that is not available. You can use the question mark ‘?’ to verify the commands and options that are available.
Commands and options may not be available for the following reasons:
• FortiGate model. All commands are not available on all FortiGate models. For example, low end FortiGate models do not support the aggregate interface type option of the config system interface command.
• Hardware configuration. For example, some AMC module commands are only available when an AMC module is installed.
• FortiOS Carrier, FortiGate Voice, FortiWiFi etc. Commands for extended functionality are not available on all FortiGate models. The CLI Reference includes commands only available for FortiWiFi units, FortiOS Carrier, and FortiGate Voice units
Page 19
Managing Firmware with the FortiGate
BIOS
FortiGate units are shipped with firmware installed. Usually firmware upgrades are performed through the web-based manager or by using the CLI execute restore command. From the console, you can also interrupt the FortiGate unit’s boot-up process to load firmware using the
BIOS firmware that is a permanent part of the unit.
Using the BIOS, you can:
• view system information
• format the boot device
• load firmware and reboot (see
“Loading firmware” on page 21 )
• reboot the FortiGate unit from the backup firmware, which then becomes the default
firmware (see “Booting the backup firmware” on page 22 )
Accessing the BIOS
The BIOS menu is available only through direct connection to the FortiGate unit’s Console port.
During boot-up, “Press any key” appears briefly. If you press any keyboard key at this time, boot-up is suspended and the BIOS menu appears. If you are too late, the boot-up process continues as usual.
Navigating the menu
The main BIOS menu looks like this:
[C]: Configure TFTP parameters
[R]: Review TFTP paramters
[T]: Initiate TFTP firmware transfer
[F]: Format boot device
[Q]: Quit menu and continue to boot
[I]: System Information
[B]: Boot with backup firmare and set as default
[Q]: Quit menu and continue to boot
[H]: Display this list of options
Enter C,R,T,F,I,B,Q,or H:
Typing the bracketed letter selects the option. Input is case-sensitive. Most options present a submenu. An option value in square brackets at the end of the “Enter” line is the default value which you can enter simply by pressing Return. For example,
Enter image download port number [WAN1]:
In most menus, typing H re-lists the menu options and typing Q returns to the previous menu.
Page 20
Loading firmware
The BIOS can download firmware from a TFTP server that is reachable from a FortiGate unit network interface. You need to know the IP address of the server and the name of the firmware file to download.
The downloaded firmware can be saved as either the default or backup firmware. It is also possible to boot the downloaded firmware without saving it.
Configuring TFTP parameters
Starting from the main BIOS menu
[C]: Configure TFTP parameters.
Selecting the VLAN (if VLANs are used)
[V]: Set local VLAN ID.
Choose port and whether to use DHCP
[P]: Set firmware download port.
The options listed depend on the FortiGate model. Choose the network interface through which the TFTP server can be reached. For example:
[0]: Any of port 1 - 7
[1]: WAN1
[2]: WAN2
Enter image download port number [WAN1]:
[D]: Set DHCP mode.
Please select DHCP setting
[1]: Enable DHCP
[2]: Disable DHCP
If there is a DHCP server on the network, select
[1]. This simplifies configuration.
Otherwise, select
[2].
Non-DHCP steps
[I]: Set local IP address.
Enter local IP address [192.168.1.188]:
This is a temporary IP address for the FortiGate unit network interface. Use a unique address on the same subnet to which the network interface connects.
[S]: Set local subnet mask.
Enter local subnet mask [255.255.252.0]:
[G]: Set local gateway.
The local gateway IP address is needed if the TFTP server is on a different subnet than the one to which the FortiGate unit is connected.
TFTP and filename
[T]: Set remote TFTP server IP address.
Enter remote TFTP server IP address [192.168.1.145]:
[F]: Set firmware file name.
Enter firmware file name [image.out]:
Enter
[Q] to return to the main menu.
Fortinet Technologies Inc.
Page 21 FortiOS™ - CLI Reference for FortiOS 5.0
Initiating TFTP firmware transfer
Starting from the main BIOS menu
[T]: Initiate TFTP firmware transfer.
Please connect TFTP server to Ethernet port 'WAN1'.
MAC: 00:09:0f:b5:55:28
Connect to tftp server 192.168.1.145 ...
##########################################################
Image Received.
Checking image... OK
Save as Default firmware/Backup firmware/Run image without saving:[D/B/R]?
After you choose any option, the FortiGate unit reboots. If you choose [D] or [B], there is first a pause while the firmware is copied:
Programming the boot device now.
................................................................
................................................................
Booting the backup firmware
You can reboot the FortiGate unit from the backup firmware, which then becomes the default firmware.
Starting from the main BIOS menu
[B]: Boot with backup firmware and set as default.
If the boot device contains backup firmware, the FortiGate unit reboots. Otherwise the unit responds:
Failed to mount filesystem. . .
Mount back up partition failed.
Back up image open failed.
Press ‘Y’ or ‘y’ to boot default image.
Fortinet Technologies Inc.
Page 22 FortiOS™ - CLI Reference for FortiOS 5.0
What’s new
As the FortiOS Handbook has developed, the FortiGate CLI Reference for FortiOS 5.0 has become a dictionary of FortiOS CLI commands defining each command and its options, ranges, defaults and dependencies. The CLI Reference now includes FortiOS Carrier commands and future versions will include FortiGate Voice commands.
The table below lists the CLI commands and options in FortiOS 5.0 that have changed since the last major release of FortiOS.
Command
config
edit <name_str> set block-botnet-connections
Change
set extended-utm-log set ftgd-analytics set inspection-mode
New field. Enables blocking connections to known botnet servers.
New field, Enables logging UTM events.
New field. Enables FortiGuard Analytics.
New field. Selects proxy or flow-based antivirus operation. config http set avdb config mapi
Field removed.
New subcommand. Configures MAPI protocol options.
New subcommand. config smb config
set drop-infected pop3 mapi set store-infected imaps smtps pop3s https ftps set enable-auto-submit set sel-status set use-fpat set use-status config antivirus quarfilepattern
New options. Support MAPI, POP3 protocols.
New options. Support IMAPS, SMTPS, POP3S,
HTTPS, FTPS protocols.
Fields removed. Quarantine auto-submit feature removed.
Command removed. FortiGuard quarantine autosubmit feature was removed.
config
set default-db flow-based
Option removed. Use inspection-mode in
config
edit <app_list_str> set extended-utm-log set log set options
New field, Enables logging UTM events.
Field removed. Use traffic log application sensor name and application action fields instead.
New field. Enables basic application signatures for
DNS, HTTP, ICMP, SSL.
Page 23
Command
config entries edit <id_integer> set popularity config
config dlp compound config
edit <filepattern_list_int> config entries edit <filepattern_str> set action set filter-by encrypted
Change
New field. Sets application popularity levels.
New command. Configure client reputation tracking.
Command removed. set active config dlp rule
config filter edit <id> end set proto http-get http-post config
set cache-mem-percent
Field removed.
New option. Catches files that could not be scanned because of encryption.
Field removed.
Command removed. See
HTTP-PUT protocols.
config
New field. Can separately detect HTTP-GET and
New field. Sets amount of available memory used for caching.
Command removed.
config endpoint-control app-detect rule-list config
endpoint-control forticlientregistration-sync
config
edit <profile_name> config forticlient-winmac-settings config forticlient-android-settings config forticlient-ios-settings set forticlient-config-deployment
New command. Configures peer FortiGate units for synchronization of Endpoint license registration.
New subcommands. Profile re-organized into separate sections for Windows/Mac, Android, and iOS. set forticlient-log-upload set forticlient-log-upload-server set forticlient-settings-lock set forticlient-settings-lock-passwd set forticlient-update-from-fmg set forticlient-update-server set forticlient-vpn-provisioning config forticlient-vpn-settings set forticlient-advanced-vpn set forticlient-advanced-vpn-buffer
New field. Enables deployment of FortiClient settings from Endpoint Control profile.
New field. Enables sending of FortiClient logs to a
FortiAnalyzer unit via the FortiGate unit.
New field. Sets FortiClient log upload server.
New fields. Locks FortiClient settings and sets password to unlock them.
New field. Enables FortiClient update from
FortiManager.
New field. Sets FortiClient update servers.
New fields. Configure VPNs on FortiClient endpoints.
Fortinet Technologies Inc.
Page 24 FortiOS™ - CLI Reference for FortiOS 5.0
Command
set type network-service set users set user-groups config service config
set endpoint-profile set forticlient-keepalive-interval set forticlient-reg-key-enforce set forticlient-reg-key set forticlient-reg-timeout set forticlient-sys-update-interval set forticlient-temp-authorizationtimeout set registration-password config
config
config
firewall deep-inspection-options
config
firewall DoS-policy, DoS-policy6
config
edit <name_str> set unknown-version-action config
config
set arp-enable set arp-intf set block-size set num-blocks-per-user set source-startip set source-endip set type config
config
config
config
set mm1 strict-file set mm7 strict-file
Change
New option.
New option. Specifies the users to whom this profile applies.
New option. Specifies the user groups to which this profile applies.
New subcommand. Configures network-service address.
New field. Sets which endpoint profile to apply.
New field. Sets keepalive message interval.
New fields. Enable enforcement of FortiClient registration.
New field. Sets timeout of FortiClient registration.
New field. Sets update message interval.
New field. Sets duration of temporary authorization.
New field. Sets a password for FortiClient updates.
An address group can be a member of another address group.
New command. Adds an external authentication portal.
New command. Sets deep inspection options for secure protocols, such as HTTPS, FTPS, etc.
New command. Replaces config ips DoS.
New field. Allow or deny traffic with GTP version > 1.
New command. Configures identity-based routes.
New fields. Can limit ARP requests to one interface or disable them completely.
New fields. Set block size and blocks/user for new port-block-allocation IP pool type.
New fields. Define the source IP range for fixed port range mapping.
Field added. Select type of mapping.
New command. Configures IPv6 IP pools.
New command. Configures IP address translation.
New command. Configures IPv6 routing header packet filtering.
Option strict-file is obsolete and was removed.
Fortinet Technologies Inc.
Page 25 FortiOS™ - CLI Reference for FortiOS 5.0
Command
config
config
edit <index_int> set dstaddr set srcaddr set nat set snat config
edit <policy_id> set active-auth-method set application-list set auth-method set auth-portal set block-notification set capture-packet set client-reputation set device-detection-portal set dstaddr-negate set dstintf set dynamic-profile set dynamic-profile-group set dynamic-profile-access set email-collection-portal set fall-through-unauthenticated set forticlient-compliance-devices set deep-inspection-options set forticlient-complianceenforcement-portal set identity-based-route set identity-from
Change
New command. Configures multicast firewall addresses.
This field now accepts multicast address names defined in
This field now accepts address names defined in
Field removed. Use snat.
New field. Enables substitution of outgoing interface
IP address for the original source IP address.
The nat, ippool and poolname fields now also apply to policy6.
New field. Specifies active authentication method, which is used if sso-auth-method fails.
This field is now also available in IPv6 policies.
Field removed. Use sso-auth-method and active-auth-method.
New field. Enables use of external authentication portal defined in
New field. Enables Fortinet Bar notification of blocked files.
New field. Enables packet capture in policy.
New field. Enables Client Reputation in policy.
New field. Enables the Device Detection portal.
New field. Negates dstaddr selection.
Field now accepts multiple interface names.
Fields removed. Dynamic profile is controlled in the interface.
Field removed. RADIUS SSO replaces dynamic profile feature.
New field. Enables email collection from new devices.
New field. Enables unauthenticated user to skip authentication rules and possibly match another policy.
New field. Select device types to which FortiClient enforcement applies.
New field. Applies a deep inspection options profile.
New field. Enables the FortiClient portal.
New field. Enables use of identity-based route defined in
New field. Selects whether identity comes from authenticated user or device.
Fortinet Technologies Inc.
Page 26 FortiOS™ - CLI Reference for FortiOS 5.0
Command
config
(continued) set ips-DoS-status set ips-DoS set ips-sensor set logtraffic set logtraffic-start set netscan-discover-hosts set srcaddr6 set dstaddr6 set per-ip-shaper set permit-any-host set permit-stun-host set require-tfa set rsso set send-deny-packet set service-negate set srcaddr-negate set sso-auth-method set srcintf set tcp-reset set timeout-send-rst set wanopt set wanopt-detection set wanopt-profile set wanopt-peer set webcache-https set wsso config identity-based-policy edit <split_p_id> set action set captive-portal set client-reputation set deep-inspection-options set devices
Change
Fields removed. Use config firewall DoSpolicy command.
This field is now also available in IPv6 policies.
Field options are now all, utm, or disable.
New field. Enables logging of session start and end.
New field. Enables host discovery for hostname visibility feature.
New fields. Set IPv6 addresses for source and destination.
This field is now also available for IPv6 policies.
New fields. These can help support the FaceTime application on NAT’d iPhones.
New field. Makes identity-based policy require twofactor authentication.
New field. Enables RADIUS-based single sign on for this policy.
New field. Enables sending a reply packet to denied
TCP, UDP or ICMP traffic. If deny-tcp-with-icmp is enabled in
system settings , a Communication
Prohibited ICMP packet is sent. Otherwise, denied
TCP traffic is sent a TCP reset.
New field. Negates service selection.
New field. Negates srcaddr selection.
New field. Specifies passive authentication method for
FSSO/RSSO.
Field now accepts multiple interface names.
Field removed. Use send-deny-packet instead.
New field. Enables sending a TCP reset when an application session times out.
New fields. Configure WAN Optimization on this policy.
New field. Configures HTTPS web caching.
New field. Enables WiFi Single Sign On.
New field. Selects the action for this policy.
New field. Select the type of captive portal to use when action is capture.
New field. Enables client reputation feature in policy.
New field. Applies a deep inspection options profile.
New field. Specifies the device categories to which the policy applies.
Fortinet Technologies Inc.
Page 27 FortiOS™ - CLI Reference for FortiOS 5.0
Command
set endpoint-compliance set sslvpn-portal set sslvpn-realm set users config
config
edit <group_name> set deep-inspection-options config
firewall profile-protocol-options
edit <name_str> set caname config dns config ftp set options bypass-mode-command set options bypass-rest-command config ftps config http set fortinet-bar set fortinet-bar-port set switching-protocols config https config imaps config pop3s config smtps config mapi config
edit <name_str> set expiration-days config
Change
New field. Enables endpoint compliance.
New field. Selects the SSL VPN portal when action is ssl-vpn.
New field. Specifies an SSL VPN realm for this policy.
New fields. Selects individual users to add to the policy.
New command. Configures IPv4 <-> IPv6 policies.
New field. Applies a deep inspection options profile.
Field moved from
New subcommand. Configures DNS protocol options.
New option. Disables content scanning while MODE is
'block' or 'compressed'.
New option. Disables content scanning while REST is not zero.
Subcommand moved to firewall deepinspection-options
New fields. Enable Fortinet Bar in browser.
New field. Blocks or bypasses traffic when the protocol switches.
Subcommands moved to firewall deepinspection-options
New subcommand. Configures MAPI protocol options.
New field. Sets time period for schedule expiry advance warning log entry.
New command. Creates service categories and adds
comments to service categories. Use firewall service custom
to assign services to categories.
config
edit <service_name> set category <category_name> set fqdn set iprange
New field. Assigns the service to a service category.
New field. Specifies FQDN for a service.
New field. Specifies IP or IP range for a service.
Fortinet Technologies Inc.
Page 28 FortiOS™ - CLI Reference for FortiOS 5.0
Command
set explicit-proxy set protocol {ALL | CONNECT | FTP
| HTTP | SOCKS} set visibility
Change
New field. Configures a service as an explicit web proxy service.
New set of options available when is enabled.
explicit-proxy config firewall service explicit-web
Command removed. Use firewall service custom
config firewall service group-explicit-web Command removed. Use firewall service group
config
edit <group_name> set explicit-proxy
New field. Configures a service group as explicit web proxy services. config firewall service predefined
New field. Enables listing of service in firewall policy service selection. config
config
firewall sniff-interface-policy
edit <policy_id> set ips-DoS-status set ips-DoS set logtraffic config
firewall sniff-interface-policy6
edit <policy_id> set logtraffic config
set caname
Field removed. Use config firewall service custom.
New command. Configures sniffer policies.
Fields removed. Use policy command. config firewall DoS-
Field options are now all, utm, or disable.
Field options are now all, utm, or disable.
Field moved to
firewall profile-protocoloptions
Fields removed. set ssl-max-version set ssl-min-version config
New command. Creates Generalized TTL Security
Mechanism (GTSM) policies. config
edit <name_str> set portmapping-type set srcintf-filter set ssl-algorithm custom config ssl-cipher-suites
New field. Selects portmapping type.
New field. Creates a source interface filter.
New option. Enables custom encryption algorithm.
New subcommand. Defines custom encryption algorithm.
set weblogic-server
New field. Adds HTTP header indicating SSL offload for WebLogic server. set websphere-server
New field. Adds HTTP header indicating SSL offload for WebSphere server. config
New command. Configures virtual IP addresses for
IPv6.
Fortinet Technologies Inc.
Page 29 FortiOS™ - CLI Reference for FortiOS 5.0
Command
config
config
config ips DoS
Change
New commands. Configure vip46 and vip64 VIP groups.
Command removed. Use
config firewall DoSpolicy, DoS-policy6
config
set algorithm super
set maximum-log-age
New option. Selects algorithm suitable for models with
4GB or more memory. set database set skype-client-public-ipaddr config
set rate-count set rate-duration set rate-mode rate-track
New fields. Configure rate-based IPS signatures. config
set analytics set endpoint set extended-traffic-log
New field. Enables FortiGuard Analytics logging.
Field moved from
config config log settings.
Field removed. Use log-invalid-packet in
set suspicious set switching-protocols
New field. Enables virus suspicious logging.
New field. Controls whether protocol switching is logged.
set voip set upload-format set web-filter-command-block
New field. Selects regular or extended IPS database.
New field. Defines network IP addresses used for
Skype sessions to help identify Skype sessions in the
Sessions dashboard widget.
Field moved from
config
Field removed. Compact format no longer used.
New field. Enables logging of web filter command block messages.
New field. Sets maximum age of log, after which it is purged.
set max-policy-packet-capture-size
New field. Sets maximum size of packet captures in firewall policies. set ms-per-transaction set report set rows-per-transaction set sql-max-size set sql-max-size-action set sql-oldest-entry set upload type voip
Field removed.
New field. Enables reports.
Fields removed.
New option. Enables upload of VOIP logs.
Fortinet Technologies Inc.
Page 30 FortiOS™ - CLI Reference for FortiOS 5.0
Command
config
set amc-intf-bypass set chassis-loadbalance-ha set cpu-memory-usage set ha set ldb-monitor set auth set radius set config set ipsec set sslvpn-log-auth set sslvpn-log-adm set sslvpn-log-session set dhcp set ppp set vip-ssl set gtp set notification set pattern set forticlient set mms-stats set nac-quarantine
Change
Fields removed. Use
Fields removed. Use
Field removed. Use system field. user field. admin field.
Fields removed. Use
Fields removed. Use
Fields removed. Use vpn field. network field. utm field. set network
Field removed. See endpoint in
New field. Enables logging of DHCP, PPP, VIP-SSL,
GTP and notifications. set voip set user set utm
Field removed. See voip in
New field. Replaces auth and radius.
New field. Replaces pattern, forticlient, mms-stats, and nac-quarantine. set vpn
New field. Replaces ipsec, sslvpn-log-auth, sslvpn-log-adm, sslvpn-log-session. config
log {fortianalyzer | fortianalyzer2 | fortianalyzer3} setting
set buffer-max-send set max-buffer-size set address-mode set fdp-device set fdp-interface
Fields removed. Memory queue now used instead of file buffer.
Fields removed. Fortinet Discovery Protocol not supported in FortiOS 5.0 or FortiAnalyzer 5.0.
Fortinet Technologies Inc.
Page 31 FortiOS™ - CLI Reference for FortiOS 5.0
Command
config
set source-ip
Change
New field. Sets the source IP for communications to
FAMS.
set upload-option set upload-interval set upload-time config log gui
New field. Enables uploading logs to FortiGuard.
New field. Sets frequency of log file upload.
New field. Sets the time to roll logs.
Command removed. See set gui-log-display in config system admin. config
set resolve-apps set resolve-hosts config
set ips-archive
Fields moved from config
Command removed. DLP archive to memory is no longer supported. config
set daemon-log set gui-location
New command. Configures general logging settings.
New field. Enables logging of daemons.
New field. Replaces gui-log-location in system admin.
New commands. Enable logging of local-in policies. set local-in-admin set local-in-deny set local-in-fortiguard set local-in-other set local-out set neighbor-event
New field. Enables logging of ARP and IPv6 neighbor discovery events.
Fields moved to config
set resolve-apps set resolve-hosts set user-anonymize
New field. Enables anonymizing users as
“anonymous” in logs.
set os-detection auto set service-detection auto set tcp-scan auto set udp-scan auto
Option renamed. auto was previously called default.
Option renamed. auto was previously called default.
Option renamed. auto was previously called default.
Option renamed. auto was previously called default. config
edit <layout_name> set schedule-type once config body-item
Option removed. Use demand option.
edit <item_id> set misc-component section-start New option. Adds a report section. config report summary
Command removed. No longer used.
Fortinet Technologies Inc.
Page 32 FortiOS™ - CLI Reference for FortiOS 5.0
Command
config
config
set ebgp-multipath set ibgp-multipath config
edit <id> set gateway-ip set interface config
config
config area config ospf-interface edit <ospf_interface_name> set network-type point-to-multipointnon-broadcast set prefix-length config
config ospf6-interface edit <ospf6_interface_name> set network-type non-broadcast config neighbor config
config
config distance
config spamfilter emailbwl config spamfilter ipbwl
edit default set flow-based set spam-bwl-table set spam-emailbwl-table set spamipbwl-table config mapi
Change
New command. Enables BFD when there is no dynamic routing active.
New field. Enable ECMP load balancing across multiple (four) eBGP connections.
New field. Enable ECMP load balancing across multiple (four) iBGP connections.
Changed from edit <interface_name>.
New field. Set gateway IP address.
New field. Specifies interface.
New command. Configures the FortiGate unit as IPv6
Protocol Independent Multicast (PIM) version 2 router.
New network type option.
New field. Sets size of OSPF hello prefix.
New network type option.
New subcommand.
New command. Creates policy routes for IPv6 traffic.
New subcommand. Similar to config distance subcommand in config router rip.
New command. Combines old emailbwl and ipbwl.
Command removed. Use
Command removed. Use
.
New field. Enables flow-based spam filtering.
New field. Enables spam-bwl-table, which combines old spam-emailbwl-table and spamipbwltable.
Field removed. Use spam-bwl-table.
Field removed. Use spam-bwl-table.
New subcommand. Configures protocol options.
Fortinet Technologies Inc.
Page 33 FortiOS™ - CLI Reference for FortiOS 5.0
Command
config switch-controller config
edit <profile-name> set fwgrp custom config fwgrp-permission set device set utmpgrp custom config utmgrp-permission set voip
edit <name_str> set guest-auth set guest-groups set gui-detail-panel-location set gui-log-display config dashboard edit n set widget-type sessions set report-by destination-location set report-by destination-port edit n set widget-type sessions-bandwidth set sort-by config dashboard-tab config dashboard edit <id> set aggregate-hosts set dst-interface set show-forward-traffic set show-local-traffic set show-policy-overflow set widget-type analytics set widget threat-history config system alertemail
Change
New command. Enables management of FortiSwitch units.
New field. Sets level of access to netscan deviceidentification configuration.
New field. Sets level of access to VOIP configuration.
New fields. Enable guest authentication and specify guest user groups.
Command removed.
Command removed. Replaced by gui-location in config log settings.
Options removed.
New options bandwidth and session.
New subcommand. Configures additional dashboards.
New field. Enables host aggregation in Sessions widget.
New field. Sets a destination filter for Sessions widget.
New field. Sets forward traffic filter for Sessions widget.
New field. Sets local traffic filter for Sessions widget.
New field. Enables display of oversize policy alert in the Alert widget.
New option. Selects the AntiVirus Statistics widget.
New option. Selects the Threat History widget.
Renamed to
.
Fortinet Technologies Inc.
Page 34 FortiOS™ - CLI Reference for FortiOS 5.0
Command
config system autoupdate clientoverride config system autoupdate override config
set fortimanager-fds-override config
set login config
set ddns-server FortiGuardDDNS set monitor-interface config
config
edit <server_index_int> set dns-service local set enable set ntp-server1 set ntp-server2 set ntp-server3 set ntp-service set option4 set option5 set option6 set status set vci-string
Change
Commands removed. Use the new central management override setting, fortimanager-fdsoverride, in config
New field. Enables FortiManager override of FDS server. Replaces set srv-ovrd and config srvovrd-lst in config system fortiguard.
New field. Disables console login.
New option. Selects FortiGuard DDNS service.
Option now supports multiple interfaces, allowing for failover.
New command. Configures dedicated management interface on model 100D.
New option. Use this FortiGate unit as a DNS server.
Field renamed to status.
New fields. Provide addresses of NTP servers.
New field. Selects NTP source for DHCP clients.
New fields. Provide additional custom DHCP options.
Field renamed from enable.
Field now supports multiple names separated by spaces, for example: set vci-string FortiAP FortiSwitch.
New fields. Provide addresses of WiFi controllers. set wifi-ac1 set wifi-ac2 set wifi-ac3 config
set inter-chassis-support set mode dual-forticontroller set mode forticontroller config
set security set type
New field. Enables content cluster inter-chassis support.
New option. Supports FortiController.
New option. Supports FortiController.
Renamed from config system alertemail.
New field. Optionally selects STARTTLS or SMTPS security for email messages.
Field removed.
Fortinet Technologies Inc.
Page 35 FortiOS™ - CLI Reference for FortiOS 5.0
Command
config
set entropy-token config
set analysis-service set ddns-server-ip set ddns-server-port set service-account-passwd set source-ip set srv-ovrd config srv-ovrd-lst set webfilter-sdns-server-ip set webfilter-sdns-server-port config system fortiguard-log
set access-banner set admin-console-timeout set admin-https-redirect set admin-reset-button set allow-traffic-redirect set auth-lockout-duration set auth-lockout-threshold set block-session-timer set catutp-port set cert-chain-max set detection-summary set gui-certificates set gui-client-reputation set gui-dlp set gui-dynamic-routing
Fortinet Technologies Inc.
Change
New field. Enable to require USB entropy token for
FIPS-CC boot-up.
Command removed. No longer required.
New field. Sets IP for FortiDDNS service.
New field. Sets port for FortiDDNS service.
New field. Sets FAMS account password.
Field moved from config system fortiguardlog command.
Field and subcommand deleted. Use the new central management override setting, fortimanager-fdsoverride, in config system centralmanagement.
New fields. Sets the IP address and port of the
FortiDNS server.
Command removed. See
New command. Configure use of FortSandbox appliance.
New command. Configures overrides to IP geolocation database.
Field name changed to pre-login-banner.
New field. Overrides admintimeout for console sessions.
New field. Enables redirect of HTTP administrative access to HTTPS.
New field. Disables unit reset button.
New field. Stops redirection of traffic back out original interface.
Fields moved to
.
New field. Sets duration for blocked sessions.
New field.
New field. Set maximum depth for a certificate chain.
Field removed. Log & Archive Statistics widget removed from web-based manager.
New field. Controls display of Certificate features in the web-based manager.
New field. Controls display of client reputation features in the web-based manager.
New field. Controls display of Data Leak Prevention features in the web-based manager.
New field. Controls display of Dynamic Routing features in the web-based manager.
Page 36 FortiOS™ - CLI Reference for FortiOS 5.0
Command
config
(continued) set gui-explicit-proxy
Change
set gui-implicit-id-based-policy set gui-multicast-policy
New field. Controls display of Explicit Proxy features in the web-based manager.
Field removed. Use set gui-implicit-policy.
New field. Controls display of multicast policies in the web-based manager. set gui-multiple-utm-profiles
New field. Controls display of multiple UTM profiles in the web-based manager. set gui-nat46-64
New field. Controls display of NAT46 and NAT64 settings in the web-based manager. set gui-policy-based-ipsec
New field. Controls display of policy-based IPsec VPN options in the web-based manager. set gui-replacement-message-groups
New field. Controls display of Replacement Message
Groups in the web-based manager. set gui-sslvpn-personal-bookmarks
New field. Controls display of Personal Bookmarks feature in the SSLVPN portal. set gui-sslvpn-realms
New field. Controls display of SSL VPN realms in the web-based manager.
set gui-utm-monitors
New field. Controls display of UTM monitors in the web-based manager. set gui-wanopt-cache
New field. Controls display of WANopt features in the web-based manager. set gui-wireless-opensecurity
New field. Controls display of open security option for
SSID in the web-based manager. set login-timestamp set max-dlpstat-memory
New field. Controls logging of login timestamps.
New field. Controls amount of memory DLP stat daemon uses. set max-report-db-size
New field. Sets the maximum size for the log report database. set max-sql-log-size set miglogd-children set optimize-ssl
Field removed.
New field. Sets the number of miglogd process to run.
New field. Enables optimization of SSL inspection by using multiple processes. set per-user-bwl
New field. Enables webfilter per-user black/white list. set policy-auth-concurrent <limit_int>
Field changed to numerical limit, or 0 for no limit.
set post-login-banner
New field. Enables disclaimer message that appears after login. set pre-login-banner set revision-backup-on-logout
Field name changed. Was access-banner.
Default changed to disable.
set revision-image-auto-backup set sslvpn-cipher-hardware-acceleration set sslvpn-kxp-hardware-acceleration
New field. Enables auto-backup of image on upgrade.
New fields. Control hardware acceleration for SSLVPN. set sslvpn-pkce2-hardware-acceleration
New field. Controls PKCE2 hardware acceleration for
SSLVPN. set sslvpn-personal-bookmarks
New field. Enables management of SSLVPN user bookmarks in the web-based manager.
Fortinet Technologies Inc.
Page 37 FortiOS™ - CLI Reference for FortiOS 5.0
Command
config
(continued) set ssl-worker-count
Change
New field. Sets number of processes to use for optimization of SSL inspection. set switch-controller
New field. Enables switch controller on models where switch management is supported.
set switch-controller-reserved-network
New field. Defines a subnet for managed switches. set two-factor-email-expiry
New field. Sets the timeout period for email-based two-factor authentication. set two-factor-sms-expiry
New field. Sets the timeout period for SMS-based two-factor authentication. set usb-wan-auth-type set usb-wan-extra-init set usb-wan-passwd set usb-wan-username set use-usb-wan
New fields. Set authentication parameters for 4G/LTE modems.
New field. Enables use of USB wireless LTE modem. set virtual-server-hardware-acceleration set virtual-server-count
New fields. Control hardware acceleration.
set wan
New field. On models FWF-20C-ADSL and FGT-20C-
ADSL enables one of the switch port interfaces to act as a WAN port. set wireless-controller set wireless-mode wtp config
set gratuitous-arps
New field. Disables wireless daemon.
Option removed.
New field. Disables gratuitous ARP packets from new master unit. set group-id set minimum-worker-threshold
Value range now 0-255.
New field. Defines threshold to assign a lower rank to systems with few worker blades when electing an HA master. set update-all-session-timer
New field. Enables updating all session timers after a failover. config frup-settings
New subcommand. Configures Fortinet Redundant
UTM Protocol (FRUP). config
edit <interface_name> set allowaccess dynamic-profileradius-server set allowaccess radius-acct
Field name changed to radius-acct. set allowaccess capwap set atm-protocol
Field renamed, was dynamic-profile-radiusserver.
New option. Enables CAPWAP data on interface.
New field. Enables IPoA protocol on ADSL interfaces that support it. set dedicate-to
New field. Dedicates mgmt interface to unit management, optionally limited to trusted source IPs.
Fortinet Technologies Inc.
Page 38 FortiOS™ - CLI Reference for FortiOS 5.0
Command
config
(continued) set dedicate-to-switch set device-access-list set device-identification set device-netscan set device-user-identification set drop-fragment set dropped-overlapped-fragment set listen-forticlient-connection set log set replacemsg-override-group set security-groups set security-mode set snmp-index set stpforward-mode set trust-ip-1 set trust-ip-2 set trust-ip-3 set wifi-auto-connect set wifi-auto-save config ip6 set dhcp6-relay-server set dhcp6-relay-ip set ip6-mode config wifi-networks config
config
config
Change
New field.
New field. Selects a device access list when device-identification is enabled.
New field. Enables discovery of OS and device information for source hosts.
New field. Enables inclusion of detected devices in network vulnerability scans.
New field. Enables determination of user name for source hosts.
New field. Enables dropping and logging of fragmented packets.
New field. Enables dropping of overlapped packet fragments.
New field. Enables interface listening for connecting
FortiClient endpoints.
Field removed.
New field. Selects replacement message override group for captive portal messages.
New field. Selects groups that can get access through captive portal on this interface.
New field. Selects security mode for interface.
New field. Specifies interface index value for SNMP.
New field. Sets Spanning Tree Protocol forwarding mode.
New fields. When dedicate-to is management, these fields specify trusted IP addresses for management access.
New field. Makes client mode WiFi automatically connect to nearest saved WiFi network.
New field. Makes client mode WiFi automatically save passphrase when it connects to a WiFi network.
New fields. Configure DHCP relay server for IPv6.
New field. Selects static or DHCP6 addressing.
New subcommand. Configures settings for WiFi in client mode.
New command. Configures RFC 1853 IP-to-IP tunnel.
New command. Configures IPS URL filter DNS servers.
New command. Saves neighbor cache entries for the
VDOM.
Fortinet Technologies Inc.
Page 39 FortiOS™ - CLI Reference for FortiOS 5.0
Command
config
edit <mac-address_hex> set reply-substitute
Change
New field. Defines a substitute MAC address to use in reply. config
set lockdown-lac set network-init
New command. Allows connection only to the specified location area code (LAC).
New command. Sets current GSM/UMTS network operator. config
New command. Configures NAT64 (communication between IPv6 hosts and IPv4 servers).
New command. Configures network visibility features. config
config
New command. Configures the NP6 and NPlite
Network Processing Unit (NPU).
config
set dedicated-management-cpu set dedicated-tx-npu
New field (some models). Enables dedicating one CPU to management functions.
New field. On model 3600C, enables slow path packet processing using a dedicated third NP4. config
set type set server-mode set interface config
set elbc-mode
New field. Selects either FortiGuard or custom NTP server definition.
New fields. Configure an NTP server to be available on specified interfaces.
config
Field removed. Use mode field in
New command. Configures response to server probing. config
auth-token-login config
auth-token-login-failed config
system replacemsg device-detectionportal device-detection-failed
config
system replacemsg ftp ftp-dl-dlp
config
infected config
system replacemsg http http-client-
virus config
system replacemsg http http-dlp
config
system replacemsg http http-virus
config
system replacemsg mail email-dlp
config
email-virus config
smtp-virus
New command, Defines replacement message for two-factor authentication.
New command. Defines replacement message when two-factor authentication fails.
New command. Defines replacement message when
FortiGate unit cannot identify device type.
Commands removed. See system replacemsg utm
Commands removed. See system replacemsg utm
Fortinet Technologies Inc.
Page 40 FortiOS™ - CLI Reference for FortiOS 5.0
Command
config
nntp-dlinfected config
nntp-dlp config
config
config
edit <sync_id> config filter set service set dstaddr6 set srcaddr6 config custom-service config
set deny-tcp-with-icmp set discovered-device-timeout set email-portal-check-dns set gui-default-policy-columns set mac-ttl set ses-denied-traffic set sip-ssl-port set tcp-port config
set source-ip config
config
edit <index_number> set events fan-failure config
edit <user_name> set events fan-failure config hosts edit <host_id> set host-type
Change
Commands removed. See system replacemsg utm
New command. Replacement messages for some
FTP, HTTP, and email data leak and virus detections.
New command. Configures server probing.
Field removed. Use custom-service subcommand.
New fields. Set IPv6 addresses for session sync destination and source.
New subcommand. Configures custom service filter.
Replaces service field.
New field. Enables denying TCP, UDP or ICMP traffic by sending an ICMP Communication Prohibited packet.
New field. Sets timeout of discovered devices.
New field. Enables email collection portal checking of user-supplied email domains.
New field. Overrides firewall policy displayed column set.
New field. Sets duration of MAC addresses in transparent mode.
New field. Enables inclusion of denied traffic in the session table.
New field. Sets the port that the SIP proxy monitors for
SIP traffic.
Field now accepts two port numbers.
New field. Sets IP address for sFlow agent.
New command. Defines SMS servers for use in twofactor authentication.
New option. Enables fan failure event.
New option. Enables fan failure event.
New field. Determines permitted SNMP actions for host.
Fortinet Technologies Inc.
Page 41 FortiOS™ - CLI Reference for FortiOS 5.0
Command
config
config
edit <name> set type config
config
config
config
config
config
config
edit <serial_number> set activation-code set activation-expire set license config
config
edit <groupname> set auth-concurrent-override set auth-concurrent-value set company set email set mobile-phone set password set sponsor set user-id set user-name set expire <seconds_int> set expire-type set group-type fsso-service set group-type guest set group-type rsso set multiple-guest-add set sslvpn-portal set sso-attribute-value
Fortinet Technologies Inc.
Change
New command. Configures STP on Internal interface switches in switch mode.
New field. Selects type of VDOM link: PPP or Ethernet.
New command. Specifies the dynamic profile RADIUS server for each VDOM.
New command. Configures virtual switch interfaces.
New command. Defines devices.
New command. Configures device lists for use on interfaces with device identification enabled.
New command. Displays comments and descriptions for predefined device types.
New command. Defines device groups.
New fields to support FortiToken Mobile soft token.
New command. Configures polling of Windows AD servers.
New fields. Override policy-auth-concurrent setting in
New fields. When group-type is guest, these fields enable or disable fields on the web-based manager
Guest Management page. The user-id and password fields can select either an auto-generated value, an email address, or a specified value.
New fields. When group-type is guest, these fields specify the time until account expiry beginning either immediately or after the user’s first logon.
Value renamed from directory-service.
New value. Guest user groups are used for guest WiFi accounts.
New value. RADIUS SSO users.
New field. Enables auto-creation of a number of guest user accounts.
Field removed. Use identity-based firewall policy sslvpn-portal field.
New field. Defines the RADIUS user group that this local user group represents.
Page 42 FortiOS™ - CLI Reference for FortiOS 5.0
Command
config guest config match edit <id> set rsso config
edit <server_name> set source-ip
Change
New subcommand. Configures guest user.
New field. Enables RSSO match in this group.
New field. Specifies an IP address to use for LDAP communications. set secondary-server
New field. Specifies a secondary LDAP server to use if the primary server is unavailable. set tertiary-server config
edit <server_name> set dynamic-profile set dp-*
New field. Specifies a tertiary LDAP server to use if both the primary and secondary servers are unavailable. config
edit <name> set auth-concurrent-override set auth-concurrent-value set passwd-policy
New fields. Override policy-auth-concurrent setting in
New field. Applies a password policy to this account. set sms-custom-server set sms-phone set sms-server set two-factor set workstation config
New fields. Configure two-factor authentication.
New field. Limits user logon to a specified workstation.
New command. Creates a user password policy. config
edit <peer_name> set ocsp-override-server <ocsp_name>
New field. Sets OCSP server to use to retrieve certificate, if OCSP is enabled.
Fields removed. The RADIUS SSO feature replaces the dynamic profile feature. Use rsso-* fields.
Fortinet Technologies Inc.
Page 43 FortiOS™ - CLI Reference for FortiOS 5.0
Command
set h3c-compatibility set rsso set rsso-radius-server-port set rsso-radius-response set rsso-validate-request-secret set rsso-secret set rsso-endpoint-attribute set rsso-endpoint-block-attribute set rsso-context-timeout set rsso-log-period set rsso-log-flags set rsso-flush-ip-session set sso-attribute set sso-attribute-key set secondary-server set secondary-secret set tertiary-server set tertiary-secret config accounting-server config
set auth-lockout-duration set auth-lockout-threshold set auth-timeout set radius-ses-timeout-act config
edit <server_name> set secondary-server set secondary-key set tertiary-server set tertiary-key
Change
New field. Enables compatibility with H3C Intelligent
Management Platform (IMC) server.
New fields for RADIUS SSO feature that replaces
Dynamic Policy feature.
New fields. Specify a secondary RADIUS server to use if the primary server is unavailable.
New fields. Specify a tertiary RADIUS server to use if both the primary and secondary are unavailable.
New subcommand. Configures accounting server.
Fields moved from
config
Maximum is now 1440 minutes (24 hours).
New field. Selects whether to use or ignore RADIUS session timeout.
New fields. Specifies a secondary TACACS+ server to use if the primary server is unavailable.
New fields. Specifies a tertiary TACACS+ server to use if both the primary and secondary servers are unavailable.
Fortinet Technologies Inc.
Page 44 FortiOS™ - CLI Reference for FortiOS 5.0
Command
config
edit <profile_name> set extended-utm-log config sip set open-record-route-pinhole set open-via-pinhole set ssl-mode set ssl-algorithm set ssl-auth-client set ssl-auth-server set ssl-client-certificate set ssl-client-renegotiation set ssl-min-version set ssl-max-version set ssl-pfs set ssl-send-empty-frags set ssl-server-certificate config
edit <ca_name> set source-ip config
edit <ca_name> set source-ip config
edit <ca_name> set source-ip config
edit <ca_name> set source-ip config
config
edit <tunnel_name> set encryption aria128 set encryption aria192 set encryption aria256 set encryption seed set npu-offload config
edit <tunnel_name> set enc-alg aria128 set enc-alg aria192 set enc-alg aria256 set enc-alg seed
Fortinet Technologies Inc.
Change
New field. Enables detailed UTM log messages.
New SIP-related commands.
New SSL-related commands for models equipped with CP6, CP7, or CP8 processor.
New field. Defines expected IP for requests.
New field. Defines expected IP for requests.
New field. Defines expected IP for requests.
The config vpn certificate ocsp command was re-organized to support multiple servers.
New field. Defines expected IP for requests.
New command. Enables obtaining certificates by
OSCP and setting default server.
New options. ARIA is a Korean 128-bit block algorithm with a 128, 192, or 256-bit key. SEED is a Korean 128bit block algorithm with a 128-bit key.
New field. Enables offload of VPN session to NPU.
New options. ARIA is a Korean 128-bit block algorithm with a 128, 192, or 256-bit key. SEED is a Korean 128bit block algorithm with a 128-bit key.
Page 45 FortiOS™ - CLI Reference for FortiOS 5.0
Command
set npu-offload config
edit <gateway_name> set autoconfig set fragmentation set ike-version set proposal aria128 set proposal aria192 set proposal aria256 set proposal seed set xauthexpire config
edit <gateway_name> set client-auto-negotiate set client-keep-alive set fragmentation set include-local-lan set monitor set monitor-phase1 set monitor-hold-down-delay set npu-offload set proposal aria128 set proposal aria192 set proposal aria256 set proposal seed set save-password set send-cert-chain set split-include-service set xauthexpire config
edit <tunnel_name> set l2tp set proposal aria128 set proposal aria192 set proposal aria256 set proposal seed
Fortinet Technologies Inc.
Page 46
Change
New field. Enables offload of VPN session to NPU.
New field. Enables VPN autoconfiguration as a gateway or a client.
New field. Enables IKE fragmentation support.
New field. Selects either IKE v1 or v2. Previously only phase1-interface supported v2.
New options. ARIA is a Korean 128-bit block algorithm with a 128, 192, or 256-bit key. SEED is a Korean 128bit block algorithm with a 128-bit key.
New field. Controls when XAUTH credentials expire.
New field. Enables client to bring up the tunnel when there is no traffic.
New field. Enables client to keep the tunnel up when there is no traffic.
New field. Enables IKE fragmentation support.
New field. Enables access to their local LAN for Unity users who are not using split tunneling.
Field renamed from monitor-phase1.
Field renamed to monitor.
New field. Sets time to delay return to primary interface from backup interface.
New field. Controls offload of VPN session to NPU.
New options. ARIA is a Korean 128-bit block algorithm with a 128, 192, or 256-bit key. SEED is a Korean 128bit block algorithm with a 128-bit key.
New field. Enables FortiClient users to save Xauth user name and password.
New field. Enables sending of certificate chain, rather than single certificate.
New field. Determines which services the client can access through the VPN.
New field. Controls when XAUTH credentials expire.
New field. Enables L2TP traffic over IPsec VPN.
New options. ARIA is a Korean 128-bit block algorithm with a 128, 192, or 256-bit key. SEED is a Korean 128bit block algorithm with a 128-bit key.
FortiOS™ - CLI Reference for FortiOS 5.0
Command
config
edit <tunnel_name> set l2tp set proposal aria128 set proposal aria192 set proposal aria256 set proposal seed config
set allow-ssl-big-buffer set allow-ssl-insert-empty-fragment set allow-ssl-client-renegotiation set auto-tunnel-policy set auto-tunnel-static-route set dns-suffix set http-only-cookie set port-precedence set tlsv1-0 set tlsv1-1 set tlsv1-2 config
edit <portal_name> set auto-prompt-mobile-user set mac-addr-action set mac-addr-check config mac-addr-check-rule edit "rule1" set mac-addr-list set mac-addr-mask end config os-check-list windows-8 config widget edit <widget_id> set type forticlient-download set auto-connect set keep-alive set save-password set type history set type tunnel set tunnel-status
Fortinet Technologies Inc.
Change
New field. Enables L2TP traffic over IPsec VPN.
New options. ARIA is a Korean 128-bit block algorithm with a 128, 192, or 256-bit key. SEED is a Korean 128bit block algorithm with a 128-bit key.
New fields. Default settings enhance performance.
New field. Controls renegotiation of SSL connection.
New field. Enables automatic creation of policies for
SSLVPN.
New field. Enables automatic creation of static routes for SSLVPN.
New field. Adds DNS suffix support for SSLVPN tunnel mode.
New field. Disables httponly cookie.
New field. Enables giving SSLVPN higher priority than
HTTPS if both are enabled on the same port.
New fields. Enable TLS v1.0, 1.1, and 1.2 protocols.
New field. Enables prompt for mobile users to download FortiClient Endpoint Security.
New fields. Define MAC address host checking.
New option for os-check-list.
Widget configuration.
New option. Creates widget for downloading
FortiClient Endpoint Security.
New fields. Options for FortiClient users.
New option. Creates login history widget.
Option removed.
Page 47 FortiOS™ - CLI Reference for FortiOS 5.0
Command
set dns-server1 set dns-server2 set ipv6-dns-server1 set ipv6-dns-server2 set ipv6-wins-server1 set ipv6-wins-server2 set wins-server1 set wins-server2 config bookmarks edit <bookmark_name> set sso static set sso-credential set sso-username set sso-password
edit <user_name> config widget edit <widget_id> config bookmarks edit <bookmark_name> set sso auto set sso-credential set sso-username set sso-password config wanopt rule
edit <ssl-server-name> set add-header-x-forwarded-proto config
edit <ssl-server-name> set ssl-client-renegotiation set url-rewrite config
set cache-cookie set cache-exemption config cache-exemption-list
Change
New fields for tunnel widget.
Option removed. Use auto option and set sso-credential to alternative.
New field. Selects SSL-VPN or alternative credentials.
New fields. Specify alternative credentials for a bookmark.
New command. Configures SSL VPN realms.
New field. Selects SSL-VPN or alternative credentials.
New fields. Specify alternative credentials for a bookmark.
Command replaced by config
New command. Replaces config wanopt rule.
New field. Adds X-Forwarded_Proto header.
New field. Controls client renegotiation.
New field. Enables rewrite of HTTP redirection
Location header.
New field. Enables cookie caching.
Field moved to
Subcommand removed. Use
Fortinet Technologies Inc.
Page 48 FortiOS™ - CLI Reference for FortiOS 5.0
Command
config
set ipv6-status set incoming-ip6 set outgoing-ip6 set ssl-algorithm config
web-proxy forward-server-group
config
set forward-server-affinity-timeout set tunnel-non-http set unknown-http-version config
config
edit <entry_number> config entries edit <regex> set category config
webfilter ips-urlfilter-cachesetting
config
webfilter ips-urlfilter-setting
config
edit <name_str> set extended-utm-log set log-all-url set options per-user-bwl set web-filter-activex set web-filter-activex-log set web-filter-command-block-log set web-filter-sdns-action set web-filter-sdns-portal
Change
New fields. Configure IPv6 explicit web-proxy.
New field. Sets the strength of encryption algorithms accepted for deep scan.
New command. Configures a load-balanced group of web proxy forward servers.
New field. Sets affinity timeout for load balancing in a forward server group.
New field. Enables non-HTTP tunneling.
New field. Selects how to handle requests with unknown HTTP version.
New command. Defines URLs for forward-matching or cache exemption.
New field. Specifies FortiGuard categories to match.
New command. Configures the global DNS settings for flow-based URL filtering in conjunction with a border gateway.
New command. Configures a gateway router to do flow-based url filtering.
New field. Enables detailed UTM log messages.
New field. Enables logging of all URLs, even if
FortiGuard is not enabled.
New option. Enables per-user black/white list.
Renamed option. web-filter-activex renamed to
web-filter-activex-log for consistency.
New field. Enables logging of web filter command block messages.
New fields. Configures redirection to a captive portal by FortiGuard DNS-based web filtering.
Fortinet Technologies Inc.
Page 49 FortiOS™ - CLI Reference for FortiOS 5.0
Command
config ftgd-wf set disable set enable set category-override config quota edit <id> set type {time | traffic} set unit set value config web set log-search set safe-search set youtube-edu-filter-id
config webfilter search-engine
edit <list_int> set one-arm-ips-urlfilter
config wireless-controller global
set max-discoveries set ac-discovery-type set ac-list set ac-port set discovery-mc-ttl set image-update set max-failed-dtls set mesh-eth-type
config wireless-controller setting
set ap-auto-suppress set ap-bgscan-period set ap-bgscan-disable-day set ap-bgscan-disable-start set ap-bgscan-disable-end
config wireless-controller timers
set fake-ap-log
config wireless-controller vap
edit <vap_name> set broadcast-suppress [arp | dhcp] set dynamic-vlan set external-fast-roaming
Change
Field removed as it was redundant with enable field.
Field renamed to category-override.
Field renamed from enable.
New fields. Configure traffic quotas.
New field. Enables logging of all search words.
Field changed. Now selects whether safe search is based on the request URL or header.
New field. Sets YouTube EDU ID.
New command. Configures search engine access.
New field. Enables IPS URL filter.
Fields removed. These were used when a FortiWiFi unit runs in WTP mode, which is not supported in
FortiOS 5.0.
New field. Sets mesh ID for use in packets.
New field. Enables automatic suppression of detected rogue APs.
New field. Sets interval between background scans.
New fields. Configure a period on one or more days of the week when background scanning is disabled.
New field. Sets reporting interval for fake AP log.
New field. Prevents ARP or DHCP messages being carried to other access points carrying the same SSID.
New field. Enables user VLAN assignment based on
RADIUS attribute.
New field. Enables pre-authentication with external non-managed AP.
Fortinet Technologies Inc.
Page 50 FortiOS™ - CLI Reference for FortiOS 5.0
Command
set gtk-rekey-intv set ptk-rekey-intv set multicast-enhance set me-disable-thresh set local-bridging set local-switching set mesh-backhaul set vlanid set radius-mac-auth set radius-mac-auth-server set mac set mac-filter set mac-filter-policy set mac-filter-policy-other config mac-filter-list set vlan-auto config wireless-controller vap-group config
wireless-controller wids-profile
config
edit <wtp-id> set auto-power-level set auto-power-low set auto-power-high set band set ip-fragment-preventing set tun-mtu-downlink set tun-mtu-uplink config lan config
wireless-controller wtp-profile
edit <name_str> set ap-country set dtls-enabled set handoff-rssi set handoff-sta-thresh set ip-fragment-preventing set max-clients
Change
New fields. Modify WPA and WPA-RADIUS rekey intervals.
New fields. Enable conversion of multicast to unicast to improve performance, with an upper limit.
New field. Enables bridging WiFi and Ethernet interfaces.
New field. Enables bridging VAP interfaces.
New field. Enables SSID as backhaul link.
New field. Sets VLAN ID.
New fields. Configure MAC-based authentication of
WiFi clients on a RADIUS server.
Subcommand removed. Use DHCP server reservedaddress capability.
New field. Enables automatic management of SSID
VLAN interface.
Command removed.
New command. Configures profiles for the Wireless
Intrusion Detection System (WIDS).
New fields. Configure automatic power adjustment to prevent interference.
New field. Select radio band to use with automatic profile.
New field. Enables methods of CAPWAP fragmentation prevention, including MTU adjustment.
New fields. Adjust CAPWAP MTU.
New subcommand. Controls use of FortiAP LAN ports.
New field. Sets country of AP operation.
New field. Enables DTLS encryption for CAPWAP data channel.
New field. Sets minimum RSSI threshold for handoff.
New field. Sets threshold value for AP handoff.
New field. Enables methods of CAPWAP fragmentation prevention, including MTU adjustment.
New field. Sets a maximum number of clients that the
AP will support.
Fortinet Technologies Inc.
Page 51 FortiOS™ - CLI Reference for FortiOS 5.0
Command
set tun-mtu-downlink set tun-mtu-uplink config lan config radio-1, radio-2 set ap-auto-suppress set ap-bgscan-period set ap-bgscan-disable-day set ap-bgscan-disable-start set ap-bgscan-disable-end set ap-handoff set auto-power-level set auto-power-low set auto-power-high set frequency-handoff set max-distance set protection-mode set station-locate set wids-profile
config usb-mode
update
erase
host-count
host-detail
host-summary
purge
topN
[keepvmlicense]
[keepvmlicense] execute firmware-list update
agreement
certification
create-account
login
Change
New fields. Adjust CAPWAP MTU.
New subcommand. Controls use of FortiAP LAN ports.
New field. Enables automatic rogue suppression.
New field. Sets interval between background scans.
New fields. Configure a period on one or more days of the week when background scanning is disabled.
New field. Enables controller to switch clients to another AP for load balancing.
New fields. Configure automatic power adjustment to prevent interference.
New field. Enables controller to switch clients to the other frequency band (2.4GHz or 5GHz) for load balancing.
New field. Adjusts AP for optimum throughput at the specified distance.
New field. Enables 802.11g protection.
New field. Enables station location service.
New field. Assigns WIDS profile to this radio.
New command. Backs up configuration to a USB drive, which can be encrypted with a password.
Command removed. No longer required.
New commands to view and remove client reputation information.
New command. Reformats boot device or other hard drive. Optionally, can restore image afterwards.
New command. Resets the FortiGate configuration to factory default settings except VDOM and interface settings.
New option. Preserves VM license after reset.
Available on VM models only.
Command removed. No longer required.
New command. Updates FortiCarrier license.
New commands for managing the FortiCloud account.
Fortinet Technologies Inc.
Page 52 FortiOS™ - CLI Reference for FortiOS 5.0
Command
execute fortisandbox test-connectivity
Change
New command. Queries connectivity to FortiSandbox appliance .
import
import
poll
provision
execute ha ignore-hardware-revision
exec ha sync avupd exec ha sync attackdef exec ha sync weblists exec ha sync emaillists exec ha sync ca exec ha sync localcert exec ha sync ase exec ha sync all
New command. Imports OTP seeds.
New commands. Configure FortiToken Mobile soft tokens.
New command. Sets ignore-hardware-revision status.
Obsolete commands removed.
New commands. Available only if your system contains old compact logs created by an earlier version of FortiOS.
reset field
flash-cache
New option. Resets only log filter fields.
New command. Displays progress of latest log upload.
start discover
Command removed.
execute policy-packet-capture delete-all
New command. Deletes captured packets.
New command. Generates cache record in the report database.
Command modified. Now accepts start and end times.
execute restore config usb-mode
New command. Restores configuration from a USB drive, which can be encrypted with a password.
New command. Download source visibility signature package.
execute ssh <destination> [<port>]
New option to specify port number.
New command. Forces session synchronization
New command. Updates the IP geography database from FortiGuard. execute update-modem
Command removed. No longer required.
New command. trigger an FDS update of the source visibility signature package.
execute usb-device {list | disconnect}
get log sql status get mgmt-data status
New commands. Manage FortiExplorer IOS devices.
New command. Resets user webfilter quota.
Command removed.
get netscan scan
New command. Displays information additional to that provided by get system status or get hardware status.
Command removed.
New command. Lists IPv6 policy routes.
Fortinet Technologies Inc.
Page 53 FortiOS™ - CLI Reference for FortiOS 5.0
Command
get system fdp-fortianalyzer
get wireless-controller rf-analysis
get wireless-controller status
get wireless-controller vap-status
get wireless-controller wlchanlistlic
get wireless-controller wtp-status
Change
Command removed. Fortinet Discovery Protocol not supported in FortiOS 5.0 or FortiAnalyzer 5.0.
New command. Provides information about radio conditions on each channel at an AP.
New command. Shows the numbers of wtp sessions and clients.
New command. Shows information about SSIDs.
New command. Shows radio channels information.
New command. Returns information about an AP.
Fortinet Technologies Inc.
Page 54 FortiOS™ - CLI Reference for FortiOS 5.0
alertemail
Use the config alertemail command to configure the FortiGate unit to monitor logs for log messages with certain severity levels. If the message appears in the logs, the FortiGate unit sends an email to predefined recipients of the log message encountered. Alert emails provide immediate notification of issues occurring on the FortiGate unit, such as system failures or network attacks.
You must configure the server setting under config system email-server before the commands under config alertemail become accessible.
This chapter describes the following command:
Page 55
alertemail
setting
setting
Use this command to configure the FortiGate unit to send an alert email to up to three recipients. This command can also be configured to send an alert email a certain number of days before the FDS license expires and/or when the disk usage exceeds a certain threshold amount. You need to configure an SMTP server before configuring alert email settings. See
“system email-server” on page 514
for more information.
Syntax
config alertemail setting set
set
set
set
set
filter-mode {category | threshold}
set
set
emergency-interval <minutes_int>
set
set
critical-interval <minutes_int>
set
set
warning-interval <minutes_int>
set
notification-interval <minutes_int>
set
information-interval <minutes_int>
set
set
severity {alert | critical | debug | emergency | error
| information | notification | warning}
set
set
firewall-authentication-failure-logs {disable | enable}
set
set
IPsec-error-logs {disable | enable}
set
FDS-update-logs {disable | enable}
set
PPP-errors-logs {disable | enable}
set
sslvpn-authentication-errors-logs {disable | enable}
set
antivirus-logs {disable | enable}
set
webfilter-logs {disable | enable}
set
configuration-changes-logs {disable | enable}
set
violation-traffic-logs {disable | enable}
set
admin-login-logs {disable | enable}
set
local-disk-usage-warning {disable | enable}
set
FDS-license-expiring-warning {disable | enable}
set
FDS-license-expiring-days <days_int>
set
end set
fortiguard-log-quota-warning {disable | enable}
Fortinet Technologies Inc.
Page 56 FortiOS™ - CLI Reference for FortiOS 5.0
alertemail setting
Variable
username <user-name_str> mailto1 <email-address_str> mailto2 <email-address_str> mailto3 <email-address_str>
Description
Enter a valid email address in the format [email protected]. This address appears in the From header of the alert email.
Default
No default.
No default.
Enter an email address. This is one of the email addresses where the FortiGate unit sends an alert email.
Enter an email address. This is one of the email addresses where the FortiGate unit sends an alert email.
Enter an email address. This is one of the email addresses where the FortiGate unit sends an alert email.
Select the filter mode of the alert email.
No default.
No default.
category filter-mode {category | threshold}
The following fields display only when threshold is selected: emergency-interval alert-interval critical-interval error-interval warning-interval notification-interval information-interval debug-interval severity email-interval <minutes_int> emergency-interval <minutes_int>
Enter the number of minutes the FortiGate unit should wait before sending out alert email for emergency level messages. Only available when filter-mode is threshold. alert-interval <minutes_int>
Enter the number of minutes the FortiGate unit should wait before sending out an alert email for alert level messages. Only available when filter-mode is threshold. critical-interval <minutes_int>
Enter the number of minutes the FortiGate unit should wait before sending out an alert email. This is not available when filter-mode is threshold.
Enter the number of minutes the FortiGate unit should wait before sending out an alert email for critical level messages. Only available when filter-mode is threshold. error-interval <minutes_int>
Enter the number of minutes the FortiGate unit should wait before sending out an alert email for error level messages. Only available when filter-mode is threshold.
5
1
2
3
5
Fortinet Technologies Inc.
Page 57 FortiOS™ - CLI Reference for FortiOS 5.0
alertemail setting
Variable Description
warning-interval <minutes_int>
Enter the number of minutes the FortiGate unit should wait before sending out an alert email for warning level messages. Only available when filter-mode is threshold. notification-interval <minutes_int>
Enter the number of minutes the FortiGate unit should wait before sending out an alert email for notification level messages. Only available when filter-mode is threshold. information-interval <minutes_int>
Enter the number of minutes the FortiGate unit should wait before sending out an alert email for information level messages. Only available when filter-mode is threshold. debug-interval <minutes_int>
Enter the number of minutes the FortiGate unit should wait before sending out an alert email for debug level messages. Only available when filter-mode is threshold. severity {alert | critical | debug
| emergency | error | information
| notification | warning}
Select the logging severity level. This is only available when filter-mode is threshold.
The FortiGate unit logs all messages at and above the logging severity level you select.
For example, if you select error, the unit logs error, critical, alert, and emergency level messages.
Default
10
20
30
60 alert alert – Immediate action is required. critical – Functionality is affected. debug – Information used for diagnosing or debugging the FortiGate unit. emergency – The system is unusable. error – An erroneous condition exists and functionality is probably affected. information – General information about system operations notification – Information about normal events.
warning – Functionality might be affected.
IPS-logs {disable | enable} firewall-authentication-failure-logs
{disable | enable}
HA-logs {enable | disable}
IPsec-error-logs {disable | enable}
Enable or disable high availability (HA) logs. disable
Enable or disable IPSec error logs disable
FDS-update-logs {disable | enable}
Enable or disable FDS update logs.
PPP-errors-logs {disable | enable}
Enable or disable PPP error logs. disable disable sslvpn-authentication-errors-logs
{disable | enable} antivirus-logs {disable | enable} webfilter-logs
{disable | enable}
Enable or disable IPS logs.
Enable or disable firewall authentication failure logs.
Enable or disable SSL VPN authentication error logs.
Enable or disable antivirus logs.
Enable or disable web filter logs. disable disable disable disable disable
Fortinet Technologies Inc.
Page 58 FortiOS™ - CLI Reference for FortiOS 5.0
alertemail
Variable
FDS-license-expiring-warning
{disable | enable}
Description
Enable or disable to receive an email notification of the expire date of the FDS license.
Default
configuration-changes-logs
{disable | enable} violation-traffic-logs
{disable | enable} admin-login-logs {disable | enable}
Enable or disable admin login logs local-disk-usage-warning
{disable | enable}
Enable or disable configuration changes logs.
Enable or disable traffic violation logs.
Enable or disable local disk usage warning in percent. For example enter the number 15 for a warning when the local disk usage is at 15 percent. The number cannot be 0 or 100. disable disable disable disable disable
FDS-license-expiring-days
<days_int>
Enter the number of days to be notified by email when the FDS license expires. For example, if you want notification five days in advance, enter 5.
15 local-disk-usage <percentage>
Enter a number for when the local disk’s usage exceeds that number.
75 fortiguard-log-quota-warning
{disable | enable}
Enable to receive an alert email when the
FortiGuard Log & Analysis server reaches its quota.
disable
setting
Fortinet Technologies Inc.
Page 59 FortiOS™ - CLI Reference for FortiOS 5.0
antivirus
Use antivirus commands to configure antivirus scanning for services, quarantine options, and to enable or disable grayware and heuristic scanning.
This chapter describes the following commands:
Page 60
antivirus
heuristic
heuristic
Use this command to configure heuristic scanning for viruses in binary files.
Syntax
config antivirus heuristic set
end
Variable Description
mode {pass | block | disable}
Enter pass to enable heuristic scanning but pass detected files to the recipient. Suspicious files are quarantined if quarantine is enabled.
Enter block to enable heuristic scanning and block detected files. A replacement message is forwarded to the recipient. Blocked files are quarantined if quarantine is enabled.
Enter disable to disable heuristic scanning.
Default
disable
Fortinet Technologies Inc.
Page 61 FortiOS™ - CLI Reference for FortiOS 5.0
antivirus mms-checksum
mms-checksum
Use this command in FortiOS Carrier to create a list of attachment checksum values. Messages containing these attachments can be blocked by the MMS profile.
Syntax
config antivirus mms-checksum edit <entry_id>
config entries edit
set
end set
end
Variable Description
comment <comment_str>
<entry_name>
Optionally, enter a comment.
Enter a name for the blockable item.
checksum <checksum_value>
Enter the checksum value.
status {enable | disable}
Enable the entry.
Default
enable
Fortinet Technologies Inc.
Page 62 FortiOS™ - CLI Reference for FortiOS 5.0
antivirus notification
notification
Use this command for FortiOS Carrier to configure the viruses that trigger notification messages.
A notification list must be added to the MMS profile to generate notification messages.
Syntax
config antivirus notification edit
<list_id_int> set name <name_str> set comment <comment_str>
config entries edit
set
set
end end
Keywords and variables
<list_id_int> name <name_str> comment <comment_str>
<virus_str> prefix {enable | disable} status {enable | disable}
Description
Enter the ID number of the list to edit. Each notification list has a unique ID number. Enter edit ? to view all the lists with their ID numbers.
Default
No default.
Enter a name for the notification list. If the list is new, you must enter a name. You can also use this command to change the name of an existing notification list.
No default.
Enter an optional comment for the notification list. You can also use this command to change the name of an existing notification list.
No default.
Enter the virus pattern to edit an existing list entry, or enter a new virus pattern to create a new list entry.
No default.
enable
Enable to match the virus pattern with the beginning of any virus name. Disable to match the virus pattern with all of any virus name.
For example, a pattern of
BDoor.ACJ!tr.bdr with the prefix setting disabled will have the
FortiGate unit check for a virus with that exact name. With the prefix setting enabled, a prefix match entry for
BDoor will generate a notification message for any of the dozens of virus variants starting with
BDoor.
If required, you can disable a notification entry without removing it from the list. The FortiGate unit will ignore the list entry. By default, all list entries are enabled as soon as you create them.
enable
Fortinet Technologies Inc.
Page 63 FortiOS™ - CLI Reference for FortiOS 5.0
antivirus
profile
profile
Use this command to configure UTM antivirus profiles for firewall policies. Antivirus profiles configure how virus scanning is applied to sessions accepted by a firewall policy that includes the antivirus profile.
Syntax
config antivirus profile edit
set
archive-block [corrupted encrypted mailbomb multipart nested unhandled]
set
archive-log [corrupted encrypted mailbomb multipart nested unhandled]
set
options {avmonitor | avquery | quarantine | scan}
end set
infected {none | quar-interface | quar-scr-ip}
set
set
end
Default Variable
<name_str> analytics-bl-filetype {1 | 2
| <filepattern_list_int>}
Description
Enter the name of the antivirus profile.
Select file type pattern to blacklist and submit to
FortiGuard Analytics:
0
1— builtin patterns analytics-wl-filetype {1 | 2
| <filepattern_list_int>}
2 —all executables
<filepattern_list_int> — the identifier of a defined filepattern. See
“dlp filepattern” on page 83 .
Select file type pattern to whitelist and not submit to FortiGuard Analytics:
0
1— builtin patterns
2 —all executables
<filepattern_list_int> — the identifier of a defined filepattern. See
“dlp filepattern” on page 83 .
Fortinet Technologies Inc.
Page 64 FortiOS™ - CLI Reference for FortiOS 5.0
antivirus
Variable Description
analytics-max-upload <mbytes>
Enter the maximum file size that can be scanned in
Mbytes. Range: 1MB to 44MB av-virus-log {enable | disable}
Enable or disable logging for virus scanning.
av-block-log {enable | disable}
Enable or disable logging for antivirus file blocking.
block-botnet-connections
{enable | disable} comment <comment_str>
Enable to block connections to known botnet servers.
Optionally enter a description of up to 63 characters of the antivirus profile.
extended-utm-log
{eanble | disable} ftgd-analytics
{disable | suspicious | everything}
Enable or disable logging of UTM events.
FortiGuard Analytics mode: disable — FortiGuard Analytics disabled
Default
10 disable disable disable disable disable inspection-mode
{flow-based | proxy} suspicious — send only suspicious items everything — send all items to FortiGuard
Select flow-based or proxy antivirus protection.
proxy
config {http | https | ftp | ftps | imap | imaps | mapi | pop3 | pop3s | smb | smtp | smtps | nntp | im}
Configure virus scanning options for the selected protocol.
Variable
archive-block [corrupted encrypted mailbomb multipart nested unhandled] archive-log [corrupted encrypted mailbomb multipart nested unhandled] options {avmonitor | avquery | quarantine | scan}
Description
Select which types of archive to block.
Select which types of archive to log.
Select one or more options apply to virus scanning for the protocol. To select more than one, enter the option names separated by a space. Some options are only available for some protocols.
avmonitor — log detected viruses, but allow them through the firewall without modification.
avquery — use the FortiGuard AV query service.
quarantine — quarantine files that contain viruses. This feature is available for FortiGate units that contain a hard disk or are connected to a
FortiAnalyzer unit.
scan — Scan files transferred using this protocol for viruses.
Default
null null
profile
Fortinet Technologies Inc.
Page 65 FortiOS™ - CLI Reference for FortiOS 5.0
antivirus
config nac-quar
Configure NAC quarantine virus scanning options.
Variable
expiry <duration_str> infected {none | quar-interface | quar-scr-ip} log {disable | enable}
Description
Set the duration of the quarantine in the days, hours, minutes format
###d##h##m. The minimum setting is 5 minutes. The maximum is
364d23h59m. This field is available when infected is not none.
Select to quarantine infected hosts to banned user list.
Default
5m none none — no action is taken.
quar-interface — quarantine all traffic on infected interface.
quar-src-ip — quarantine all traffic from source
IP.
Enable or disabling logging for NAC quarantine.
disable
profile
Fortinet Technologies Inc.
Page 66 FortiOS™ - CLI Reference for FortiOS 5.0
antivirus
quarantine
quarantine
Use this command to set file quarantine options. FortiGate units with a hard disk or a connection to a FortiAnalyzer unit can quarantine files. FortiGate features such as virus scanning can quarantine files.
Syntax
config antivirus quarantine set
set
destination {disk | FortiAnalyzer | NULL}
set
set
drop-infected {ftp ftps http im imap mapi mm1 mm3 mm4 mm7 nntp pop3 smtp}
set
drop-intercepted {ftp http imap mm1 mm3 mm4 mm7 pop3 smtp}
set
lowspace {drop-new | ovrw-old}
set
set
set
store-blocked {ftp http imap mm1 mm3 mm4 mm7 nntp pop3 smtp}
set
store-heuristic {ftp http im imap mm1 mm3 mm4 mm7 nntp pop3 smtp}
set
store-infected {ftp ftps http https im imap imaps mm1 mm3 mm4 mm7 nntp pop3 pop3s smtp smtps}
end set
store-intercepted {ftp http imap mm1 mm3 mm4 mm7 pop3 smtp}
Variable
agelimit <hours_int> destination
{disk | FortiAnalyzer
| NULL}
Description
Specify how long files are kept in quarantine to a maximum of 479 hours. The age limit is used to formulate the value in the TTL column of the quarantined files list. When the limit is reached the
TTL column displays EXP and the file is deleted
(although a record is maintained in the quarantined files list). Entering an age limit of 0 (zero) means files are stored on disk indefinitely depending on low disk space action. This option appears when destination is not set to
NULL.
The destination for quarantined files:
Default
0
NULL disk is the FortiGate unit internal hard disk, if present.
FortiAnalyzer is a FortiAnalyzer unit the
FortiGate unit is configured to use.
NULL disables the quarantine.
This command appears only if the FortiGate unit has an internal hard disk or is configured to use a
FortiAnalyzer unit.
Fortinet Technologies Inc.
Page 67 FortiOS™ - CLI Reference for FortiOS 5.0
antivirus quarantine
Variable
drop-blocked
{ftp ftps http imap mm1 mm3 mm4 mm7 nntp pop3 smtp}
Description
Do not quarantine blocked files found in traffic for the specified protocols. The files are deleted.
drop-heuristic
{ftp ftps http im imap mm1 mm3 mm4 mm7 nntp pop3 smtp} drop-infected
{ftp ftps http im imap mapi mm1 mm3 mm4 mm7 nntp pop3 smtp}
Default
imap nntp
MM1, MM3, MM4, and MM7 traffic types supported only in FortiOS Carrier.
Do not quarantine files found by heuristic scanning in traffic for the specified protocols.
NNTP support for this field will be added in the future.
MM1, MM3, MM4, and MM7 traffic types supported in FortiOS Carrier.
http im imap nntp pop3 smtp
Do not quarantine virus infected files found in traffic for the specified protocols.
im imap nntp drop-intercepted
{ftp http imap mm1 mm3 mm4 mm7 pop3 smtp} lowspace
{drop-new | ovrw-old}
NNTP support for this field will be added in the future.
MM1, MM3, MM4, and MM7 traffic types supported in FortiOS Carrier.
For FortiOS Carrier, do not quarantine intercepted files found in traffic for the specified protocols. The files are deleted.
Select the method for handling additional files when the FortiGate hard disk is running out of space.
imap smtp pop3 http ftp mm1 mm3 mm4 mm7 ovrw-old maxfilesize <MB_int>
Enter ovwr-old to drop the oldest file (lowest TTL), or drop-new to drop new quarantine files.
This option appears when destination is not set to
NULL.
Specify, in MB, the maximum file size to quarantine.
0
The FortiGate unit keeps any existing quarantined files over the limit. The FortiGate unit does not quarantine any new files larger than this value. The file size range is 0-499 MB. Enter 0 for unlimited file size. quarantine-quota <MB_int>
Set the antivirus quarantine quota in MB, which is the amount of disk space to reserve for quarantining files.
store-blocked
{ftp http imap mm1 mm3 mm4 mm7 nntp pop3 smtp}
Quarantine blocked files found in traffic for the specified protocols.
NNTP support for this field will be added in the future.
HTTP, FTP, MM1, MM3, MM4, and MM7 traffic types supported in FortiOS Carrier.
store-heuristic
{ftp http im imap mm1 mm3 mm4 mm7 nntp pop3 smtp}
Quarantine files found by heuristic scanning in traffic for the specified protocols.
NNTP support for this field will be added in the future.
MM1, MM3, MM4, and MM7 traffic types supported in FortiOS Carrier.
0
No default.
No default.
Fortinet Technologies Inc.
Page 68 FortiOS™ - CLI Reference for FortiOS 5.0
antivirus quarantine
Variable
store-infected
{ftp ftps http https im imap imaps mm1 mm3 mm4 mm7 nntp pop3 pop3s smtp smtps} store-intercepted
{ftp http imap mm1 mm3 mm4 mm7 pop3 smtp}
Description
NNTP support for this field will be added in the future.
MM1, MM3, MM4, and MM7 traffic types supported in FortiOS Carrier.
Quarantine intercepted FortiOS Carrier files found in traffic of the specified protocols.
Default
Quarantine virus infected files found in traffic for the specified protocols.
No default.
imap smtp pop3 http ftp mm1 mm3 mm4 mm7
Fortinet Technologies Inc.
Page 69 FortiOS™ - CLI Reference for FortiOS 5.0
antivirus
service
service
Use this command to configure how the FortiGate unit handles antivirus scanning of large files in HTTP, HTTPS, FTP, POP3, IMAP, and SMTP traffic.
Syntax
config antivirus service
set
block-page-status-code <integer>
set
set
end set
Variable
<service_str>
Description
The service being configured: HTTP, HTTPS, FTP,
FTPS, IM, IMAP, NNTP, POP3, SMTP. block-page-status-code <integer> Set a return code for HTTP replacement pages.
Default
200 scan-bzip2 {enable | disable} uncompnestlimit <depth_int> uncompsizelimit <MB_int>
This field is only for the HTTP service.
Enable to allow the antivirus engine to scan the contents of bzip2 compressed files. Requires antivirus engine 1.90 for full functionality. Bzip2 scanning is extemely CPU intensive. Unless this feature is required, leave scan-bzip2 disabled.
Set the maximum number of archives in depth the AV engine will scan with nested archives. The limit is from 2 to 100. The supported compression formats are arj, bzip2, cab, gzip, lha, lzh, msc, rar, tar, and zip. Bzip2 support is disabled by default.
disable
12
Set the maximum uncompressed file size that can be buffered to memory for virus scanning.
Enter a value in megabytes between 1 and the maximum oversize threshold. Enter “?” to display the range for your FortiGate unit. Enter 0 for no limit (not recommended).
10
Fortinet Technologies Inc.
Page 70 FortiOS™ - CLI Reference for FortiOS 5.0
antivirus
settings
settings
Use this command to select the default antivirus database and to enable or disable grayware detection as part of antivirus scanning.
Syntax
config antivirus settings set
default-db {extended | extreme | normal}
set
end
Variable
default-db {extended | extreme | normal}
Description
Select the default antivirus database to use for virus scanning. You can override the default database for specific protocols in the antivirus profile, see
“antivirus profile” on page 64
.
Default
normal extended select the extended virus database, which includes both In the Wild viruses and a large collection of zoo viruses that are no longer seen in recent virus studies. It is suitable for an enhanced security environment.
extreme select the extreme virus database, which includes both In the Wild viruses and all available zoo viruses that are no longer seen in recent virus studies. It is suitable for an enhanced security environment.
normal select the regular virus database, which includes In the Wild viruses and most commonly seen viruses on the network. For regular virus protection, it is sufficient to use this database.
grayware {enable | disable}
Enable or disable grayware detection. Grayware includes adware, dial, downloader, hacker tool, keylogger, RAT and spyware.
disable
Fortinet Technologies Inc.
Page 71 FortiOS™ - CLI Reference for FortiOS 5.0
application
Use these commands to configure application control.
Page 72
application
custom
custom
Use this command to create custom application definitions.
Syntax
config application custom edit
<signature_tag_str> set behavior <behave_str> set category <cat_int>
end
The category field is required.
Variable
<signature_tag_str>
Description
behavior <behave_str>
Select the application behavior filter to apply.
Options include
2 — Botnet
3 — Evasive category <cat_int>
Default
No default.
5 —Excessive-Bandwidth
All —all of the above
Enter the category integer to specify an application category, or enter All to include all categories.
0
To determine the available application categories, enter set category ?.
comment
<comment_str> protocol
<protocol_str | All> technology
<technology_str> vendor <vendor_int>
Specify the protocols that this application uses.
Enter one or more protocol numbers separated by spaces, or
All. For a list of protocol numbers, enter set protocols ?.
No default.
Select the technologies involved in these applications. Enter one or more or the following technology numbers separated by spaces, or enter
All.
No default.
0—Network protocol
1—Browser-based
2—Client-server
4—Peer-to-peer
Enter the vendors to include. Enter one or more vendor numbers separated by spaces, or enter all. For a list of vendor numbers, enter set vendor ?.
No default.
Fortinet Technologies Inc.
Page 73 FortiOS™ - CLI Reference for FortiOS 5.0
application
list
Use this command to create application control lists and configure the application options.
Syntax
config application list edit
config entries edit
set
set
application [<app1_int> <app2_int> ...]
set
behavior {0 | 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8}
set
block-audio {enable | disable}
set
block-encrypt {enable | disable}
set
set
set
block-photo {enable | disable}
set
block-video {enable | disable}
set
set
set
im-no-content-summary {enable | disable}
set
inspect-anyport {enable | disable}
set
set
set
set
set
set
set
sub-category {<subcat_int> | all}
set
set
end set
end
end
set unknown-application-action {block | pass} set unknown-application-log {disable | enable}
list
Fortinet Technologies Inc.
Page 74 FortiOS™ - CLI Reference for FortiOS 5.0
application
Variable
<app_list_str>
<id_integer> action {block | pass
| reset}
Description
The name of the application control list.
Enter the unique ID of the list entry you want to edit, or enter an unused ID to create a new one.
Enter the action the FortiGate unit will take with traffic from the application of the specified type.
application [<app1_int>
<app2_int> ...] behavior
{0 | 1 | 2 | 3 | 4 | 5 | 6 | 7
| 8} block will stop traffic from the specified application.
pass will allow traffic from the specified application.
reset will reset the network connection.
Enter one or more application integers to specify applications.
Enter set application ? to list all application integers in the currently configured category.
Select the application behavior filter to apply. Options include
0 — Other
1 — Reasonable
2 — Botnet block-audio
{enable | disable} block-encrypt
{enable | disable} block-file
{enable | disable} block-im
{enable | disable} block-photo
{enable | disable} block-video
{enable | disable}
3 — Evasion
4 — Loss of productivity
5 — Excessive bandwidth
6 — Tunneling
7 — Reconnaissance
8 — Encrypted tunneling
Enable to block audio.
This command is available only when application is set to
AIM, ICQ, MSN, or Yahoo.
Enable to block encrypted IM sessions.
This command is available only when application is set to
AIM, ICQ, MSN, or Yahoo.
Enable to block IM file transfers.
This command is available only when application is set to
AIM, ICQ, MSN, or Yahoo.
Enable to block instant messages.
This command is available only when application is set to
AIM, ICQ, MSN, or Yahoo.
Enable to block IM photo sharing.
This command is available only when application is set to
AIM, ICQ, MSN, or Yahoo.
Enable to block MSN video chat.
This command is available only when application is set to
MSN.
Default
No default.
block all disable disable disable disable disable disable
Fortinet Technologies Inc.
Page 75 FortiOS™ - CLI Reference for FortiOS 5.0
list
application
Variable
category
{<cat_int> | All}
Description
Enter the category integer to specify an application category, or enter All to include all categories.
Set a specific category to limit the scope of the
All setting of the application command. For example, setting category to im and application to All will have the list entry include all IM applications. Similarly, the applications listed with the set application ? command will be limited to the currently configured category.
Default
All comment
<comment_string> extended-utm-log
{eanble | disable} im-no-content-summary
{enable | disable}
Enter set category ? to list all category integers.
Optionally, enter a descriptive comment.
Enable or disable logging of UTM events.
Enable to prevent display of content information on the dashboard.
No default.
disable disable inspect-anyport
{enable | disable}
This command is available only when application is set to
AIM, ICQ, MSN, or Yahoo.
Enable to inspect all ports not used by any proxy for IM traffic.
disable
This command is available only when application is set to
AIM, ICQ, MSN, or Yahoo.
log-packet {disable | enable} log {enable | disable} options [allow-dns allow-http allow-icmp allow-ssl] other-application-action
{block | pass}
Enable or disable packet logging for an application in the application control list.
Enable or disable logging.
Enable basic application signatures by default.
Enter the action the FortiGate unit will take for unrecognized application traffic or supported application traffic not configured in the current application control list.
other-application-log
{enable | disable} p2p-black-list [bittorrent edonkey skype]
Enter the P2P applications that are blacklisted, popularity {1 2 3 4 5}
Enter the popularity levels of this application.
protocols
<protocols_str>
Enter the logging action the FortiGate unit will take for unrecognized application traffic or supported application traffic not configured in the current application control list.
session-ttl <ttl_int>
Enter the protocols that these applications use. Enter one or more protocol numbers separated by spaces. For a list of protocol numbers, enter set protocols ?.
Enter the application’s session TTL. Enter
0 to disable this option. If this option is not enabled, the TTL defaults to the setting of the config system session-ttl
CLI command.
shaper <shaper_str>
Enter the name of a traffic shaper to enable traffic shaping for this application.
disable disable allow-dns pass disable null
No default.
0
No default
Fortinet Technologies Inc.
Page 76 FortiOS™ - CLI Reference for FortiOS 5.0
list
application
Variable
shaper-reverse
<shaper_str> sub-category
{<subcat_int> | all} tags <tag_str> technology
<technology_Str> unknown-applicationaction {block | pass} unknown-applicationlog {disable | enable} vendor <vendor_int>
Description
Default
Enter the name of a traffic shaper to enable reverse traffic shaping for this application.
No default
Enter the sub-category integer to specify an application sub-category, or enter all to include all sub-categories.
all
To see a list of sub-category numbers, enter set category ?.
Optionally, assign object tags.
Select the technologies involved in these applications.
Enter one or more or the following technology numbers separated by spaces, or enter all.
0—Other
No default.
all
1—Web browser
2—Client
3—Server
4—Peer-to-peer
Pass or block applications that have not been added to this application list. pass
Enable or disable recording log messages when an application not added to the application list is detected.
disable
Enter the vendors to include. Enter one or more vendor numbers separated by spaces, or enter all. For a list of vendor numbers, enter set vendor ?.
all
list
Fortinet Technologies Inc.
Page 77 FortiOS™ - CLI Reference for FortiOS 5.0
application
name
name
Use this command to view the settings of each application. The application category and ID are displayed. This command is ‘read only’ and cannot be used to change application settings.
Syntax
config application
get end
Variable
name <app_str>
Description
Enter the name of the application you want to view.
Enter config application name ? to list all the applications.
Default
No default
Fortinet Technologies Inc.
Page 78 FortiOS™ - CLI Reference for FortiOS 5.0
client-reputation
Use these commands to configure client reputation tracking.
Page 79
client-reputation
profile
profile
Use this command to configure client reputation profiles.
Syntax
config client-reputation profile set
blocked-connection {disable | low | medium | high | critical}
set
failed-connection {disable | low | medium | high | critical}
set
malware-detected {disable | low | medium | high | critical}
set
set
url-block-detected {disable | low | medium | high | critical}
set
config application
set
set
level {disable | low | medium | high | critical}
end config geolocation
set
set
level {disable | low | medium | high | critical}
end config ips
set low <int> set medium <int> set high <int> set critical <int>
end config level
set low <int> set medium <int> set high <int> set critical <int>
end config web
set
end set
level {disable | low | medium | high | critical}
end
Variable
blocked-connection {disable | low
| medium | high | critical} failed-connection {disable | low
| medium | high | critical} malware-detected {disable | low
| medium | high | critical}
Description
Select which score level to use for blocked connection status: low, medium, high or critical.
Default
high
Select which score level to use for failed connection status: low, medium, high or critical. low
Select which score level to use for malware detected status: low, medium, high or critical.
low
Fortinet Technologies Inc.
Page 80 FortiOS™ - CLI Reference for FortiOS 5.0
client-reputation profile
Variable
max-rep-db-size <MBytes_int> url-block-detected {disable | low
| medium | high | critical} window-size <wsize_int>
Description
Set the maximum client reputation database size in MBytes. Range 10 to 2000.
Select which score level to use for URL block detected status: low, medium, high or critical.
Enter the reputation data window size.
Default
100 low
7
Range: 1 to 30 days.
config application variables
<app_id> category <category_int>
Enter an ID number for this application.
level {disable | low | medium | high
| critical}
Enter the category. To view the list of categories, enter set category ?
No default.
Select which score level to use: disable, low, medium, high or critical.
low
config geolocation variables
<geoentry_ID> country <country_code)
Enter an ID for this entry.
level {disable | low | medium | high
| critical}
Enter the country code. For a list of country codes, enter set country ?
Select which score level to use: disable, low, medium, high or critical.
No default.
low
config ips variables
info-severity-status
{enable | disable} low-severity-status
{enable | disable} medium-severity-status
{enable | disable} high-severity-status
{enable | disable} critical-severity-status
{enable | disable}
config level variables
low <int> medium <int> high <int> critical <int>
Enable Information severity status level.
Enable Low severity status level.
Enable Medium severity status level.
Enable High severity status level.
Enable Critical severity status level.
Set low threshold. Range 1 to 10.
Set medium threshold. Range 5 to 30.
Set high threshold. Range 10 to 50.
Set critical threshold. Range 30 to 100.
config web variables
<webentry_ID> group <group_ID)
Enter an ID for this entry.
level {disable | low | medium | high
| critical}
Enter the group category ID. For a list of ID values, enter set group ?
Select which score level to use: disable, low, medium, high or critical.
disable disable disable disable disable
5
10
30
50
No default.
low
Fortinet Technologies Inc.
Page 81 FortiOS™ - CLI Reference for FortiOS 5.0
dlp
Use these commands to configure Data Leak Prevention (DLP).
Page 82
dlp
filepattern
filepattern
Use this command to add, edit or delete the file patterns used for DLP file blocking and to set which protocols to check for files to block.
Syntax
config dlp filepattern edit
<filepattern_list_int> set name <list_name_str> set comment <comment_str>
end config entries edit
set
file-type {unknown | ignored | activemime | arj
| aspack | base64 | bat | binhex | bzip | bzip2 | cab
| jad | elf | exe | fsg | gzip | hlp | hta | html
| javascript | lzh | msc | msoffice | mime | petite
| prc | rar | class | sis | tar | upx | uue | cod
set
Variable
<filepattern_list_int> name <list_name_str>
<filepattern_str>
A unique number to identify the file pattern list.
Enter a name for the file pattern header list.
comment <comment_str>
Optionally enter a comment about the file pattern header list.
The name of the file pattern being configured. This can be any character string.
file-type
{unknown | ignored
| activemime | arj | aspack
| base64 | bat | binhex
| bzip | bzip2 | cab | jad | elf
| exe | fsg | gzip | hlp | hta
| html | javascript | lzh
| msc | msoffice | mime
| petite | prc | rar | class | sis
| tar | upx | uue | cod | zip}
Description
This command is only available and valid when filtertype is set to type.
Select the type of file the file filter will search for. Note that unlike the file pattern filter, this file type filter will examine the file contents to determine the what type of file it is.
The file name and file extension is ignored.
Because of the way the file type filter works, renaming files to make them appear to be of a different type will not allow them past the FortiGate unit without detection.
Two of the available options are not file types:
Default
unknown
• Select unknown to configure a rule affecting every file format the file type filter unit does not recognize.
Unknown includes every file format not available in the file-type command.
• Select ignored to configure a rule affecting traffic the
FortiGate unit typically does not scan. This includes primarily streaming audio and video.
Fortinet Technologies Inc.
Page 83 FortiOS™ - CLI Reference for FortiOS 5.0
dlp filepattern
Variable
Description
filter-type {pattern | type} Select the file filter detection method.
• Enter pattern to examine files only by their names.
For example, if filter-type is set to pattern, and the pattern is
*.zip, all files ending in .zip will trigger this file filter. Even files ending in .zip that are not actually ZIP archives will trigger this filter.
• Enter type to examine files only by their contents.
Using the above example, if filter-type is set to type, and the type is zip, all ZIP archives will trigger this file filter. Even files renamed with non-zip file extensions will trigger this filter.
Default
pattern
Fortinet Technologies Inc.
Page 84 FortiOS™ - CLI Reference for FortiOS 5.0
dlp fp-doc-source
fp-doc-source
Use this command to add fingerprinting document sources including the server and filepath for the source files.
Syntax
config dlp fp-doc-source edit
set
set
set
file-pattern <wildcard_pattern>
set
keep-modified {enable | disable}
set
set
period {daily | weekly | monthly | none}
set
remove-deleted {enable | disable}
set
scan-subdirectories {enable | disable}
set
set
set
set
set
set
end set
set
Variable
Description
<name> file-pattern
<wildcard_pattern>
Enter a name for this document source.
date <int>
Set the date (day of month) to check the server. This is available when period is monthly.
file-path <server_filepath> Enter the path to the file on the server.
Enter the file pattern to match when using DLP blocking.
Can include wildcards, and should include file type. For example to match all files that end in fortinet.xls you would enter set file-pattern "*fortinet.xls" keep-modified
{enable | disable} password <pwd_string>
Enable to keep modified files in the list.
Enter the Samba password string to use when logging into the server.
period {daily | weekly | monthly | none} remove-deleted
{enable | disable}
Select the interval of time to use when checking the server.
Select enable to remove deleted chunks of documents from the server.
scan-subdirectories
{enable | disable} sensitivity <name>
Enable to scan directories contained in the current directory while fingerprinting documents.
Select a configured sensitivity label to apply to this configuration.
server <server_location>
Enter the IP address or IPv6 location of the server.
Default
1 none
Fortinet Technologies Inc.
Page 85 FortiOS™ - CLI Reference for FortiOS 5.0
dlp
Variable
server-type <samba> tod-hour <int> tod-min <int> username <string> vdom {mgmt | current} weekday {day_str>
fp-doc-source
Description
Enter the type of DLP server. Currently only samba servers are supported.
Default
samba
1
Set the time of day (hour) to check the server. This is available when period is not none.
Set the time of day (minute) to check the server. This is available when period is not none.
0
Enter the Samba login name to use when logging into the server.
Choose whether to perform document fingerprinting from the current VDOM or the management VDOM. Through the management VDOM, files might be accessible that are not accessible via the current VDOM.
mgmt
Enter the day of the week (e.g., “monday”) to check the server. This is available when period is weekly.
sunday
Fortinet Technologies Inc.
Page 86 FortiOS™ - CLI Reference for FortiOS 5.0
dlp fp-sensitivity
fp-sensitivity
Use this command to add fingerprinting sensitivity labels that can be applied to document sources and DLP rules.
These entries are labels only.
Syntax
config dlp fp-sensitivity edit
end
Variable
<name_string>
Description
Enter a string that will be a label. It will be used to describe DLP rules.
Default
No default.
Fortinet Technologies Inc.
Page 87 FortiOS™ - CLI Reference for FortiOS 5.0
dlp
sensor
sensor
Use this command to create a DLP sensor.
Syntax
config dlp sensor edit
set summary-proto {aim ftp http-get http-post icq imap mapi msn nntp pop3 smtp yahoo}
config filter
set
action {block | log-only | none | quarantine-ip }
set
set
filter-by {credit-card | encrypted | file-size | filetype | fingerprint | regexp | ssn | watermark}
set
set
end end nn
Variable
Description
<sensor_str>
Enter the name of a sensor to edit. Enter a new name to create a new DLP sensor.
comment <comment_str>
Enter an optional description of the DLP sensor.
Enclose the description in quotes if you want to include spaces.
extended-utm-log
{enable | disable} flow-based
{disable | enable} full-archive-proto {aim ftp http-get http-post icq imap mapi msn nntp pop3 smtp yahoo} options {strict-file}
Enable or disable detailed UTM log messages.
Enable or disable flow-based DLP.
Enter the protocols to always content archive.
strict-file is required for file filtering to function when the URL contains a ? character. For example, a file pattern configured to block
*.exe will not block file.exe if the URL is www.example.com/download?filename=file.exe unless strict-file is specified.
replacemsg-group
<group_name>
Enter the replacement message group to use.
Default
No default.
No default.
disable disable null
No default
No default
Fortinet Technologies Inc.
Page 88 FortiOS™ - CLI Reference for FortiOS 5.0
dlp sensor
Variable
summary-proto {aim ftp http-get http-post icq imap mapi msn nntp pop3 smtp yahoo}
Description
Enter the protocols to always log summary.
Default aim ftp http-get http-post icq imap mapi msn nntp pop3 smtp yahoo
No default edit <filter_str> action {block | log-only
| none | quarantine-ip }
Add a rule to a sensor by specifying the name of a
DLP rule that has already been added.
Enter the action taken when the rule is triggered.
block — prevents the traffic matching the rule from being delivered.
log-only — Prevent the DLP rule from taking any action on network traffic but log the rule match. Other matching rules in the same sensor and other sensors may still operate on matching traffic.
none none — Take no action.
quarantine-ip — Block access through the
FortiGate unit for any IP address that sends traffic matching a sensor with this action. The IP address is added to the Banned User list.
expiry <duration_str>
Set the duration of the quarantine in the days, hours, minutes format
###d##h##m. The minimum setting is
5 minutes. The maximum is 364d23h59m. This field is available when action is quarantine-ip.
filter-by {credit-card | encrypted | file-size | filetype | fingerprint | regexp | ssn | watermark}
Select what the sensor filters by.
proto {http-get http-post}
Enter the HTTP protocols to detect. Values are HTTP-
GET and HTTP-PUT.
type {file | message}
5m http-get http-post file
Fortinet Technologies Inc.
Page 89 FortiOS™ - CLI Reference for FortiOS 5.0
dlp
settings
settings
Use this command designate logical storage for DLP fingerprinting database.
These entries are labels only.
Syntax
config dlp settings set
cache-mem-percent <memmax_int>
set
db-mode {remove-modified-then-oldest | remove-oldest | stopadding}
end set
set
Variable
cache-mem-percent
<memmax_int> db-mode {removemodified-thenoldest | removeoldest | stop-adding}
Description
Enter the maximum portion of available memory allocated to caching. Range: 1 to 15 percent.
Select the method of maintaining the database size.
remove-modified-then-oldest — remove oldest chunks first, and then remove oldest file entries
Default
2 stop-adding remove-oldest — just remove the oldest files first stop-adding — don’t remove files, just stop adding to it.
size <maxsize_int>
Enter the maximum total size of files within storage in
MB.
storage-device <device>
Enter the storage device name.
16
No default.
Fortinet Technologies Inc.
Page 90 FortiOS™ - CLI Reference for FortiOS 5.0
endpoint-control
Use endpoint-control commands to configure the following parts of the Endpoint NAC feature:
• Endpoint license registration synchronization
• Endpoint NAC profiles
• the required minimum version of FortiClient Endpoint Security
• the FortiClient installer download location
Endpoint NAC is enabled in firewall policies.
This chapter contains the following sections:
Page 91
endpoint-control forticlient-registration-sync
forticlient-registration-sync
Use this command to configure peer FortiGate units for synchronization of Endpoint license registration.
Units can synchronize registration data only if they are both running the same version of
FortiOS with the same word size (32-bit or 64-bit).
Syntax
config endpoint-control forticlient-registration-sync edit
end
Variable
<peer-name> peer-ip <addr_ipv4>
Description
Enter a name to identify the peer FortiGate unit.
Enter the IP address of the peer FortiGate unit.
Default
No default.
No default.
Fortinet Technologies Inc.
Page 92 FortiOS™ - CLI Reference for FortiOS 5.0
endpoint-control
profile
profile
Use this command to configure an Endpoint NAC profile.
Syntax
config endpoint-control profile edit
<profile_name> set description <string>
set replacemsg-override-group <groupname_string>
set device-groups <group_list>
set users <user_list> set user-groups <usergroup_list>
config forticlient-winmac-settings set
forticlient-application-firewall {enable | disable}
set
forticlient-application-firewall-list <applist_name>
set
forticlient-ad {enable | disable}
set
forticlient-advanced-cfg {enable | disable}
set
forticlient-advanced-cfg-buffer <xml_config_str>
set
forticlient-advanced-vpn {enable | disable}
set
forticlient-advanced-vpn-buffer <xml_config_str>
set
forticlient-av {enable | disable}
set
forticlient-log-upload {enable | disable}
set
forticlient-log-upload-schedule {daily | hourly}
set
forticlient-log-upload-server {FQDN | ip4_addr}
set
forticlient-settings-lock {enable | disable}
set
forticlient-settings-lock-passwd <pwd_str>
set
forticlient-ui-options {af av vpn vs wf}
set
forticlient-update-from-fmg {enable | disable}
set
forticlient-update-server {<FQDN | ip4_addr>
[<FQDN | ip4_addr> <FQDN | ip4_addr>]}
set
forticlient-vpn-provisioning {enable | disable}
set
view-profile-details {enable | disable}
config forticlient-vpn-settings
set
set
auth-method {certificate | psk}
set
set
ssl-require-certificate {enable | disable}
set
ssl-vpn-access-port <port_int>
set
end set
forticlient-vuln-scan {enable | disable}
set
forticlient-vuln-scan-schedule {daily | weekly | monthly}
set
forticlient-vuln-scan-on-registration {enable | disable}
set
forticlient-wf {enable | disable}
set
forticlient-wf-profile <profile_name>
set
disable-wf-when-protected {enable | disable}
end
Fortinet Technologies Inc.
Page 93 FortiOS™ - CLI Reference for FortiOS 5.0
endpoint-control profile
config forticlient-android-settings set
forticlient-advanced-cfg {enable | disable}
set
forticlient-advanced-cfg-buffer <xml_config_str>
set
forticlient-advanced-vpn {enable | disable}
set
forticlient-advanced-vpn-buffer <xml_config_str>
set
forticlient-vpn-provisioning {enable | disable}
config forticlient-vpn-settings
set
set
auth-method {certificate | psk}
set
set
ssl-require-certificate {enable | disable}
set
ssl-vpn-access-port <port_int>
set
end set
forticlient-wf {enable | disable}
set
disable-wf-when-protected {enable | disable}
end config forticlient-ios-settings set
client-vpn-provisioning {enable | disable}
set
forticlient-advanced-cfg {enable | disable}
set
forticlient-advanced-cfg-buffer <xml_config_str>
set
forticlient-advanced-vpn {enable | disable}
set
forticlient-advanced-vpn-buffer <xml_config_str>
config client-vpn-settings
set
set
vpn-configuration-name <cfg_name_str>
set
vpn-configuration-content <str>
set
set
set
sslvpn-require-certificate {enable | disable}
end set
distribute-configuration-profile {enable | disable}
set
set
end end set
forticlient-wf {enable | disable}
set
disable-wf-when-protected {enable | disable}
Variable
<profile_name> client-vpn-provisioning
{enable | disable} description <string>
Description
Enter a name for this Endpoint NAC profile.
Enable or disable setting client VPN configuration.
This is available under config forticlientios-settings only.
Optionally, enter a description enclosed in quote (") marks.
Default
No default.
disable
No default.
Fortinet Technologies Inc.
Page 94 FortiOS™ - CLI Reference for FortiOS 5.0
endpoint-control profile
Variable
Description
device-groups <group_list>
Enter a space-delimited list of the device groups that are assigned to this endpoint profile.
forticlient-application-firewall
{enable | disable} forticlient-applicationfirewall-list <applist_name> forticlient-ad
{enable | disable} forticlient-advanced-cfg
{enable | disable} forticlient-advanced-cfgbuffer <xml_config_str>
Enable application detection.
Enter the name of the application list to use. See
.
Enable or disable FortiClient advertising.
Enable or disable setting a custom FortiClient configuration.
Custom FortiClient configuration in XML format, enclosed in quote (") marks. Available when forticlient-advanced-cfg is enabled.
Maximum buffer size is 32KB.
forticlient-advanced-vpn
{enable | disable} forticlient-advanced-vpnbuffer <xml_config_str>
Enable or disable setting custom FortiClient VPN configuration.
Custom FortiClient VPN configuration in XML format, enclosed in quote (") marks. Available when forticlient-advanced-vpn is enabled.
forticlient-av
{enable | disable} forticlient-log-upload
{enable | disable} forticlient-log-uploadschedule {daily | hourly} forticlient-log-upload-server
{FQDN | ip4_addr} forticlient-settings-lock
{enable | disable} forticlient-settings-lockpasswd <pwd_str>
Enable or disable FortiClient antivirus protection.
Enable of disable uploading logs to FortiAnalyzer unit via FortiGate unit.
Set log upload schedule.
Set upload forticlient log upload server.
Enable to lock FortiClient settings. This is available if forticlient-config-deployment is enable.
Set the password to unlock FortiClient configuration. This is available when forticlient-settings-lock is enable.
forticlient-ui-options {af av vpn vs wf}
Set the user interface components of FortiClient that will be available to the user.
Default
null disable
No default.
disable disable
No default.
disable
No default.
disable disable hourly null disable
No default.
av vpn wf af - application firewall av - antivirus forticlient-update-from-fmg
{enable | disable} forticlient-update-server
{<FQDN | ip4_addr>
[<FQDN | ip4_addr>
<FQDN | ip4_addr>]} forticlient-vpn-provisioning
{enable | disable} vpn - VPN vs - vulnerability scan wf - web filtering
Enable or disable FortiClient update from
FortiManager.
Enter one or more FortiClient update servers.Separate entries with spaces.
Enable or disable setting FortiClient VPN configuration.
disable null disable
Fortinet Technologies Inc.
Page 95 FortiOS™ - CLI Reference for FortiOS 5.0
endpoint-control profile
Variable
forticlient-vuln-scan
{enable | disable} forticlient-vuln-scan-schedule
{daily | weekly | monthly} forticlient-vuln-scan-onregistration {enable | disable} forticlient-wf
{enable | disable}
Description
Enable or disable endpoint vulnerability scanning.
Set endpoint vulnerability scan schedule.
Enable or disable endpoint vulnerability scan when endpoint registers.
Enable or disable FortiClient web category filtering.
Default
disable monthly enable forticlient-wf-profile
<profile_name> disable-wf-when-protected
{enable | disable} users <user_list> view-profile-details
{enable | disable} replacemsg-override-group
<groupname_string>
FortiClient web filter profile to use.
Disable FortiClient webfiltering when FortiGate unit is providing web filtering.
Enter the replacement message group name to use for portal message generating. The group must have its group-type set to ec. Maximum of 35 characters long.
default enable
Enter a space-separated list of the users to whom this profile applies. This is not available for the default profile.
user-groups <usergroup_list>
Enter a space-separated list of the user groups to which this profile applies. This is not available for the default profile.
No default.
No default.
Enable or disable client viewing of profile settings.
enable
No default.
If no group is specified, the default will take effect.If the group does not contain certain ec messages they will be loaded from the per-vdom or global settings. distribute-configurationprofile {enable | disable}
Enable to provide .mobileconfig information to all iOS clients.
configuration-name <str>
Enter the iOS configuration name.
configuration-content <str>
Enter XML .mobileconfig file content.
disable
No default.
No default.
config client-vpn-settings variables
edit <vpn_name> type {ipsec | ssl} vpn-configuration-name
<cfg_name_str>
Select IPsec or SSL VPN.
Enter the name of the VPN configuration. (IPsec) vpn-configuration-content
<str> sslvpn-require-certificate
{enable | disable}
Enter XML .mobileconfig file content.
remote-gw <addr>
Enter gateway FQDN or IP address. (SSL VPN) sslvpn-access-port <port_int> For SSL VPN, enter port number to use.
For SSL VPN, enable or disable authenticating clients by certificate.
config forticlient-vpn-settings variables
edit <vpn_name> remote-gw <ipv4_addr>
Enter gateway IP address.
No default.
ipsec
No default.
No default.
No default.
443 disable
No default.
No default.
Fortinet Technologies Inc.
Page 96 FortiOS™ - CLI Reference for FortiOS 5.0
endpoint-control profile
Variable
Description
Default
auth-method {certificate | psk} Select certificate or pre-shared key authentication.
psk preshared-key <psk_str>
Enter the pre-shared key.
No default.
ssl-vpn-access-port <port_int> For SSL VPN, enter port number to use.
ssl-require-certificate
{enable | disable} type {ipsec | ssl}
For SSL VPN, enable or disable authenticating clients by certificate.
Select IPsec or SSL VPN.
443 disable ipsec
Fortinet Technologies Inc.
Page 97 FortiOS™ - CLI Reference for FortiOS 5.0
endpoint-control
settings
settings
Use this command to configure the FortiClient Endpoint Security installer download location.
This is part of the Endpoint Control feature.
Syntax
config endpoint-control settings set
download-location {custom | fortigate | fortiguard}
set
set
forticlient-keepalive-interval <secs_int>
end set
forticlient-reg-key-enforce {enable | disable}
set
set
forticlient-reg-timeout <days_int>
set
forticlient-sys-update-interval <upd_int>
Variable
download-location {custom
| fortigate | fortiguard}
Description
Select location from which FortiClient application is downloaded: download-custom-link
<url>
custom — set download-custom-link to a URL that provides the download
fortigate — this FortiGate unit, available on some models
fortiguard — FortiGuard Services
Enter a URL where the FortiClient installer can be downloaded. This is available if downloadlocation is custom.
Set the interval in seconds between FortiClient keepalive messages. Range 20-86 400.
Enable enforcement of FortiClient registration key.
forticlient-keepaliveinterval <secs_int> forticlient-reg-key-enforce
{enable | disable} forticlient-reg-key
<key_str> forticlient-reg-timeout
<days_int> forticlient-sys-updateinterval <upd_int> version
<major.minor.patch> version-check
{latest | minimum}
Enter the FortiClient registration key.
Set the FortiClient license timeout in days. Range 1-
180.
Default
fortiguard
No default.
120 disable
No default.
7
Set the interval in minutes between system update messages from FortiClient. Range 30-1440.
720
Enter the minimum acceptable version of the
FortiClient application. This is available if versioncheck is minimum.
Enter latest to require the newest version available from the download location. Enter minimum to specify a minimum version in version. This is available if enforce-minimum-version is enabled.
4.0.0
minimum
Fortinet Technologies Inc.
Page 98 FortiOS™ - CLI Reference for FortiOS 5.0
firewall
Use firewall commands to configure firewall policies and the data they use.
This chapter contains the following sections:
local-in-policy, local-inpolicy6
Page 99
firewall address, address6
address, address6
Use this command to configure firewall addresses used in firewall policies. An IPv4 firewall address is a set of one or more IP addresses, represented as a domain name, an IP address and a subnet mask, or an IP address range. An IPv6 firewall address is an IPv6 6-to-4 address prefix.
Addresses, address groups, and virtual IPs must have unique names to avoid confusion in firewall policies. If an address is selected in a policy, it cannot be deleted until it is deselected from the policy.
Syntax
config firewall address edit
<name_str> set associated-interface <interface_str> set cache-ttl <ttl_int>
| wildcard} set visibility {enable | disable} set wildcard <address_ip4mask>
config service edit
set
set
end set
end config firewall address6 edit
<name_str> set ip6 <address_ipv6prefix>
end
Variable Description
The following fields are for config firewall address.
<name_str>
Enter the name of the address.
associated-interface
<interface_str>
Enter the name of the associated interface.
If not configured, the firewall address is bound to an interface during firewall policy configuration.
cache-ttl <ttl_int>
Enter minimum time-to-live (TTL) of individual IP addresses in FQDN cache. This is available when type is fqdn.
Default
No default.
No default.
0
Fortinet Technologies Inc.
Page 100 FortiOS™ - CLI Reference for FortiOS 5.0
firewall
Variable
color <color_int>
Description
Set the icon color to use in the web-based manager.
0 sets the default, color 1.
address, address6
Default
0
1 comment
<comment_string> country
<country_code> end-ip
<address_ipv4> fqdn
<domainname_str> start-ip
<address_ipv4> subnet
<address_ipv4mask>
Enter a descriptive comment for this address.
No default.
Enter the two-letter country code. For a list of codes, enter set country ? This is available when type is geography.
null
If type is iprange, enter the last IP address in the range.
0.0.0.0
If type is fqdn, enter the fully qualified domain name
(FQDN).
No default.
If type is iprange, enter the first IP address in the range.
0.0.0.0
If type is ipmask, enter an IP address then its subnet mask, in dotted decimal format and separated by a space, or in CIDR format with no separation. For example, you could enter either:
•
172.168.2.5/32
•
172.168.2.5 255.255.255.255
The IP address can be for a single computer or a subnetwork. The subnet mask corresponds to the class of the IP address being added.
0.0.0.0
0.0.0.0
tags <tags_str>
• A single computer’s subnet mask is
255.255.255.255 or
/32.
• A class A subnet mask is
255.0.0.0 or /8.
• A class B subnet mask is
255.255.0.0 or /26.
• A class C subnet mask is
255.255.255.0 or /24.
Enter object tags applied to this address. Separate tag names with spaces.
null type {ipmask | iprange
| fqdn | geography
| network-service
| wildcard} visibility
{enable | disable} wildcard
<address_ip4mask>
Select whether this firewall address is a subnet address, an address range, fully qualified domain name, a geographybased address, a network service or an IP with a wildcard netmask.
Select whether this address is available in firewall policy address fields in the web-based manager.
This is available if type is wildcard.
Fields for config service. type must be network-service ipmask enable
0.0.0.0
0.0.0.0
Fortinet Technologies Inc.
Page 101 FortiOS™ - CLI Reference for FortiOS 5.0
firewall
Variable Description
<service_id>
Enter an ID number, or 0 to auto-assign one.
end-port <port_int>
Enter the last port in the service range.
protocol {sctp | tcp
| udp}
Select the service protocol.
start-port <port_int>
Enter the first port in the service range.
The following fields are for config firewall address6.
<name_str>
Enter the name of the IPv6 address prefix.
ip6
<address_ipv6prefix>
If the IP address is IPv6, enter an IPv6 IP address prefix.
address, address6
Default
0 tcp
0
No default.
::/0
Fortinet Technologies Inc.
Page 102 FortiOS™ - CLI Reference for FortiOS 5.0
firewall addrgrp, addrgrp6
addrgrp, addrgrp6
Use this command to configure firewall address groups used in firewall policies.
You can organize related firewall addresses into firewall address groups to simplify firewall policy configuration. For example, rather than creating three separate firewall policies for three firewall addresses, you could create a firewall address group consisting of the three firewall addresses, then create one firewall policy using that firewall address group.
Addresses, address groups, and virtual IPs must all have unique names to avoid confusion in firewall policies. If an address group is selected in a policy, it cannot be deleted unless it is first deselected in the policy.
An address group can be a member of another address group.
Syntax
config firewall addrgrp, addrgrp6 edit
<name_str> set comment <comment_string> set member <name_str>
end
set visibility {enable | disable} set color <color_int>
Variable
<name_str> comment
<comment_string>
Enter the name of the address group.
Enter any comments for this address group.
member <name_str>
Enter one or more names of firewall addresses to add to the address group. Separate multiple names with a space.
To remove an address name from the group, retype the entire new list, omitting the address name.
visibility
{enable | disable} color <color_int>
Description
Select whether this address group is available in firewall policy address group fields in the web-based manager.
Set the icon color to use in the web-based manager.
Default
No default.
No default.
No default.
enable
0
0 sets the default, color 1.
Fortinet Technologies Inc.
Page 103 FortiOS™ - CLI Reference for FortiOS 5.0
firewall
auth-portal
auth-portal
Use this command to add an external authentication portal.
Syntax
config firewall auth-portal set
set
identity-based-route <route_name>
set
end set
portal-addr6 <IP6_addr | FQDN>
Variable
groups <group_list>
Decription
Enter the firewall user groups permitted to authenticate through this portal. Separate group names with spaces.
Default
No default.
Enter the identity-based route that applies to this portal. No default.
identity-based-route
<route_name> portal-addr
<IP4_addr | FQDN> portal-addr6
<IP6_addr | FQDN>
Enter the IP address or FQDN of the authentication portal. Use portal-addr6 for IPv6 address.
No default.
Fortinet Technologies Inc.
Page 104 FortiOS™ - CLI Reference for FortiOS 5.0
firewall carrier-endpoint-bwl
carrier-endpoint-bwl
Use FortiOS Carrier carrier end point filtering (also called carrier end point blocking) to control access to MMS services for users according to their carrier end point. Carrier end point filtering can filter MM1, MM3, MM4, and MM7 messages according to the carrier end points in the From or To addresses of the messages.
Syntax
config firewall carrier-endpoint-bwl edit
<carr-endpnt-lst-integer> set comment <carr_endpnt_lst_comment>
config entries edit
set
pattern-type {regexp | wildcard | simple}
set
action {none | block | exempt-mass-MMS | exempt }
set
log-action {archive | intercept}
end set
next
set name <carr_endpnt_lst_name>
next
Variable
action {none | block
| exempt-mass-MMS
| exempt }
Description
The action (or actions archive and intercept) to take if the carrier end point expression is found in the list.
Default
block none — no action is taken block — message is not delivered to intended recipient, log message in AV LOG as blocked due to carrier end point log-action
{archive | intercept} exempt-mass-MMS — no mass MMS scanning performed exempt — exempt user messages from all scanning archive — Message is delivered to intended recipient, MMS transaction is forwarded to
FortiAnalyzer archive, an entry is generated in content summary for FortiGate unit.
No default.
<carr_endpnt_lst_comment> Optional description of the carrier end point filter list.
The comment text must be less than 63 characters long, or it will be truncated. Spaces are replaced with a plus sign (+).
<carr_endpnt_pattern> intercept — Message is delivered to intended recipient, files are quarantined based on quarantine configuration, log message in AV LOG as intercepted due to carrier end point.
The carrier end point pattern to use for filtering/searching.
null
No default.
<carr-endpnt-lst-integer>
A unique number to identify the carrier end point filter list.
No default.
Fortinet Technologies Inc.
Page 105 FortiOS™ - CLI Reference for FortiOS 5.0
firewall
Variable
name
<carr_endpnt_lst_name> pattern-type {regexp
| wildcard | simple} status {enable | disable}
carrier-endpoint-bwl
Description
The name of the carrier end point filter list.
Default
null
Set the pattern type for the banned word. Choose from regexp, wildcard., or simple. Create patterns for banned carrier end point expressions using Perl regular expressions or wildcards.
Enable carrier end point filter search for carrier end point expression in carr-endpnt-expression.
wildcard disable
Fortinet Technologies Inc.
Page 106 FortiOS™ - CLI Reference for FortiOS 5.0
firewall carrier-endpoint-ip-filter
carrier-endpoint-ip-filter
In mobile networks, neither the user name nor the IP address can be used to identify a specific user. The only element unique to a user is the carrier end point. The carrier end point IP filter provides a mechanism to block network access for a specific list of carrier end points.
The carrier end point IP filter feature uses a carrier end point filter list created using the CLI command
config firewall carrier-endpoint-bwl . To set up a carrier end point IP filter, you must
create the carrier end point filter list prior to enabling the carrier end point IP filter feature.
Syntax
config firewall carrier-endpoint-ip-filter edit
<carr_endpnt> set log-status {enable | disable} set status {enable | disable}
end next
Variable
status {enable | disable}
Description
<carr_endpnt>
The carrier end point to be blocked.
log-status {enable | disable}
Enable or disable writing a log message when the carrier end point is blocked.
Enable or disable blocking the carrier end point.
Default
No default disable disable
Fortinet Technologies Inc.
Page 107 FortiOS™ - CLI Reference for FortiOS 5.0
firewall
central-nat
central-nat
Use this command to create NAT rules as well as NAT mappings that are set up by the global firewall table. Multiple NAT rules can be added on a FortiGate nd these NAT rules can be used in firewall policies.
A Typical NAT rule consists of:
• source ip address
• original port number
• translated ip address
• translated port number
IP addresses can be single address or multiple addresses that are predefined with an IP pool.
Similarly, port numbers can also be a single port or a range of ports.
Syntax
config firewall central-nat edit <name_str>
set status {enable | disable} set orig-addr <name_ip>
end
set nat-ippool <name_ip> set orig-port <port_int>
end
set nat-port <port_int-port_int>
Variable Description
status {enable | disable} orig-addr <name_ip> nat-ippool <name_ip> orig-port <port_int>
Enable or disable central NAT rule
Enter source ip address name
Enter translated ip pool name for translated addresses
Enter port number of the source ip nat-port <port_int-port_int> Enter translated port or port range
0
0
Default
enable
Fortinet Technologies Inc.
Page 108 FortiOS™ - CLI Reference for FortiOS 5.0
firewall deep-inspection-options
deep-inspection-options
Use this command to configure UTM deep inspection options profiles for firewall policies. Deep inspection options configure how UTM functionality identifies secure content protocols such as
HTTPS, FTPS, and SMTPS. Client comforting options are controlled by the corresponding nonsecure protocol options in
firewall profile-protocol-options .
To configure the ssl-server, change client-cert-request from bypass.
Syntax
config firewall deep-inspection-options edit
set
set
allow-invalid-server-cert {enable | disable}
set
client-cert-request {bypass | inspect | block}
set
ssl-ca-list {enable | disable}
set
set
unsupported-ssl {bypass | block}
end
set
set
allow-invalid-server-cert {enable | disable}
set
client-cert-request {bypass | inspect | block}
set
ssl-ca-list {enable | disable}
set
set
unsupported-ssl {bypass | block}
end
set
set
allow-invalid-server-cert {enable | disable}
set
client-cert-request {bypass | inspect | block}
set
ssl-ca-list {enable | disable}
set
set
unsupported-ssl {bypass | block}
end
set
set
allow-invalid-server-cert {enable | disable}
set
client-cert-request {bypass | inspect | block}
set
ssl-ca-list {enable | disable}
set
set
unsupported-ssl {bypass | block}
end
Fortinet Technologies Inc.
Page 109 FortiOS™ - CLI Reference for FortiOS 5.0
firewall deep-inspection-options
set
set
allow-invalid-server-cert {enable | disable}
set
client-cert-request {bypass | inspect | block}
set
ssl-ca-list {enable | disable}
set
set
unsupported-ssl {bypass | block}
end
set
allow-invalid-server-cert {enable | disable}
set
inspect-all {enable | disable}
set
ssl-ca-list {enable | disable}
end
config ssl-server edit <table_id>
set
ftps-client-cert-request {block | bypass | inspect}
set
https-client-cert-request {block | bypass | inspect}
set
imaps-client-cert-request {block | bypass | inspect}
set
set
pops3-client-cert-request {block | bypass | inspect}
end end set
smtps-client-cert-request {block | bypass | inspect}
set
ssl-other-client {block | bypass | inspect}
Variable
<name_str> caname <cacert_name>
Enter the name of the protocol options profile.
Select the CA certificate used by SSL content scanning and inspection for establishing encrypted SSL sessions.
certname <cert_name> Select the server certificate used by SSL inspection.
comment
<comment_str> extended-utm-log
{enable | disable} ssl-invalid-server-certlog {enable | disable}
Description
Optionally enter a description of up to 63 characters of the protocol options profile.
Enable or disable detailed UTM log messages.
Enable or disable logging for SSL server certificate validation. enabled.
extended-utm-log must be
Default
Fortinet_CA_SSLProxy disable disable
config ftps
Configure FTPS protocol options.
Variable Description
ports <port_number_list>
Enter the port numbers to scan for FTPS content.
allow-invalid-server-cert
{enable | disable}
Enable to allow SSL sessions whose server certificate validation failed.
Default
990 disable
Fortinet Technologies Inc.
Page 110 FortiOS™ - CLI Reference for FortiOS 5.0
firewall deep-inspection-options
Variable
client-cert-request
{bypass | inspect | block}
Description
Select what action is taken by the FortiGate SSL proxy when the client certificate request fails during the SSL handshake.
Default
bypass
SSL sessions that use client-certificates bypass the SSL inspection by default. This command offers the options to inspect or block that traffic.
ssl-ca-list
{enable | disable}
Enable to verify SSL session server certificate against stored CA certificate list.
status {enable | disable}
Enable or disable FTPS protocol inspection.
unsupported-ssl
{bypass | block}
Select whether to bypass or block undecryptable SSL sessions.
disable enable bypass
config https
Configure HTTPS protocol options.
Variable
ports
<port_number_list> allow-invalid-server-cert
{enable | disable} client-cert-request
{bypass | inspect | block}
Description
Enter the port numbers to scan for HTTPS content.
Enable to allow SSL sessions even if server certificate validation failed for the session.
Select what action is taken by the FortiGate SSL proxy when the client certificate request fails during the SSL handshake.
Default
443 disable bypass
SSL sessions that use client-certificates bypass the SSL inspection by default. This command offers the options to inspect or block that traffic.
ssl-ca-list
{enable | disable}
Enable to verify SSL session server certificate against stored CA certificate list.
status {enable | disable}
Enable or disable HTTPS protocol inspection.
unsupported-ssl
{bypass | block}
Select whether to bypass or block undecryptable SSL sessions.
disable enable bypass
config imaps
Configure secure IMAP (IMAPS) protocol options.
Variable
ports
<port_number_list> allow-invalid-servercert {enable | disable} client-cert-request
{bypass | inspect
| block} ssl-ca-list
{enable | disable}
Description
Enter the port numbers to scan for IMAPS content.
Enable to allow SSL sessions even if server certificate validation failed for the session.
Select what action is taken by the FortiGate SSL proxy when the client certificate request fails during the SSL handshake.
Default
993 disable bypass
SSL sessions that use client-certificates bypass the SSL inspection by default. This command offers the options to inspect or block that traffic.
Enable to verify SSL session server certificate against stored
CA certificate list.
disable
Fortinet Technologies Inc.
Page 111 FortiOS™ - CLI Reference for FortiOS 5.0
firewall deep-inspection-options
Variable
status
{enable | disable} unsupported-ssl
{bypass | block}
Description
Enable or disable IMAPS protocol inspection.
Select whether to bypass or block undecryptable SSL sessions.
Default
enable bypass
config pop3s
Configure secure POP3 (POP3S) protocol options.
Variable
ports
<port_number_list> allow-invalid-servercert {enable | disable} client-cert-request
{bypass | inspect | block} ssl-ca-list
{enable | disable} status
{enable | disable} unsupported-ssl
{bypass | block}
Description
Enter the port numbers to scan for POP3S content.
Enable to allow SSL sessions even if server certificate validation failed for the session.
Select what action is taken by the FortiGate SSL proxy when the client certificate request fails during the SSL handshake.
Select whether to bypass or block undecryptable SSL sessions.
Default
995 disable bypass
SSL sessions that use client-certificates bypass the SSL inspection by default. This command offers the options to inspect or block that traffic.
Enable to verify SSL session server certificate against stored
CA certificate list.
Enable or disable POP3S protocol inspection.
disable enable bypass
config smtps
Configure secure SMTP (SMTPS) protocol options.
Variable
ports
<port_number_list> allow-invalid-servercert {enable | disable} client-cert-request
{bypass | inspect | block} ssl-ca-list
{enable | disable} status
{enable | disable} unsupported-ssl
{bypass | block}
Description
Enter the port numbers to scan for SMTPS content.
Enable to allow SSL sessions even if server certificate validation failed for the session.
Select what action is taken by the FortiGate SSL proxy when the client certificate request fails during the SSL handshake.
Select whether to bypass or block undecryptable SSL sessions.
Default
465 disable bypass
SSL sessions that use client-certificates bypass the SSL inspection by default. This command offers the options to inspect or block that traffic.
Enable to verify SSL session server certificate against stored
CA certificate list.
Enable or disable SMTPS protocol inspection.
disable enable bypass
Fortinet Technologies Inc.
Page 112 FortiOS™ - CLI Reference for FortiOS 5.0
firewall deep-inspection-options
config ssl
Configure SSL settings.
Variable
allow-invalid-server-cert
{enable | disable} inspect-all
{enable | disable} ssl-ca-list
{enable | disable}
Description
Enable to allow SSL sessions even if server certificate validation failed for the session.
Inspect all.
Enable to verify SSL session server certificate against stored CA certificate list.
Default
disable disable disable
config ssl-server
Configure ssl server settings for use with the secure protocols (https, ftps, pop3s, smtps).
Variable
edit <table_id> ftps-client-cert-request
{block | bypass | inspect} https-client-cert-request
{block | bypass | inspect}
Description
Enter a number to identify this SSL server in the list of configured SSL servers
Select what action is taken by the FortiGate SSL proxy when the client certificate request fails during the FTPS client handshake.
Default
bypass
SSL sessions that use client-certificates bypass the SSL inspection by default. This command offers the options to inspect or block that traffic.
Select what action is taken by the FortiGate SSL proxy when the client certificate request fails during the HTTPS client handshake.
bypass imaps-client-cert-request
{block | bypass | inspect}
SSL sessions that use client-certificates bypass the SSL inspection by default. This command offers the options to inspect or block that traffic.
Select what action is taken by the FortiGate SSL proxy when the client certificate request fails during the IMAPS client handshake.
bypass ip <ipv4_addr> pops3-client-cert-request
{block | bypass | inspect}
SSL sessions that use client-certificates bypass the SSL inspection by default. This command offers the options to inspect or block that traffic.
Enter the IP address of the SSL server.
Select what action is taken by the FortiGate SSL proxy when the client certificate request fails during the POP3S client handshake.
bypass
SSL sessions that use client-certificates bypass the SSL inspection by default. This command offers the options to inspect or block that traffic.
Fortinet Technologies Inc.
Page 113 FortiOS™ - CLI Reference for FortiOS 5.0
firewall deep-inspection-options
Variable
smtps-client-cert-request
{block | bypass | inspect}
Description
Select what action is taken by the FortiGate SSL proxy when the client certificate request fails during the SMTPS client handshake.
Default
bypass ssl-other-client
{block | bypass | inspect}
SSL sessions that use client-certificates bypass the SSL inspection by default. This command offers the options to inspect or block that traffic.
Select what action is taken by the FortiGate SSL proxy when the client certificate request fails during the client handshake for SSL protocols other than those above.
bypass
SSL sessions that use client-certificates bypass the SSL inspection by default. This command offers the options to inspect or block that traffic.
Fortinet Technologies Inc.
Page 114 FortiOS™ - CLI Reference for FortiOS 5.0
firewall dnstranslation
dnstranslation
Use this command to add, edit or delete a DNS translation entry. If DNS translation is configured, the FortiGate unit rewrites the payload of outbound DNS query replies from internal
DNS servers, replacing the resolved names’ internal network IP addresses with external network IP address equivalents, such as a virtual IP address on a FortiGate unit’s external network interface. This allows external network hosts to use an internal network DNS server for domain name resolution of hosts located on the internal network.
Syntax
config firewall dnstranslation edit
<index_int> set dst <destination_ipv4> set netmask <address_ipv4mask>
end
Variable Description Default
<index_int>
Enter the unique ID number of the DNS translation entry.
dst <destination_ipv4> Enter the IP address or subnet on the external network to substitute for the resolved address in DNS query replies.
No default.
0.0.0.0
netmask
<address_ipv4mask> src <source_ipv4> dst can be either a single IP address or a subnet on the external network, but must be equal in number to the number of mapped IP addresses in src.
If src and dst are subnets rather than single IP addresses, enter the netmask for both src and dst.
Enter the IP address or subnet on the internal network to compare with the resolved address in DNS query replies. If the resolved address matches, the resolved address is substituted with dst.
0.0.0.0
0.0.0.0
Fortinet Technologies Inc.
Page 115 FortiOS™ - CLI Reference for FortiOS 5.0
firewall DoS-policy, DoS-policy6
DoS-policy, DoS-policy6
Use these commands to configure Denial of Service (DoS) policies:
Dos-policy applies to
IPv4 traffic,
Dos-policy6 applies to IPv6 traffic.
FortiGate Intrusion Protection uses Denial of Service (DoS) sensors to identify network traffic anomalies that do not fit known or preset traffic patterns. Four statistical anomaly types for the
TCP, UDP, and ICMP protocols can be identified.
Flooding
Scan
Source session limit
Destination session limit
If the number of sessions targeting a single destination in one second is over a threshold, the destination is experiencing flooding.
If the number of sessions from a single source in one second is over a threshold, the source is scanning.
If the number of concurrent sessions from a single source is over a threshold, the source session limit is reached.
If the number of concurrent sessions to a single destination is over a threshold, the destination session limit is reached.
Enable or disable logging for each anomaly, and select the action taken in response to detecting an anomaly. Configure the anomaly thresholds to detect traffic patterns that could represent an attack.
It is important to estimate the normal and expected traffic on the network before changing the default anomaly thresholds. Setting the thresholds too low could cause false positives, and setting the thresholds too high could allow some attacks.
The list of anomalies can be updated only when the FortiGate firmware image is upgraded.
Syntax
config firewall DoS-policy edit <dospolicy_id_int>
config anomaly edit
set
set
end set
end set
quarantine {attacker | both | interface | none}
set
Fortinet Technologies Inc.
Page 116 FortiOS™ - CLI Reference for FortiOS 5.0
firewall DoS-policy, DoS-policy6
Variable
client-reputation
{enable | disable} dstaddr <name_str> interface <name_str> service <name_str> srcaddr <name_str> status {enable | disable}
Description
Enable or disable the client reputation feature in this policy.
Enter one or more destination firewall addresses.
Set the interface.
Default
disable
No default.
No default.
Enter one or more services to which the policy applies. No default.
Enter one or more source firewall addresses.
Enable or disable the specified anomaly in the current
DoS sensor.
config anomaly fields
<anomaly_str>
Enter the name of the anomaly you want to configure.
Display a list of the available anomaly types by entering
‘?’.
action {block | pass}
Pass or block traffic in which the specified anomaly is detected.
log {enable | disable}
Enable or disable logging of the specified anomaly in the current DoS sensor.
quarantine {attacker | both
| interface | none}
To prevent the attacker from continuing to attack the
FortiGate unit, you can quarantine the attacker to the banned user list in one of three ways.
No default.
disable
No default.
pass disable none
• Enter attacker to block all traffic sent from the attacker’s IP address. The attacker’s IP address is also added to the banned user list. The target’s address is not affected.
• Enter both to block all traffic sent from the attacker’s IP address to the target (victim’s) IP address. Traffic from the attacker’s IP address to addresses other than the victim’s IP address is allowed. The attacker’s and target’s IP addresses are added to the banned user list as one entry.
• Enter interface to block all traffic from connecting to the FortiGate unit interface that received the attack. The interface is added to the banned user list.
• Enter none to disable the adding of addresses to the quarantine but the current DoS sensor.
status {enable | disable}
Enable or disable the specified anomaly in the current
DoS sensor.
threshold <threshold_int>
Enter the number of times the specified anomaly must be detected in network traffic before the action is triggered.
Range 1 to 2 147 483 647.
disable varies by anomaly
Fortinet Technologies Inc.
Page 117 FortiOS™ - CLI Reference for FortiOS 5.0
firewall
gtp
Use this command to configure GTP profiles. This command is FortiOS Carrier only.
Syntax
config firewall gtp edit
config apn edit
set
set
end set
config ie-remove-policy edit
set
remove-ies {apn-restriction rat-type rai uli imei}
set
end config ie-validation set
apn-restriction {disable | enable}
set
charging-ID {disable | enable}
set
charging-gateway-addr {disable | enable}
set
end-user-addr {disable | enable}
set
set
set
set
set
set
ms-validated {disable | enable}
set
set
set
pdp-context {disable | enable}
set
qos-profile {disable | enable}
set
set
set
reordering-required {disable | enable}
set
selection-mode {disable | enable}
end set
config imsi edit
end set
set
set
set
Fortinet Technologies Inc.
Page 118 FortiOS™ - CLI Reference for FortiOS 5.0
gtp
firewall
Fortinet Technologies Inc.
gtp
config ip-policy edit
set
set
end set
config message-filter edit
set
set
set
set
set
set
set
set
set
error-indication {allow | deny}
set
set
set
fwd-srns-context {allow | deny}
set
set
set
mbms-notification {allow | deny}
set
set
note-ms-present {allow | deny}
set
pdu-notification {allow | deny}
set
set
set
relocation-cancel {allow | deny}
set
set
set
support-extension {allow | deny}
set
unknown-message-action {allow | deny}
set
set
set
version-not-support {allow | deny}
end config message-rate-limit edit
set set set end config noip-policy edit
set
set
set
set
Page 119 FortiOS™ - CLI Reference for FortiOS 5.0
firewall
Fortinet Technologies Inc.
end config policy edit
set
set
set
set
set
max-apn-restriction {all | private-1 | private-2 | public-1 | public-2}
set
messages {create-req create-res update-req update-res}
set
set
rat-type {any geran utran wlan}
set
end
Page 120
gtp
FortiOS™ - CLI Reference for FortiOS 5.0
firewall
end
set unknown-message-action {allow | deny} set unknown-version-action {allow | deny}
set update-pdp {allow | deny} set version-not-support {allow | deny}
Variable
<name_str> apn
Description
Enter the name of this GTP profile.
The following commands are the options for config apn.
index_int
Enter the unique ID number of the APN filter profile.
action {allow | deny}
Select to allow or deny traffic matching both the APN and Selection Mode specified for this APN filter profile.
Default
No default.
No default.
allow
gtp
Fortinet Technologies Inc.
Page 121 FortiOS™ - CLI Reference for FortiOS 5.0
firewall
Variable
selection-mode
{ms net vrf}
Description
Select the selection mode or modes required for the
APN. The selection mode indicates where the APN originated and whether the Home Location Register
(HLR) has verified the user subscription.
Default
ms net vrf
• Enter ms to specify a mobile station provided APN, subscription not verified. This Selection Mode indicates that the mobile station (MS) provided the
APN and that the HLR did not verify the user's subscription to the network.
• Enter net to specify a network-provided APN, subscription not verified. This Selection Mode indicates that the network provided a default APN because the MS did not specify one, and that the
HLR did not verify the user's subscription to the network.
• Enter vrf to specify a mobile station or networkprovided APN, subscription verified. This Selection
Mode indicates that the MS or the network provided the APN and that the HLR verified the user's subscription to the network.
Enter the network ID and operator ID of the APN.
No default.
value <networkid_str> ie-remove-policy
The following commands are the
set options for config ie-remove-policy.
<index_int>
Enter the unique ID number of the IE removal policy.
No default.
remove-ies
{apn-restriction rat-type rai uli imei} sgsn-addr
<addr/group_str> ie-validation
Select the information elements to be removed from messages prior to being forwarding to the HGGSN. Any combination of R6 information elements (RAT, RAI, ULI,
IMEI-SV and APN restrictions) may be specified.
Enter an SGSN address or group the IE removal policy will be applied to.
apnrestriction rat-type rai uli imei all
The following commands allow validating specific parts of the IE apn-restriction
{disable | enable}
Enable to restrict the Access Point Number (APN).
Restricting the APN limits the IP packet data networks that can be associated with the GTP tunnel.
charging-ID
{disable | enable} charging-gateway-addr
{disable | enable} end-user-addr
{disable | enable} gsn-addr
{disable | enable} imei {disable | enable} imsi {disable | enable} mm-context
{disable | enable}
Enable to validate the charging ID in the IE.
Enable to validate the charging gateway address.
Enable to validate the end user address.
Enable to validate the GSN address.
Enable to validate the IMEI (SV).
Enable to validate the IMSI.
Enable to validate the MM context.
disable disable disable disable disable disable disable disable
gtp
Fortinet Technologies Inc.
Page 122 FortiOS™ - CLI Reference for FortiOS 5.0
firewall
Variable Description Default
ms-tzone
{disable | enable} ms-validated
{disable | enable}
Enable to validate the mobile station (MS) timezone.
Enable to validate the MS.
msisdn {disable | enable} Enable to validate the MSISDN.
nsapi {disable | enable}
Enable to validate the NSAPI.
pdp-context
{disable | enable} qos-profile
{disable | enable}
Enable to validate the PDP context.
Enable to validate the Quality of Service (QoS).
rai {disable | enable}
Enable to validate the RAI.
rat-type {disable | enable} Enable to validate the RAT type.
reordering-required
{disable | enable} selection-mode
{disable | enable} uli {disable | enable} imsi
Enable to validate the required reordering.
Enable to validate the selection mode.
Enable to validate the User Location Information (ULI).
disable disable disable disable disable disable disable disable disable disable disable
The following commands are the options for config imsi.
<index_int>
Enter the unique ID number of the IMSI filtering policy.
disable action {allow | deny}
Select to allow or deny traffic matching both the APN and Selection Mode specified for this APN filter profile allow apn <networkid_str>
Enter the network ID and operator ID of the APN.
mcc-mnc <mccmnc_str>
Enter the MCC and MNC.
selection-mode {ms net vrf}
Select the selection mode or modes. The selection mode indicates where the APN originated and whether the Home Location Register (HLR) has verified the user subscription.
No default.
No default.
ms net vrf
• Enter ms to specify a mobile station provided APN, subscription not verified. This Selection Mode indicates that the mobile station (MS) provided the
APN and that the HLR did not verify the user's subscription to the network.
• Enter net to specify a network-provided APN, subscription not verified. This Selection Mode indicates that the network provided a default APN because the MS did not specify one, and that the
HLR did not verify the user's subscription to the network.
• Enter vrf to specify a mobile station or networkprovided APN, subscription verified. This Selection
Mode indicates that the MS or the network provided the APN and that the HLR verified the user's subscription to the network.
gtp
Fortinet Technologies Inc.
Page 123 FortiOS™ - CLI Reference for FortiOS 5.0
firewall
Variable
ip-policy
Description Default
The following commands are the
options for config ip-policy.
<index_int>
Enter the unique ID number of the encapsulated IP traffic filtering policy.
action {allow | deny}
Select to allow or deny traffic matching both the source and destination addresses specified for this APN filter profile dstaddr <address_str>
Enter the name of a destination address or address group.
srcaddr <address_str> message-filter
Enter the name of a source address or address group.
No default.
allow
No default.
No default.
The following tunnel management messages are used to create, update and delete tunnels used to route tunneled PDUs between a MS and a PDN via SGSN and GGSN.
create-aa-pdp {allow | deny}
Allow Anonymous Access Packet Data Protocol (AA
PDP) tunnel management messages.
allow
These messages are used to create a tunnel between a context in the SGSN and context GGSN.
create-mbms {allow | deny}
Allow Multimedia Broadcast Multicast Service (MBMS) create messages. These messages occur when a GTP-
U tunnel is setup for a multicast flow.
create-pdp {allow | deny} Allow create PDP context tunnel management messages. allow allow
SEnt from a SGSN to a GGSN node as part of the
GPRS PDP Context Activation procedure
Allow data record messages.
data-record {allow | deny} allow delete-aa-pdp {allow | deny}
Data record messages are used to reliably transport
CDRs from the point of generation (SGSN/GGSN) to non-volatile storage in the CGF
Allow Anonymous Access (AA) PDP context tunnel management messages. allow
These messages are sent between the SGSN and
GGSN as part of the AA PDP context deactivation procedure.
delete-mbms {allow | deny}
Allow delete MBMS messages.
These messages are part of the request to deactivate the MBMS context. When the response is received, the
MBMS context will be inactive.
delete-pdp {allow | deny} Allow delete PDP context tunnel management message. allow allow echo {allow | deny}
Messages are sent as part of the GPRS Detach
Procedure to deactivate an activated PDP Context.
Allow Echo path management messages.
These messages are sent to a GSN peer to see if it is alive.
allow
gtp
Fortinet Technologies Inc.
Page 124 FortiOS™ - CLI Reference for FortiOS 5.0
firewall
Variable
error-indication {allow | deny} failure-report {allow | deny}
Description
Allow error indication message.
These messages are sent to the GGSN when a tunnel
PDU is received when
Default
allow
• no PDP context exists
• PDP context is inactive
• no MM context exists
• GGSN deletes its PDP context when the message is received
Allow failure report messages. allow
The GGSN sends the failure report request, and the
GSN sends the response. Causes for the failure can include: fwd-relocation {allow | deny}
• request accepted
• no resources available
• service not supported
• system failure
• mandatory IE incorrect
• mandatory IE missing
• optional IE incorrect
• invalid message format
• version not supported
Allow forward relocation mobility management messages.
These messages indicate mobile activation/deactivation within a Routing Area. This prevents paging of a mobile device that is not active
(visited VLR rejects calls from the HLR or applies Call
Forwarding). Note that the mobile station does not maintain an attach/detach state.
allow fwd-srns-context {allow | deny}
SRNS contexts contain for each concerned RAB the sequence numbers of the GTP-PDUs next to be transmitted in uplink and downlink directions.
Allow forward SRNS context mobility management messages.
allow
This procedure may be used to trigger the transfer of
SRNS contexts from RNC to CN (PS domain) in case of inter system forward handover.
gtp-pdu {allow | deny}
Allow GPRS Packet data unit delivery management messages.
identification {allow | deny}
Allow identification mobility management messages.
If the mobile station (MS) identifies itself at GPRS attach, and the SGSN has changed since the detach, the new SGSN will send an identification message to the old SGSN to get the IMSI.
allow allow
gtp
Fortinet Technologies Inc.
Page 125 FortiOS™ - CLI Reference for FortiOS 5.0
firewall
Variable
mbms-notification {allow
| deny}
Description
Allow MBMS notification MBMS messages.
These are used for the notification of the radio access devices.
node-alive {allow | deny} Allow node alive GTP-U messages.
Default
allow allow
This message is used to inform the rest of the network when a node starts service.
Allow Note MS messages.
allow note-ms-present {allow | deny} pdu-notification {allow | deny}
This message is sent when an MS should be reachable for GPRS.
Allow PDU notification messages including response, request, and reject response.
These messages are sent between the GGSN and
SGSN as part of the new PDP context initiation procedure. ran-info {allow | deny}
Allow Radio Access Network (RAN) information messages.
redirection {allow | deny} Allow redirection GTP-U messages. allow allow allow
Used to divert the flow of CDRs from the CDFs to another CGF when the sender is being removed, or they are used when the CGF has lost its connection to a downstream system.
relocation-cancel {allow | deny}
Allow relocation cancel mobility messages.
Send to cancel the relocation of a connection.
send-route {allow | deny} Allow Send Routing information for GPRS messages.
allow allow sgsn-context {allow | deny}
This message is sent to get the IP address of the SGSN where the MS is located when there is no PDP context.
Allow Serving GPRS Support Node (SGSN) context request, response, and acknowledge messages.
allow
The new SGSN will send this message to the old SGSN to get the Mobility Management (MM) and PDP contexts for the MS.
support-extension {allow | deny} unknown-message-action
{allow | deny}
Allow messages about support various header extensions.
Allow unknown message action messages.
This message type needs to be set to deny as that will prevent malformed messages which may be attempts to hack into the network.
update-mbms {allow | deny}
Allow MBMS update messages.
update-pdp {allow | deny} Allow Update PDP context tunnel management messages. allow allow allow allow
Messages sent as part of the GPRS Inter-SGSN
Routing Update procedure, and is used to change the
QoS and the path.
gtp
Fortinet Technologies Inc.
Page 126 FortiOS™ - CLI Reference for FortiOS 5.0
firewall gtp
Variable
version-not-support
{allow | deny}
Description
Allow version not supported path management messages.
Default
allow
This message indicates the more recent version of GTP that is supported. message-rate-limit
The following commands are rate limits in packets per second for various message context requests and responses. A rate of zero indicates there is no rate limiting in place. create-aa-pdp-request create-aa-pdp-response create-mbms-request create-mbms-response create-pdp-request create-pdp-response delete-aa-pdp-request delete-aa-pdp-response delete-mbms-request delete-mbms-response delete-pdp-request delete-pdp-response echo-reponse echo-request error-indication failure-report-request failure-report-response fwd-reloc-complete-ack fwd-relocation-complete fwd-relocation-request fwd-relocation-response fwd-srns-context fwd-srns-context-ack g-pdu identification-request identification-response mbms-de-reg-request mbms-de-reg-response mbms-notify-rej-request mbms-notify-rej-response mbms-notify-request mbms-notify-response mbms-reg-request mbms-reg-response mbms-ses-start-request
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
Fortinet Technologies Inc.
Page 127 FortiOS™ - CLI Reference for FortiOS 5.0
firewall gtp
Variable Description Default
mbms-ses-start-response mbms-ses-stop-request mbms-ses-stop-response note-ms-request note ms GPRS present request note-ms-response pdu-notify-rej-request note ms GPRS present response pdu-notify-rej-response rate limit (packs/s) for pdu notification reject response
0 pdu-notify-request 0
0
0
0
0
0
0 pdu-notify-response ran-info relocation-cancel-request relocation-cancelresponse
RAN information relay
0
0
0
0 send-route-request send-route-response sgsn-context-ack sgsn-context-request sgsn-context-response support-ext-hdr-notify update-mbms-request update-mbms-response update-pdp-request update-pdp-response version-not-support noip-policy
0
0
0
0
0
0
0
0
0
0
0
The following commands are the options for config noip-policy.
<index_int>
Enter the unique ID number of the encapsulated non-IP traffic filtering policy.
action {allow | deny}
Select to allow or deny traffic matching the message protocol specified for this APN filter profile start <protocol_int>
Enter the number of the start protocol. Acceptable rate values range from 0 to 255.
end <protocol_int>
Enter the number of the end protocol. Acceptable rate values range from 0 to 255.
type {etsi | ietf} policy
Select an ETSI or IETF protocol type.
The following commands are the options for config policy.
<index_int>
Enter the unique ID number of the advanced filtering policy.
action {allow | deny}
Select to allow or deny traffic matching the message attributes specified for this advanced filtering policy apn <apn_str> imei <imei_str>
Enter the APN suffix, if required.
Enter the IMEI (SV) pattern, if required.
No default.
allow
0
0 etsi
No default.
allow
No default.
No default.
Fortinet Technologies Inc.
Page 128 FortiOS™ - CLI Reference for FortiOS 5.0
firewall
Variable
imsi <imsi_str> max-apn-restriction {all | private-1 | private-2 | public-1 | public-2} messages {create-req create-res update-req update-res} rai <rai_str>
Description
Enter the IMSI prefix, if required.
Select the maximum APN restriction.
Enter the type or types of GTP messages.
Enter the Routing Area Identifier (RAI) pattern.
rat-type {any geran utran wlan}
The RAI and ULI are commonly used to determine a mobile user’s location.
Enter one or more Radio Access Technology (RAT) types.
Default
No default.
all create-req
No default.
any
• any - accept any RAT type
• geran - GSM EDGE Radio Access Network
• utran - UMTS Terrestrial Radio Access Network
• wlan - Wireless LAN uli <uli_str> context-id <id_int>
Enter the ULI pattern.
The following commands are the options for edit <profile_str>.
addr-notify <Gi_ipv4>
Enter the IP address of the Gi firewall.
apn-filter
{enable | disable} authorized-sgsns
<addr/grp_str>
Select to apply APN filter policies.
Enter authorized SSGN addresses or groups. Any
SSGN groups not specified will not be able to send packets to the GGSN. All firewall addresses and groups defined on the FortiGate unit are available for use with this command.
Enter the security context ID. This ID must match the ID entered on the server Gi firewall.
control-plane-messagerate-limit <limit_int>
Enter the control plane message rate limit. Acceptable rate values range from 0 (no limiting) to 2147483674 packets per second.
FortiGate units can limit the packet rate to protect the
GSNs from possible Denial of Service (DoS) attacks, such as Border gateway bandwidth saturation or a GTP flood.
create-aa-pdp
{allow | deny}
Select to allow or deny all create AA pdp messages.
create-pdp {allow | deny} Select to allow or deny all create pdp messages.
data-record
{allow | deny} default-apn-action
{allow | deny}
Select to allow or deny all data record messages.
Select to allow or deny any APN that is not explicitly defined with in an APN policy.
default-imsi-action
{allow | deny} default-ip-action
{allow | deny}
Select to allow or deny any IMSI that is not explicitly defined in an IMSI policy.
Select to allow or deny any encapsulated IP address traffic that is not explicitly defined in an IP policy.
No default.
0.0.0.0
disable all
696
0 allow allow allow allow allow allow
gtp
Fortinet Technologies Inc.
Page 129 FortiOS™ - CLI Reference for FortiOS 5.0
firewall
Variable Description Default
default-noip-action
{allow | deny} default-policy-action
{allow | deny}
Select to allow or deny any encapsulated non-IP protocol that is not explicitly defined in a non-IP policy.
Select to allow or deny any traffic that is not explicitly defined in an advanced filtering policy.
delete-aa-pdp
{allow | deny}
Select to allow or deny all delete AA pdp messages.
delete-pdp {allow | deny} Select to allow or deny all delete pdp messages.
denied-log
{enable | disable} echo {allow | deny} error-indication
{allow | deny} extension-log
{enable | disable}
Select to log denied GTP packets.
Select to allow or deny all echo messages.
Select to log extended information about GTP packets.
When enabled, this additional information will be included in log entries: allow allow allow allow disable allow
Select to allow or deny all error indication messages.
allow disable
• IMSI
• MSISDN
• APN
• Selection Mode
• SGSN address for signaling
• SGSN address for user data
• GGSN address for signaling
• GGSN address for user data failure-report
{allow | deny} forwarded-log
{enable | disable} fwd-relocation
{allow | deny} fwd-srns-context
{allow | deny}
Select to allow or deny all failure report messages.
Select to log forwarded GTP packets.
Select to allow or deny all forward relocation messages.
Select to allow or deny all forward SRNS messages.
gtp-in-gtp {allow | deny} Select to allow or deny GTP packets that contains another GTP packet in its message body.
allow disable allow allow allow gtp-pdu {allow | deny}
Select to allow or deny all G-PDU messages.
handover-group
<group_name>
Handover requests will be honored only from the addresses listed in the specified address group. This way, an untrusted GSN cannot highjack a GTP tunnel with a handover request.
allow
No default.
identification
{allow | deny} ie-remover
{enable | disable} imsi-filter
{enable | disable}
Select to allow or deny all identification messages.
Select whether to use information element removal policies.
Select whether to use IMSI filter policies.
allow disable disable
gtp
Fortinet Technologies Inc.
Page 130 FortiOS™ - CLI Reference for FortiOS 5.0
firewall gtp
Variable
interface-notify
<interface_str>
Description
Enter any local interface of the FortiGate unit. The interface IP address will be used to send the “clear session” message.
invalid-reserved-field
{allow | deny}
Select to allow or deny GTP packets with invalid reserved fields. Depending on the GTP version, a varying number of header fields are reserved and should contain specific values. If the reserved fields contain incorrect values, the packet will be blocked if this field is set to deny.
ip-filter {enable | disable} Select whether to use encapsulated IP traffic filtering policies.
log-freq <drop_int>
Enter the number of messages to drop between logged messages.
An overflow of log messages can sometimes occur when logging rate-limited GTP packets exceed their defined threshold. To conserve resources on the syslog server and the FortiGate unit, you can specify that some log messages are dropped. For example, if you want only every twentieth message to be logged, set a logging frequency of 19. This way, 19 messages are skipped and the next logged.
Default
deny disable
0 max-message-length
<bytes_int>
Acceptable frequency values range from 0 to
2147483674. When set to ‘0’, no messages are skipped.
Enter the maximum GTP message size, in bytes, that the FortiGate unit will allows to pass.
1452 min-message-length
<bytes_int>
Acceptable values range from 0 to 2147483674 bytes.
When set to ‘0’, the maximum size restriction is disabled.
Enter the minimum GTP message size, in bytes, that the FortiGate unit will allows to pass.
0
Acceptable values range from 0 to 2147483674 bytes.
When set to ‘0’, the minimum size restriction is disabled.
miss-must-ie
{allow | deny}
Select to allow or deny passage of GTP packets with missing mandatory information elements to the GGSN.
node-alive {allow | deny} Select to allow or deny all node alive messages.
noip-filter
{enable | disable} note-ms-present
{allow | deny}
Enable or disable the configured encapsulated non-IP traffic filtering policies.
Select to allow or deny all note MS GPRS present messages.
out-of-state-ie
{allow | deny} out-of-state-message
{allow | deny}
Select to allow or deny passage of GTP Packets with out of sequence information elements.
Select to allow or deny out of state messages.
The GTP protocol requires a certain state to be kept by both the GGSN and SGSN. Since the GTP has a state, some message types can only be sent when in specific states. Packets that do not make sense in the current state should be filtered or rejected deny allow disable allow deny deny
Fortinet Technologies Inc.
Page 131 FortiOS™ - CLI Reference for FortiOS 5.0
firewall gtp
Variable Description Default
pdu-notification
{allow | deny} policy-filter
{enable | disable}
Select to allow or deny all pdu notification messages.
Enable or disable the configured advanced filtering policies.
port-notify <port_int>
Enter the server firewall’s listening port number.
ran-info {allow | deny}
Select to allow or deny all RAN info relay messages.
rate-limited-log
{enable | disable}
Select to log rate-limited GTP packets.
allow disable
21123 allow disable redirection {allow | deny} Select to allow or deny all redirection messages.
relocation-cancel
{allow | deny} allow
Select to allow or deny all relocation cancel messages.
allow reserved-ie {allow | deny} Select to allow or deny GTP messages with reserved or undefined information elements.
deny allow disable send-route {allow | deny} Select to allow or deny all send route messages.
seq-number-validate
{enable | disable}
Enable or disable sequence number validation
The GTP packet header contains a sequence number.
The receiving GGSN and the sending GGSN use this number to ensure the packets are in sequence. The
FortiGate unit can assume this task and save GGSN resources.
sgsn-context
{allow | deny} spoof-src-addr
{allow | deny}
Select to allow or deny all SGSN context messages.
Select to allow or deny packets containing spoofed MS addresses.
allow deny state-invalid-log
{enable | disable} support-extension
{allow | deny} traffic-count-log
{enable | disable}
As the MS address is negotiated within the PDP
Context creation handshake, any packets originating from the MS that contain a different source address will be detected and dropped if this field is set to deny.
Select to log GTP packets that have failed stateful inspection.
Select to allow or deny all support extension messages.
allow
Enable or disable logging the total number of control and user data messages received from and forwarded to the GGSNs and SGSNs the FortiGate unit protects.
tunnel-limit <limit_int>
Enter the maximum number of GTP tunnels according to the GSN capacity.
disable disable
0 tunnel-limit-log
{enable | disable} tunnel-timeout
<time_int>
Select to log packets dropped because the maximum limit of GTP tunnels for the destination GSN is reached.
Enter a tunnel timeout value, in seconds. By setting a timeout value, you can configure the FortiGate unit to remove hanging tunnels.
Acceptable values range from 0 to 2147483674 seconds. When set to ‘0’, the timeout is disabled.
disable
86400 unknown-message-action
{allow | deny} unknown-version-action
{allow | deny}
Select to allow or deny all unknown message types.
Select to allow or deny traffic with GTP version higher than 1.
allow allow
Fortinet Technologies Inc.
Page 132 FortiOS™ - CLI Reference for FortiOS 5.0
firewall
Variable
update-pdp
{allow | deny} version-not-support
{allow | deny}
Description
Select to allow or deny all update pdp messages.
Select to allow or deny all version not supported messages.
Default
allow allow
gtp
Fortinet Technologies Inc.
Page 133 FortiOS™ - CLI Reference for FortiOS 5.0
firewall identity-based-route
identity-based-route
Use this command to define identity-based routes.
Syntax
config firewall identity-based-route edit
<route_name_str> set comments <comment_str>
config rule edit <id_int> set
end set
set
end
Description Variable
<route_name_str> comments
<comment_str> device <interface> gateway <ip4_addr> groups <group_list>
Enter the output interface for this route.
Enter the gateway IP address.
Default
No default.
No default.
No default.
0.0.0.0
Enter the groups who are allowed to use this route.
Separate group names with spaces.
No default.
Fortinet Technologies Inc.
Page 134 FortiOS™ - CLI Reference for FortiOS 5.0
firewall interface-policy
interface-policy
DoS policies, called interface policies in the CLI, are primarily used to apply DoS sensors to network traffic based on the FortiGate interface it is leaving or entering as well as the source and destination addresses. DoS sensors are a traffic anomaly detection feature to identify network traffic that does not fit known or common traffic patterns and behavior. A common example of anomalous traffic is the denial of service attack. A denial of service occurs when an attacking system starts an abnormally large number of sessions with a target system. The large number of sessions slows down or disables the target system so legitimate users can no longer use it. You can also use the
Interface-policy command to invoke an IPS sensor as part of a DoS policy.
The interface-policy command is used for DoS policies applied to IPv4 addresses. For
IPv6 addresses, use interface-policy6 instead.
Syntax
config firewall interface-policy edit <policy_id>
end
Variable
application-list-status
{enable | disable} application_list
<app_list_str>
Description
Enable to have the FortiGate unit apply an application black/white list to matching network traffic.
Enter the name of the application black/white list the
FortiGate unit uses when examining network traffic.
av-profile-status
{enable | disable} av-profile
<avprofile_name> dlp-profile-status
{enable | disable}
Default
disable
No default.
This option is available only when application-list-status is set to enable.
Enable to apply an antivirus profile to traffic on this interface.
Enter the antivirus profile to apply. This is available when av-profile-status is enabled.
Enable to apply a Data Leak Prevention (DLP) profile to traffic on this interface.
disable
No default.
disable
Fortinet Technologies Inc.
Page 135 FortiOS™ - CLI Reference for FortiOS 5.0
firewall interface-policy
Variable
dlp-profile
<avprofile_name>
Description
Enter the Data Leak Prevention (DLP) profile to apply.
This is available when dlp-profile-status is enabled.
dstaddr <dstaddr_ipv4>
Enter an address or address range to limit traffic monitoring to network traffic sent to the specified address or range.
interface <int_str> ips-sensor-status
{enable | disable}
The interface or zone to be monitored.
Enable to have the FortiGate unit examine network traffic for attacks and vulnerabilities.
ips-sensor <sensor_str>
Enter the name of the IPS sensor the FortiGate unit will use when examining network traffic.
Default
No default.
disable
No default.
service <service_str>
This option is available only when ips-sensorstatus is set to enable.
Enter a service to limit traffic monitoring to only the selected type. You may also specify a service group, or multiple services separated by spaces.
spamfilter-profile
<spfilter_profile_name> spamfilter-profile-status
{enable | disable}
Enter the spamfilter profile to apply. This is available when spamfilter-profile-status is enabled.
Enable to apply a spamfilter profile to traffic on this interface.
srcaddr <srcaddr_ipv4>
Enter an address or address range to limit traffic monitoring to network traffic sent from the specified address or range.
status {enable | disable}
Enable or disable the DoS policy. A disabled DoS policy has no effect on network traffic.
webfilter-profile-status
{enable | disable} webfilter-profile
<webfilter_profile_name>
Enable to apply a webfilter profile to traffic on this interface.
Enter the webfilter profile to apply. This is available when webfilter-profile-status is enabled.
No default.
No default.
disable
No default.
enable disable
No default.
Fortinet Technologies Inc.
Page 136 FortiOS™ - CLI Reference for FortiOS 5.0
firewall interface-policy6
interface-policy6
DoS policies (called interface policies in the CLI) for IPv6 addresses, are used to apply IPS sensors to network traffic based on the FortiGate interface it is leaving or entering as well as the source and destination addresses.
The interface-policy6 command is used for DoS policies applied to IPv6 addresses. For
IPv4 addresses, use interface-policy instead.
Syntax
config firewall interface-policy6 edit <policy_id>
end
Variable
application-list-status
{enable | disable}
Description
Enable to have the FortiGate unit apply an application black/white list to matching network traffic.
application_list <app_list_str> Enter the name of the application black/white list the FortiGate unit uses when examining network traffic.
Default
disable
No default.
This option is available only when applicationlist-status is set to enable.
av-profile-status
{enable | disable}
Enable to apply an antivirus profile to traffic on this interface.
av-profile <avprofile_name>
Enter the antivirus profile to apply. This is available when av-profile-status is enabled.
dlp-profile-status
{enable | disable}
Enable to apply a Data Leak Prevention (DLP) profile to traffic on this interface.
dlp-profile <avprofile_name>
Enter the Data Leak Prevention (DLP) profile to apply. This is available when dlp-profile-status is enabled.
disable
No default.
disable
No default.
Fortinet Technologies Inc.
Page 137 FortiOS™ - CLI Reference for FortiOS 5.0
firewall
Variable
dstaddr6 <dstaddr_ipv6> interface ips-sensor-status
{enable | disable} ips-sensor <sensor_str> service6 <service_str> spamfilter-profile
<spfilter_profile_name> spamfilter-profile-status
{enable | disable} srcaddr6 <srcaddr_ipv6> status {enable | disable} webfilter-profile-status
{enable | disable} webfilter-profile
<webfilter_profile_name>
interface-policy6
Description
Enter an address or address range to limit traffic monitoring to network traffic sent to the specified address or range.
Default
The interface or zone to be monitored.
Enable to have the FortiGate unit examine network traffic for attacks and vulnerabilities.
No default.
disable
Enter the name of the IPS sensor the FortiGate unit will use when examining network traffic.
No default.
This option is available only when ips-sensorstatus is set to enable.
Enter a service to limit traffic monitoring to only the selected type. You may also specify a service group, or multiple services separated by spaces.
Enter the spamfilter profile to apply. This is available when spamfilter-profile-status is enabled.
No default.
Enable to apply a spamfilter profile to traffic on this interface.
disable
Enter an address or address range to limit traffic monitoring to network traffic sent from the specified address or range.
enable
Enable or disable the DoS policy. A disabled DoS policy has no effect on network traffic.
Enable to apply a webfilter profile to traffic on this interface.
disable
Enter the webfilter profile to apply. This is available when webfilter-profile-status is enabled.
No default.
Fortinet Technologies Inc.
Page 138 FortiOS™ - CLI Reference for FortiOS 5.0
firewall ipmacbinding setting
ipmacbinding setting
Use this command to configure IP to MAC address binding settings.
IP/MAC binding protects the FortiGate unit and/or the network from IP address spoofing attacks. IP spoofing attacks attempt to use the IP address of a trusted computer to connect to, or through, the FortiGate unit from a different computer. It is simple to change a computer’s IP address to mimic that of a trusted host, but MAC addresses are often added to Ethernet cards at the factory, and are more difficult to change. By requiring that traffic from trusted hosts reflect both the IP address and MAC address known for that host, fraudulent connections are more difficult to construct.
To configure the table of IP addresses and the MAC addresses bound to them, see
“ipmacbinding table” on page 140 . To enable or disable IP/MAC binding for an individual
FortiGate unit network interface, see ipmac in
“system interface” on page 555 .
If IP/MAC binding is enabled, and the IP address of a host with an IP or MAC address in the
IP/MAC table is changed, or a new computer is added to the network, update the IP/MAC table. If you do not update the IP/MAC binding list, the new or changed hosts will not have access to or through the FortiGate unit. For details on updating the IP/MAC binding table, see
“ipmacbinding table” on page 140 .
If a client receives an IP address from the FortiGate unit’s DHCP server, the client’s MAC address is automatically registered in the IP/MAC binding table. This can simplify IP/MAC binding configuration, but can also neutralize protection offered by IP/MAC binding if untrusted hosts are allowed to access the DHCP server. Use caution when enabling and providing access to the DHCP server.
Syntax
config firewall ipmacbinding setting set
bindthroughfw {enable | disable}
end set
set
Variable
bindthroughfw
{enable | disable} bindtofw
{enable | disable} undefinedhost
{allow | block}
Description
Select to use IP/MAC binding to filter packets that a firewall policy would normally allow through the FortiGate unit.
Select to use IP/MAC binding to filter packets that would normally connect to the FortiGate unit.
disable block
Select how IP/MAC binding handles packets with IP and MAC addresses that are not defined in the IP/MAC list for traffic going through or to the FortiGate unit.
Default
disable
• allow: Allow packets with IP and MAC address pairs that are not in the IP/MAC binding list.
• block: Block packets with IP and MAC address pairs that are not in the IP/MAC binding list.
This option is available only when either or both bindthroughfw and bindtofw are enable.
Fortinet Technologies Inc.
Page 139 FortiOS™ - CLI Reference for FortiOS 5.0
firewall ipmacbinding table
ipmacbinding table
Use this command to configure IP and MAC address pairs in the IP/MAC binding table. You can bind multiple IP addresses to the same MAC address, but you cannot bind multiple MAC addresses to the same IP address.
To configure the IP/MAC binding settings, see “ipmacbinding setting” on page 139
. To enable or disable IP/MAC binding for an individual FortiGate unit network interface, see ipmac in
“system interface” on page 555 .
If IP/MAC binding is enabled, and the IP address of a host with an IP or MAC address in the
IP/MAC table is changed, or a new computer is added to the network, update the IP/MAC table. If you do not update the IP/MAC binding list, the new or changed hosts will not have access to or through the FortiGate unit.
If a client receives an IP address from the FortiGate unit’s DHCP server, the client’s MAC address is automatically registered in the IP/MAC binding table. This can simplify IP/MAC binding configuration, but can also neutralize protection offered by IP/MAC binding if untrusted hosts are allowed to access the DHCP server. Use caution when enabling and providing access to the DHCP server.
Syntax
config firewall ipmacbinding table edit
<index_int> set ip <address_ipv4> set mac <address_hex>
end
set name <name_str> set status {enable | disable}
Variable
<index_int> ip <address_ipv4> mac <address_hex> name <name_str> status
{enable | disable}
Description
Enter the unique ID number of this IP/MAC pair.
Enter the IP address to bind to the MAC address.
Default
No default.
0.0.0.0
To allow all packets with the MAC address, regardless of the IP address, set the IP address to
0.0.0.0.
Enter the MAC address.
00:00:00:00:00:00
To allow all packets with the IP address, regardless of the MAC address, set the MAC address to
00:
00:00:00:00:00.
Enter a name for this entry on the IP/MAC address table. (Optional.)
Select to enable this IP/MAC address pair.
noname disable
Packets not matching any IP/MAC binding will be dropped. Packets matching an IP/MAC binding will be matched against the firewall policy list.
Fortinet Technologies Inc.
Page 140 FortiOS™ - CLI Reference for FortiOS 5.0
firewall ippool, ippool6
ippool, ippool6
Use the firewall ippool command to configure IPv4 IP address pools.
Use the firewall ippool6 command to configure IPv6 IP address pools.
Use IP pools to add NAT policies that translate source addresses to addresses randomly selected from the IP pool, rather than the IP address assigned to that FortiOS™ unit interface.
In Transparent mode, IP pools are available only from the FortiGate CLI.
An IP pool defines a single IP address or a range of IP addresses. A single IP address in an IP pool becomes a range of one IP address. For example, if you enter an IP pool as 1.1.1.1 the IP pool is actually the address range 1.1.1.1 to 1.1.1.1.
If a FortiGate interface IP address overlaps with one or more IP pool address ranges, the interface responds to ARP requests for all of the IP addresses in the overlapping IP pools.
For example, consider a FortiGate unit with the following IP addresses for the port1 and port2 interfaces:
• port1 IP address: 1.1.1.1/255.255.255.0 (range is 1.1.1.0-1.1.1.255)
• port2 IP address: 2.2.2.2/255.255.255.0 (range is 2.2.2.0-2.2.2.255)
And the following IP pools:
• IP_pool_1: 1.1.1.10-1.1.1.20
• IP_pool_2: 2.2.2.10-2.2.2.20
• IP_pool_3: 2.2.2.30-2.2.2.40
The port1 interface overlap IP range with IP_pool_1 is:
• (1.1.1.0-1.1.1.255) and (1.1.1.10-1.1.1.20) = 1.1.1.10-1.1.1.20
The port2 interface overlap IP range with IP_pool_2 is:
• (2.2.2.0-2.2.2.255) & (2.2.2.10-2.2.2.20) = 2.2.2.10-2.2.2.20
The port2 interface overlap IP range with IP_pool_3 is:
• (2.2.2.0-2.2.2.255) & (2.2.2.30-2.2.2.40) = 2.2.2.30-2.2.2.40
And the result is:
• The port1 interface answers ARP requests for 1.1.1.10-1.1.1.20
• The port2 interface answers ARP requests for 2.2.2.10-2.2.2.20 and for 2.2.2.30-2.2.2.40
Select NAT in a firewall policy and then select Dynamic IP Pool and select an IP pool to translate the source address of packets leaving the FortiGate unit to an address randomly selected from the IP pool.
Fortinet Technologies Inc.
Page 141 FortiOS™ - CLI Reference for FortiOS 5.0
firewall ippool, ippool6
Syntax
config firewall ippool edit
end
set type {one-to-one | overload | fixed-port-range
Variable
<ippool_name_str> arp-intf
<interface_name>
Description
Enter a name for this IP pool.
Send ARP replies only to the specified interface. Leave unset to send replies to all interfaces. arp-reply must be enabled.
arp-reply
{enable | disable}
Enable or disable ARP replies.
block-size <size_int>
Set the size of the port block. Available when type is port-block-allocation. Range 64 to 4096 endip <address_ipv4>
The end IP of the address range. The end IP must be higher than the start IP. The end IP does not have to be on the same subnet as the IP address of the interface for which you are adding the IP pool.
num-blocks-per-user
<int>
Set the number of ports per user when when type is port-block-allocation. Range: 1 to 128.
source-startip
<address_ipv4>
Enter start IP for the range when type is fixed-portrange.
source-endip
<address_ipv4>
Enter end IP for the range when type is fixed-portrange.
startip <address_ipv4> The start IP of the address range. The start IP does not have to be on the same subnet as the IP address of the interface for which you are adding the IP pool.
type {one-to-one
| overload
| fixed-port-range
| port-block-allocation}
Select the type of IP pool: one-to-one — one-to-one mapping overload — clients can share pool IP addresses
Default
No default.
Null enable
128
0.0.0.0
8
0.0.0.0
0.0.0.0
0.0.0.0
overload fixed-port-range — fixed mapping of source-startip / source-endip range to startip
/ endip range.
port-block-allocation — allocate a block of ports for IP pool users
Fortinet Technologies Inc.
Page 142 FortiOS™ - CLI Reference for FortiOS 5.0
firewall ip-translation
ip-translation
Use this command to configure IP address translation.
Syntax
config firewall ip-translation edit
<iptrans_id> set endip <ipv4_addr> set map-startip
end
Variable
<iptrans_id> endip <ipv4_addr> map-startip startip <ipv4_addr>
Description Default
Enter an ID number for this IP address translation.
No default.
Enter the end of the IP address range to translate.
0.0.0.0
Enter the beginning of the mapped address range.
0.0.0.0
Enter the beginning of the IP address range to translate.
0.0.0.0
Fortinet Technologies Inc.
Page 143 FortiOS™ - CLI Reference for FortiOS 5.0
firewall
ipv6-eh-filter
Use this command to configure IPv6 routing header packet filtering.
Syntax
config firewall ipv6-eh-filter set
set
set
set
set
set
set
set
end
Variable
hop-opt
{enable | disable} dest-opt
{enable | disable} hdopt-type
<type_int_list>
Description
Enable to block packets with Hop-by-Hop Options header.
Default
disable
Enable to block packets with Destination Options header.
disable
Enable to block specific Hop-by-Hop and/or Destination
Option types. Types are integers, separate type values with spaces.
0
Enable to block packets with Routing header.
enable routing
{enable | disable} routing-type
<type_int_list>
Enable to block specific Routing header types (maximum
7 types, each between 0 and 255). Types are integers, separate type values with spaces.
0
Enable to block packets with Fragment header.
disable fragment
{enable | disable} auth
{enable | disable} no-next
{enable | disable}
Enable to block packets with Authentication header.
Enable to block packets with No Next header.
disable disable
ipv6-eh-filter
Fortinet Technologies Inc.
Page 144 FortiOS™ - CLI Reference for FortiOS 5.0
firewall ldb-monitor
ldb-monitor
Use this command to configure health check settings.
Health check settings can be used by load balancing VIPs to determine if a real server is currently responsive before forwarding traffic. One health check is sent per interval using the specified protocol, port and HTTP-GET, where applicable to the protocol. If the server does not respond during the timeout period, the health check fails and, if retries are configured, another health check is performed. If all health checks fail, the server is deemed unavailable, and another real server is selected to receive the traffic according to the selected load balancing algorithm.
Health check settings can be re-used by multiple real servers. For details on enabling health
checking and using configured health check settings, see “firewall vip” on page 222 .
Syntax
config firewall ldb-monitor edit
<name_str> set http-get <httprequest_str>
end
Variable
<name_str> http-get
<httprequest_str>
Description
Enter the name of the health check monitor.
Default
No default.
For HTTP health check monitors, add a URL that the
FortiGate unit uses when sending a get request to check the health of a HTTP server. The URL should match an actual
URL for the real HTTP servers. The URL is optional.
No default.
The URL would not usually include an IP address or domain name. Instead it should start with a
/and be followed by the address of an actual web page on the real server. For example, if the IP address of the real server is
10.10.10.1, the
URL /test_page.htm causes the FortiGate unit to send am HTTP get request to http:
//10.10.10.1/test_page.htm.
This option appears only if type is http.
Fortinet Technologies Inc.
Page 145 FortiOS™ - CLI Reference for FortiOS 5.0
firewall ldb-monitor
Variable
http-match
<contentmatch_str>
Description Default
For HTTP health check monitors, add a phrase that a real
HTTP server should include in response to the get request sent by the FortiGate unit using the content of the http-get option. If the
No default.
http-get URL returns a web page, the http-match option should exactly match some of the text on the web page. You can use the http-get and http-matched options to verify that an HTTP server is actually operating correctly by responding to get requests with expected web pages. http-match is only required if you add a http-get
URL.
For example, you can set http-match to “server test page” if the real HTTP server page defined by http-get contains the phrase server test page. When the
FortiGate unit receives the web page in response to the URL get request, the system searches the content of the web page for the http-match phrase.
This option appears only if type is http.
Enter the interval time in seconds between health checks.
10 interval
<seconds_int> port <port_int>
Enter the port number used to perform the health check. If you set the
Port to 0, the health check monitor uses the port defined in the real server. This way you can use a single health check monitor for different real servers.
0
This option does not appear if type is ping.
retry <retries_int>
Enter the number of times that the FortiGate unit should retry the health check if a health check fails. If all health checks, including retries, fail, the server is deemed unavailable.
timeout
<seconds_int>
Enter the timeout in seconds. If the FortiGate unit does not receive a response to the health check in this period of time, the health check fails.
type {http | ping
| tcp}
Select the protocol used by the health check monitor.
3
2
No default.
Fortinet Technologies Inc.
Page 146 FortiOS™ - CLI Reference for FortiOS 5.0
firewall local-in-policy, local-in-policy6
local-in-policy, local-in-policy6
Use these commands to create firewall policies for traffic destined for the FortiGate unit itself.
Syntax
config firewall local-in-policy (for IPv4 traffic) config firewall local-in-policy6 (for IPv6 traffic) edit
end
Variable
<index_int>
Description
Enter the unique ID number of this policy. Enter 0 to assign the next available ID.
Default
action
{accept | deny} auto-asic-offload
{enable | disable} intf <name_str>
Select the action that the FortiGate unit will perform on traffic matching this firewall policy.
Enable or disable session offload to NP or SP processors.
deny enable
Enter the source interface. This is the interface through which the traffic reaches the FortiGate unit.
No default.
srcaddr <name_str>
Enter one or more source firewall addresses for the policy. Separate multiple firewall addresses with a space.
No default.
dstaddr <name_str>
Enter one or more destination firewall addresses for the policy. Separate multiple firewall addresses with a space.
No default.
service <name_str>
Enter the name of one or more services, or a service group, to match with the firewall policy. Separate multiple services with a space.
No default.
schedule <name_str> Enter the name of the one-time or recurring schedule or schedule group to use for the policy.
status
{enable | disable}
Enable or disable this policy.
No default.
enable
Fortinet Technologies Inc.
Page 147 FortiOS™ - CLI Reference for FortiOS 5.0
firewall mms-profile
mms-profile
Use this command to configure MMS profiles. This command applies to FortiOS Carrier only.
Syntax
config firewall mms-profile edit
<profile_str> set avnotificationtable <index_int> set bwordtable <index_int>
set carrierendpointbwltable <index_int>
set comment <str> set exmwordtable <index_int> set filepattable <index_int>
set mm1comfortinterval <seconds_int>
set mms-checksum-table <tableID_int>
Fortinet Technologies Inc.
Page 148 FortiOS™ - CLI Reference for FortiOS 5.0
firewall
Fortinet Technologies Inc.
mms-profile
set mmsbwordthreshold <score_int> config dupe {mm1 | mm4}
set
action1 {alert-notif archive archive-first block intercept log}
set
set
get
set
set
set
end
set
action1 {alert-notif archive archive-first block intercept log}
set
set
set
set
set
end
set
log-antispam-mass-mms {enable | disable}
set
log-av-block {enable | disable}
set
log-av-carrier-endpoint-filter {enable | disable}
set
log-av-oversize {enable | disable}
set
log-av-virus {enable | disable}
set
log-intercept {enable | disable}
set
log-mms-notification {enable | disable}
set
log-web-content {enable | disable}
end
config notification {alert-dupe-1 | alert-flood-1 | mm1 | mm3 | mm4 | mm7}
set
set
alert-int-mode {minutes | hours}
set
set
alert-status {enable | disable}
set
bword-int <noticeinterval_int>
set
bword-int-mode {minutes | hours}
set
bword-status {enable | disable}
set
carrier-endpoint-bwl-int <interval_int>
set
carrier-endpoint-bwl-int-mode {hours | minutes}
set
carrier-endpoint-bwl-status {enable | disable}
set
days-allowed {monday tuesday wednesday thursday friday saturday sunday}
set
detect-server {enable | disable}
set
set
dupe-int-mode {hours | minutes}
set
dupe-status {enable | disable}
set
Page 149 FortiOS™ - CLI Reference for FortiOS 5.0
firewall mms-profile
set
file-block-int-mode {hours | minutes}
set
file-block-status {enable | disable}
set
set
flood-int-mode {hours | minutes}
set
flood-status {enable | disable}
set
from-in-header {enable | disable}
set
mmsc-hostname {<fqdn_str> | <ipv4>}
set
set
set
set
set
msg-protocol {mm1 | mm3 | mm4 | mm7}
set
msg-type {deliver-req | send-req}
get
set
set
tod-window-start <window_time>
set
tod-window-duration <window_time>
set
set
set
set
set
virus-int-mode {hours | minutes}
set
virus-status {enable | disable}
end end
edit
end set
threshold {dupe-thresh-1 dupe-thresh-2 dupe-thresh-3 flood-thresh-1 flood-thresh-2 flood-thresh-3}
Variable Description
<profile_str> avnotificationtable
<index_int>
Enter the name of this MMS profile.
Enter the ID number of the antivirus notification list to be used for the MMS profile. Antivirus notification tables contain virus names that, when detected, will have the
FortiGate unit send a notification message to the administrator. For more information on antivirus notification tables, see
bwordtable <index_int> Enter the ID number of the web content block filter to be used for MMS traffic.
Default
No default.
No default.
No default.
carrierendpointbwltable
<index_int>
The web content block tables can be configured using the config webfilter bword command.
Enter the ID number of the endpoint, such as MSISDN, filtering table to use for MMS traffic with the MMS profile.
No default.
Fortinet Technologies Inc.
Page 150 FortiOS™ - CLI Reference for FortiOS 5.0
firewall mms-profile
Variable
carrier-endpoint-prefix
{enable | disable} carrier-endpoint-prefixrange-min <limit_int>
Description
Select to add the country code to the extracted carrier endpoint, such as MSISDN, for logging and notification purposes. You can limit the number length for the test numbers used for internal monitoring without a country code.
Enter the minimum carrier endpoint prefix length. If this and endpoint-prefix-range-max are set to zero (0), length is not limited.
0
Default disable carrier-endpoint-prefixrange-max <limit_int>
This option appears only if msisdn-prefix is enable.
Enter the maximum endpoint prefix length. If this and endpoint-prefix-range-min are set to zero (0), length is not limited.
This option appears only if msisdn-prefix is enable.
Enter the endpoint, such as MSISDN, prefix.
0 carrier-endpoint-prefixstring <prefix_str>
No default.
comment <str>
This option appears only if endpoint-prefix is enable.
Enter an optional comment to give additional detail about the MMS profile.
Enter the ID number of the webfilter exempt word list to be used with the MMS profile.
No default.
exmwordtable
<index_int>
The web content exempt tables can be configured using the config webfilter exmword command.
filepattable <index_int> Enter the ID number of the file pattern list to be used with the MMS profile.
0
Fortinet Technologies Inc.
Page 151 FortiOS™ - CLI Reference for FortiOS 5.0
firewall mms-profile
Variable
mm1 {archive-full archive-summary avmonitor avquery bannedword block carrier-endpoint-bwl chunkedbypass clientcomfort exemptword no-content-summary oversize removeblocked scan server-comfort} mm3 {archive-full archive-summary avmonitor avquery bannedword block carrier-endpoint-bwl fragmail no-content-summary oversize removeblocked scan servercomfort splice} mm4 {archive-full archive-summary avmonitor avquery bannedword block carrier-endpoint-bwl fragmail no-content-summary oversize removeblocked scan servercomfort splice} mm7 {archive-full archive-summary avmonitor avquery bannedword block carrier-endpoint-bwl chunkedbypass clientcomfort exemptword no-content-summary oversize removeblocked scan server-comfort}
Description
Select actions, if any, the FortiGate unit will take on MMS messages of the specified protocol.
Default
No default.
archive-full — Content archive both metadata and the
MMS message itself.
archive-summary — Content archive metadata.
avmonitor — Log detected viruses, but allow them through the firewall without modification.
avquery — Use the FortiGuard Antivirus service for virus detection using MD5 checksums.
bannedword — Block messages containing content in the banned word list. no-contentsummary splice
block — Block messages matching the file patterns selected by mms-file-pat-table, even if the files do not contain viruses.
carrier-endpoint-bwl — Enable the black/white list specified with the carrierendpointbwltable command.
chunkedbypass — Allow web sites that use chunked encoding for HTTP to bypass the firewall. Chunked encoding means the HTTP message body is altered to allow it to be transferred in a series of chunks. Use of this feature is a risk. Malicious content could enter the network if web content is allowed to bypass the firewall.
This option only available for the mm1 and mm7 commands.
splice
clientcomfort — Apply client comforting to prevent client timeout. This option is available only for mm1 and mm7.
exemptword — Exempt words from content blocking.
This option only available for the mm1 and mm7 commands.
No default.
fragmail — Pass fragmented email messages.
Fragmented email messages cannot be scanned for viruses. This option only available for the mm3 and mm4 commands.
no-content-summary — Omit MMS filtering statistics from the dashboard.
oversize — Block files that are over the file size limit.
remove-blocked — Remove blocked items from messages.
scan — Scan files for viruses and worms.
server-comfort — Apply server comforting and prevent server timeout. This option is available only for mm1 and mm7.
Fortinet Technologies Inc.
Page 152 FortiOS™ - CLI Reference for FortiOS 5.0
firewall mms-profile
Variable
mm1-addr-hdr
<identifier_str> mm1-addr-source
{cookie | http-header} mm1-convert-hex
{enable | disable} mm1-retr-dupe
{enable | disable} mm1-retrieve-scan
{enable | disable} mm1comfortamount
<size_int>
Description
splice — Simultaneously scan a message and send it to the recipient. If the FortiGate unit detects a virus, it prematurely terminates the connection and returns an error message to the recipient, listing the virus name and infected file name. This option is available only for mm3 and mm4.
Enter the sender address (MSISDN) identifier.
Default
If mm1-addr-source is http-header, the address and its identifier in the HTTP request header is in the format of: x-upcalling-lineid
<Sender Address Identifier>: <MSISDN Value>
For example, the HTTP header might contain: x-up-calling-line-id: 6044301297 where x-up-calling-line-id would be the Sender Address
Identifier.
If mm1-addr-source is cookie, the address and its identifier in the HTTP request header’s Cookie field is in the format of attribute-value pairs:
Cookie: id=<cookie-id>;
<Sender Address Identifier>=<MSISDN Value>
For example, the HTTP request headers might contain:
Cookie: id=0123jf!a;x-up-calling-lineid=6044301297 where x-up-calling-line-id would be the sender address identifier.
Select to extract the sender’s address from the HTTP header field or a cookie.
http-header
Select to convert the sender address from ASCII to hexadecimal or from hexadecimal to ASCII. This is required by some applications.
disable
Select to scan MM1 mm1-retr messages for duplicates.
By default, mm1-retr messages are not scanned for duplicates as they may often be the same without necessarily being bulk or spam.
disable
This option is available only if status is enable for the config dupe mm1 command.
Select to scan message retrieval by MM1. If you select scan for all MMS interfaces, messages are scanned while being sent, and so scanning message retrieval by
MM1 is redundant. In this case, you can disable MM1 message retrieval scanning to improve performance.
Enter the number of bytes client comforting sends each interval to show a download is progressing.
The interval time is set using mm1comfortinterval. enable
1
Fortinet Technologies Inc.
Page 153 FortiOS™ - CLI Reference for FortiOS 5.0
firewall mms-profile
Variable
mm1comfortinterval
<seconds_int> mm1oversizelimit
<limit_int> mm3oversizelimit
<limit_int> mm4oversizelimit
<limit_int> mm7-addr-hdr
<identifier_str> mm7-addr-source
{cookie | http-header} mm7-convert-hex
{enable | disable} mm7oversizelimit
<limit_int> mm7comfortamount
<size_int> mm7comfortinterval
<seconds_int>
Description
Enter the time in seconds before client comforting starts after a download has begun. It is also the interval between subsequent client comforting sends.
Default
10
The amount of data sent each interval is set using mm1comfortamount.
Block files in MM1 streams that are over this file size limit in KB.
Block files in MM4 streams that are over this file size limit in KB.
10240
Block files in MM3 streams that are over this file size limit in KB.
10240
10240
Enter the sender address (MSISDN) identifier.
If of: mm7-addr-source is http-header, the address and its identifier in the HTTP request header is in the format x-upcalling-lineid
<Sender Address Identifier>: <MSISDN Value>
For example, the HTTP header might contain: x-up-calling-line-id: 6044301297 where x-up-calling-line-id would be the Sender Address
Identifier.
If mm7-addr-source is cookie, the address and its identifier in the HTTP request header’s Cookie field is in the format of attribute-value pairs:
Cookie: id=<cookie-id>;
<Sender Address Identifier>=<MSISDN Value>
For example, the HTTP request headers might contain:
Cookie: id=0123jf!a;x-up-calling-lineid=6044301297 where x-up-calling-line-id would be the sender address identifier.
Select to extract the sender’s address from the HTTP header field or a cookie.
http-header
Select to convert the sender address from ASCII to hexadecimal or from hexadecimal to ASCII. This is required by some applications.
Enter the number of bytes client comforting sends each interval to show a download is progressing.
disable
Block files in MM7 streams that are over this file size limit in KB.
10240
1
The interval time is set using mm7comfortinterval.
Enter the time in seconds before client comforting starts after a download has begun. It is also the interval between subsequent client comforting sends.
10
The amount of data sent each interval is set using mm7comfortamount.
Fortinet Technologies Inc.
Page 154 FortiOS™ - CLI Reference for FortiOS 5.0
firewall mms-profile
Variable
mms-checksum-table
<tableID_int> mmsbwordthreshold
<score_int> remove-blockedconst-length
{enable | disable}
Description
Enter the MMS content checksum table ID.
Default
Enter the maximum score an MMS message can have before being blocked. If the combined scores of the content block patterns appearing in an MMS message exceed the threshold value, the message will be blocked.
10
Select to preserve the length of the MMS message when removing blocked content, such as viruses.
disable
config dupe {mm1 | mm4}
Duplicate MMS messages can result from bulk MMS messages, MMS spam, attacks, or other issues.
You can use the config dupe subcommand to detect and act on MMS duplicate messages.
Thresholds that define excessive duplicate messages and response actions are both configurable.
You can configure MMS duplicate message detection for MM1 messages using config dupe mm1 and for MM4 messages using config dupe mm4.
There are four threshold settings each for mm1 and mm4. The integer at the end of each command indicates which threshold you are configuring. By default, only the first threshold is available for configuration. Enable status2 to gain access to the second threshold. Then enable status3 to gain access to the third threshold. Finally, enable status 4 to gain access to the fourth threshold. They must be enabled in sequence.
Fortinet Technologies Inc.
Page 155 FortiOS™ - CLI Reference for FortiOS 5.0
firewall mms-profile
Variable
action1 {alert-notif archive archive-first block intercept log}
Description
Select the actions to take, if any, when excessive duplicate messages are detected. To select more than one action, separate each action with a space.
alert-notif — Enable to have the FortiGate unit send a notification message If this threshold is exceeded.
archive — Archive duplicates in excess of the configured threshold.
archive-first — Archive the first duplicate in excess of the configured threshold.
block — Block and intercept excess duplicates. If block is selected, messages are also intercepted, even if intercept is not selected.
intercept — Intercept excess duplicates.
log — Log excess duplicates. This option takes effect only if logging is enabled for bulk MMS message detection. See
“log-antispam-mass-mms {enable | disable}” on page 158 .
Default
archive block intercept log block-time1
<minutes_int>
This option appears only if status is set to enable for the
MMS interface.
Enter the amount of time in minutes during which the
FortiGate unit will perform the action after a message flood is detected.
100 limit1
<duplicatetrigger_int> protocol1
This option appears only if status is enable for the MMS interface.
Enter the number of messages which signifies excessive message duplicates if exceeded within the window.
This option appears only if status is enable for the MMS interface.
The MMS interface that you are configuring. protocol can be mm1 or mm2 depending on whether you entered config dupe mm1 or config dupe mm4.
This variable can be viewed with the get command, but cannot be set.
Select to detect and act upon duplicate MMS messages.
status1
{enable | disable} status2
{enable | disable} window1
<minutes_int>
Enable to gain access to the second set of threshold configuration settings.
Enter the period of time in minutes during which excessive message duplicates will be detected if the limit is exceeded.
This option appears only if status is enable for the protocol (MM1 or MM4).
.
100 disable disable
60
Fortinet Technologies Inc.
Page 156 FortiOS™ - CLI Reference for FortiOS 5.0
firewall mms-profile
config flood {mm1 | mm4}
Excessive MMS activity (message floods) can result from bulk MMS messages, MMS spam, attacks, or other issues.
You can use the config flood subcommand to detect and act on MMS message floods.
Thresholds that define a flood of message activity and response actions are both configurable.
You can configure MMS flood detection for MM1 messages using config flood mm1 and for
MM4 messages using config flood mm4.
There are four threshold settings for mm1 and mm4. The integer at the end of each command indicates which threshold you are configuring. By default, only the first threshold is available for configuration. Enable status2 to gain access to the second threshold. Then enable status3 to gain access to the third threshold. Finally, enable status 4 to gain access to the fourth threshold.
They must be enabled in sequence.
Variable
action1 {alert-notif archive archive-first block intercept log} block-time1
<minutes_int> limit1
<floodtrigger_int> protocol1 status1
{enable | disable}
Description
Select which actions to take, if any, when excessive message activity is detected. To select more than one action, separate each action with a space.
Default
block intercept log
alert-notif — Enable to have the FortiGate unit send a notification message If this threshold is exceeded.
archive — Archive messages in excess of the configured threshold.
archive-first — Archive the first message in excess of the configured threshold.
block — Block and intercept excess messages. If block is selected, messages are also intercepted, even if intercept is not selected.
intercept — Intercept excess messages.
log — Log excess messages. This option takes effect only if logging is enabled for bulk MMS message detection. See
“log-antispam-mass-mms {enable | disable}” on page 158
.
This option appears only if status is enable for the MMS interface.
Enter the amount of time in minutes during which the
FortiGate unit will perform the action after a message flood is detected.
100
This option appears only if status is enable for the MMS interface.
Enter the number of messages which signifies excessive message activity if exceeded within the window.
This option appears only if status is enable for the MMS interface.
The MMS interface that you are configuring. protocol can be mm1 or mm2 depending on whether you entered config flood mm1 or config flood mm4.
This variable can be viewed with the get command, but cannot be set.
Select to detect and act upon excessive MMS message activity.
100 disable
Fortinet Technologies Inc.
Page 157 FortiOS™ - CLI Reference for FortiOS 5.0
firewall mms-profile
Variable
status2
{enable | disable} window1
<minutes_int>
Description
Enable to gain access to the second threshold configuration settings.
Default
disable
Enter the period of time in minutes during which excessive message activity will be detected if the limit is exceeded.
60
This option appears only if status is enable for the MMS interface.
config log
Use this command to write event log messages when the options that you have enabled in this
MMS profile perform an action. For example, if you enable antivirus protection you could also use the config log command to enable log-av-block so that the FortiGate unit writes an event log message every time a virus is detected.
All of the config log fields are the same as the corresponding config policy fields except the following
Variable
log-antispam-mass-mms
{enable | disable}
Description
log-av-block {enable | disable} Enable to log blocked viruses and files.
log-av-carrier-endpoint-filter
{enable | disable}
Enable to log endpoint, such as MSISDN, blocking, intercepts, and archiving in MMS messages.
log-av-oversize
{enable | disable}
Enable to log oversized messages.
log-av-virus {enable | disable} Enable to log detected viruses.
log-intercept {enable | disable} Enable to log MMS intercept actions in MMS messages.
log-mms-notification
{enable | disable} log-web-content
{enable | disable}
Enable to log duplicate or flood MMS notification messages. Also select the log action for each protocol and bulk MMS message event that you want to log. For details, see
“action1 {alert-notif archive archive-first block intercept log}” on page 156 and
“action1 {alert-notif archive archive-first block intercept log}” on page 156 .
Enable to log MMS notification messages in MMS messages.
Enable to log blocked web content.
Default
disable disable disable disable disable disable disable disable
config notification {alert-dupe-1 | alert-flood-1 | mm1 | mm3 | mm4 | mm7}
Use this command to configure how the FortiGate unit sends MMS messages to MMS clients to inform them that messages have been sent from their device that violate the settings in this
MMS profile. To enable sending notifications you need to enable notification types. You can enable all notification types or you can enable separate notifications for web content blocking, file blocking, end point blocking, flooding, duplicate messages, and virus scanning. You can also use the MMS notifications options to configure how the notification messages are sent.
The FortiGate unit sends notification messages immediately for the first event, then at a configurable interval if events continue to occur. If the interval does not coincide with the window of time during which notices may be sent, the FortiGate unit waits and sends the notice in the next available window. Subsequent notices contain a count of the number of events that have occurred since the previous notification.
Fortinet Technologies Inc.
Page 158 FortiOS™ - CLI Reference for FortiOS 5.0
firewall mms-profile
There are separate notifications for each notification type, including virus events. Virus event notifications include the virus name. Up to three viruses are tracked for each user at a time. If a fourth virus is found, one of the existing tracked viruses is removed.
The notifications are MM1 m-send-req messages sent from the FortiGate unit directly to the
MMSC for delivery to the client. The host name of the MMSC, the URL to which m-send-req messages are sent, and the port must be specified.
Variable
alert-int <int> alert-int-mode
{minutes | hours}
Description
Enter the interval the FortiGate will use to send alert messages. The integer you enter will be interpreted as hours or minutes depending on how the alertint-mode command is set.
Enter minutes or hours. This setting will determine whether the integer entered with the alert-int command is interpreted as minutes or hours.
alert-src-msisdn <str>
Enter the address the alert messages will appear to be sent from.
alert-status {enable | disable}
Enable to have the FortiGate unit send alert messages.
bword-int <noticeinterval_int> Enter the banned word notification send interval.
bword-int-mode
{minutes | hours}
Select whether the value specified in the bword-int command is minutes or hours.
bword-status {enable | disable} Select to send notices for banned word events.
carrier-endpoint-bwl-int
<interval_int>
Enter the amount of time between notifications for endpoint black/white list events. Also set endpoint-bwl-status to enable and select the time unit in endpoint-bwl-int-mode.
carrier-endpoint-bwl-int-mode
{hours | minutes} carrier-endpoint-bwl-status
{enable | disable}
Select the unit of time in minutes or hours for carrier-endpoint-bwl-int.
Select to send notices for endpoint black/white list events.
days-allowed {monday tuesday wednesday thursday friday saturday sunday}
Notifications will be sent on the selected days of the week.
Default
1 hour enable
24 hours disable
24 hours disable detect-server {enable | disable} Select to automatically determine the server address.
dupe-int <interval_int>
Enter the amount of time between notifications of excessive MMS duplicates. Also set dupe-status to enable and select the time unit in dupe-intmode.
dupe-int-mode
{hours | minutes}
Select the unit of time in minutes or hours for dupe-int. Available only for MM1 and MM4 notifications.
monday tuesday wednesday thursday friday saturday sunday enable
24 hours
Fortinet Technologies Inc.
Page 159 FortiOS™ - CLI Reference for FortiOS 5.0
firewall mms-profile
Variable Description
dupe-status {enable | disable}
Select to send notices for excessive MMS message duplicate events. Available only for MM1 and MM4 notifications. Available only for MM1 and MM4 notifications.
file-block-int <interval_int>
Enter the amount of time between notifications of file block events. Also set file-block-status to enable and select the time unit in file-blockint-mode.
file-block-int-mode
{hours | minutes}
Select whether the value specified in the file-block-int command is minutes or hours.
file-block-status
{enable | disable}
Select to send notices for file block events.
flood-int <interval_int>
Enter the amount of time between notifications of excessive MMS activity. Also set flood-status to enable and select the time unit in flood-intmode. Available only for MM1 and MM4 notifications.
flood-int-mode
{hours | minutes}
Select the unit of time in minutes or hours for flood-int. Available only for MM1 and MM4 notifications.
flood-status {enable | disable}
Select to send notices for excessive MMS message activity events. Available only for MM1 and MM4 notifications.
from-in-header
{enable | disable} mmsc-hostname {<fqdn_str> |
<ipv4>}
Select to insert the “from” address in the HTTP header.
Enter the FQDN or the IP address of the destination server.
mmsc-password <passwd_str> Enter the password required for sending messages using this server. (Optional) mmsc-port <port_int>
Enter the port number the server is using.
mmsc-url <url_str> mmsc-username <user_str>
Enter the URL address of the server.
Enter the user-name required for sending messages using this server. (Optional)
Default
disable
24 hours disable
24 hours disable disable
No default.
No default.
Varies by msg-prot ocol.
No default.
No default.
msg-protocol
{mm1 | mm3 | mm4 | mm7}
Select the protocol to use for sending notification messages.
msg-type
{deliver-req | send-req}
Select the type of notification message directed to either a VASP or a MMSC.
Depends on protocol
{mm1 | mm3 | mm4 | mm7}.
deliver-req
Fortinet Technologies Inc.
Page 160 FortiOS™ - CLI Reference for FortiOS 5.0
firewall
Variable
protocol rate-limit <limit_int> tod-window-start
<window_time> tod-window-duration
<window_time> user-domain <fqdn_str> vas-id <vas_str> vasp-id <vasp_str> virus-int <interval_int> virus-int-mode
{hours | minutes} virus-status
{enable | disable}
mms-profile
Description
The MMS interface that you are configuring. protocol can be mm1, mm3, mm4 or mm7 depending on the message type that you are configuring notifications for.
Default
This variable can be viewed with the get command, but cannot be set.
Enter the number of notifications to send per second. If you enter zero (0), the notification rate is not limited.
0
Select the time of day to begin sending notifications. If you select a start and end time of zero (
00:00), notifications are not limited by time of day.
00:00
Select the duration of the period during which the
FortiGate unit will send notification messages. If you select a start and duration time of zero (
00:00), notifications are not limited by time of day.
00:00
No default.
Enter the FQDN of the server to which the user’s address belongs.
Enter the value added service (VAS) ID to be used when sending a notification message.
No default.
This option is available only when msg-type is set to send-req.
Enter the value added service provider (VASP) ID to be used when sending a notification message.
No default.
This option is available only when msg-type is set to send-req.
Enter the amount of time between notifications for antivirus events. Also set virus-status to enable and select the time unit in virus-intmode.
Select the unit of time in minutes or hours for virus-int.
Select to send notices for antivirus events.
24 hours disable
Fortinet Technologies Inc.
Page 161 FortiOS™ - CLI Reference for FortiOS 5.0
firewall mms-profile
Example
This example shows how to enable sending MMS notifications for all MM3 notification types and set the interval for each one to 400 minutes: config firewall mms-profile edit example config notification mm3 set bword-status enable set bword-int-mode minutes set bword-int 400 set file-block-status enable set file-block-mode minutes set file-block-int 400 set carrier-endpoint-bwl-status enable set carrier-endpoint-bwl-int-mode minutes set carrier-endpoint-bwl-int 400 end set virus-status enable set virus-int-mode minutes set virus-int 400 end
config notif-msisdn
Individual MSISDN users can be configured to have specific duplicate and flood thresholds.
Variable
<msisdn_int> threshold
{dupe-thresh-1 dupe-thresh-2 dupe-thresh-3 flood-thresh-1 flood-thresh-2 flood-thresh-3}
Description
Enter the MSISDN number. Enter a new number to create a new entry.
Enter the thresholds on which this MSISDN user will receive an alert. Clear all thresholds with the unset threshold command.
Default
(null)
Fortinet Technologies Inc.
Page 162 FortiOS™ - CLI Reference for FortiOS 5.0
firewall multicast-address
multicast-address
Use this command to configure multicast firewall addresses used in firewall multicast policies.
Addresses, address groups, and virtual IPs must have unique names to avoid confusion in firewall policies. If an address is selected in a policy, it cannot be deleted until it is deselected from the policy.
Syntax
config firewall multicast-address edit
set type {broadcastmask | multicastrange}
end
set visibility {enable | disable}
Variable
<name_str>
Description
Enter the name of the address. There are also predefined addresses: Bonjour, EIGRP, OSPF, all_hosts, all_routers. associated-interface
<interface_str>
Enter the name of the associated interface.
If not configured, the firewall address is bound to an interface during firewall policy configuration.
color <color_int>
Set the icon color to use in the web-based manager.
0 sets the default, color 1.
Default
No default.
No default.
0 comment
<comment_string> end-ip
<address_ipv4>
Enter a descriptive comment for this address.
If
No default.
type is iprange, enter the last IP address in the range. 0.0.0.0
start-ip
<address_ipv4>
If type is iprange, enter the first IP address in the range. 0.0.0.0
subnet <ip4mask>
Enter a broadcast IP/mask to be treated as multicast address. Available when type is broadcastmask.
tags <tags_str>
Enter object tags applied to this address. Separate tag names with spaces.
0.0.0.0 0.0.0.0
null
Fortinet Technologies Inc.
Page 163 FortiOS™ - CLI Reference for FortiOS 5.0
firewall multicast-address
Variable
type
{broadcastmask
| multicastrange} visibility
{enable | disable}
Description
Select the type of multicast address:
Default
multicastrange broadcastmask—define a broadcast IP/mask in subnet to be treated as multicast address.
multicastrange—define multicast IP address range in start-ip and end-ip.
Select whether this address is available in firewall multicast policy address fields in the web-based manager. enable
Fortinet Technologies Inc.
Page 164 FortiOS™ - CLI Reference for FortiOS 5.0
firewall multicast-policy
multicast-policy
Use this command to configure a source NAT IP. This command can also be used in Transparent mode to enable multicast forwarding by adding a multicast policy.
The matched forwarded (outgoing) IP multicast source IP address is translated to the configured IP address. For additional options related to multicast, see
in
and
tp-mc-skip-policy {enable | disable} in
.
Syntax
config firewall multicast-policy edit
end
Variable Description
<index_int> action {accept | deny} auto-asic-offload
{enable | disable}
Enter the unique ID number of this multicast policy.
Enter the policy action.
Enable or disable session offloading to SP processors.
dstaddr
<addr_name_list>
Only available in NAT/Route operation mode.
dnat <address_ipv4> Enter an IP address to destination network address translate (DNAT) externally received multicast destination addresses to addresses that conform to your organization's internal addressing policy.
Enter the names of multicast destination addresses for this policy. Separate address names with spaces. These addresses are defined in
.
dstintf <name_str>
Enter the destination interface name to match against multicast NAT packets.
logtraffic
{enable | disable} snat
{enable | disable} srcaddr
<addr_name_list>
Enable or disable recording traffic log messages for this policy.
Enable substitution of outgoing interface IP address for the original source IP address.
Enter the names of source IP addresses for this policy.
Separate address names with spaces. These addresses are defined in
Default
No default.
accept enable
0.0.0.0
No default.
No default.
disable disable
No default.
Fortinet Technologies Inc.
Page 165 FortiOS™ - CLI Reference for FortiOS 5.0
firewall multicast-policy
Variable Description
srcintf <name_str>
Enter the source interface name to match against multicast
NAT packets.
status
{enable | disable} protocol
<multicastlimit_int>
Enable or disable this policy.
Limit the number of protocols (services) sent out via multicast using the FortiGate unit.
start-port <port_int> The beginning of the port range used for multicast.
Availability of this field depends on protocol.
end-port <port_int>
The end of the port range used for multicast. Availability of this field depends on protocol.
Default
No default.
enable
0
No default.
65535
Fortinet Technologies Inc.
Page 166 FortiOS™ - CLI Reference for FortiOS 5.0
firewall policy, policy6
policy, policy6
Use these commands to add, edit, or delete firewall policies.
• Use config firewall policy for IPv4 policies
• Use config firewall policy6 for IPv6 policies
Firewall policies control all traffic passing through the FortiGate unit. Firewall policies are instructions used by the FortiGate unit to decide what to do with a connection request. The policy directs the firewall to allow the connection, deny the connection, require authentication before the connection is allowed, or apply IPSec or SSL VPN processing.
If you are creating a policy that involves IPv6 addresses, some of the IPv4 options, such as NAT and VPN settings, are not applicable.
Syntax
config firewall policy or config firewall policy6 edit
Fortinet Technologies Inc.
Page 167 FortiOS™ - CLI Reference for FortiOS 5.0
firewall
Fortinet Technologies Inc.
policy, policy6
Page 168 FortiOS™ - CLI Reference for FortiOS 5.0
firewall
Fortinet Technologies Inc.
set redirect-url <name_str> set replacemsg-group <name_str>
set webproxy-forward-server <fwd_srv_name_string> set wsso {enable | disable}
policy, policy6
Page 169 FortiOS™ - CLI Reference for FortiOS 5.0
firewall
end
edit
set
action {accept | deny | capture}
set
set
set
captive-portal {device-identification
| email-collection | forticlient-download}
set
client-reputation {enable | disable}
set
deep-inspection-options <profile_name>
set
set
set
set
endpoint-compliance {enable | disable}
set
set
set
set
set
set
profile-group {group | single}
set
profile-protocol-options <name_str>
set
set
set
set
set
set
set
set
traffic-shaper-reverse <name_str>
set
set
set
end set
end
policy, policy6
Fortinet Technologies Inc.
Page 170 FortiOS™ - CLI Reference for FortiOS 5.0
firewall policy, policy6
Variable
<index_int> action
{accept | deny | ipsec | sslvpn}
Description Default
Enter the unique ID number of this policy.
Select the action that the FortiGate unit will perform on traffic matching this firewall policy.
No default.
deny
accept — Allow packets that match the firewall policy.
Also enable or disable nat to make this a NAT policy
(NAT/Route mode only), enable or disable ippool so that the NAT policy selects a source address for packets from a pool of IP addresses added to the destination interface, and enable or disable fixedport so that the NAT policy does not translate the packet source port.
deny — Deny packets that match the firewall policy. active-auth-method {basic
| digest | form | ntlm}
ipsec — Allow and apply IPSec VPN. When action is set to ipsec, you must specify the vpntunnel attribute. You may also enable or disable the inbound, outbound, natoutbound, and natinbound attributes and/or specify a natip value.
ssl-vpn — Allow and apply SSL VPN. When action is set to ssl-vpn, you may specify values for the sslvpn-auth, sslvpn-ccert, and sslvpncipher attributes.
For IPv6 policies, only accept, deny and ssl-vpn options are available.
Select the active authentication method to use. This is available if srcintf is web-proxy and identitybased is enabled. If sso-auth-method is set, it is tried first.
null
basic — client must authenticate with a user-ID and password for each realm. User name and password are sent unencrypted
digest — a nonce value is sent to client in the challenge and is included when the client sends a response of an MD5 checksum for the combination of their user-ID, password, nonce, and URI requested.
The FortiOS unit has all this information and can confirm the MD5 checksum is correct.
fsso — use Fortinet Single Sign On (FSSO) authentication with FSSO clients on a Windows AD network. This option is available only if ip-based is enabled.
form — use Form-based authentication
ntlm — NT Lan manager (ntlm) - ntlm uses Windows
AD and Internet Explorer to authenticate through the browser. Useful when FSSO client cannot be installed on Windows AD server.
If basic is enabled, FSSO_GUEST_user cannot be selected under Identity Based Policy (IBP).
Fortinet Technologies Inc.
Page 171 FortiOS™ - CLI Reference for FortiOS 5.0
firewall policy, policy6
Variable
application
{enable | disable}
Description
Enable or disable tracking the application usage of each host. This is available when auto-profiling is enabled.
Default
disable
Enter the name of the application list to add to the firewall policy.
(null) application-list
<name_str>
This option appears only if identity-based is disable and utm-status is enable.
auth-cert <certificate_str> Select an HTTPS server certificate for policy authentication.
No default.
auth-path {enable | disable} self-sign is the built-in, self-signed certificate; if you have added other certificates, you may select them instead.
This option appears only if identity-based is enable.
Select to apply authentication-based routing. You must also specify a RADIUS server, and the RADIUS server must be configured to supply the name of an object specified in config router auth-path. For details on configuring authentication-based routes, see
“router auth-path” on page 345
.
disable auth-portal {enable | disable} auth-redirect-addr
<domainname_str> auto-asic-offload
{enable | disable} av-profile <name_str>
This option appears only when the FortiGate unit is operating in NAT mode and identity-based is enable.
For details on NAT and transparent mode, see
“opmode {nat | transparent}” on page 674
.
Enable or disable use of the external authentication portal defined in
Enter the IP address or domain name to redirect user
HTTP requests after accepting the authentication disclaimer. The redirect URL could be to a web page with extra information (for example, terms of usage).
disable
No default.
To prevent web browser security warnings, this should match the CN field of the specified auth-cert, which is usually a fully qualified domain name (FQDN).
This option appears only if identity-based is enable.
Enable or disable session offload to NP or SP processors.
enable
This is available on models that have network processors.
Enter the name of the antivirus profile to add to the firewall policy.
This option appears only if identity-based is disable and utm-status is enable. To add an avprofile, you must obtain an adequate profile name in profile-protection-options.
(null)
Fortinet Technologies Inc.
Page 172 FortiOS™ - CLI Reference for FortiOS 5.0
firewall policy, policy6
Variable
bandwidth
{enable | disable} block-notification
{enable | disable} capture-packet
{enable | disable} central-nat
{enable | disable} client-reputation
{enable | disable} client-reputation-mode
{learning | monitoring}
Description
Enable or disable tracking the bandwidth usage of each host. This is available when auto-profiling is enabled.
Default
disable
Enable to display Fortinet Bar in browser when a site is
blocked. Fortinet Bar must be enabled in firewall profile-protocol-options
.
disable disable
Enable or disable packet capture. This is available when logtraffic is all or utm.
Enable or disable use of the central NAT table in this policy.
disable
This is available only when nat is enabled.
Enable to turn on client reputation monitoring. disable
This option is visible only when action is set to accept.
Set client reputation mode to one of learning or monitoring.
Set to learning to establish a baseline of client network usage patterns.
Set to monitoring when baseline has been established. It will monitor the client’s network patterns for abnormalities. When monitoring, client network usage data is logged for use in reports.
This is available when client-reputation is enabled.
comments <comment_str> Enter a description or other information about the policy. (Optional)
No default.
custom-log-fields
<fieldid_int> comment_str is limited to 63 characters. Enclose the string in single quotes to enter special characters or spaces.
Enter custom log field index numbers to append one or more custom log fields to the log message for this policy. Separate multiple log custom log field indices with a space. (Optional.)
No default.
deep-inspection-options
<profile_name>
This option takes effect only if logging is enabled for the policy, and requires that you first define custom log fields. For details, see
“log custom-field” on page 278 .
Enter the name of the deep inspection options profile to apply. See
“firewall deep-inspection-options” on page 109 .
Enable or disable the Device Detection Portal.
No default.
disable device-detection-portal
{enable | disable} diffserv-forward
{enable | disable} diffserv-reverse
{enable | disable}
Enable or disable application of the differentiated services code point (DSCP) value to the DSCP field of forward (original) traffic. If enabled, also configure diffservcode-forward.
Enable or disable application of the differentiated services code point (DSCP) value to the DSCP field of reverse (reply) traffic. If enabled, also configure diffservcode-rev.
disable disable
Fortinet Technologies Inc.
Page 173 FortiOS™ - CLI Reference for FortiOS 5.0
firewall policy, policy6
Variable
diffservcode-forward
<dscp_bin> diffservcode-rev
<dscp_bin> disclaimer {enable | disable} dlp-sensor <name_str>
Description
Enter the differentiated services code point (DSCP) value that the FortiGate unit will apply to the field of originating (forward) packets. The value is 6 bits binary.
The valid range is 000000-111111.
Default
000000
This option appears only if diffserv-forward is enable.
For details and DSCP configuration examples, see the
Knowledge Center article Differentiated Services Code
Point (DSCP) behavior .
Enter the differentiated services code point (DSCP) value that the FortiGate unit will apply to the field of reply (reverse) packets. The value is 6 bits binary. The valid range is 000000-111111.
000000
This option appears only if diffserv-rev is enable
For details and DSCP configuration examples, see the
Knowledge Center article Differentiated Services Code
Point (DSCP) behavior .
Enable to display the authentication disclaimer page, which is configured with other replacement messages.
The user must accept the disclaimer to connect to the destination.
disable
Enter the name of the DLP sensor to add to the firewall policy.
(null)
This option appears only if identity-based is disable and utm-status is enable.
dponly {enable | disable}
For FortiOS Carrier, enable to configure the firewall policy to only accept sessions with source addresses that are in the dynamic profile user context list.
Sessions with source addresses that are not in the user context list do not match the policy. For sessions that don’t match the policy, the FortiOS Carrier unit continues searching down the policy list for a match. dstaddr <name_str> dstaddr6 <name_str>
Enter one or more destination firewall addresses, or a virtual IP, if creating a NAT policy. Separate multiple firewall addresses with a space.
disable
No default.
Use dstaddr6 for IPv6 addresses.
If action is set to ipsec, enter the name of the IP address to which IP packets may be delivered at the remote end of the IPSec VPN tunnel.
If action is set to ssl-vpn, enter the name of the IP address that corresponds to the host, server, or network that remote clients need to access behind the
FortiGate unit.
dstaddr-negate
{enable | disable}
For details on configuring virtual IPs, see
Enable to negate dstaddr match. This causes dstaddr to specify what the destination address must
not be. disable
Fortinet Technologies Inc.
Page 174 FortiOS™ - CLI Reference for FortiOS 5.0
firewall policy, policy6
Variable
dstintf <name_str> email-collection-portal
{enable | disable} endpoint-check
{enable | disable} endpoint-keepaliveinterface <intf_name> endpoint-profile
<ep_profile_name> failed-connection
{enable | disable} fall-throughunauthenticated
{enable | disable} firewall-session-dirty
{check-all | check-new}
Description Default
Enter the destination interface(s) for the policy. Enter the source interface(s) for the policy. Separate interface names with spaces.
No default.
The interface can be a physical interface, a VLAN subinterface, or a zone.
If action is set to ipsec, enter the name of the interface to the external (public) network.
If action is set to ssl-vpn, enter the name of the interface to the local (private) network.
Note: If a interface or VLAN subinterface has been added to a zone, the interface or VLAN subinterface cannot be used for dstintf.
Enable or disable email collection from new devices.
disable
Enable to perform endpoint NAC compliance check.
This check denies access to this firewall policy for hosts that do not have up-to-date FortiClient Endpoint
Security software running. You need to also configure endpoint-profile.
disable
Note: If the firewall policy involves a load balancing virtual IP, the endpoint compliance check is not performed.
For more information, see
“endpoint-control” on page 91 .
If endpoint-check is enabled, this field is available to specify the keepalive interface. The default is a null string, which is interpreted as the source interface.
null
Select the endpoint NAC profile to apply. This is available when endpoint-check is enabled. For information about creating endpoint NAC profiles, see
“endpoint-control profile” on page 93
.
No default.
Enable or disable tracking of failed connection attempts. This is available when auto-profiling is enabled.
disable
Enable to allow an unauthenticated user to skip authentication rules and possibly match another policy.
disable
Select how to manage changes to a firewall policy: check-all — flush all current sessions and re-evaluate them check-new — keep existing sessions and apply policy change to new sessions only check-all
Fortinet Technologies Inc.
Page 175 FortiOS™ - CLI Reference for FortiOS 5.0
firewall policy, policy6
Variable
fixedport
{enable | disable} forticlient-compliancedevices <device_type_str>
Description
Enable to preserve packets’ source port number, which may otherwise be changed by a NAT policy. Some applications do not function correctly if the source port number is changed, and may require this option.
Default
disable
If fixedport is enable, you should usually also enable IP pools; if you do not configure an IP pool for the policy, only one connection can occur at a time for this port.
Restrict the device types to which FortiClient enforcement applies. You can enter a space-delimited list containing any of: android, iphone-ipad, mac, or windows-pc. These are the device types that
FortiClient currently supports. If the list is empty, all devices regardless of type are subject to FortiClient enforcement.
null forticlient-complianceenforcement-portal
{enable | disable} fsso {enable | disable} fsso-server-for-ntlm
<server_str>
The FortiClient enforcement portal must be enabled.
Enable or disable the FortiClient enforcement portal.
Enable or disable Fortinet Single Sign On.
Restrict NTLM authentication to one particular server only for this policy. Enter the name of a server defined in
geo-location
{enable | disable}
Enable or disable determining the country of each destination IP address. This is available when autoprofiling is enabled.
global-label <label_str>
Put policy in the named subsection in the web-based manager. Subsection is created if it does not already exist.
gtp_profile <name_str>
For FortiOS Carrier, enter the name of a profile to add the GTP profile to the policy.
disable disable
No default.
disable
No default.
No default.
icap-profile
<icap_pr_name> identity-based
{enable | disable}
Optionally, enter the name of an Internet Content
Adaptation Protocol (ICAP) profile. This is available if utm-status is enable.
Select to enable or disable identity-based policy authentication. null disable identity-based-route
<idroute_name> identity-from
{auth | device} inbound
{enable | disable}
This field appears only if action is accept.
Optionally, specify an identity-based route to include.
Identity-based routes are defined in
.
No default.
Select whether identity is based on authenticated user or device. This field is not available if srcintf is webproxy.
When action is set to ipsec, enable or disable traffic from computers on the remote private network to initiate an IPSec VPN tunnel. auth disable
Fortinet Technologies Inc.
Page 176 FortiOS™ - CLI Reference for FortiOS 5.0
firewall policy, policy6
Variable Description
ip-based {enable | disable} If srcintf is web-proxy and identity-based is enabled, enable ip-based to handle FSSO authentication.
Default
disable ippool
{enable | disable} ips-sensor <name_str> label <label_string> logtraffic {all | utm
| disable}
Will cause an error if disabled when the firewall policy refers to directory based user groups such as FSSO.
When the action is set to accept and NAT is enabled, configure a NAT policy to translate the source address to an address randomly selected from the first IP pool added to the destination interface of the policy.
disable
Enter the name of the IPS sensor to add to the firewall policy.
(null)
This option appears only if identity-based is disable and utm-status is enable.
Optionally, enter a label for this policy. The label is visible in the web-based manager in Section View.
Choose which traffic logs will be recorded:
No default.
utm
• all
• utm - only UTM-relatedlogs
• disable - no logging
Enable to log traffic while application logging is active.
enable logtraffic-app
{enable | disable} logtraffic-start
{enable | disable} log-unmatched-traffic
{disable | enable} match-vip
{enable | disable}
Enable to log session starts and ends.
disable
Enable or disabling logging dropped traffic for policies with identity-based enabled.
If you want to explicitly drop a packet that is not matched with a firewall policy and write a log message when this happens, you can add a general policy
(source and destination address set to ANY) to the bottom of a policy list and configure the firewall policy to DENY packets and record a log message when a packet is dropped.
disable disable
In some cases, when a virtual IP performs destination
NAT (DNAT) on a packet, the translated packet may not be accepted by a firewall policy. If this happens, the packet is silently dropped and therefore not matched with the general policy at the bottom of the policy list.
To catch these packets, enable match-vip in the general policy. Then the DNATed packets that are not matched by a VIP policy are matched with the general policy where they can be explicitly dropped and logged.
mms-profile <name_str>
For FortiOS Carrier, enter the name of the MMS profile to add to the firewall policy.
(null)
This option appears only if identity-based is disable and utm-status is enable.
Fortinet Technologies Inc.
Page 177 FortiOS™ - CLI Reference for FortiOS 5.0
firewall policy, policy6
Variable
nat {enable | disable} natinbound
{enable | disable}
Description
Enable or disable network address translation (NAT).
NAT translates the address and the port of packets accepted by the policy. When NAT is enabled, ippool and fixedport can also be enabled or disabled.
Default
disable
This option appears only if action is accept or sslvpn.
Enable or disable translating the source addresses IP packets emerging from the tunnel into the IP address of the FortiGate unit’s network interface to the local private network.
disable
This option appears only if action is ipsec.
natip <address_ipv4mask> When action is set to ipsec and natoutbound is enabled, specify the source IP address and subnet mask to apply to outbound clear text packets before they are sent through the tunnel.
natoutbound
{enable | disable} netscan-discover-hosts
{enable | disable} ntlm {enable | disable}
0.0.0.0
0.0.0.0
If you do not specify a natip value when natoutbound is enabled, the source addresses of outbound encrypted packets are translated into the IP address of the FortiGate unit’s external interface. When a natip value is specified, the FortiGate unit uses a static subnetwork-to-subnetwork mapping scheme to translate the source addresses of outbound IP packets into corresponding IP addresses on the subnetwork that you specify. For example, if the source address in the firewall encryption policy is 192.168.1.0/24 and the natip value is 172.16.2.0/24, a source address of
192.168.1.7 will be translated to 172.16.2.7.
When action is set to ipsec, enable or disable translating the source addresses of outbound encrypted packets into the IP address of the FortiGate unit’s outbound interface. Enable this attribute in combination with the natip attribute to change the source addresses of IP packets before they go into the tunnel.
disable disable
Enable host discovery for hostname visibility feature.
Available when utm-status is enabled.
Enable or disable Directory Service authentication via
NTLM.
disable ntlm-enabled-browsers
<user-agent_string>
If you enable this option, you must also define the user groups.
This option appears only if identity-based is enable.
Enter the HTTP-User-Agent strings of supported browsers. Enclose each string in quotes and separate strings with a space.
No default.
ntlm-guest
{enable | disable}
Browsers with non-matching strings get guest access.
Enable or disable NTLM guest user access.
disable
Fortinet Technologies Inc.
Page 178 FortiOS™ - CLI Reference for FortiOS 5.0
firewall policy, policy6
Variable
outbound
{enable | disable} per-ip-shaper
<shaper_name> permit-any-host
{enable | disable} permit-stun-host
{enable | disable} poolname <name_str>
Description
When action is set to ipsec, enable or disable traffic from computers on the local private network to initiate an IPSec VPN tunnel.
Default
disable
Enter the name of the per-IP traffic shaper to apply. For information about per-IP traffic shapers, see
firewall shaper per-ip-shaper .
No default.
disable
Enable to accept UDP packets from any host. This can help support the FaceTime application on NAT’d iPhones.
disable
Enable to accept UDP packets from any STUN host.
This can help support the FaceTime application on
NAT’d iPhones.
Enter the name of the IP pool. No default.
This variable appears only if nat and ippool are enable.
Select whether to add individual UTM profiles or a UTM profile group to the firewall policy.
single profile-type {group | single}
This option is available in this context level only if the identity-based option is set to disable. If identity-based is set to enable this option will instead be available in each Authentication Rule in the
config identity-based-policy sub section.
profile-group <name_str>
Enter the name of a UTM profile group to add to the firewall policy. This option is available if profiletype is set to group.
(null) profile-protocol-options
<name_str>
This option is available in this context level only if, at this context level the identity-based option is set to disable and utm-status is set to enable. If identity-based is set to enable this option may be available within Authentication rules in the config
identity-based-policy sub section.
Enter the name of the protocol options profile to add to the firewall policy.
(null) redirect-url <name_str>
This option is available in this context level only if, at this context level the identity-based option is set to disable and utm-status is set to enable. If identity-based is set to enable this option may be available within Authentication rules in the config
identity-based-policy sub section.
Enter a URL, if any, that the user is redirected to after authenticating and/or accepting the user authentication disclaimer.
No default.
replacemsg-group
<name_str>
This option only appears if disclaimer is enable.
For FortiOS Carrier, enter the name of the replacement message group to add to the firewall policy.
default
This option appears only if identity-based is disable and utm-status is enable.
Fortinet Technologies Inc.
Page 179 FortiOS™ - CLI Reference for FortiOS 5.0
firewall policy, policy6
Variable Description
replacemsg-override-group
<group_string>
Select a replacement message override group from the available configured groups.This will override the default replacement message for this policy.
require-tfa
{enable | disable} rsso {enable | disable}
Enable to require two-factor authentication.
Enable or disable RADIUS-based single sign-on (SSO) for this policy. rtp-nat {disable | enable}
Enable to apply source NAT to RTP packets received by the firewall policy. This field is used for redundant
SIP configurations. If rtp-nat is enabled you must add one or more firewall addresses to the rtp-addr field.
rtp-addr <name_str>
Enter one or more RTP firewall addresses for the policy.
Separate multiple firewall addresses with a space.
Default
disable disable disable schedule <name_str>
This field is only available when rtp-nat is enabled.
Enter the name of the one-time or recurring schedule or schedule group to use for the policy.
schedule-timeout
{enable | disable} send-deny-packet
{enable | disable}
Enable to force session to end when policy schedule end time is reached.
Enable to send a packet in reply to denied TCP, UDP or
ICMP traffic. When deny-tcp-with-icmp is enabled in
system settings , a Communication Prohibited ICMP
packet is sent. Otherwise, denied TCP traffic is sent a
TCP reset.
service <name_str>
Enter the name of one or more services, or a service group, to match with the firewall policy. Separate multiple services with a space.
service-negate
{enable | disable} session-ttl
<session_time_int>
Enable to negate service match. This causes service to specify what the service must not be. sessions {enable | disable} Enable or disable taking a snapshot of the number of active sessions for the policy every five minutes. This is available when auto-profiling is enabled.
Set the timeout value in the policy to override the global timeout setting defined by using config system session-ttl. When it is on default value, it will not take effect.
spamfilter-profile
<name_str>
Enter the name of the email filter profile to add to the firewall policy.
No default.
disable disable
No default.
disable disable
0
(null)
This option appears only if identity-based is disable and utm-status is enable.To add a spamfilter-profile, you must obtain an adequate profile name in profile-protection-options.
Fortinet Technologies Inc.
Page 180 FortiOS™ - CLI Reference for FortiOS 5.0
firewall policy, policy6
Variable
srcaddr <name_str> srcaddr6 <name_str> srcaddr-negate
{enable | disable} srcintf <name_str>
Description
Enter one or more source firewall addresses for the policy. Separate multiple firewall addresses with a space.
Use srcaddr6 for IPv6 addresses.
If action is set to ipsec, enter the private IP address of the host, server, or network behind the FortiGate unit.
Default
No default.
If action is set to ssl-vpn and the firewall encryption policy is for web-only mode clients, type all.
If action is set to ssl-vpn and the firewall encryption policy is for tunnel mode clients, enter the name of the
IP address range that you reserved for tunnel mode clients. To define an address range for tunnel mode
clients, see “ssl settings” on page 816 .
Enable to negate srcaddr match. This causes srcaddr to specify what the source address must not be. disable
Enter the source interface(s) for the policy. Separate interface names with spaces.
No default.
The interface can be a physical interface, a VLAN subinterface, a zone, ftp-proxy, or web-proxy.
If the interface or VLAN subinterface has been added to a zone, interface or VLAN subinterface cannot be used for srcintf.
If action is set to ipsec, enter the name of the interface to the local (private) network.
sslvpn-auth
{any | ldap | local | radius | tacacs+}
If action is set to ssl-vpn, enter the name of the interface that accepts connections from remote clients.
If action is set to ssl-vpn, enter one of the following client authentication options:
• If you want the FortiGate unit to authenticate remote clients using any local user group, a RADIUS server, or LDAP server, type any.
• If the user group is a local user group, type local.
• If the remote clients are authenticated by an external RADIUS server, type radius.
• If the remote clients are authenticated by an external LDAP server, type ldap.
• If the remote clients are authenticated by an external TACACS+ server, type tacacs+.
any sslvpn-ccert
{enable | disable}
You must also set the name of the group which will use the authentication method.
If action is set to ssl-vpn, enable or disable the use of security certificates to authenticate remote clients. If sslvpn-ccert is enabled, the SSLVPN daemon will require a client certificate for the users defined in the policy.
disable
Fortinet Technologies Inc.
Page 181 FortiOS™ - CLI Reference for FortiOS 5.0
firewall policy, policy6
Variable
sslvpn-cipher {any
| medium | high}
Description
If action is set to ssl-vpn, enter one of the following options to determine the level of SSL encryption to use.
Default
any
• high is 164-bit or greater cipher suite.
• medium is 128-bit or greater cipher suite.
sso-auth-method
{fsso | rsso}
Select the passive authentication method to use with
FSSO/RSSO. If it fails, active-auth-method is used, if set.
status {enable | disable}
Enable or disable the policy.
tags <tags_str>
Enter object tags applied to this policy. Separate tag names with spaces.
tcp-mss-sender
<maximumsize_int>
Enter a TCP Maximum Sending Size number for the sender.
When a FortiGate unit is configured to use PPPoE to connect to an ISP, certain web sites may not be accessible to users. This occurs because a PPPoE frame takes an extra 8 bytes off the standard Ethernet
MTU of 1500.
null enable null
0
When the server sends the large packet with DF bit set to 1, the ADSL provider’s router either does not send an “ICMP fragmentation needed” packet or the packet is dropped along the path to the web server. In either case, the web server never knows fragmentation is required to reach the client.
In this case, configure the tcp-mss-sender option to enable access to all web sites. For more information, see the article Cannot view some web sites when using
PPPoE on the Fortinet Knowledge Center.
tcp-mss-receiver
<maximumsize_int> timeout-send-rst
{enable | disable}
Enter a TCP MSS number for the receiver.
Enable sending a TCP reset when an application session times out.
traffic-shaper <name_str> Select a traffic shaper for the policy. A traffic shaper controls the bandwidth available to, and sets the priority of the traffic processed by, the policy.
0 disable
No default.
traffic-shaper-reverse
<name_str> utm-status {disable | enable}
This option appears only if identity-based is disable.
Select a reverse traffic shaper. For example, if the traffic direction that a policy controls is from port1 to port2, select this option will also apply the policy shaping configuration to traffic from port2 to port1.
Enable or disable UTM for the firewall policy. If you enable UTM you must add one or more UTM profiles and sensors (or a group profile) to the firewall policy.
No default.
disable
This option is available in this context level only if the identity-based option is set to disable. If identity-based is set to enable this option will instead be available in each Authentication Rule in the
config identity-based-policy sub section.
Fortinet Technologies Inc.
Page 182 FortiOS™ - CLI Reference for FortiOS 5.0
firewall policy, policy6
Variable Description
voip-profile <name_str>
Enter the name of the VoIP profile to add to the firewall policy.
Default
(null) vpntunnel <name_str>
This option appears only if identity-based is disable and utm-status is enable.
Enter the name of a Phase 1 IPSec VPN configuration to apply to the tunnel.
No default.
wanopt-detection {active
| passive | off}
This option appears only if action is ipsec.
wanopt {enable | disable}
Enable or disable WAN optimization on this policy.
WANopt is available only if action is accept.
Select WANopt peer auto-detection mode.
wanopt-profile
<name_str>
Enter the WANopt profile to use in this policy.
wanopt-peer <peer_name> Enter the WAN Optimization peer. wccp {enable | disable}
Enable or disable web cache on the policy. If enabled, the FortiGate unit will check the learned web cache information, and may redirect the traffic to the web cache server.
web-auth-cookie
{enable | disable}
Enable to reduce the number of authentication requests to the authentication server when sessionbased authentication is applied using explicit web proxy. This is only available when session based authentication is enabled.
webcache
{disable | enable}
Enable or disable WAN optimization web caching for
HTTP traffic accepted by the firewall policy. This option is available only on FortiGate units that support WAN
Optimization and web caching.
webcache-https {disable
| any| ssl-server}
Enable the level of webcaching for HTTPS traffic.
disable — no caching of HTTPS traffic disable off
No default.
No default.
disable disable disable disable any — use SSL offload for traffic of matched SSL server. For other HTTPS traffic, it intercepts in the same way as HTTPS deep scan.
webfilter-profile
<name_str> ssl-server — cache only traffic of matched SSL server whose port matches the HTTPS port in the protocol option or 443 if protocol option is not defined.
This field is not available if srcintf is ftp-proxy or wanopt.
Enter the name of the web filtering profile to add to the firewall policy.
(null)
This option appears only if identity-based is disable and utm-status is enable.To add a webfilter-profile, you must obtain an adequate profile name in profile-protection-options.
Fortinet Technologies Inc.
Page 183 FortiOS™ - CLI Reference for FortiOS 5.0
firewall
Variable
webproxy-forward-server
<fwd_srv_name_string> wsso {enable | disable}
Description
Enter the name of the web-proxy forward server.
Available if srcintf is web-proxy.
Enable or disable WiFi Single Sign On.
policy, policy6
Default
No default.
disable
config identity-based-policy
Create an identity-based firewall policy that requires authentication. This option is only available if identity-based is enabled.
Variable Description
<policy_id> action {accept | deny
| capture}
Enter the name for the identity-based policy.
Select the action for this policy: accept, deny, or route to captive portal.
application-list
<name_str>
Enter the name of the application list to add to the identify-based policy.
av-profile <name_str> Enter the name of the antivirus profile to add to the identify-based policy.
Default
No default.
accept
(null)
(null) captive-portal
{device-identification
| email-collection
| forticlient-download} client-reputation
{enable | disable}
Select the type of captive portal. Available when is capture.
action
Enable or disable client reputation feature on this policy. utm-status must be enabled.
deviceidentification disable deep-inspectionoptions
<profile_name>
Enter the name of the deep inspection options profile to
.
“firewall deep-inspection-options” on
No default.
devices <device_list>
Enter the device categories to which this policy applies.
No default.
dlp-sensor <name_str> Enter the name of the DLP sensor to add to the identifybased policy.To add a dlp-sensor, you must obtain an adequate name in profile-protection-options.
endpoint-compliance
{enable | disable}
Enable or disable Endpoint control.
(null) disable groups <group_name> Enter the user group name for the identity-based policy.
No default.
ips-sensor <name_str> Enter the name of the IPS sensor to add to the identifybased policy.
(null) logtraffic
{enable | disable} mms-profile
<name_str> per-ip-shaper
<name_str> profile-group {group | single} profile-protocoloptions <name_str>
Enable or disable traffic logging for the identity-based policy.
For FortiOS Carrier, enter the name of the MMS profile to add to the identify-based policy.
Enter the per-IP traffic shaper for the identity-based policy.
Enter the name of a UTM profile group to add to the identity-based policy. This option is available if profiletype is set to group.
Enter the name of the protocol options profile to add to the firewall policy.
disable
(null)
No default.
(null)
(null)
Fortinet Technologies Inc.
Page 184 FortiOS™ - CLI Reference for FortiOS 5.0
firewall policy, policy6
Variable
voip-profile
<name_str> webfilter-profile
<name_str>
Description
profile-type {group | single}
Select whether to add individual UTM profiles or a UTM profile group to the identity-based policy.
single schedule <name_str>
Enter the firewall schedule for the identity-based policy.
No default.
service <name_str>
Enter the firewall service for the identity-based policy.
No default.
spamfilter-profile
<name_str> sslvpn-realm
<realm-url-path> traffic-shaper
<name_str> traffic-shaper-reverse
<name_str> users
<user_name_list> utm-status {disable | enable}
Enter the name of the email filter profile to add to the identify-based policy.
Optionally, enter the SSL VPN realm URL (without “http:
//”). This is available when action is ssl-vpn.
Enter the traffic shaper for the identity-based policy.
Enter the reverse direction traffic shaper for the identitybased policy.
Enter the users to whom this policy applies. Separate names with spaces.
Enable or disable UTM for the identity-based policy. If you enable UTM you must add one ore more UTM profiles and sensors (or a profile group) to the identify-based policy.
(null)
No default.
No default.
No default.
No default.
disable
Enter the name of the VoIP profile to add to the identifybased policy.
Enter the name of the web filtering profile to add to the identify-based policy.
Default
(null)
(null)
Fortinet Technologies Inc.
Page 185 FortiOS™ - CLI Reference for FortiOS 5.0
firewall policy46, policy64
policy46, policy64
Use this command to configure IPv6 <-> IPv4 policies.
• Use config firewall policy46 for IPv4-to-IPv6 policies
• Use config firewall policy64 for IPv6-to-IPv4 policies
Syntax
config firewall policy46 or config firewall policy64 edit
<index_int> set action {accept | deny} set comments <comment_str> set dstaddr <name_str>
end
set traffic-shaper-reverse <name_str>
Variable Description
<index_int>
Enter the unique ID number of this policy.
action {accept | deny} Select the action that the FortiGate unit will perform on traffic matching this firewall policy.
Default
No default.
deny
• accept: Allow packets that match the firewall policy.
Also enable or disable ippool to select a source address for packets from a pool of IP addresses added to the destination interface and enable or disable fixedport so that the policy does not translate the packet source port.
• deny: Deny packets that match the firewall policy.
Enter a description or other information about the policy.
(Optional)
No default.
comments
<comment_str> comment_str is limited to 63 characters. Enclose the string in single quotes to enter special characters or spaces. dstaddr <name_str>
Enter one or more destination firewall addresses. Separate multiple firewall addresses with a space.
No default.
Fortinet Technologies Inc.
Page 186 FortiOS™ - CLI Reference for FortiOS 5.0
firewall policy46, policy64
Variable Description
dstintf <name_str>
Enter the destination interface for the policy. The interface can be a physical interface, a VLAN subinterface, or a zone.
Default
No default.
fixedport
{enable | disable}
Note: If a interface or VLAN subinterface has been added to a zone, the interface or VLAN subinterface cannot be used for dstintf.
Enable to preserve packets’ source port number. Some applications do not function correctly if the source port number is changed, and may require this option.
disable
If fixedport is enable, you should usually also enable IP pools; if you do not configure an IP pool for the policy, only one connection can occur at a time for this port.
ippool
{enable | disable}
Enable translating the source address to an address randomly selected from the first IP pool added to the destination interface of the policy.
logtraffic
{enable | disable} per-ip-shaper
<shaper_name>
Enable or disable recording traffic log messages for this policy.
Enter the name of the per-IP traffic shaper to apply. For information about per-IP traffic shapers, see
firewall shaper per-ip-shaper .
poolname <name_str> Enter the name of the IP pool. disable disable
No default.
No default.
This variable appears only if ippool is enable.
schedule <name_str>
Enter the name of the one-time or recurring schedule or schedule group to use for the policy.
service <name_str>
Enter the name of one or more services, or a service group, to match with the firewall policy. Separate multiple services with a space.
srcaddr <name_str>
Enter one or more source firewall addresses for the policy.
Separate multiple firewall addresses with a space.
srcintf <name_str>
Enter the source interface for the policy.
No default.
No default.
No default.
No default.
If the interface or VLAN subinterface has been added to a zone, interface or VLAN subinterface cannot be used for srcintf.
Enable or disable the policy.
status
{enable | disable} tags <tags_str> enable traffic-shaper
<name_str> traffic-shaper-reverse
<name_str>
Enter object tags applied to this policy. Separate tag names with spaces.
null
Select a traffic shaper for the policy. A traffic shaper controls the bandwidth available to, and sets the priority of the traffic processed by, the policy.
No default.
Select a reverse traffic shaper. For example, if the traffic direction that a policy controls is from port1 to port2, select this option will also apply the policy shaping configuration to traffic from port2 to port1.
No default.
Fortinet Technologies Inc.
Page 187 FortiOS™ - CLI Reference for FortiOS 5.0
firewall profile-group
profile-group
Use this command in FortiOS Carrier to create profile groups. A profile group can contain an antivirus profile, IPS sensor, web filter profile, email filter profile, DLP sensor, application control list, a VoIP profile, an MMS profile and a replacement message group. Once you create profile groups you can add them to firewall policies instead of adding individual UTM profiles and lists.
Syntax
config firewall profile-group edit
end
Variable Description Default
<name_str> profile-protocoloptions <name_str>
Enter the name of the profile group.
Enter the name of the protocol options profile to add to the profile group.
(null) deep-inspectionoptions
<profile_name>
Enter the name of the deep inspection options profile to
apply. See “firewall deep-inspection-options” on page 109
.
No default.
av-profile <name_str> Enter the name of the antivirus profile to add to the profile group. To add an av-profile, you must obtain an adequate profile name in profile-protectionoptions.
icap-profile
<name_str>
Enter the name of the Internet Content Adaptation Protocol
(ICAP) profile to add to the profile group. To add an icapprofile, you must obtain an adequate profile name in profile-protection-options.
webfilter-profile
<name_str>
Enter the name of the web filtering profile to add to the profile group. To add a webfilter-profile, you must obtain an adequate profile name in profileprotection-options.
(null)
(null)
(null) spamfilter-profile
<name_str>
Enter the name of the email filter profile to add to the profile group. To add a spamfilter-profile, you must obtain an adequate profile name in profile-protectionoptions.
(null) ips-sensor <name_str> Enter the name of the IPS sensor to add to the profile group. (null)
Fortinet Technologies Inc.
Page 188 FortiOS™ - CLI Reference for FortiOS 5.0
firewall profile-group
Variable Description
dlp-sensor <name_str> Enter the name of the DLP sensor to add to the profile group.To add an dlp-sensor, you must obtain an adequate profile name in profile-protectionoptions.
application-chart
{top10-app
| top10-media-user
| top10-p2p-user}
Enter the application chart type.
•
• top10-app: Top 10 applications chart top10-media-user: Top 10 media users chart
• top10-p2p-user: Top 10 P2P users chart application-list
<name_str>
Enter the name of the application list to add to the profile group.
voip-profile
<name_str> mms-profile
<name_str> replacemsg-group
<name_str>
Enter the name of the VoIP profile to add to the profile group.
For FortiOS Carrier, enter the name of the MMS profile to add to the profile group.
For FortiOS Carrier, enter the name of the replacement message group to add to the profile group.
Default
(null)
(null)
(null)
(null)
(null) default
Fortinet Technologies Inc.
Page 189 FortiOS™ - CLI Reference for FortiOS 5.0
firewall profile-protocol-options
profile-protocol-options
Use this command to configure UTM protocol options profiles for firewall policies. Protocol options configure how UTM functionality identifies content protocols such as HTTP, FTP, and
SMTP. Every firewall policy that includes UTM profiles must include a protcol options profile.
SSL-related options for secure protocols are set in
firewall deep-inspection-options
.
Syntax
config firewall profile-protocol-options edit
set
set
inspect-all {enable | disable}
set
options {chunkedbypass | clientcomfort
| no-content-summary | oversize | servercomfort}
set
comfort-interval <interval_int>
set
set
post-lang <charset1> [<charset2>... <charset5>]
set
set
end
set
set
inspect-all {disable | enable}
set
options {bypass-mode-command | bypass-rest-command
| clientcomfort | no-content-summary | oversize
set
comfort-interval <interval_int>
set
set
post-lang <charset1> [<charset2>... <charset5>]
set
set
end
set
set
end
set
set
inspect-all {enable | disable}
set
options {fragmail | no-content-summary | oversize}
set
set
end
Fortinet Technologies Inc.
Page 190 FortiOS™ - CLI Reference for FortiOS 5.0
firewall profile-protocol-options
set
set
options {fragmail | no-content-summary | oversize}
set
set
end
set
set
inspect-all {enable | disable}
set
options {fragmail | no-content-summary | oversize}
set
set
end
set
set
inspect-all {enable | disable}
set
options {fragmail | no-content-summary | oversize
set
set
server_busy {enable | disable}
set
end
set
set
inspect-all {disable | enable}
set
options { no-content-summary | oversize | splice}
set
set
end
set
options { no-content-summary | oversize}
set
set
end end
set
set
end
Variable
<name_str> comment
<comment_str> oversize-log {disable | enable} intercept-log {enable | disable}
Description
Enter the name of the protocol options profile.
Optionally enter a description of up to 63 characters of the protocol options profile.
Enable or disable logging for antivirus oversize file blocking.
Enable or disable logging for FortiOS Carrier antivirus file filter is set to intercept.
Default
disable
Fortinet Technologies Inc.
Page 191 FortiOS™ - CLI Reference for FortiOS 5.0
firewall profile-protocol-options
config http
Configure HTTP protocol options.
Variable
ports
<port_number_list> inspect-all {enable | disable} options {chunkedbypass
| clientcomfort
| no-content-summary
| oversize
| servercomfort}
Description
Enter a space-separated list of port numbers to scan for HTTP content.
chunkedbypass — allow web sites that use chunked encoding for HTTP to bypass the firewall. Chunked encoding means the HTTP message body is altered to allow it to be transferred in a series of chunks. Use of this feature is a risk. Malicious content could enter the network if web content is allowed to bypass the firewall.
Default
80
Enable to monitor all ports for the HTTP protocol. If you enable this option you can’t select a port.
disable
Select one or more options apply to HTTP sessions. To select more than one, enter the option names separated by a space.
no-contentsummary comfort-interval
<interval_int> comfort-amount
<amount_int> clientcomfort — apply client comforting and prevent client timeout.
no-content-summary — do not add content information from the dashboard.
oversize — block files that are over the file size limit.
servercomfort — apply server comforting and prevent server timeout.
Enter the time in seconds to wait before client comforting starts after a download has begun. It is also the interval between subsequent client comforting sends. The range is 1 to 900 seconds.
10
1
Enter the number of bytes client comforting sends each interval to show that an HTTP download is progressing.
The range is 1 to 10240 bytes.
Enable or disable Fortinet Bar on HTML pages.
fortinet-bar
{enable | disable} fortinet-bar-port
<port_int> post-lang <charset1>
[<charset2>...
<charset5>]
Specify port for Fortinet Bar.
For HTTPS post pages, because character sets are not always accurately indicated in HTTPS posts, you can use this option to specify up to five character set encodings. The FortiGate unit performs a forced conversion of HTTPS post pages to UTF-8 for each specified character set. After each conversion the
FortiGate unit applies web content filtering and DLP scanning to the content of the converted page.
8011
Specifying multiple character sets reduces web filtering and DLP performance.
Fortinet Technologies Inc.
Page 192 FortiOS™ - CLI Reference for FortiOS 5.0
firewall profile-protocol-options
Variable Description
oversize-limit <size_int> Enter the maximum in-memory file size that will be scanned, in megabytes. If the file is larger than the oversize-limit, the file is passed or blocked, depending on whether oversize is a selected HTTP option. The maximum file size for scanning in memory is 10% of the FortiGate unit’s RAM. retry-count <retry_int>
Enter the number of times to retry establishing an HTTP connection when the connection fails on the first try.
The range is 0 to 100.
Default
10
0
This allows the web server proxy to repeat the connection attempt on behalf of the browser if the server refuses the connection the first time. This works well and reduces the number of hang-ups or page not found errors for busy web servers.
Entering zero (
0) effectively disables this feature. status {enable | disable}
Enable or disable HTTP protocol inspection.
switching-protocols
{block | bypass}
Choose whether when the protocol switches, the new protocol is blocked or bypassed from scanning.
enable bypass
config ftp
Configure FTP protocol options.
Variable Description
ports <port_number_list> Enter a space-separated list of port numbers to scan for
FTP content.
inspect-all {disable | enable} comfort-interval
<interval_int>
Enable to monitor all ports for the FTP protocol. If you enable this option you can’t select a port.
Enter the time in seconds to wait before client comforting starts after a download has begun. It is also the interval between subsequent client comforting sends. The range is 1 to 900 seconds.
comfort-amount
<amount_int>
Enter the number of bytes client comforting sends each interval to show that an FTP download is progressing. The range is 1 to 10240 bytes.
Default
21 disable
10
1
Fortinet Technologies Inc.
Page 193 FortiOS™ - CLI Reference for FortiOS 5.0
firewall profile-protocol-options
Variable
options
{bypass-mode-command
| bypass-rest-command
| clientcomfort
| no-content-summary
| oversize | splice}
Description
Select one or more options apply to FTP sessions. To select more than one, enter the option names separated by a space.
bypass-mode-command — if the MODE command is issued with 'block' or 'compressed', disable content scanning until the setting changes or a new command is issued.
bypass-rest-command — if the REST command is issued with a value other than 0, disable content scanning until the setting changes or a new command is issued.
Default
nocontentsummary splice clientcomfort — apply client comforting and prevent client timeout.
no-content-summary — do not add content information from the dashboard.
oversize — block files that are over the file size limit.
splice — simultaneously scan a file and send it to the recipient. If the FortiGate unit detects a virus, it prematurely terminates the connection.
oversize-limit <size_int> Enter the maximum in-memory file size that will be scanned, in megabytes. If the file is larger than the oversize-limit, the file is passed or blocked depending on whether oversize is a selected FTP option. The maximum file size for scanning in memory is
10% of the FortiGate unit’s RAM. status {enable | disable}
Enable or disable FTP protocol inspection.
10 enable
config dns
Configure DNS protocol options.
Variable
ports <dns_port_list>
Description
Enter a space-separated list of port numbers to scan for DNS content.
status {enable | disable} Enable or disable DNS protocol inspection.
Default
53 enable
config imap
Configure IMAP protocol options.
Variable
ports
<port_number_list> inspect-all
{enable | disable}
Description
Enter a space-separated list of port numbers to scan for
IMAP content.
Enable to monitor all ports for the IMAP protocol. If you enable this option you can’t select a port.
Default
143 disable
Fortinet Technologies Inc.
Page 194 FortiOS™ - CLI Reference for FortiOS 5.0
firewall profile-protocol-options
Variable
options {fragmail
| no-content-summary
| oversize} oversize-limit
<size_int> status
{enable | disable}
Description
Select one or more options apply to IMAP sessions. To select more than one, enter the option names separated by a space.
Default
fragmail nocontentsummary fragmail — allow fragmented email. Fragmented email cannot be scanned for viruses.
no-content-summary — do not add content information from the dashboard.
oversize — block files that are over the file size limit.
Enter the maximum in-memory file size that will be scanned, in megabytes. If the file is larger than the oversize-limit, the file is passed or blocked depending on whether oversize is a selected IMAP option. The maximum file size for scanning in memory is 10% of the FortiGate unit’s RAM.
10
Enable or disable IMAP protocol inspection.
enable
config mapi
Configure MAPI protocol options.
Variable
ports
<port_number_list> options {fragmail
| no-content-summary
| oversize} oversize-limit
<size_int> status
{enable | disable}
Description
Enter a space-separated list of port numbers to scan for
MAPI content.
Select one or more options apply to MAPI sessions. To select more than one, enter the option names separated by a space.
fragmail — allow fragmented email. Fragmented email cannot be scanned for viruses.
Default
135 fragmail nocontentsummary no-content-summary — do not add content information from the dashboard.
oversize — block files that are over the file size limit.
Enter the maximum in-memory file size that will be scanned, in megabytes. If the file is larger than the oversize-limit, the file is passed or blocked depending on whether oversize is a selected MAPI option. The maximum file size for scanning in memory is 10% of the FortiGate unit’s RAM.
10
Enable or disable MAPI protocol inspection. enable
config pop3
Configure POP3 protocol options.
Variable
ports
<port_number_list> inspect-all
{enable | disable}
Description
Enter a space-separated list of port numbers to scan for
POP3 content.
Enable to monitor all ports for the POP3 protocol. If you enable this option you can’t select a port.
Default
110 disable
Fortinet Technologies Inc.
Page 195 FortiOS™ - CLI Reference for FortiOS 5.0
firewall profile-protocol-options
Variable
options {fragmail
| no-content-summary
| oversize} oversize-limit
<size_int> status
{enable | disable}
Description
Select one or more options apply to POP3 sessions. To select more than one, enter the option names separated by a space.
Default
fragmail nocontentsummary fragmail — allow fragmented email. Fragmented email cannot be scanned for viruses.
no-content-summary — do not add content information from the dashboard.
oversize — block files that are over the file size limit.
Enter the maximum in-memory file size that will be scanned, in megabytes. If the file is larger than the oversize-limit, the file is passed or blocked depending on whether oversize is a selected POP3 option. The maximum file size for scanning in memory is 10% of the FortiGate unit’s
RAM.
10
Enable or disable POP3 protocol inspection.
enable
config smtp
Configure SMTP protocol options.
Variable
ports
<port_number_list> inspect-all
{enable | disable} options {fragmail
| no-content-summary
| oversize | splice}
Description
Enter a space-separated list of port numbers to scan for
SMTP content.
Enable to monitor all ports for the SMTP protocol. If you enable this option you can’t select a port.
Select one or more options apply to SMTP sessions. To select more than one, enter the option names separated by a space.
fragmail allow fragmented email. Fragmented email cannot be scanned for viruses.
no-content-summary — do not add content information from the dashboard.
oversize — block files that are over the file size limit.
splice — simultaneously scan a message and send it to the recipient. If the FortiGate unit detects a virus, it prematurely terminates the connection, and returns an error message to the sender, listing the virus and infected file name. splice is selected when scan is selected. With streaming mode enabled, select either Spam Action (Tagged or Discard) for SMTP spam. When streaming mode is disabled for SMTP, infected attachments are removed and the email is forwarded (without the attachment) to the SMTP server for delivery to the recipient.
Throughput is higher when streaming mode is enabled.
Default
25 disable fragmail nocontentsummary splice
Fortinet Technologies Inc.
Page 196 FortiOS™ - CLI Reference for FortiOS 5.0
firewall profile-protocol-options
Variable
oversize-limit
<size_int> server_busy
{enable | disable}
Description
Enter the maximum in-memory file size that will be scanned, in megabytes. If the file is larger than the oversize-limit, the file is passed or blocked depending on whether oversize is a selected SMTP option. The maximum file size for scanning in memory is 10% of the FortiGate unit’s
RAM.
Default
10 disable
Enable this options so that when the FortiGate unit attempts to send an SMTP email but can’t because of a connection timeout or connection error it returns a 412 server busy error message to the email client attempting to send the message.
Usually the FortiGate unit accepts SMTP SYN from clients and immediately send back ACK before actually connecting with the real SMTP server. If the server responds back with
NACK (service not available) the FortiGate-to-server connection drops, but the FortiGate-to-client connection will just hang until a timeout occurs. This causes particular problems for systems that use alternative servers, they may not move to the next server until the timeout occurs. Not all
SMTP mail servers behave in this way, some use an SMTP
HELO to confirm the connection is active and so do not have an issue with this behavior.
Enable or disable SMTP protocol inspection.
enable status
{enable | disable}
config nntp
Configure NNTP protocol options.
Variable
ports
<port_number_list> inspect-all
{disable | enable} options { no-content-summary
| oversize | splice}
Description
Enter a space-separated list of port numbers to scan for
NNTP content.
Enable to monitor all ports for the NNTP protocol. If you enable this option you can’t select a port.
Select one or more options apply to NNTP sessions. To select more than one, enter the option names separated by a space.
no-content-summary — do not add content information from the dashboard.
oversize — block files that are over the file size limit.
splice — simultaneously scan a file and send it to the recipient. If the FortiGate unit detects a virus, it prematurely terminates the connection.
Default
119 disable nocontentsummary
Fortinet Technologies Inc.
Page 197 FortiOS™ - CLI Reference for FortiOS 5.0
firewall profile-protocol-options
Variable
oversize-limit
<size_int>
Description
Enter the maximum in-memory file size that will be scanned, in megabytes. If the file is larger than the oversize-limit, the file is passed or blocked depending on whether oversize is a selected NNTP option. The maximum file size for scanning in memory is 10% of the FortiGate unit’s
RAM.
Default
10
Enable or disable NNTP protocol inspection.
enable status
{enable | disable}
config im
Configure IM protocol options.
Variable
options { no-content-summary | oversize} oversize-limit
<size_int> status
{enable | disable}
Description
Select one or more options apply to IM sessions. To select more than one, enter the option names separated by a space.
Default
nocontentsummary no-content-summary — do not add content information from the dashboard.
oversize — block files that are over the file size limit.
Enter the maximum in-memory file size that will be scanned, in megabytes. If the file is larger than the oversize-limit, the file is passed or blocked depending on whether oversize is a selected IM option. The maximum file size for scanning in memory is 10% of the FortiGate unit’s RAM.
10
Enable or disable IM protocol inspection.
enable
config mail-signature
Configure email signature options for SMTP.
Variable
status
{enable | disable} signature <text>
Description
Enable or disable adding an email signature to SMTP email messages as they pass through the FortiGate unit.
Default
disable
Enter a signature to add to outgoing email. If the signature contains spaces, surround it with single or double quotes (
‘ or
").
(null)
Fortinet Technologies Inc.
Page 198 FortiOS™ - CLI Reference for FortiOS 5.0
firewall schedule onetime
schedule onetime
Use this command to add, edit, or delete one-time schedules.
Use scheduling to control when policies are active or inactive. Use one-time schedules for policies that are effective once for the period of time specified in the schedule.
To edit a schedule, define the entire schedule, including the changes. This means entering all of the schedule parameters, both those that are changing and those that are not.
Syntax
config firewall schedule onetime edit
<name_str> set color <color_int> set end <hh:mm> <yyyy/mm/dd>
end
set start <hh:mm> <yyyy/mm/dd> set expiration-days <days_int>
Variable
<name_str> color <color_int>
Description
Enter the name of this schedule.
Set the icon color to use in the web-based manager.
0 sets the default, color 1.
Default
No default.
0 end <hh:mm>
<yyyy/mm/dd> start <hh:mm>
<yyyy/mm/dd> expiration-days
<days_int>
Enter the ending day and time of the schedule.
• hh - 00 to 23
• mm - 00, 15, 30, or 45
• yyyy - 1992 to infinity
• mm - 01 to 12
• dd - 01 to 31
Enter the starting day and time of the schedule.
• hh - 00 to 23
• mm - 00, 15, 30, or 45
• yyyy - 1992 to infinity
• mm - 01 to 12
• dd - 01 to 31
Generate an event log <days_int> days before the schedule expires. Range 1-100 days, 0 disables log.
00:00
2001/01/01
00:00
2001/01/01
3
Fortinet Technologies Inc.
Page 199 FortiOS™ - CLI Reference for FortiOS 5.0
firewall schedule recurring
schedule recurring
Use this command to add, edit, and delete recurring schedules used in firewall policies.
Use scheduling to control when policies are active or inactive. Use recurring schedules to create policies that repeat weekly. Use recurring schedules to create policies that are effective only at specified times of the day or on specified days of the week.
If a recurring schedule is created with a stop time that occurs before the start time, the schedule starts at the start time and finishes at the stop time on the next day. You can use this technique to create recurring schedules that run from one day to the next. To create a recurring schedule that runs for 24 hours, set the start and stop times to the same time.
Syntax
config firewall schedule recurring edit
<name_str> set day <name_str> set end <hh:mm>
end
set start <hh:mm> set color <color_int>
Variable
end <hh:mm>
Description
<name_str>
Enter the name of this schedule.
day <name_str>
Enter the names of one or more days of the week for which the schedule is valid. Separate multiple names with a space.
Enter the ending time of the schedule.
• hh can be 00 to 23
• mm can be 00, 15, 30, or 45 only
Enter the starting time of the schedule.
start <hh:mm>
• hh can be 00 to 23
• mm can be 00, 15, 30, or 45 only color <color_int> Set the icon color to use in the web-based manager.
0 sets the default, color 1.
Default
No default.
sunday
00:00
00:00
0
Fortinet Technologies Inc.
Page 200 FortiOS™ - CLI Reference for FortiOS 5.0
firewall schedule group
schedule group
Use this command to configure schedule groups.
Syntax
config firewall schedule group edit
end
set member {<schedule1_name> [schedule2_name ...]} set color <color_int>
Variable
<group-name_str> member
{<schedule1_name>
[schedule2_name ...]} color <color_int>
Description
Enter the name of this schedule group.
0 sets the default, color 1.
Default
No default.
Enter one or more names of one-time or recurring firewall schedules to add to the schedule group.
Separate multiple names with a space. To view the list of available schedules enter
set member ? at the prompt. Schedule names are case-sensitive.
No default.
Set the icon color to use in the web-based manager.
0
Fortinet Technologies Inc.
Page 201 FortiOS™ - CLI Reference for FortiOS 5.0
firewall service category
service category
Use this command to create new categories or add comments to firewall service categories. To assign services to categories, use the
firewall service custom command.
Syntax
config firewall service category edit
end
Variable
<category_name>
Description
Predefined categories are General, Web Access,
File Access, Email, Network Services,
Authentication, Remote Access, Tunneling, VoIP,
Messaging\ &\ Other Applications, Web Proxy
Note: when entering a category name that includes spaces, escape the spaces. For example, enter
“Web Access” as “Web\ Access”.
comment
<comment_str>
Default
No default.
No default.
Fortinet Technologies Inc.
Page 202 FortiOS™ - CLI Reference for FortiOS 5.0
firewall service custom
service custom
Use this command to configure firewall services.
Syntax
config firewall service custom edit
set check-reset-range {disable | strict | default}
set protocol-number <protocol_int> set sctp-portrange <dstportlow_int>[-<dstporthigh_int>:
set tcp-portrange <dstportlow_int>[-<dstporthigh_int>:
<srcportlow_int>-<srcporthigh_int>]
end
set visibility {enable | disable}
Variable
<name_str> category
<category_name>
Description
Enter the name of this custom service.
Assign the service to a service category.
Default
No default
Depends on service.
Fortinet Technologies Inc.
Page 203 FortiOS™ - CLI Reference for FortiOS 5.0
firewall
Variable
check-reset-range
{disable | strict
| default} color <color_int>
service custom
Description
Configure ICMP error message verification.
• disable — The FortiGate unit does not validate ICMP error messages.
• strict — If the FortiGate unit receives an ICMP error packet that contains an embedded IP(A,B) | TCP(C,D) header, then if FortiOS can locate the A:C
->B:D session it checks to make sure that the sequence number in the TCP header is within the range recorded in the session. If the sequence number is not in range then the ICMP packet is dropped. If
{enable | disable}” on page 298 is enabled the
FortiGate unit logs that the ICMP packet was dropped.
Strict checking also affects how the anti-replay option checks packets.
• default — Use the global setting defined in system global.
This field is available when protocol is TCP/UDP/SCTP.
This field is not available if explicit-proxy is enabled.
Set the icon color to use in the web-based manager.
0
Default
default
0 sets the default, color 1.
comment <string> explicit-proxy
{enable | disable}
Add comments for the custom service.
Enable to configure this service as an explicit web proxy service. The service will be available to explicit proxy firewall policies but not to regular firewall policies. fqdn <fqdn_str>
Enter a fully-qualified domain name (FQDN) for this service.
icmpcode <code_int>
Enter the ICMP code number. Find ICMP type and code numbers at www.iana.org.
icmptype <type_int>
Enter the ICMP type number. The range for type_int is from 0-255. Find ICMP type and code numbers at www.iana.org.
iprange
<serv_ip[-serv_ip]> protocol
{ICMP | ICMP6 | IP
| TCP/UDP/SCTP}
Enter an IP address or address range for this service.
Select the protocol used by the service. These protocols are available when explicit-proxy is disabled.
If you select
TCP/UDP/SCTP you must specify the tcpportrange, udp-portrange, or sctp-portrange.
No default.
disable
No default.
No default.
0
No default.
IP
Fortinet Technologies Inc.
Page 204 FortiOS™ - CLI Reference for FortiOS 5.0
firewall service custom
Variable
protocol
{ALL | CONNECT
| FTP | HTTP
| SOCKS} protocol-number
<protocol_int> sctp-portrange
<dstportlow_int>[-
<dstporthigh_int>:
<srcportlow_int>-
<srcporthigh_int>]
Description
Select the protocol used by the service. These protocols are available when explicit-proxy is enabled.
For an IP service, enter the IP protocol number. For information on protocol numbers, see http://www.iana.org
.
For SCTP services, enter the destination and source port ranges.
0
No default.
If the destination port range can be any port, enter
0-65535. If the destination is only a single port, simply enter a single port number for dstportlow_int and no value for dstporthigh_int.
If source port can be any port, no source port need be added. If the source port is only a single port, simply enter a single port number for srcportlow_int and no value for srcporthigh_int.
The total number of TCP, UDP, and SCTP port ranges cannot exceed 16.
session-ttl <seconds>
Enter the default session timeout in seconds. The valid range is from 300 - 604 800 seconds. Enter
0 to use either the per-policy session-ttl or per-VDOM session-ttl, as applicable.
0
Default
ALL tcp-halfclose-timer
<seconds> tcp-halfopen-timer
<seconds>
This is available when protocol is TCP/UDP/SCTP.
Enter how many seconds the FortiGate unit should wait to close a session after one peer has sent a FIN packet but the other has not responded. The valid range is from 1 to
86400 seconds.
0
Enter
0 to use the global setting defined in system global.
This is available when protocol is TCP/UDP/SCTP.
Enter how many seconds the FortiGate unit should wait to close a session after one peer has sent an open session packet but the other has not responded. The valid range is from 1 to 86400 seconds.
0
Enter
0 to use the global setting defined in system global.
This is available when protocol is TCP/UDP/SCTP.
Fortinet Technologies Inc.
Page 205 FortiOS™ - CLI Reference for FortiOS 5.0
firewall service custom
Variable
tcp-portrange
<dstportlow_int>[-
<dstporthigh_int>:
<srcportlow_int>-
<srcporthigh_int>] tcp-timewait-timer
<seconds_int> udp-idle-timer
<seconds> udp-portrange
<dstportlow_int>[-
<dstporthigh_int>:
<srcportlow_int>-
<srcporthigh_int>] visibility
{enable | disable}
Description
For TCP services, enter the destination and source port ranges.
If the destination port range can be any port, enter
0-65535. If the destination is only a single port, simply enter a single port number for dstportlow_int and no value for dstporthigh_int.
If source port can be any port, no source port need be added. If the source port is only a single port, simply enter a single port number for srcportlow_int and no value for srcporthigh_int.
The total number of TCP, UDP, and SCTP port ranges cannot exceed 16.
Set the length of the TCP TIME-WAIT state in seconds. As described in RFC 793 , the “TIME-WAIT state represents waiting for enough time to pass to be sure the remote TCP received the acknowledgment of its connection termination request”.
1
Reducing the time of the TIME-WAIT state means the
FortiGate unit can close terminated sessions faster which means more new sessions can be opened before the session limit is reached.
Default
0:0
The valid range is 0 to 300 seconds. A value of 0 sets the
TCP TIME-WAIT to 0 seconds
Enter
0 to use the global setting defined in system global.
This is available when protocol is TCP/UDP/SCTP.
Enter the number of seconds before an idle UDP connection times out. The valid range is from 1 to 86400 seconds.
Enter
0 to use the global setting defined in system global.
This is available when protocol is TCP/UDP/SCTP.
For UDP services, enter the destination and source port ranges.
0
No default.
If the destination port range can be any port, enter
0-65535. If the destination is only a single port, simply enter a single port number for dstportlow_int and no value for dstporthigh_int.
If source port can be any port, no source port need be added. If the source port is only a single port, simply enter a single port number for srcportlow_int and no value for srcporthigh_int.
The total number of TCP, UDP, and SCTP port ranges cannot exceed 16.
Enable visibility to include this service in firewall policy service selection. enable
Fortinet Technologies Inc.
Page 206 FortiOS™ - CLI Reference for FortiOS 5.0
firewall service group
service group
Use this command to configure firewall service groups.
To simplify policy creation, you can create groups of services and then add one policy to provide or block access for all the services in the group. A service group can contain predefined services and custom services in any combination. A service group cannot contain another service group.
To edit a service group, enter all of the members of the service group, both those changing and those staying the same.
Syntax
config firewall service group edit
<group-name_str> set comment set explicit-proxy {enable | disable}
end
set member <service_str> set color <color_int>
Variable
<group-name_str> comment explicit-proxy
{enable | disable} member <service_str> color <color_int>
Description
Enter the name of this service group.
Add comments for this service group
Enable to configure this service group as explicit web proxy services. The service group will be available to explicit proxy firewall policies but not to regular firewall policies.
0 sets the default, color 1.
Default
No default.
No default.
disable
Enter one or more names of predefined or custom firewall services to add to the service group. Separate multiple names with a space. To view the list of available services enter
set member ? at the prompt.
No default.
<service_str> is case-sensitive.
Set the icon color to use in the web-based manager.
0
Fortinet Technologies Inc.
Page 207 FortiOS™ - CLI Reference for FortiOS 5.0
firewall shaper per-ip-shaper
shaper per-ip-shaper
Use this command to configure traffic shaping that is applied per IP address, instead of per policy or per shaper. As with the shared traffic shaper, you select per-IP traffic shapers in firewall policies.
Syntax
config firewall shaper per-ip-shaper
set max-bandwidth <kbps_int> set max-concurrent-session <sessions_int>
end
Variable
edit <name_str> diffserv-forward
{enable | disable} diffserv-reverse
{enable | disable} diffservcode-forward
<dscp_bin> diffservcode-rev
<dscp_bin>
Description Default
Enter the name of the traffic shaper.
Enable or disable application of the differentiated services code point (DSCP) value to the DSCP field of forward
(original) traffic. If enabled, also configure diffservcode-forward.
Enable or disable application of the differentiated services code point (DSCP) value to the DSCP field of reverse
(reply) traffic. If enabled, also configure diffservcoderev.
Enter the differentiated services code point (DSCP) value that the FortiGate unit will apply to the field of originating
(forward) packets. The value is 6 bits binary. The valid range is 000000-111111.
No default.
disable disable
000000
This option appears only if diffserv-forward is set to enable.
For details and DSCP configuration examples, see the
Knowledge Center article Differentiated Services Code
Point (DSCP) behavior .
Enter the differentiated services code point (DSCP) value that the FortiGate unit will apply to the field of reply
(reverse) packets. The value is 6 bits binary. The valid range is 000000-111111.
This option appears only if diffserv-rev is set to enable
For details and DSCP configuration examples, see the
Knowledge Center article Differentiated Services Code
Point (DSCP) behavior .
000000
Fortinet Technologies Inc.
Page 208 FortiOS™ - CLI Reference for FortiOS 5.0
firewall shaper per-ip-shaper
Variable
max-bandwidth
<kbps_int>
Description
Enter the maximum amount of bandwidth available for an
IP address controlled by the policy.
Kbps_int can be 0 to 16 776 000 Kbits/second. If maximum bandwidth is set to 0 no traffic is allowed by the policy.
max-concurrent-session
<sessions_int>
Enter the maximum number of sessions allowed for an IP address. sessions_int can be 0 to 2097000. If maximum concurrent sessions is 0 then no sessions are allowed.
Default
0
0
Fortinet Technologies Inc.
Page 209 FortiOS™ - CLI Reference for FortiOS 5.0
firewall shaper traffic-shaper
shaper traffic-shaper
Use this command to configure shared traffic shaping that is applied to and shared by all traffic accepted by a firewall policy. As with the per-IP traffic shaper, you select shared traffic shapers in firewall policies.
Syntax
config firewall shaper traffic-shaper
edit <name_str> set diffserv {enable | disable} set diffservcode <binary>
end end
Variable
maximum-bandwidth
<bandwidth_value>
Description
edit <name_str> diffserv
{enable | disable}
Enter the name of the traffic shaper.
Enable to start differentiated services on network traffic.
DiffServ enables classifying network traffic and quality of service (QoS) guarantees on IP networks.
diffservcode <binary> Enter a 6 digit differentiate services code point (DSCP) binary code to match in the header of traffic to classify traffic. This code will be used to match traffic for this traffic shaper.
guaranteed-bandwidth
<bandwidth_value>
Enter the amount of bandwidth guaranteed to be available for traffic controlled by the policy. bandwidth_value can be 0 to 16 776 000 Kbits/second.
Enter the maximum amount of bandwidth available for traffic controlled by the policy. bandwidth_value can be
0 to 16 776 000 Kbits/second. If maximum bandwidth is set to 0 no traffic is allowed by the policy.
per-policy
{enable | disable} priority
{high | low | medium}
Enable or disable applying this traffic shaper to a single firewall policy that uses it.
Select the priority level for traffic controlled by the policy.
Default
No default.
disable
000000
0
0 disable high
Fortinet Technologies Inc.
Page 210 FortiOS™ - CLI Reference for FortiOS 5.0
firewall
sniffer
sniffer
Use this command to configure sniffer policies.
Syntax
config firewall sniffer edit <policy_id>
set application-list-status {enable | disable} set application_list <app_list_str>
config anomaly edit
set
set
set
set
quarantine {attacker | both | interface | none}
set
quarantine-log {enable | disable}
end set
end
Variable
application-list-status
{enable | disable} application_list
<app_list_str>
Description
Enable to have the FortiGate unit apply an application black/white list to matching network traffic.
Enter the name of the application black/white list the
FortiGate unit uses when examining network traffic.
This option is available only when application-liststatus is set to enable.
Default
disable
Fortinet Technologies Inc.
Page 211 FortiOS™ - CLI Reference for FortiOS 5.0
firewall
Variable
av-profile-status
{enable | disable} av-profile <string>
Description
Enable to have the FortiGate unit examine network traffic for virus signatures.
Select a configured antivirus profile from the list.
Default
disable client-reputation
{enable | disable} dlp-sensor-status
{enable | disable} dlp-sensor <string>
This option is available only when av-profile-status is enabled.
Enable or disable the client reputation feature in this sniffer.
disable
Enable to have the FortiGate unit examine network traffic for data leaks.
Select one of the configured DLP sensors. disable
This option is only available when dlp-sensor-status is enabled.
dstaddr <dstaddr_ipv4> Enter an address or address range to limit traffic monitoring to network traffic sent to the specified address or range.
interface <int_str> ips-dos-sensor
{enable | disable}
The interface or zone to be monitored.
Enable to have the FortiGate unit examine network traffic for DoS sensor violations. ips-sensor-status
{enable | disable}
Enable to have the FortiGate unit examine network traffic for attacks and vulnerabilities.
ips-sensor <sensor_str> Enter the name of the IPS sensor the FortiGate unit will use when examining network traffic. This option is available only when ips-sensor-status is set to enable.
ipv6 {enable | disable}
Enable to sniff IPv6 packets.
logtraffic {all | utm
| disable}
Choose which traffic logs will be recorded:
• all disable disable disable utm
• utm - only UTM-relatedlogs
• disable - no logging logtraffic-app
{enable | disable}
Enable to log traffic while application logging is active.
max-packet-count <int> Enter the maximum number of packets to capture when sniffing. Range 1 to 10 000.
non-ip
{enable | disable}
Enable to sniff non-IP traffic.
protocol <protocol_list> Enter the protocols to sniff.
srcaddr <srcaddr_ipv4> Enter an address or address range to limit traffic monitoring to network traffic sent from the specified address or range.
status {enable | disable} Enable or disable the sniffer policy. A disabled sniffer policy has no effect on network traffic.
vlan <vlan_list> webfilter-profile-status
{enable | disable} webfilter-profile
<string>
Enter the VLANs to sniff.
This options is available only when webfilter-profile-status is enabled.
enable
4000 disable
Null enable
Null
Enable to filter web traffic based on the selected profile. disable
Select a webfilter profile from the list.
sniffer
Fortinet Technologies Inc.
Page 212 FortiOS™ - CLI Reference for FortiOS 5.0
firewall sniffer
Variable Description Default config anomaly fields
<anomaly_str>
Enter the name of the anomaly you want to configure.
Display a list of the available anomaly types by entering ‘?’.
status {enable | disable} Enable or disable the specified anomaly.
log {enable | disable}
Enable or disable logging of the specified anomaly in the sniffer.
action {block | pass}
Select whether to pass or block traffic in which the anomaly is detected.
disable disable pass quarantine {attacker
| both | interface | none}
To prevent the attacker from continuing to attack the
FortiGate unit, you can quarantine the attacker to the banned user list in one of three ways.
none quarantine-log
{enable | disable} threshold
<threshold_int>
• Enter attacker to block all traffic sent from the attacker’s IP address. The attacker’s IP address is also added to the banned user list. The target’s address is not affected.
• Enter both to block all traffic sent from the attacker’s IP address to the target (victim’s) IP address. Traffic from the attacker’s IP address to addresses other than the victim’s IP address is allowed. The attacker’s and target’s IP addresses are added to the banned user list as one entry.
• Enter interface to block all traffic from connecting to the FortiGate unit interface that received the attack. The interface is added to the banned user list.
• Enter none to disable adding addresses to the quarantine.
Enable NAC quarantine logging. NAC quarantine logging is only available when quarantine is set something other than none.
disable
Enter the number of times the specified anomaly must be detected in network traffic before the action is triggered.
Range 1 to 2 147 483 647.
varies by anomaly
Fortinet Technologies Inc.
Page 213 FortiOS™ - CLI Reference for FortiOS 5.0
firewall sniff-interface-policy
sniff-interface-policy
Using this command you can add sniffer policies you can configure a FortiGate unit interface to operate as a one-arm intrusion detection system (IDS) appliance by sniffing packets for attacks without actually receiving and otherwise processing the packets.
To configure one-arm IDS, you need to configure one or more FortiGate interfaces to operated in one-arm sniffer mode using the ips-sniffer-mode field of the config system interface command to configure an interface to operate in one-arm sniffer mode. See
“system ips-sniffer-mode {enable | disable}” on page 565
. When you configure an interface to operate in one-arm sniffer mode it cannot be used for any other purpose. For example, you cannot add firewall policies for the interface and you cannot add the interface to a zone.
If you add VLAN interfaces to an interface configured for one-arm sniffer operation this VLAN interface also operates in one-arm sniffer mode and you can add sniffer policies for this VLAN interface.
After you have configured the interface for one-arm sniffer mode, connect the interface to a hub or to the SPAN port of a switch that is processing network traffic.
Then use the config firewall sniff-interface-policy command to add Sniffer policies for that
FortiGate interface that include a DoS sensor, an IPS sensors, and an Application black/white list to detect attacks and other activity in the traffic that the FortiGate interface receives from the hub or switch SPAN port.
In one-arm sniffer mode, the interface receives packets accepted by sniffer mode policies only.
All packets not received by sniffer mode policies are dropped. All packets received by sniffer mode policies go through IPS inspection and are dropped after then are analyzed by IPS.
One-arm IDS cannot block traffic. However, if you enable logging in the DoS and IPS sensors and the application black/white lists, the FortiGate unit records log messages for all detected attacks and applications.
The sniff-interface-policy command is applied to IPv4 addresses. For IPv6 addresses, use sniff-interface-policy6 instead.
Syntax
config firewall sniff-interface-policy edit <policy_id>
Fortinet Technologies Inc.
Page 214 FortiOS™ - CLI Reference for FortiOS 5.0
firewall sniff-interface-policy
set webfilter-profile <string> set webfilter-profile-status {enable | disable}
end
Variable
application-list-status
{enable | disable} application_list
<app_list_str>
Description
Enable to have the FortiGate unit apply an application black/white list to matching network traffic.
Enter the name of the application black/white list the
FortiGate unit uses when examining network traffic.
This option is available only when application-liststatus is set to enable.
Select a configured antivirus profile from the list.
Default
disable av-profile <string> av-profile-status
{enable | disable} dlp-sensor <string>
This option is available only when av-profile-status is enabled.
Enable to have the FortiGate unit examine network traffic for virus signatures.
Select one of the configured DLP sensors. disable dlp-sensor-status
{enable | disable} dstaddr
<dstaddr_ipv4> interface <int_str> ips-sensor-status
{enable | disable} ips-sensor
<sensor_str>
This option is only available when dlp-sensor-status is enabled.
Enable to have the FortiGate unit examine network traffic for data leaks.
Enter an address or address range to limit traffic monitoring to network traffic sent to the specified address or range.
The interface or zone to be monitored.
Enable to have the FortiGate unit examine network traffic for attacks and vulnerabilities.
Enter the name of the IPS sensor the FortiGate unit will use when examining network traffic.
disable disable
This option is available only when ips-sensor-status is set to enable.
Choose which traffic logs will be recorded: logtraffic {all | utm
| disable} utm
• all
• utm - only UTM-relatedlogs logtraffic-app
{enable | disable}
Enable to log traffic while application logging is active.
service <service_str>
Enter a service to limit traffic monitoring to only the selected type. You may also specify a service group, or multiple services separated by spaces.
srcaddr
<srcaddr_ipv4> status
{enable | disable}
• disable - no logging
Enter an address or address range to limit traffic monitoring to network traffic sent from the specified address or range.
Enable or disable the sniffer policy. A disabled sniffer policy has no effect on network traffic.
enable enable
Fortinet Technologies Inc.
Page 215 FortiOS™ - CLI Reference for FortiOS 5.0
firewall sniff-interface-policy
Variable
webfilter-profile
<string>
Description
Select a webfilter profile from the list.
This options is available only when webfilter-profile-status is enabled.
webfilter-profile-status
{enable | disable}
Enable to filter web traffic based on the selected profile.
Default
disable
Fortinet Technologies Inc.
Page 216 FortiOS™ - CLI Reference for FortiOS 5.0
firewall sniff-interface-policy6
sniff-interface-policy6
Using this command you can add sniffer policies you can configure a FortiGate unit interface to operate as a one-arm intrusion detection system (IDS) appliance for IPv6 traffic by sniffing packets for attacks without actually receiving and otherwise processing the packets.
To configure one-arm IDS, you need to configure one or more FortiGate interfaces to operated in one-arm sniffer mode using the ips-sniffer-mode field of the config system interface command to configure an interface to operate in one-arm sniffer mode. See
“system ips-sniffer-mode {enable | disable}” on page 565
When you configure an interface to operate in one-arm sniffer mode it cannot be used for any other purpose. For example, you cannot add firewall policies for the interface and you cannot add the interface to a zone.
If you add VLAN interfaces to an interface configured for one-arm sniffer operation this VLAN interface also operates in one-arm sniffer mode and you can add sniffer policies for this VLAN interface.
After you have configured the interface for one-arm sniffer mode, connect the interface to a hub or to the SPAN port of a switch that is processing network traffic.
Then use the config firewall sniff-interface-policy command to add Sniffer policies for that
FortiGate interface that include a DoS sensor, an IPS sensors, and an Application black/white list to detect attacks and other activity in the traffic that the FortiGate interface receives from the hub or switch SPAN port.
In one-arm sniffer mode, the interface receives packets accepted by sniffer mode policies only.
All packets not received by sniffer mode policies are dropped. All packets received by sniffer mode policies go through IPS inspection and are dropped after then are analyzed by IPS.
One-arm IDS cannot block traffic. However, if you enable logging in the IPS sensors and the application black/white lists, the FortiGate unit records log messages for all detected attacks and applications.
The interface-policy6 command is used for DoS policies applied to IPv6 addresses. For
IPv4 addresses, use interface-policy instead.
Fortinet Technologies Inc.
Page 217 FortiOS™ - CLI Reference for FortiOS 5.0
firewall sniff-interface-policy6
Syntax
config firewall sniff-interface-policy6 edit <policy_id>
end
Variable
application-list-status
{enable | disable} application_list
<app_list_str> av-profile <string>
Description
Enable to have the FortiGate unit apply an application black/white list to matching network traffic.
Enter the name of the application black/white list the
FortiGate unit uses when examining network traffic.
This option is available only when application-liststatus is set to enable.
Select a configured antivirus profile from the list.
Default
disable av-profile-status
{enable | disable} dlp-sensor <string>
This option is available only when av-profile-status is enabled.
Enable to have the FortiGate unit examine network traffic for virus signatures.
disable
Select one of the configured DLP sensors.
This option is only available when dlp-sensor-status is enabled.
dlp-sensor-status
{enable | disable} dstaddr6
<dstaddr_ipv6> interface
Enable to have the FortiGate unit examine network traffic for data leaks.
Enter an address or address range to limit traffic monitoring to network traffic sent to the specified address or range.
The interface or zone to be monitored.
ips-sensor-status
{enable | disable}
Enable to have the FortiGate unit examine network traffic for attacks and vulnerabilities.
ips-sensor <sensor_str> Enter the name of the IPS sensor the FortiGate unit will use when examining network traffic.
disable disable
This option is available only when ips-sensor-status is set to enable.
Fortinet Technologies Inc.
Page 218 FortiOS™ - CLI Reference for FortiOS 5.0
firewall sniff-interface-policy6
Variable
logtraffic {all | utm
| disable}
Description
Choose which traffic logs will be recorded:
Default
utm
• all
• utm - only UTM-relatedlogs
• disable - no logging logtraffic-app
{enable | disable}
Enable to log the application for the traffic.
service6 <service_str> Enter a service to limit traffic monitoring to only the selected type. You may also specify a service group, or multiple services separated by spaces.
srcaddr6
<srcaddr_ipv6> status
{enable | disable} webfilter-profile
<string>
Enter an address or address range to limit traffic monitoring to network traffic sent from the specified address or range.
Enable or disable the DoS policy. A disabled DoS policy has no effect on network traffic.
Select a webfilter profile from the list.
This options is available only when webfilter-profile-status is enabled.
webfilter-profile-status
{enable | disable}
Enable to filter web traffic based on the selected profile. enable enable disable
Fortinet Technologies Inc.
Page 219 FortiOS™ - CLI Reference for FortiOS 5.0
firewall
ssl setting
ssl setting
Use this command to configure SSL proxy settings so that you can apply antivirus scanning, web filtering, FortiGuard web filtering, spam filtering, data leak prevention (DLP), and content archiving to HTTPS, IMAPS, POP3S, and SMTPS traffic by using the config firewall profile command.
To perform SSL content scanning and inspection, the FortiGate unit does the following:
• intercepts and decrypts HTTPS, IMAPS, POP3S, and SMTPS sessions between clients and servers (FortiGate SSL acceleration speeds up decryption)
• applies content inspection to decrypted content, including:
• HTTPS, IMAPS, POP3S, and SMTPS Antivirus, DLP., and content archiving
• HTTPS web filtering and FortiGuard web filtering
• IMAPS, POP3S, and SMTPS spam filtering
• re-encrypts the sessions and forwards them to their destinations.
Syntax
config firewall ssl setting set
cert-cache-capacity <capacity_integer>
set
cert-cache-timeout <timeout_integer>
set
no-matching-cipher-action {bypass | drop}
set
proxy-connect-timeout <timeout_integer>
set
session-cache-capacity <capacity_integer>
set
session-cache-timeout <port_int>
set
ssl-dh-bits {1024 | 1536 | 2048 | 768}
end set
ssl-send-empty-frags {enable | disable}
Variable
cert-cache-capacity
<capacity_integer> cert-cache-timeout
<timeout_integer> no-matching-cipher-action
{bypass | drop} proxy-connect-timeout
<timeout_integer> session-cache-capacity
<capacity_integer> session-cache-timeout
<port_int> ssl-dh-bits {1024 | 1536
| 2048 | 768} ssl-send-empty-frags
{enable | disable}
Description
Enter the capacity of the host certificate cache. The range is from 0 to 200.
Enter the time limit to keep the certificate cache. The range is from 1 to 120 minutes.
10
Bypass or drop SSL traffic when unsupported cipher is being used by the server.
Enter the capacity of SSL session cache (0 - 1000).
bypass
Enter the time limit to make an internal connection to the appropriate proxy process (1 - 60 seconds).
30
500
Enter the time limit in minutes to keep the SSL session.
20
Select the size of Diffie-Hellman prime used in DHE_RSA negotiation.
Enable or disable sending empty fragments to avoid attack on CBC IV (SSL 3.0 & TLS 1.0 only).
Default
100
1024 enable
Fortinet Technologies Inc.
Page 220 FortiOS™ - CLI Reference for FortiOS 5.0
firewall
ttl-policy
ttl-policy
Use this command to create Generalized TTL Security Mechanism (GTSM) policies.
Syntax
config firewall ttl-policy edit <id>
end
Variable
action {accept | deny} schedule <name_str>
Description
Enter the name of the one-time or recurring schedule or schedule group to use for the policy.
service <name_str>
Enter the name of one or more services, or a service group, to match with the firewall policy. Separate multiple services with a space.
srcaddr <name_str>
Enter one or more source firewall addresses for the policy. Separate multiple firewall addresses with a space.
srcintf <name_str>
Enter the source interface for the policy. status {enable | disable}
Enable or disable this policy.
ttl <ttl-range>
Enter the range of TTL values to match in the form lowhigh, “253-255” for example.
Value
No default.
No default.
No default.
No default.
enable null
Fortinet Technologies Inc.
Page 221 FortiOS™ - CLI Reference for FortiOS 5.0
firewall
vip
Use this command to configure virtual IPs and their associated address and port mappings
(NAT).
Virtual IPs can be used to allow connections through a FortiGate unit using network address translation (NAT) firewall policies. Virtual IPs can use proxy ARP so that the FortiGate unit can respond to ARP requests on a network for a server that is actually installed on another network.
Proxy ARP is defined in RFC 1027.
For example, you can add a virtual IP to an external FortiGate unit interface so that the external interface can respond to connection requests for users who are actually connecting to a server on the DMZ or internal network.
Depending on your configuration of the virtual IP, its mapping may involve port address translation (PAT), also known as port forwarding or network address port translation (NAPT), and/or network address translation (NAT) of IP addresses.
If you configure NAT in the virtual IP and firewall policy, the NAT behavior varies by your selection of:
• static vs. dynamic NAT mapping
• the dynamic NAT’s load balancing style, if using dynamic NAT mapping
• full NAT vs. destination NAT (DNAT)
The following table describes combinations of PAT and/or NAT that are possible when configuring a firewall policy with a virtual IP.
Static NAT
Static NAT with
Port Forwarding
Static, one-to-one NAT mapping: an external IP address is always translated to the same mapped IP address.
If using IP address ranges, the external IP address range corresponds to a mapped IP address range containing an equal number of IP addresses, and each IP address in the external range is always translated to the same IP address in the mapped range.
Static, one-to-one NAT mapping with port forwarding: an external IP address is always translated to the same mapped IP address, and an external port number is always translated to the same mapped port number.
If using IP address ranges, the external IP address range corresponds to a mapped IP address range containing an equal number of IP addresses, and each IP address in the external range is always translated to the same IP address in the mapped range. If using port number ranges, the external port number range corresponds to a mapped port number range containing an equal number of port numbers, and each port number in the external range is always translated to the same port number in the mapped range.
Load Balancing
Dynamic, one-to-many NAT mapping: an external IP address is translated to one of the mapped IP addresses. For each session, a load balancing algorithm dynamically selects an IP address from the mapped IP address range to provide more even traffic distribution. The external IP address is not always translated to the same mapped IP address.
vip
Fortinet Technologies Inc.
Page 222 FortiOS™ - CLI Reference for FortiOS 5.0
firewall
Load Balancing with Port
Forwarding
Dynamic
Virtual IPs
Server Load
Balancing
Server Load
Balancing with
Port Forwarding
Dynamic, one-to-many NAT mapping with port forwarding: an external IP address is translated to one of the mapped IP addresses. For each session, a load balancing algorithm dynamically selects an IP address from the mapped IP address range to provide more even traffic distribution. The external IP address is not always translated to the same mapped IP address.
Dynamic, one-to-one NAT mapping for an interface with dynamically assigned IP address. If you set the external IP address of a virtual IP to
0.0.0.0, the interface maps traffic destined for the interface IP address, and is dynamically translated to a mapped IP address or address range.
Dynamic, one-to-many NAT mapping: an external IP address is translated to one of the mapped IP addresses, as determined by the selected load balancing algorithm for more even traffic distribution. The external IP address is not always translated to the same mapped IP address.
Server load balancing requires that you configure at least one “real” server, but can use up to eight (8) real servers per virtual IP (VIP). Real servers can be configured with health check monitors. Health check monitors can be used to gauge server responsiveness before forwarding packets.
Dynamic, one-to-many NAT mapping with port forwarding: an external IP address is translated to one of the mapped IP addresses, as determined by the selected load balancing algorithm for more even traffic distribution.The external IP address is not always translated to the same mapped IP address.
Server load balancing requires that you configure at least one “real” server, but can use up to eight (8) real servers per virtual IP (VIP). Real servers can be configured with health check monitors. Health check monitors can be used to gauge server responsiveness before forwarding packets.
If the NAT check box is not selected when building the firewall policy, the resulting policy does not perform full (source and destination) NAT; instead, it performs destination network address translation (DNAT).
For inbound traffic, DNAT translates packets’ destination address to the mapped private IP address, but does not translate the source address. The private network is aware of the source’s public IP address. For reply traffic, the FortiGate unit translates packets’ private network source IP address to match the destination address of the originating packets, which is maintained in the session table.
The following limitations apply when adding virtual IPs, Load balancing virtual servers, and load balancing real servers. Load balancing virtual servers are actually server load balancing virtual
IPs. You can add server load balance virtual IPs from the CLI.
• Virtual IP extip entries or ranges cannot overlap with each other unless src-filter is used.
• A virtual IP mappedip cannot be 0.0.0.0 or 255.255.255.255.
• A real server
IP cannot be 0.0.0.0 or 255.255.255.255.
• If a static NAT virtual IP extip is 0.0.0.0, the mappedip must be a single IP address.
• If a load balance virtual IP extip is 0.0.0.0, the mappedip can be an address range.
vip
Fortinet Technologies Inc.
Page 223 FortiOS™ - CLI Reference for FortiOS 5.0
firewall
• When port forwarding, the count of mappedport and extport numbers must be the same. The web-based manager does this automatically but the CLI does not.
• Virtual IP names must be different from firewall address or address group names.
Syntax
config firewall vip edit
<name_str> set arp-reply {enable | disable} set comment <comment_str> set extintf <name_str>
set http-multiplex {enable | disable} set https-cookie-secure {disable | enable} set id <id_num_str>
set ldb-method {first-alive | http-host | least-rtt
| least-session | round-robin | static | weighted}
set server-type {http | https | imaps | ip | pop3s | smtps | ssl
set src-filter <addr_str> set srcintf-filter <intf_str>
Fortinet Technologies Inc.
Page 224 FortiOS™ - CLI Reference for FortiOS 5.0
vip
firewall
set ssl-http-match-host {enable | disable}
?
edit
set
client-ip <ip_range_ipv4> [<ip_range_ipv4>]
[<ip_range_ipv4>] [<ip_range_ipv4>]
set
healthcheck {enable | disable}
set
holddown-interval <seconds_int>
set
set
set
max-connections <connection_integer>
set
set
set
status {active | disable | standby}
end end set
weight <loadbalanceweight_int>
edit <id> end set
set
versions {ssl-3.0 tls-1.0 tls-1.1}
Variable Description Default
<name_str> arp-reply
{enable | disable}
Enter the name of this virtual IP address.
Select to respond to ARP requests for this virtual IP address.
No default.
enable comment <comment_str> Enter comments relevant to the configured virtual IP.
No default extintf <name_str>
Enter the name of the interface connected to the source network that receives the packets that will be forwarded to the destination network. The interface name can be any FortiGate network interface, VLAN subinterface, IPSec VPN interface, or modem interface.
No default.
vip
Fortinet Technologies Inc.
Page 225 FortiOS™ - CLI Reference for FortiOS 5.0
firewall
Variable
extip <address_ipv4>[-
<address_ipv4>] extport <port_int> gratuitous-arp-interval
<interval_seconds> http-cookie-age
<age_int> http-cookie-domain
<domain_str>
Description
Enter the IP address or address range on the external interface that you want to map to an address or address range on the destination network.
Default
0.0.0.0
If type is static-nat and mappedip is an IP address range, the FortiGate unit uses extip as the first IP address in the external IP address range, and calculates the last IP address required to create an equal number of external and mapped IP addresses for one-to-one mapping.
To configure a dynamic virtual IP that accepts connections destined for any IP address, set extip to
0.0.0.0.
Enter the external port number that you want to map to a port number on the destination network.
0
This option only appears if portforward is enabled.
If portforward is enabled and you want to configure a static NAT virtual IP that maps a range of external port numbers to a range of destination port numbers, set extport to the first port number in the range.
Then set mappedport to the start and end of the destination port range. The FortiGate unit automatically calculates the end of the extport port number range.
If type is server-load-balance, extport is available unless server-type is ip. The value of extport changes to 80 if server-type is http and to
443 if server-type is https.
Configure sending of ARP packets by a virtual IP. You can set the time interval between sending ARP packets. Set the interval to 0 to disable sending ARP packets.
0
Configure HTTP cookie persistence to change how long the browser caches the cookie. Enter an age in minutes or set the age to 0 to make the browser keep the cookie indefinitely. The range is 0 to 525600 minutes.
60
This option is available when type is server-loadbalance, server-type is http or https and persistence is http or https.
Configure HTTP cookie persistence to restrict the domain that the cookie should apply to. Enter the DNS domain name to restrict the cookie to.
This option is available when type is server-loadbalance, server-type is http or https and persistence is http or https.
vip
Fortinet Technologies Inc.
Page 226 FortiOS™ - CLI Reference for FortiOS 5.0
firewall
Variable
http-cookie-domainfrom-host {enable | disable} http-cookie-generation
<generation_int> http-cookie-path
<path_str> http-cookie-share
{disable | same-ip} http-ip-header
{enable | disable}
Description
If enabled, when the FortiGate unit adds a SetCookie to the HTTP(S) response, the Domain attribute in the
SetCookie will be set to the value of the Host: header, if there was one.
Default
disable
If there was no Host: header, the Domain attribute will be set to the value of http-cookie-domain if it is set and if it is not then the Domain attribute will not be included in the SetCookie.
This option is available when type is server-loadbalance, server-type is http or https and persistence is http-cookie.
Configure HTTP cookie persistence to invalidate all cookies that have already been generated. The exact value of the generation is not important, only that it is different from any generation that has already been used.
0
This option is available when type is server-loadbalance, server-type is http or https and persistence is http or https.
Configure HTTP cookie persistence to limit the cookies to a particular path, for example
/new/path.
This option is available when type is server-loadbalance, server-type is http or https and persistence is http or https.
Configure HTTP cookie persistence to control the sharing of cookies across more than one virtual server.
The default setting same-ip means that any cookie generated by one virtual server can be used by another virtual server in the same virtual domain.
same-ip
Select disable to make sure that a cookie generated for a virtual server cannot be used by other virtual servers.
This options is available when type is serverload-balance, server-type is http or https and persistence is http or https.
Select to preserve the client’s IP address in the
X-
Forwarded-For HTTP header line if HTTP multiplexing is enabled. This can be useful if you require logging on the server of the client’s original IP address. If this option is not selected, in HTTP multiplexing configurations the header will contain the
IP address of the FortiGate unit.
disable
This option appears only if portforward and httpmultiplex are enable.
vip
Fortinet Technologies Inc.
Page 227 FortiOS™ - CLI Reference for FortiOS 5.0
firewall
Variable
http-multiplex
{enable | disable} https-cookie-secure
{disable | enable} id <id_num_str>
Description
Select to use the FortiGate unit to multiplex multiple client connections into a few connections between the
FortiGate unit and the real server. This can improve performance by reducing server overhead associated with establishing multiple connections. The server must be HTTP/1.1 compliant.
Default
disable
This option is only available if server-type is http or https.
Configure HTTP cookie persistence to enable or disable using secure cookies for HTTPS sessions.
Secure cookies are disabled by default because they can interfere with cookie sharing across HTTP and
HTTPS virtual servers. If enabled, then the
Secure tag is added to the cookie inserted by the FortiGate unit.
disable
This option is available when type is server-loadbalance, server-type is http or https and persistence is http or https.
Enter a unique identification number for the configured virtual IP. Not checked for uniqueness. Range 0 -
65535.
No default.
vip
Fortinet Technologies Inc.
Page 228 FortiOS™ - CLI Reference for FortiOS 5.0
firewall
Variable
ldb-method
{first-alive | http-host | least-rtt | least-session
| round-robin | static
| weighted}
Description
Select the method used by the virtual server to distribute sessions to the real servers. You add real servers to the virtual server using config realservers.
• first-alive: Always directs requests to the first alive real server. In this case “first” refers to the order of the real servers in the virtual server configuration. For example, if you add real servers
A, B and C in that order, then traffic always goes to
A as long as it is alive. If A goes down then traffic goes to B and if B goes down the traffic goes to C.
If A comes back up, traffic goes to A. Real servers are ordered in the virtual server configuration in the order in which you add them, with the most recently added real server last. If you want to change the order you must delete and re-add real servers as required.
• http-host: Load balance HTTP requests by the contents of the HOST header.
• least-rtt: Directs requests to the real server with the least round trip time. The round trip time is determined by a Ping monitor and is defaulted to 0 if no Ping monitors are defined.
• least-session: Directs requests to the real server that has the least number of current connections. This method works best in environments where the real servers or other equipment you are load balancing have similar capabilities.
• round-robin: Directs request to the next real server, and treats all real servers as equals regardless of response time or number of connections. Unresponsive real servers are avoided. A separate real server is required.
• static: Distributes sessions evenly across all real servers according to the session source IP address. This load balancing method provides some persistence because all sessions from the same source address would always go to the same server. However, the distribution is stateless, so if a real server is added or removed (or goes up or down) the distribution is changed so persistence will be lost. Separate real servers are not required.
• weighted: Real servers with a higher weight value receive a larger percentage of connections at any one time. Server weights can be set in config realservers set weight
This option appears only if type is server-loadbalance.
Default
static
vip
Fortinet Technologies Inc.
Page 229 FortiOS™ - CLI Reference for FortiOS 5.0
firewall
Variable
mappedip
[<start_ipv4>-
<end_ipv4>]
Description
Enter the IP address or IP address range on the destination network to which the external IP address is mapped.
If type is static-nat and mappedip is an IP address range, the FortiGate unit uses extip as the first IP address in the external IP address range, and calculates the last IP address required to create an equal number of external and mapped IP addresses for one-to-one mapping.
If type is load-balance and mappedip is an IP address range, the FortiGate unit uses extip as a single IP address to create a one-to-many mapping.
mappedport <port_int>
Enter the port number on the destination network to which the external port number is mapped.
Default
0.0.0.0
0
You can also enter a port number range to forward packets to multiple ports on the destination network.
max-embryonicconnections
<initiated_int> monitor <name_str> nat-source-vip
{enable | disable} outlook-web-access
{disable | enable}
For a static NAT virtual IP, if you add a map to port range the FortiGate unit calculates the external port number range.
Enter the maximum number of partially established
SSL or HTTP connections. This should be greater than the maximum number of connections you want to establish per second.
1000
This option appears only if portforward is enable, and http is enable or ssl is not off.
Select the health check monitor for use when polling to determine a virtual server’s connectivity status.
Enable to prevent unintended servers from using a virtual IP. The virtual IP will be used as the source IP address for connections from the server through the
FortiGate unit.
No default.
disable
Disable to use the actual IP address of the server (or the FortiGate destination interface if using NAT) as the source address of connections from the server that pass through the FortiGate unit.
If the FortiGate unit provides SSL offload for Microsoft
Outlook Web Access then the Outlook server expects to see a
Front-End-Https: on header inserted into the HTTP headers as described in this Microsoft
Technical Note . If outlook-web-access is enabled
FortiGate unit adds this header to all HTTP requests.
disable
This options is available when type is serverload-balance, server-type is http or https.
vip
Fortinet Technologies Inc.
Page 230 FortiOS™ - CLI Reference for FortiOS 5.0
firewall
Variable
persistence {none | sslsession-id | httpcookie(http) http https ssl
Description
If the type is server-load-balance, configure persistence for a virtual server to make sure that clients connect to the same server every time they make a request that is part of the same session.
Default
none
When you configure persistence, the FortiGate unit load balances a new session to a real server according to the ldb-method. If the session has an HTTP cookie or an SSL session ID, the FortiGate unit sends all subsequent sessions with the same HTTP cookie or
SSL session ID to the same real server.
You can configure persistence if server-type is set to http, https, or ssl.
• none: No persistence. Sessions are distributed solely according to the ldb-method. Setting ldbmethod to static (the default) results in behavior equivalent to persistence. See the description of
“firewall ldb-method {first-alive | httphost | least-rtt | least-session | round-robin | static
| weighted}” on page 229 for more information.
• http-cookie: all HTTP or HTTPS sessions with the same HTTP session cookie are sent to the same real server. http-cookie is available if server-type is set to https or ssl. If you select http-cookie you can also configure httpcookie-domain, http-cookie-path, httpcookie-generation, http-cookie-age, and http-cookie-share for HTTP and these settings plus https-cookie-secure for HTTPS.
• ssl-session-id: all sessions with the same SSL session ID are sent to the same real server. sslsession-id is available if server-type is set to https or ssl.
portforward
{enable | disable}
Select to enable port forwarding. You must also specify the port forwarding mappings by configuring extport and mappedport.
portmapping-type {1-to-1
| m-to-n}
Select the type of port mapping.
1-to1 — one-to-one mapping disable
1-to-1 m-to-n — load balancing
This is available when portforward is enable.
protocol {sctp | tcp | udp} Select the protocol, TCP or UDP, to use when forwarding packets.
tcp
vip
Fortinet Technologies Inc.
Page 231 FortiOS™ - CLI Reference for FortiOS 5.0
firewall
Variable
server-type {http | https | imaps | ip | pop3s | smtps | ssl | tcp | udp}
Description
If the type is server-load-balance, select the protocol to be load balanced by the virtual server (also called the server load balance virtual IP). If you select a general protocol such as ip, tcp, or udp the virtual server load balances all IP, TCP, or UDP sessions. If you select specific protocols such as http, https, or ssl you can apply additional server load balancing features such as persistence and HTTP multiplexing.
Default
(none)
• http: load balance only HTTP sessions with destination port number that matches the extport setting. Change extport to match the destination port of the sessions to be load balanced. You can also configure httpmultiplex. You can also set persistence to http-cookie and configure http-cookiedomain, http-cookie-path, http-cookiegeneration, http-cookie-age, and httpcookie-share settings for cookie persistence.
• https: load balance only HTTPS sessions with destination port number that matches the extport setting. Change extport to match the destination port of the sessions to be load balanced. You can also configure httpmultiplex and set persistence to httpcookie and configure the same http-cookie options as for http virtual servers plus the httpscookie-secure option. You can also set persistence to ssl-session-id. You can also configure the SSL options such as ssl-mode and ssl-certificate and so on. https is available on FortiGate units that support SSL acceleration.
• imaps: load balance only IMAPS sessions with destination port number that matches the extport setting. Change extport to match the destination port of the sessions to be load balanced.
• ip: load balance all sessions accepted by the firewall policy that contains this server load balance virtual IP. Since all sessions are load balanced you don’t have to set the extport.
• pop3s: load balance only POP3S sessions with destination port number that matches the extport setting. Change extport to match the destination port of the sessions to be load balanced.
• smtps: load balance only SMTPS sessions with destination port number that matches the extport setting. Change extport to match the destination port of the sessions to be load balanced.
vip
Fortinet Technologies Inc.
Page 232 FortiOS™ - CLI Reference for FortiOS 5.0
firewall
Variable
src-filter <addr_str> srcintf-filter <intf_str>
Description
• ssl: load balance only SSL sessions with destination port number that matches the extport setting. Change extport to match the destination port of the sessions to be load balanced. You can also configure the SSL options such as ssl-mode and ssl-certificate and so on.
• tcp: load balance only TCP sessions with destination port number that matches the extport setting. Change extport to match the destination port of the sessions to be load balanced.
• udp: load balance only UDP sessions with destination port number that matches the extport setting. Change extport to match the destination port of the sessions to be load balanced.
Default
Enter a source address filter. Each address must be either an IP/subnet (x.x.x.x/n) or a range (x.x.x.xy.y.y.y). Separate addresses by spaces.
null
Enter names of the interfaces to which the VIP applies.
Separate names with spaces.
No default.
vip
Fortinet Technologies Inc.
Page 233 FortiOS™ - CLI Reference for FortiOS 5.0
firewall
Variable
ssl-mode {full | half} ssl-algorithm
{low | medium | high
| custom} ssl-certificate
<certificate_str>
Description
Select whether or not to accelerate SSL communications with the destination by using the
FortiGate unit to perform SSL operations, and indicate which segments of the connection will receive SSL offloading. Accelerating SSL communications in this way is also called SSL offloading.
Default
full
• full: Select to apply SSL acceleration to both parts of the connection: the segment between the client and the FortiGate unit, and the segment between the FortiGate unit and the server. The segment between the FortiGate unit and the server will use encrypted communications, but the handshakes will be abbreviated. This results in performance which is less than the option half, but still improved over communications without
SSL acceleration, and can be used in failover configurations where the failover path does not have an SSL accelerator. If the server is already configured to use SSL, this also enables SSL acceleration without requiring changes to the server’s configuration.
• half: Select to apply SSL only to the part of the connection between the client and the FortiGate unit. The segment between the FortiGate unit and the server will use clear text communications. This results in best performance, but cannot be used in failover configurations where the failover path does not have an SSL accelerator.
SSL 3.0 and TLS 1.0 are supported.
This option appears only if server-type is ssl or https.
Set the permitted encryption algorithms for SSL sessions according to encryption strength: high low — AES, 3DES, RC4, DES medium — AES, 3DES, RC4 high — AES, 3DES custom — determined in config ssl-cipher-suites subcommand
Enter the name of the SSL certificate to use with SSL acceleration.
This option appears only if type is server-loadbalance and server-type is ssl.
No default.
vip
Fortinet Technologies Inc.
Page 234 FortiOS™ - CLI Reference for FortiOS 5.0
firewall
Variable
ssl-client-renegotiation
{allow | deny | secure} ssl-client-session-statemax <sessionstates_int> ssl-client-session-statetimeout <timeout_int> ssl-client-session-statetype {both | client | disable | time} ssl-dh-bits <bits_int> ssl-http-locationconversion
{enable | disable}
Description
Select the SSL secure renegotiation policy.
allow — Allow, but do not require secure renegotiation.
Default
allow deny — Do not allow renegotiation.
secure — Require secure renegotiation.
Secure renegotiation complies with RFC 5746 Secure
Negotiation Indication.
Enter the maximum number of SSL session states to keep for the segment of the SSL connection between the client and the FortiGate unit.
1000
This option appears only if type is server-loadbalance and server-type is ssl.
Enter the number of minutes to keep the SSL session states for the segment of the SSL connection between the client and the FortiGate unit.
30
This option appears only if type is server-loadbalance and server-type is ssl.
Select which method the FortiGate unit should use when deciding to expire SSL sessions for the segment of the SSL connection between the client and the
FortiGate unit.
both
• both: Select to expire SSL session states when either ssl-client-session-state-max or ssl-client-session-state-timeout is exceeded, regardless of which occurs first.
• count: Select to expire SSL session states when ssl-client-session-state-max is exceeded.
• disable: Select to keep no SSL session states.
• time: Select to expire SSL session states when ssl-client-session-state-timeout is exceeded.
This option appears only if type is server-loadbalance and server-type is ssl.
Enter the number of bits of the prime number used in the Diffie-Hellman exchange for RSA encryption of the
SSL connection. Larger prime numbers are associated with greater cryptographic strength.
1024
This option appears only if type is server-loadbalance and server-type is ssl.
Select to replace http with https in the reply’s
Location HTTP header field.
For example, in the reply,
Location: http:
//example.com/ would be converted to
Location: https://example.com/.
This option appears only if type is server-loadbalance and server-type is https.
disable
Fortinet Technologies Inc.
Page 235 FortiOS™ - CLI Reference for FortiOS 5.0
vip
firewall
Variable
ssl-http-match-host
{enable | disable}
Description
Select to apply
Location conversion to the reply’s
HTTP header only if the host name portion of
Location matches the request’s Host field, or, if the
Host field does not exist, the host name portion of the request’s URI. If disabled, conversion occurs regardless of whether the host names in the request and the reply match.
Default
disable
For example, if host matching is enabled, and a request contains
Host: example.com and the reply contains
Location: http://example.cc/, the
Location field does not match the host of the original request and the reply’s
Location field remains unchanged. If the reply contains
Location: http://example.com/, however, then the FortiGate unit detects the matching host name and converts the reply field to
Location: https://example.com/.
ssl-max-version {ssl-3.0 | tls-1.0}
This option appears only if ssl-http-locationconversion is enable.
Enter the maximum version of SSL/TLS to accept in negotiation.
tls-1.0
ssl-min-version {ssl-3.0 | tls-1.0}
This option appears only if type is server-loadbalance and server-type is ssl.
Enter the minimum version of SSL/TLS to accept in negotiation.
ssl-3.0
ssl-pfs
{allow | deny | require}
This option appears only if type is server-loadbalance and server-type is ssl.
Select handling of perfect forward secrecy (PFS) for connections: allow ssl-send-empty-frags
{enable | disable} allow — Allow use of any cipher suite.
deny — Allow only non-Diffie-Hellman cipher-suites.
require — Allow only Diffie-Hellman cipher-suites.
Select to precede the record with empty fragments to thwart attacks on CBC IV. You might disable this option if SSL acceleration will be used with an old or buggy SSL implementation which cannot properly handle empty fragments.
enable ssl-server-session-statemax <sessionstates_int>
This option appears only if type is server-loadbalance and server-type is ssl, and applies only to SSL 3.0 and TLS 1.0.
Enter the maximum number of SSL session states to keep for the segment of the SSL connection between the server and the FortiGate unit.
1000 ssl-server-session-statetimeout <timeout_int>
This option appears only if ssl-mode is full.
Enter the number of minutes to keep the SSL session states for the segment of the SSL connection between the server and the FortiGate unit.
30
This option appears only if ssl-mode is full.
Fortinet Technologies Inc.
Page 236 FortiOS™ - CLI Reference for FortiOS 5.0
vip
firewall
Variable
ssl-server-session-statetype {both | count | disable | time} type
{load-balance | server-load-balance | static-nat} weblogic-server
{enable | disable} websphere-server
{enable | disable}
Description
Select which method the FortiGate unit should use when deciding to expire SSL sessions for the segment of the SSL connection between the server and the
FortiGate unit.
Default
both
• both: Select to expire SSL session states when either ssl-server-session-state-max or ssl-server-session-state-timeout is exceeded, regardless of which occurs first.
• count: Select to expire SSL session states when ssl-server-session-state-max is exceeded.
• disable: Select to keep no SSL session states.
• time: Select to expire SSL session states when ssl-server-session-state-timeout is exceeded.
This option appears only if ssl-mode is full.
Select the type of static or dynamic NAT applied by the virtual IP.
static-nat
• load-balance: Dynamic NAT load balancing with server selection from an IP address range.
• server-load-balance: Dynamic NAT load balancing with server selection from among up to eight realservers, determined by your selected load balancing algorithm and server responsiveness monitors.
• static-nat: Static NAT.
Enable or disable adding HTTP header to indicate SSL offload for WebLogic server.
disable
Enable or disable adding HTTP header to indicate SSL offload for WebSphere server.
disable
vip
Fortinet Technologies Inc.
Page 237 FortiOS™ - CLI Reference for FortiOS 5.0
firewall
Variable realservers
Description Default
The following are the options for config realservers, and are available only if type is server-load-balance.
client-ip
<ip_range_ipv4>
[<ip_range_ipv4>]
[<ip_range_ipv4>]
[<ip_range_ipv4>]
Restrict the clients that can connect to a real server according to the client’s source IP address. Use the client-ip option to enter up to four client source IP addresses or address ranges. Separate each IP address or range with a space. The following example shows how to add a single IP address and an IP address range: set client-ip 192.168.1.90 192.168.1.100-
192.168.1.120
Use the client-ip option if you have multiple real servers in a server load balance VIP and you want to control which clients use which real server according to the client’s source IP address.
<table_id> healthcheck
{enable | disable}
Different real servers in the same virtual server can have the same or overlapping IP addresses and ranges. If an overlap occurs, sessions from the overlapping source addresses are load balanced among the real servers with the overlapping addresses.
If you do not specify a client-ip all clients can use the real server.
Enter an index number used to identify the server that you are configuring. You can configure a maximum number of eight (8) servers in a server load balancing cluster.
No default.
disable
Enable to check the responsiveness of the server before forwarding traffic. You must also configure monitor.
vip
Fortinet Technologies Inc.
Page 238 FortiOS™ - CLI Reference for FortiOS 5.0
firewall
Variable
holddown-interval
<seconds_int> http-host <host_str> ip <server_ip> max-connections
<connection_integer>
Description
Enter the amount of time in seconds that the health check monitor will continue to monitor the status of a server whose status is active after it has been detected to be unresponsive.
Default
300
• If the server is detected to be continuously responsive during this interval, a server whose status is standby will be removed from current use and replaced with this server, which will again be used by server load balanced traffic. In this way, server load balancing prefers to use servers whose status is active, if they are responsive.
• If the server is detected to be unresponsive during the first holddown interval, the server will remain out of use for server load balanced traffic, the health check monitor will double the holddown interval once, and continue to monitor the server for the duration of the doubled holddown interval.
The health check monitor continues to monitor the server for additional iterations of the doubled holddown interval until connectivity to the server becomes reliable, at which time the holddown interval will revert to the configured interval, and the newly responsive server whose status is active will replace the standby server in the pool of servers currently in use. In effect, if the status of a server is active but the server is habitually unresponsive, the health check monitor is less likely to restore the server to use by server load balanced traffic until the server’s connectivity becomes more reliable.
This option applies only to real servers whose status is active, but have been detected to be unresponsive (“down”).
Enter the value of the HOST header to match. For traffic to use the realserver, the HTTP(S) Host: header must match (case insensitive) the value of the httphost attribute.
null
This is available when VIP ldb-method is httphost.
Enter the IP address of a server in this server load balancing cluster.
Enter the limit on the number of active connections directed to a real server. If the maximum number of connections is reached for the real server, the
FortiGate unit will automatically switch all further connection requests to another server until the connection number drops below the specified limit.
0.0.0.0
0
0 means unlimited number of connections.
vip
Fortinet Technologies Inc.
Page 239 FortiOS™ - CLI Reference for FortiOS 5.0
firewall
Variable
monitor
<healthcheck_str> port <port_ip> status {active | disable | standby} weight
<loadbalanceweight_int>
Description
Enter one or more names of health check monitor settings to use when performing a health check, separating each name with a space. If any of the configured health check monitors detect failures, the
FortiGate unit will deem the server unresponsive, and will not forward traffic to that server. For details on configuring health check monitor settings, see
“firewall ldb-monitor” on page 145
.
Default
No default.
This option appears only if healthcheck is enable.
Enter the port used if port forwarding is enabled.
Select whether the server is in the pool of servers currently being used for server load balanced traffic, the server is on standby, or is disabled.
10 active
• active: The FortiGate unit may forward traffic to the server unless its health check monitors determine that the server is unresponsive, at which time the FortiGate unit will temporarily use a server whose status is standby. The healthcheck monitor will continue to monitor the unresponsive server for the duration of holddown-interval. If this server becomes reliably responsive again, it will be restored to active use, and the standby server will revert to standby. For details on health check monitoring when an active server is unresponsive, see
• disable: The FortiGate unit will not forward traffic to this server, and will not perform health checks.
You might use this option to conserve server load balancing resources when you know that a server will be unavailable for a long period, such as when the server is down for repair.
• standby: If a server whose status is active becomes unresponsive, the FortiGate unit will temporarily use a responsive server whose status is standby until the server whose status is active again becomes reliably responsive. If multiple responsive standby servers are available, the FortiGate unit selects the standby server with the greatest weight. If a standby server becomes unresponsive, the FortiGate unit will select another responsive server whose status is standby.
Enter the weight value of a specific server. Servers with a greater weight receive a greater proportion of forwarded connections, or, if their status is standby, are more likely to be selected to temporarily replace servers whose status is active, but that are unresponsive. Valid weight values are between 1 and
255.
1
This option is available only if ldb-method is weighted.
Fortinet Technologies Inc.
Page 240 FortiOS™ - CLI Reference for FortiOS 5.0
vip
firewall
Variable ssl-cipher-suites
Description Default
The following are the variables for config ssl-cipher-suites, and are available only if type is server-load-balance and ssl-algorithm is custom.
cipher <cipher_name>
Enter the cipher name. For a list of available ciphers, enter set cipher ?
versions {ssl-3.0 tls-1.0 tls-1.1}
Enter the algorithm versions to support. ssl-3.0 tls-1.0 tls-1.1
vip
Fortinet Technologies Inc.
Page 241 FortiOS™ - CLI Reference for FortiOS 5.0
firewall
vip46
vip46
Use this command to configure static NAT virtual IPv4 addresses for IPv6 addresses.
Syntax
config firewall vip46 edit
end
Variable
<name_str> arp-reply
{enable | disable} color <color_int>
Description
Enter the name of this virtual IP address.
Default
No default.
enable
Select to respond to ARP requests for this virtual IP address.
Enter the number of the color to use for the group icon in the web-based manager.
0
Enter comments relevant to the configured virtual IP.
No default comment
<comment_str> extip
<address_ipv4>[address_ipv4]
Enter the IP address or address range on the external interface that you want to map to an address or address range on the destination network.
If mappedip is an IP address range, the FortiGate unit uses extip as the first IP address in the external IP address range, and calculates the last IP address required to create an equal number of external and mapped IP addresses for one-to-one mapping.
0.0.0.0
extport <port_int>
To configure a dynamic virtual IP that accepts connections destined for any IP address, set extip to
0.0.0.0.
Enter the external port number that you want to map to a port number on the destination network.
0
This option only appears if portforward is enabled.
If portforward is enabled and you want to configure a static NAT virtual IP that maps a range of external port numbers to a range of destination port numbers, set extport to the first port number in the range. Then set mappedport to the start and end of the destination port range. The FortiGate unit automatically calculates the end of the extport port number range.
Fortinet Technologies Inc.
Page 242 FortiOS™ - CLI Reference for FortiOS 5.0
firewall
Variable
id <id_num_str> mappedip
[<start_ipv6>-
<end_ipv6>]
Description
Enter a unique identification number for the configured virtual IP. Not checked for uniqueness. Range 0 - 65535.
Enter the IP address or IP address range on the destination network to which the external IP address is mapped.
Default
No default.
::
If mappedip is an IP address range, the FortiGate unit uses extip as the first IP address in the external IP address range, and calculates the last IP address required to create an equal number of external and mapped IP addresses for one-to-one mapping.
If mappedip is an IP address range, the FortiGate unit uses extip as a single IP address to create a one-tomany mapping.
Enter the port number on the destination network to which the external port number is mapped.
0 mappedport
<port_int>
You can also enter a port number range to forward packets to multiple ports on the destination network.
For a static NAT virtual IP, if you add a map to port range the FortiGate unit calculates the external port number range.
portforward
{enable | disable}
Select to enable port forwarding. You must also specify the port forwarding mappings by configuring extport and mappedport.
src-filter <addr_str>
Enter a source address filter. Each address must be in the form of an IPv4 subnet (x.x.x.x/n). Separate addresses with spaces.
disable null
vip46
Fortinet Technologies Inc.
Page 243 FortiOS™ - CLI Reference for FortiOS 5.0
firewall
vip6
Use this command to configure static NAT virtual IPs for IPv6 addresses.
Syntax
config firewall vip6 edit
end
set src-filter <addr_str> set type static-nat
Variable
<name_str> arp-reply
{enable | disable} color <color_int>
Description
Enter the name of this virtual IP address.
Default
No default.
enable
Select to respond to ARP requests for this virtual IP address.
Enter the number of the color to use for the group icon in the web-based manager.
0
Enter comments relevant to the configured virtual IP.
No default comment
<comment_str> extip
<address_ipv6>[address_ipv6]
Enter the IP address or address range on the external interface that you want to map to an address or address range on the destination network.
If mappedip is an IP address range, the FortiGate unit uses extip as the first IP address in the external IP address range, and calculates the last IP address required to create an equal number of external and mapped IP addresses for one-to-one mapping.
0.0.0.0
To configure a dynamic virtual IP that accepts connections destined for any IP address, set extip to
0.0.0.0.
vip6
Fortinet Technologies Inc.
Page 244 FortiOS™ - CLI Reference for FortiOS 5.0
firewall
Variable
extport <port_int> id <id_num_str> mappedip
[<start_ipv6>-
<end_ipv6>]
Description
Enter the external port number that you want to map to a port number on the destination network.
Default
0
This option only appears if portforward is enabled.
If portforward is enabled and you want to configure a static NAT virtual IP that maps a range of external port numbers to a range of destination port numbers, set extport to the first port number in the range. Then set mappedport to the start and end of the destination port range. The FortiGate unit automatically calculates the end of the extport port number range.
Enter a unique identification number for the configured virtual IP. Not checked for uniqueness. Range 0 - 65535.
No default.
0.0.0.0
Enter the IP address or IP address range on the destination network to which the external IP address is mapped.
If mappedip is an IP address range, the FortiGate unit uses extip as the first IP address in the external IP address range, and calculates the last IP address required to create an equal number of external and mapped IP addresses for one-to-one mapping.
Enter the port number on the destination network to which the external port number is mapped.
0 mappedport
<port_int>
You can also enter a port number range to forward packets to multiple ports on the destination network.
For a static NAT virtual IP, if you add a map to port range the FortiGate unit calculates the external port number range.
portforward
{enable | disable}
Select to enable port forwarding. You must also specify the port forwarding mappings by configuring extport and mappedport.
protocol
{sctp | tcp | udp}
Select the protocol, TCP or UDP, to use when forwarding packets.
src-filter <addr_str>
Enter a source address filter. Each address must be in the form of an IPv6 subnet (x:x:x:x:x:x:x:x/n). Separate addresses with spaces.
type static-nat
Only static NAT VIP is available in IPv6.
disable tcp null static-nat
vip6
Fortinet Technologies Inc.
Page 245 FortiOS™ - CLI Reference for FortiOS 5.0
firewall
vip64
vip64
Use this command to configure static NAT virtual IPv6 addresses for IPv4 addresses.
Syntax
config firewall vip64 edit
end
Variable
<zname_str> arp-reply
{enable | disable} color <color_int>
Description
Enter the name of this virtual IP address.
Default
No default.
enable
Select to respond to ARP requests for this virtual IP address.
Enter the number of the color to use for the group icon in the web-based manager.
0
Enter comments relevant to the configured virtual IP.
No default comment
<comment_str> extip
<address_ipv6>[address_ipv6]
Enter the IP address or address range on the external interface that you want to map to an address or address range on the destination network.
If mappedip is an IP address range, the FortiGate unit uses extip as the first IP address in the external IP address range, and calculates the last IP address required to create an equal number of external and mapped IP addresses for one-to-one mapping.
:: extport <port_int> id <id_num_str>
To configure a dynamic virtual IP that accepts connections destined for any IP address, set extip to ::.
Enter the external port number that you want to map to a port number on the destination network.
0
This option only appears if portforward is enabled.
If portforward is enabled and you want to configure a static NAT virtual IP that maps a range of external port numbers to a range of destination port numbers, set extport to the first port number in the range. Then set mappedport to the start and end of the destination port range. The FortiGate unit automatically calculates the end of the extport port number range.
Enter a unique identification number for the configured virtual IP. Not checked for uniqueness. Range 0 - 65535.
No default.
Fortinet Technologies Inc.
Page 246 FortiOS™ - CLI Reference for FortiOS 5.0
firewall
Variable
mappedip
[<start_ipv4>-
<end_ipv4>]
Description
Enter the IP address or IP address range on the destination network to which the external IP address is mapped.
If mappedip is an IP address range, the FortiGate unit uses extip as the first IP address in the external IP address range, and calculates the last IP address required to create an equal number of external and mapped IP addresses for one-to-one mapping.
If mappedip is an IP address range, the FortiGate unit uses extip as a single IP address to create a one-tomany mapping.
Enter the port number on the destination network to which the external port number is mapped.
Default
0.0.0.0
mappedport
<port_int>
0
You can also enter a port number range to forward packets to multiple ports on the destination network.
For a static NAT virtual IP, if you add a map to port range the FortiGate unit calculates the external port number range.
portforward
{enable | disable}
Select to enable port forwarding. You must also specify the port forwarding mappings by configuring extport and mappedport.
src-filter <addr_str>
Enter a source address filter. Each address must be in the form of an IPv4 subnet (x:x:x:x:x:x:x:x/n). Separate addresses with spaces.
disable null
vip64
Fortinet Technologies Inc.
Page 247 FortiOS™ - CLI Reference for FortiOS 5.0
firewall
vipgrp
vipgrp
You can create virtual IP groups to facilitate firewall policy traffic control. For example, on the
DMZ interface, if you have two email servers that use Virtual IP mapping, you can put these two
VIPs into one VIP group and create one external-to-DMZ policy, instead of two policies, to control the traffic.
Firewall policies using VIP Groups are matched by comparing both the member VIP IP address(es) and port number(s).
Syntax
config firewall vipgrp edit
end
set interface <name_str> set member <virtualip_str>
Variable
<name_str> interface
<name_str> member
<virtualip_str>
Description
Enter the name of the virtual IP group.
Enter the name of the interface to which the virtual IP group will be bound.
Enter one or more virtual IPs that will comprise the virtual IP group.
Default
No default.
No default.
No default.
Fortinet Technologies Inc.
Page 248 FortiOS™ - CLI Reference for FortiOS 5.0
firewall
vipgrp46
vipgrp46
Use this command to create a vip46 virtual IP group.
Syntax
config firewall vipgrp46 edit
set color <color_int> set comments <str>
end
Variable Description
<name_str>
Enter the name of the virtual IP group.
color <color_int> Enter the number of the color to use for the group icon in the web-based manager. comments <str>
Optionally, enter a comment.
member
<virtualip_str>
Enter one or more vip46 virtual IPs that will comprise the virtual IP group.
Default
No default.
0
No default.
No default.
Fortinet Technologies Inc.
Page 249 FortiOS™ - CLI Reference for FortiOS 5.0
firewall
vipgrp64
vipgrp64
Use this command to create a vip64 virtual IP group.
Syntax
config firewall vipgrp46 edit
<name_str> set color <color_int> set comments <str>
end
Variable Description
<name_str>
Enter the name of the virtual IP group.
color <color_int> Enter the number of the color to use for the group icon in the web-based manager. comments <str>
Optionally, enter a comment.
member
<virtualip_str>
Enter one or more vip64 virtual IPs that will comprise the virtual IP group.
Default
No default.
0
No default.
No default.
Fortinet Technologies Inc.
Page 250 FortiOS™ - CLI Reference for FortiOS 5.0
ftp-proxy
Use ftp-proxy commands to configure the FortiGate explicit FTP proxy. You can use the
FortiGate explicit FTP proxy and interface settings to enable explicit FTP proxying on one or more interfaces. When enabled, the FortiGate unit becomes a FTP proxy server. All FTP sessions received by interfaces with explicit FTP proxy enabled are intercepted by the explicit
FTP proxy relayed to their destinations.
To use the explicit FTP proxy, users must add the IP address of a FortiGate interface and the explicit proxy port number to the proxy configuration settings of their FTP clients.
Page 251
ftp-proxy
explicit
explicit
Use this command to enable the explicit FTP proxy, and configure the TCP port used by the explicit FTP proxy.
Syntax
config ftp-proxy explicit set
set
set
incoming-ip <incoming_address_ipv4>
end set
outgoing-ip <outgoing_address_ipv4>
set
sec-default-action {accept | deny}
Variable
status {disable | enable} incoming-port
<in_port_int> incoming-ip
<incoming_address_ipv4>
Description
Enable the explicit FTP proxy for FTP sessions.
Enter the port number that traffic from FTP clients use to connect to the explicit FTP proxy. The range is 0 to
65535. Explicit FTP proxy users must configure their FTP client proxy settings to use this port.
Enter the IP address of a FortiGate unit interface that should accept sessions for the explicit FTP proxy. Use this command to restrict the explicit FTP proxy to only accepting sessions from one FortiGate interface.
Default
disable
21
0.0.0.0
outgoing-ip
<outgoing_address_ipv4>
The destination IP address of explicit FTP proxy sessions should match this IP address.
This field is visible in NAT/Route mode only.
Enter the IP address of a FortiGate unit interface that explicit FTP proxy sessions should exit the FortiGate unit from. Use this command to restrict the explicit FTP proxy to only allowing sessions to exit from one FortiGate interface.
This IP address becomes the source address of FTP proxy sessions exiting the FortiGate unit.
sec-default-action {accept | deny}
This field is visible in NAT/Route mode only.
Configure the explicit FTP proxy to block (deny) or accept sessions if firewall policies have not been added for the explicit FTP proxy. To add firewall policies for the explicit FTP proxy add a firewall policy and set the source interface to ftp-proxy.
deny
The default setting denies access to the explicit FTP proxy before adding a firewall policy. If you set this option to accept the explicit FTP proxy server accepts sessions even if you haven’t added an ftp-proxy firewall policy.
Fortinet Technologies Inc.
Page 252 FortiOS™ - CLI Reference for FortiOS 5.0
gui
This chapter contains the following section:
Page 253
gui
console
console
This command stores a base-64 encoded file that contains configuration of the dashboard and
System > Status web-based manager pages. This command is not user configurable
Syntax
config gui console set
end
Variable
preferences <filedata>
Description
Base-64 encoded file to upload containing the commands to set up the web-based manager CLI console on the FortiGate unit.
Default
No default.
Fortinet Technologies Inc.
Page 254 FortiOS™ - CLI Reference for FortiOS 5.0
icap
This chapter contains the following sections:
Page 255
icap
profile
profile
Use this command to configure an Internet Content Adaptation Protocol (ICAP) profile.
Syntax
config icap profile edit
<icap_profile_name> set replacemsg-group <grp_name> set request {enable | disable}
end
set response {enable | disable} set streaming-content-bypass {enable | disable}
Variable Description Default
<icap_profile_name>
Enter the ICAP profile name.
replacemsg-group <grp_name> Enter the replacement message group name.
request {enable | disable} response {enable | disable} streaming-content-bypass
{enable | disable}
Enable to send requests to an ICAP server.
Enable to bypass the ICAP server for streaming content.
disable
Enable to send HTTP responses to an ICAP server.
disable disable
Fortinet Technologies Inc.
Page 256 FortiOS™ - CLI Reference for FortiOS 5.0
icap
server
server
Use this command to configure Internet Content Adaptation Protocol (ICAP) servers.
Syntax
config icap server edit
end
Variable
port <port_int>
Description
<icap_server_name> ip-version {4 | 6} max-connections <int>
Enter the ICAP profile name.
Select IPv4 or IPv6 addressing.
ip-address <server_ipv4>
Enter the ICAP server IP address (IPv4).
ip6-address <server_ipv6>
Enter the ICAP server IP address (IPv6).
Enter the maximum permitted number of concurrent connections to the ICAP server. Range: 1-65 535.
Enter the ICAP server port number.
Default
4
0.0.0.0
::
100
1344
Fortinet Technologies Inc.
Page 257 FortiOS™ - CLI Reference for FortiOS 5.0
imp2p
Use imp2p commands to configure user access to Instant Messaging and Peer-to-Peer applications, and to configure a global policy for unknown users who might use these applications.
This chapter contains the following sections:
Page 258
imp2p
aim-user
aim-user
Use this command to permit or deny a specific user the use of AOL Instant Messenger.
Syntax
config imp2p aim-user edit <
> end
Variable
name_str action {deny | permit}
Description Default
The name of the AIM user.
Permit or deny the use of AOL Instant Messenger by this user.
deny
Fortinet Technologies Inc.
Page 259 FortiOS™ - CLI Reference for FortiOS 5.0
imp2p
icq-user
icq-user
Use this command to permit or deny a specific user the use of ICQ Instant Messenger.
Syntax
config imp2p icq-user edit <
> end
Variable
name_str action {deny | permit}
Description Default
The name of the ICQ user.
Permit or deny the use of the ICQ Instant Messenger by this user.
deny
Fortinet Technologies Inc.
Page 260 FortiOS™ - CLI Reference for FortiOS 5.0
imp2p
msn-user
msn-user
Use this command to permit or deny a specific user the use of MSN Messenger.
Syntax
config imp2p msn-user edit <
> end
Variable Description
name_str
The name of the MSN user.
action {deny | permit}
Permit or deny the use of MSN Messenger by this user.
Default
deny
Fortinet Technologies Inc.
Page 261 FortiOS™ - CLI Reference for FortiOS 5.0
imp2p
old-version
old-version
Some older versions of IM protocols are able to bypass file blocking because the message types are not recognized. The following command provides the option to disable these older IM protocol versions. Supported IM protocols include:
• MSN 6.0 and above
• ICQ 4.0 and above
• AIM 5.0 and above
• Yahoo 6.0 and above
Syntax
config imp2p old-version set
set
set
end set
Variable Description
aim {best-effort | block} Enter block to block the session if the version is too old.
Enter best-effort to inspect the session based on the policy.
icq {best-effort | block}
Enter block to block the session if the version is too old.
Enter best-effort to inspect the session based on the policy.
msn {best-effort | block} Enter block to block the session if the version is too old.
yahoo
{best-effort | block}
Enter best-effort to inspect the session based on the policy.
Enter block to block the session if the version is too old.
Enter best-effort to inspect the session based on the policy.
Default
block block block block
Fortinet Technologies Inc.
Page 262 FortiOS™ - CLI Reference for FortiOS 5.0
imp2p
policy
policy
Use this command to create a global policy for instant messenger applications. If an unknown user attempts to use one of the applications, the user can either be permitted use and added to a white list, or be denied use and added to a black list.
The imp2p settings are part of Application Control. When creating a new VDOM, the default imp2p policy settings are set to allow, thereby permitting the settings in Application Control to drive the configuration.
Syntax
config imp2p policy set
set
set
end set
Variable
aim {allow | deny}
Description
Allow an unknown user and add the user to the white list.
icq {allow | deny}
Deny an unknown user and add the user to the black list.
Allow an unknown user and add the user to the white list.
msn {allow | deny}
Deny an unknown user and add the user to the black list.
Allow an unknown user and add the user to the white list.
Deny an unknown user and add the user to the black list.
yahoo {allow | deny}
Allow an unknown user and add the user to the white list.
Deny an unknown user and add the user to the black list.
Default
allow allow allow allow
Fortinet Technologies Inc.
Page 263 FortiOS™ - CLI Reference for FortiOS 5.0
imp2p
yahoo-user
yahoo-user
Use this command to permit or deny a specific user the use of Yahoo Messenger.
Syntax
config imp2p yahoo-user edit <
> end
Variable
name_str action {deny | permit}
Description Default
The name of the Yahoo user.
Permit or deny the use of Yahoo Messenger by this user.
deny
Fortinet Technologies Inc.
Page 264 FortiOS™ - CLI Reference for FortiOS 5.0
ips
Use ips commands to configure IPS sensors to define which signatures are used to examine traffic and what actions are taken when matches are discovered. DoS sensors can also be defined to examine traffic for anomalies
This chapter contains the following sections:
If the IPS test can’t find the destination MAC address, the peer interface will be used. To ensure packets get IPS inspection, there must be a Peer Interface. Both interfaces must be in the same
VDOM, and one interface cannot be both the peer and original interface. For information on
how to set the Peer Interface see “interface” on page 555
.
Page 265
ips
custom
custom
Create custom IPS signatures and add them to IPS sensors.
Custom signatures provide the power and flexibility to customize FortiGate Intrusion Protection for diverse network environments. The FortiGate predefined signatures cover common attacks.
If an unusual or specialized application or an uncommon platform is being used, add custom signatures based on the security alerts released by the application and platform vendors.
Use custom signatures to block or allow specific traffic.
The custom signature settings are configured when it is defined as a signature override in an
IPS sensor. This way, a single custom signature can be used in multiple sensors with different settings in each.
Custom signatures are an advanced feature. This document assumes the user has previous experience writing intrusion detection signatures.
Syntax
config ips custom edit <
> end
Variable Description
sig_str
The name of the custom signature.
signature <signature_str>
Enter the custom signature. The signature must be enclosed in single quotes.
Default
No default.
Fortinet Technologies Inc.
Page 266 FortiOS™ - CLI Reference for FortiOS 5.0
ips
decoder
decoder
The Intrusion Protection system looks for certain types of traffic on specific ports. Using the decoders command, you can change ports if your configuration uses non-standard ports.
Syntax
config ips decoder
<decoder_str> set port_list <port_int>
end
Variable
<decoder_str> port_list <port_int>
Description
Enter the name of the decoder. Enter ‘?’ for a list.
Default
Enter the ports which the decoder will examine. Multiple ports can be specified by separating them with commas and enclosing the list in quotes.
varies by decoder
Fortinet Technologies Inc.
Page 267 FortiOS™ - CLI Reference for FortiOS 5.0
ips
global
global
Use this command to set IPS operating parameters.
Syntax
config ips global set
algorithm {engine-pick | low | high | super}
set
anomaly-mode {continuous | periodical}
set
set
set
set
hardware-accel-mode {engine-pick | cp-only | np-only | np-cp
end set
session-limit-mode {accurate | heuristic}
set
skype-client-public-ipaddr <IP_addr_list>
set
set
traffic-submit {enable | disable}
Variable
algorithm {engine-pick
| low | high | super}
Description
The IPS engine has two methods to determine whether traffic matches signatures.
Default
engine-pick
• low is a slower method that uses less memory
• high is a faster method that uses more memory
• super is a method that works well on models with more than 4GB memory
• engine-pick allows the IPS engine to choose the best method on the fly.
anomaly-mode
{continuous | periodical} database
{regular | extended}
Enter continuous to start blocking packets once attack starts. Enter periodical to allow configured number of packets per second.
Select regular or extended IPS database.
engine-count <integer> Enter the number of intrusion protection engines to run.
Multi-processor FortiGate units can more efficiently process traffic with multiple engines running. When set to the default value of
0, the FortiGate unit determines the optimal number of intrusion protection engines.
fail-open
{enable | disable}
If for any reason the IPS should cease to function, it will fail open by default. This means that crucial network traffic will not be blocked and the Firewall will continue to operate while the problem is resolved.
continuous regular
0 enable hardware-accel-mode
{engine-pick | cp-only
| np-only | np-cp
| none} session-limit-mode
{accurate | heuristic}
Set hardware acceleration mode. CP refers to Content
Processor, NP to Network Processor. none disables hardware acceleration. engine-pick automatically chooses the best acceleration level.
engine-pick
Enter accurate to accurately count the concurrent sessions. This option demands more resources. Enter heuristic to heuristically count the concurrent sessions. heuristic
Fortinet Technologies Inc.
Page 268 FortiOS™ - CLI Reference for FortiOS 5.0
ips global
Variable
skype-client-publicipaddr <IP_addr_list> socket-size
<ips_buffer_size> traffic-submit
{enable | disable}
Description
Enter the public IP addresses of your network that are used for Skype sessions. This will help the FortiGate unit identify Skype sessions properly in the Sessions dashboard widget. Separate IP addresses with commas,
not spaces.
Set intrusion protection buffer size. The default value is correct in most cases.
Submit attack characteristics to FortiGuard Service
Default
No default.
modeldependent disable
Fortinet Technologies Inc.
Page 269 FortiOS™ - CLI Reference for FortiOS 5.0
ips
rule
rule
The IPS sensors use signatures to detect attacks. These signatures can be listed with the rules command. Details about the default settings of each signature can also be displayed.
Syntax
config ips rule
get
Variable
<rule_str>
Description
Enter the name of a signature. For a complete list of the predefined signatures, enter ‘?’ instead of a signature name.
Default
Example
This example shows how to display the current configuration of the Apache.Long.Header.DoS signature.
# config ips rule Apache.Long.Header.DoS
(Apache.Long.He~d) # get name : Apache.Long.Header.DoS
status : enable log : enable log-packet : disable action : pass group : web_server severity : medium location : server os : Windows, Linux, BSD, Solaris application : Apache service : TCP, HTTP rule-id : 11206 rev : 2.335
Fortinet Technologies Inc.
Page 270 FortiOS™ - CLI Reference for FortiOS 5.0
ips
sensor
sensor
The IPS sensors use signatures to detect attacks. IPS sensors are made up of filters and override rules. Each filter specifies a number of signature attributes and all signatures matching all the specified attributes are included in the filter. Override rules allow you to override the settings of individual signatures.
Syntax
config ips sensor edit
set comment <comment_str> set log {disable | enable}
config entries edit
set
location {all | client | server}
set
severity {all | info low medium high critical}
set
set
os {all | other windows linux bsd solaris macos}
set
set
status {default | enable | disable}
set
set
log {default | enable | disable}
set
set
action {block | default | pass | reject}
set
quarantine {attacker | both | interface | none}
set
quarantine-expiry <minutes_int>
set
quarantine-log {disable | enable}
set
set
set
rate-mode <continuous | periodical>
set
rate-track <dest-ip | dhcp-client-mac | dns-domain
end set
rule [<rule1_int> <rule2_int> ... ] get
config exempt-ip
end set
set
end
Fortinet Technologies Inc.
Page 271 FortiOS™ - CLI Reference for FortiOS 5.0
ips
Variable
<sensor_str>
Description
Enter the name of an IPS sensor. For a list of the IPS sensors, enter ‘?’ instead of an IPS sensor name. Enter a new name to create a sensor.
comment
<comment_str>
Enter a description of the IPS sensor. This description will appear in the ISP sensor list. Descriptions with spaces must be enclosed in quotes.
log {disable | enable}
Enable or disable IPS logging.
<filter_int>
Enter the ID number of a filter. For a list of the IDs in the
IPS sensor, enter ‘?’ instead of an ID. Enter a new ID to create a filter.
location {all | client | server}
Specify the type of system to be protected.
• client selects signatures for attacks against client computers.
• server selects signatures for attacks against servers.
Default
enable all
• all selects both client and server signatures.
severity {all | info low medium high critical}
Specify the severity level or levels.
Specify all to include all severity levels.
protocol
<protocol_str>
Specify the protocols to be examined. Enter ‘?’ to display a list of the available protocols.
All will include all protocols.
Other will include all unlisted protocols.
os {all | other windows linux bsd solaris macos}
Specify the operating systems to be protected.
include all operating systems. unlisted operating systems.
All will
Other will include all application <app_str>
Specify the applications to be protected.
Enter ‘?’ to display a list of the available applications.
All will include all applications.
Other will include all unlisted applications.
status {default | enable
| disable}
Specify the status of the signatures included in the filter.
• enable will enable the filter.
• disable will disable the filter.
• default will enable the filter and only use the filters with a default status of enable. Filters with a default status of disable will not be used.
tags <tags_str>
Enter object tags applied to this filter. Separate tag names with spaces.
log {default | enable | disable}
Specify the logging status of the signatures included in the filter.
all all all all default null default
• enable will enable logging.
• disable will disable logging.
• default will enable logging for only the filters with a default logging status of enable. Filters with a default logging status of disable will not be logged.
sensor
Fortinet Technologies Inc.
Page 272 FortiOS™ - CLI Reference for FortiOS 5.0
ips
Variable
log-packet {disable | enable}
Description
When enabled, packet logging will save the packet that triggers the filter. You can download the packets in pcap format for diagnostic use. This feature is only available in
FortiGate units with internal hard drives.
action {block | default | pass | reject}
Specify what action is taken with traffic in which signatures ar detected.
Default
disable default quarantine {attacker | both | interface | none}
• block will drop the session with the offending traffic.
• pass will allow the traffic.
• reject will reset the session.
• default will either pass or drop matching traffic, depending on the default action of each signature.
To prevent the attacker from continuing to attack the
FortiGate unit, you can quarantine the attacker to the banned user list in one of three ways.
none
• Enter attacker to block all traffic sent from the attacker’s IP address. The attacker’s IP address is also added to the banned user list. The target’s address is not affected.
• Enter both to block all traffic sent from the attacker’s
IP address to the target (victim’s) IP address. Traffic from the attacker’s IP address to addresses other than the victim’s IP address is allowed. The attacker’s and target’s IP addresses are added to the banned user list as one entry.
• Enter interface to block all traffic from connecting to the FortiGate unit interface that received the attack.
The interface is added to the banned user list.
• Enter none to disable the adding of addresses to the quarantine but the current DoS sensor.
quarantine-expiry
<minutes_int> quarantine-log {disable
| enable}
Enter the duration of the quarantine in minutes. Range 0 to 259200.
Enable or disable writing a log message when a user is quarantined.
rate-count <count_int> Set the threshold (number of signature matches) that triggers the sensor. Range 1 to 65 535. 0 disables.
rate-duration
<seconds_int>
Set the duration over which the rate-count is measured.
Use rate-mode to determine how the duration is applied.
Range 1 to 65 535.
rate-mode <continuous
| periodical>
Select how rate-count is applied:
• continuous — action is applied as soon as rate-count is reached
• periodical — action is applied when rate-count is reached during rate-duration period rate-track <dest-ip
| dhcp-client-mac
| dns-domain | none
| src-ip>
Select which protocol field within the packet to track.
5
0
60 continuous none
sensor
Fortinet Technologies Inc.
Page 273 FortiOS™ - CLI Reference for FortiOS 5.0
ips
Variable
rule [<rule1_int>
<rule2_int> ... ]
get fields
get
- when used in edit <sensor_str> get
- when used in edit <filter_int>
Description
To add predefined or custom IPS signatures, specify the rule IDs of the signatures.
Default
null
This get command returns the following information about the sensor:
• name is the name of this sensor.
• comment is the comment entered for this sensor.
• count-enabled is the number of enabled signatures in this IPS sensor. Disabled signatures are not included.
• count-pass is the number of enabled signatures configured with the pass action.
• count-block is the number of enabled signatures configured with the block action.
• count-reset is the number of enabled signatures configured with the reset action.
• filter lists the filters in this IPS sensor.
• override lists the overrides in the IPS sensor.
This get command returns the following information about the filter:
• name is the name of this filter.
• count is the total number of signatures in this filter.
Both enabled and disabled signatures are included.
• location is type of system targeted by the attack.
The locations are client and server.
• severity is the relative importance of the signature, from info to critical.
• protocol is the type of traffic to which the signature applies. Examples include HTTP, POP3, H323, and
DNS.
• os is the operating systems to which the signature applies.
• application is the program affected by the signature.
• status displays whether the signature state is enabled, disabled, or default.
• log displays the logging status of the signatures included in the filter. Logging can be set to enabled, disabled, or default.
• action displays what the FortiGate does with traffic containing a signature. The action can be set to pass all, block all, reset all, or default.
• quarantine displays how the FortiGate unit will quarantine attackers.
sensor
Fortinet Technologies Inc.
Page 274 FortiOS™ - CLI Reference for FortiOS 5.0
ips sensor
Variable Description config exempt-ip fields
Default
This subcommand is available after rule has been set.
edit <exempt-ip_id>
Enter the ID number of an exempt-ip entry. For a list of the exempt-ip entries in the IPS sensor, enter ‘?’ instead of an ID. Enter a new ID to create a new exempt-ip.
dst-ip <ip4mask> src-ip <ip4mask>
Enter the destination IP address and netmask to exempt.
Enter the source IP address and netmask to exempt.
0.0.0.0 0.0.0.0
0.0.0.0 0.0.0.0
Fortinet Technologies Inc.
Page 275 FortiOS™ - CLI Reference for FortiOS 5.0
ips
setting
setting
Use the IPS settings command to configure settings for IPS packet logging.
Syntax
config ips settings set
set
packet-log-history <packets_int>
set
end set
packet-log-post-attack <packets_int>
Variable
ips-packet-quota
<MB_int> packet-log-history
<packets_int>
Description
Enter the maximum amount of disk space to use for logged packets when logging to disk. The acceptable range is from 0 to 4294967295 megabytes. This command affects only logging to disk.
Enter the number of packets to capture before and including the one in which the IPS signature is detected.
Default
0
1 packet-log-memory
<KB_int> packet-log-post-attack
<packets_int>
If the value is more than 1, the packet containing the signature is saved in the packet log, as well as those preceding it, with the total number of logged packets equalling the packet-log-history setting. For example, if packet-log-history is set to 7, the
FortiGate unit will save the packet containing the IPS signature match and the six before it.
The acceptable range for packet-log-history is from
1 to 255. The default is 1.
Setting packet-log-history to a value larger than 1 can affect the performance of the FortiGate unit because network traffic must be buffered. The performance penalty depends on the model, the setting, and the traffic load.
Enter the maximum amount of memory to use for logged packets when logging to memory. The acceptable range is from 64 to 8192 kilobytes. This command affects only logging to memory.
256
Enter how many packets are logged after the one in which the IPS signature is detected. For example, if packetlog-post- attack is set to 10, the FortiGate unit will save the ten packets following the one containing the IPS signature match.
0
The acceptable range for packet-log-post-attack is from 0 to 255. The default is 0.
Fortinet Technologies Inc.
Page 276 FortiOS™ - CLI Reference for FortiOS 5.0
log
Use the config log commands to set the logging type, the logging severity level, and the logging location for the FortiGate unit.
In Transparent mode, certain log settings and options may not be available because certain features do not support logging or are not available in this mode. For example, SSL VPN events are not available in Transparent mode.
{fortianalyzer | syslogd} override-filter
fortianalyzer override-setting
{fortianalyzer | fortianalyzer2 | fortianalyzer3} setting
{syslogd | syslogd2 | syslogd3} setting
Page 277
log custom-field
custom-field
Use the following command to customize the log fields with a name and/or value. The custom name and/or value will appear in the log message.
Syntax
config log custom-field edit
end
set name <name> set value <integer>
Variable
id <integer> name <name> value <integer>
Description
Enter the identification number for the log field.
Enter a name to identify the log. You can use letters, numbers, (‘_‘), but no characters such as the number symbol (#). The name cannot exceed 16 characters.
Enter a firewall policy number to associate a firewall policy with the logs.
Default
No default
No default
No default
Fortinet Technologies Inc.
Page 278 FortiOS™ - CLI Reference for FortiOS 5.0
log {disk | fortianalyzer | fortianalyzer2 | fortianalyzer3 | memory | syslogd | syslogd2 | syslogd3 | webtrends | fortiguard} filter
{disk | fortianalyzer | fortianalyzer2 | fortianalyzer3 | memory | syslogd | syslogd2 | syslogd3 | webtrends | fortiguard} filter
Use this command to configure log filter options. Log filters define the types of log messages sent to each log location. Use the
? command to view each filter setting since not all filter settings display for each device.
Filter settings for fortiguard are only available when FortiGuard Analysis and Management
Service is enabled. Filter settings for disk is available only for FortiGate units with hard disks.
Syntax
config log {disk | fortianalyzer | fortianalyzer2 | fortianalyzer3
|memory | syslogd | syslogd2 | syslogd3 | webtrends | fortiguard} filter set
set
set
set
app-crtl-all {enable | disable}
set
set
set
set
set
set
dlp-archive {enable | disable}
set
dlp-docsource {enable | disable}
set
set
email-log-google {enable | disable}
set
email-log-imap {enable | disable}
set
email-log-msn {enable | disable}
set
email-log-pop3 {enable | disable}
set
email-log-smtp {enable | disable}
set
email-log-yahoo {enable | disable}
set
forward-traffic {enable | disable}
set
ftgd-wf-block {enable | disable}
set
ftgd-wf-errors {enable | disable}
set
local-traffic {enable | disable}
set
set
set
set
multicast-traffic {enable | disable}
set
set
set
set
severity {alert | critical | debug | emergency | error | information | notification | warning}
set
set
set
switching-protocols {enable | disable}
set
set
Fortinet Technologies Inc.
Page 279 FortiOS™ - CLI Reference for FortiOS 5.0
log {disk | fortianalyzer | fortianalyzer2 | fortianalyzer3 | memory | syslogd | syslogd2 | syslogd3 | webtrends | fortiguard} filter
set
set
set
vulnerability {enable | disable}
set
set
web-content {enable | disable}
set
web-filter-activex {enable | disable}
set
web-filter-applet {enable | disable}
set
web-filter-command-block {enable | disable}
set
web-filter-cookie {enable | disable}
set
web-filter-ftgd-quota {enable | disable}
set
web-filter-ftgd-quota-counting {enable | disable}
set
web-filter-ftgd-quota-expired {enable | disable}
end set
web-filter-script-other {enable | disable}
Variable Description Default
analytics
{enable | disable} anomaly
{enable | disable}
Enable or disable logging of FortiGuard Analytics messages.
Enable or disable logging all detected and prevented attacks based on unknown or suspicious traffic patterns, and the action taken by the FortiGate unit in the attack log.
This field is available when attack is enabled.
enable enable app-crtl
{enable | disable} app-crtl-all
{enable | disable} attack
{enable | disable} blocked
{enable | disable}
Enable or disable logging of application control logs.
Enable or disable logging of the sub-category of application control logs.
Enable or disable the attack log.
Enable or disable logging all instances of blocked files.
enable disable enable enable discovery
{enable | disable}
Enable or disable logging of netscan discovery events.
dlp {enable | disable} Enable or disable logging of data leak prevention events. enable dlp-all {enable | disable}
Enable or disable logging of all data leak prevention subcategories. disable dlp-archive
{enable | disable} dlp-docsource
{enable | disable}
Enable or disable logging of data leak prevention content archive events.
Enable or disable logging of data leak prevention document source scanning events.
enable enable enable
Enable or disable the spam filter log.
enable email
{enable | disable} email-log-google
{enable | disable} email-log-imap
{enable | disable} email-log-msn
{enable | disable} email-log-pop3
{enable | disable}
Enable or disable logging of spam detected in Gmail messages.
Enable or disable logging of spam detected in IMAP traffic. email enable only.
Enable or disable logging of spam detected in MSN email messages.
Enable or disable logging of spam detected in POP3 traffic. email enable only.
enable enable enable enable
Fortinet Technologies Inc.
Page 280 FortiOS™ - CLI Reference for FortiOS 5.0
log {disk | fortianalyzer | fortianalyzer2 | fortianalyzer3 | memory | syslogd | syslogd2 | syslogd3 | webtrends | fortiguard} filter
Variable Description Default
email-log-smtp
{enable | disable} email-log-yahoo
{enable | disable}
Enable or disable logging of spam detected in SMTP traffic. email enable only.
Enable or disable logging of spam detected in Yahoo email messages.
enable enable forward-traffic
{enable | disable} ftgd-wf-block
{enable | disable}
Enable or disable logging of forwarded traffic messages.
Enable or disable logging of web pages blocked by
FortiGuard category filtering in the web filter log. This field is available when web is enabled.
ftgd-wf-errors
{enable | disable}
Enable or disable logging all instances of FortiGuard category filtering rating errors. This field is available when web is enabled.
local-traffic
{enable | disable}
Enable or disable logging of local-in or local-out traffic messages.
gtp {enable | disable} Enable or disable FortiOS Carrier logging for GTP messages. enable enable enable enable enable enable infected
{enable | disable} mass-mms
{enable | disable} multicast-traffic
{enable | disable} netscan
{enable | disable} oversized
{enable | disable} scanerror
{enable | disable} severity {alert | critical | debug | emergency | error | information | notification | warning}
Enable or disable logging of all virus infections in the antivirus log. This field is available when virus is enabled.
Enable or disable FortiOS Carrier logging of a large amount of MMS blocked messages.
Enable or disable logging of multicast traffic messages.
Enable or disable logging of network vulnerability scanning events.
Enable or disable logging of oversized files in the antivirus log. This field is available when virus is enabled.
Enable or disable logging of antivirus error messages.
Select the logging severity level. The FortiGate unit logs all messages at and above the logging severity level you select. For example, if you select error, the unit logs error, critical, alert and emergency level messages. enable enable enable enable enable information emergency - The system is unusable.
alert - Immediate action is required.
critical - Functionality is affected.
error - An erroneous condition exists and functionality is probably affected.
warning - Functionality might be affected.
notification - Information about normal events.
information - General information about system operations.
debug - Information used for diagnosing or debugging the
FortiGate unit.
Fortinet Technologies Inc.
Page 281 FortiOS™ - CLI Reference for FortiOS 5.0
log {disk | fortianalyzer | fortianalyzer2 | fortianalyzer3 | memory | syslogd | syslogd2 | syslogd3 | webtrends | fortiguard} filter
Variable Description Default
signature
{enable | disable}
Enable or disable logging of detected and prevented attacks based on the attack signature, and the action taken by the FortiGate unit, in the attack log. This field is available when attack is enabled.
enable suspicious
{enable | disable} switching-protocols
{enable | disable} traffic
{enable | disable} url-filter
{enable | disable}
Enable or disable logging of virus suspicious messages.
Enable or disable logging of protocol switching.
Enable or disable the traffic log.
enable enable enable
Enable or disable logging of blocked URLs (specified in the
URL block list) in the web filter log. This field is available when web is enabled.
enable virus
{enable | disable} voip
{enable | disable}
Enable or disable the antivirus log.
Enable or disable logging of VOIP messages.
enable enable vulnerability
{enable | disable}
Enable or disable logging of netscan vulnerability events.
web {enable | disable} Enable or disable the web filter log.
enable enable web-content
{enable | disable}
Enable or disable logging of blocked content (specified in the banned words list) in the web filter log. This field is available when web is enabled.
enable
Enable or disable the logging of Active X block messages.
enable web-filter-activex
{enable | disable} web-filter-applet
{enable | disable}
Enable or disable the logging of java applet block messages.
enable
Enable or disable the logging of web filter command block messages.
enable web-filter-commandblock
{enable | disable} web-filter-cookie
{enable | disable} web-filter-ftgd-quota
{enable | disable}
Enable or disable the logging of cookie block messages.
Enable or disable logging FortiGuard quota levels.
enable enable web-filter-ftgd-quotacounting
{enable | disable} web-filter-ftgd-quotaexpired
{enable | disable} web-filter-script-other
{enable | disable}
Enable or disable logging FortiGuard quota counting messages.
Enable or disable logging FortiGuard quota expired messages.
Enable or disable logging of other script filter messages.
enable enable enable
Fortinet Technologies Inc.
Page 282 FortiOS™ - CLI Reference for FortiOS 5.0
log disk setting
disk setting
Use this command to configure log settings for logging to the local disk. Disk logging is only available for FortiGate units with an internal hard disk. You can also use this command to configure the FortiGate unit to upload current log files to an FTP server every time the log files are rolled.
If you have an AMC disk installed on your FortiGate unit, you can use disk setting to configure logging of traffic to the AMC disk. The AMC disk behaves as a local disk after being inserted into the FortiGate unit and the FortiGate unit rebooted. You can view logs from
Log&Report > Log Access > Disk when logging to an AMC disk.
You can also use this command to enable SQL logs for different log types. SQL logs are stored in an SQLlite database format. The main advantage of SQL log format is that it supports
enhanced reports. For information about the report commands, see “report” on page 321
:
AMC disk is supported on all FortiGate units that have single-width AMC slots.
Syntax
config log disk setting set
set
set
set
set
set
set
set
ips-archive {enable | disable}
set
set
set
max-log-file-size <integer max>
set
max-policy-packet-capture-size <size_int>
set
set
set
roll-schedule {daily | weekly}
set
set
set
set
set
upload-delete-files {enable | disable}
set
upload-destination { ftp-server}
set
upload-ssl-conn {default | high | low | disable}
set
set
set
Fortinet Technologies Inc.
Page 283 FortiOS™ - CLI Reference for FortiOS 5.0
log disk setting
set
set
uploadsched {enable | disable}
set
set
uploadtype {attack event im spamfilter traffic virus voip webfilter}
end set
set
Variable
status
{enable | disable} diskfull
{nolog | overwrite}
Description
Enter the action to take when the local disk is full. When you enter nolog, the FortiGate unit will stop logging; overwrite will begin overwriting the oldest file once the local disk is full. dlp-archive-quota
<integer> drive-standby-time
<0-19800>
Enter the amount (in MB) of disk space allocated for DLP logs.
full-first-warning threshold full-second-warning threshold full-final-warning threshold ips-archive
{enable | disable}
Enter to configure the first warning before reaching the threshold. You can enter a number between 1 and 100.
Enter to configure the second warning before reaching the threshold. You can enter a number between 1 and 100.
Enter to configure the final warning before reaching the threshold. You can enter a number between 1 and 100.
Enable IPS packet archive logs.
log-quota <integer> Enter the amount (in MB) of disk space allocated for disk logging.
maximum-log-age
<days_int> max-log-file-size
<integer max>
Set the power management for the hard disk. Enter the number of seconds, up to 19800. If there is no hard disk activity within the defined time frame, the hard disk will spin down to conserve energy. Setting the value to 0 disables the setting.
Enter the maximum age for logs. Logs older than this are purged.
Enter the maximum size of the log file (in MB) that is saved to the local disk.
Default
Enter to either enable or disable logging to the local disk. disable overwrite
0
0
75
90
95 enable
0
7
100
When the log file reaches the specified maximum size, the
FortiGate unit saves the current log file and starts a new active log file. The default minimum log file size is 1 MB and the maximum log file size allowed is 1024MB.
Enter the maximum packet capture size in firewall policies.
10 max-policy-packetcapture-size
<size_int> report
{enable | disable} report-quota
<integer>
Enable or disable reports.
Enter the amount (in MB) of disk space allocated for report logs.
enable
0
Fortinet Technologies Inc.
Page 284 FortiOS™ - CLI Reference for FortiOS 5.0
log disk setting
Variable
roll-schedule
{daily | weekly} roll-time
<hh:mm>
Description
Enter the frequency of log rolling. When set, the FortiGate unit will roll the log event if the maximum size has not been reached.
Enter the time of day, in the format hh:mm, when the
FortiGate unit saves the current log file and starts a new active log file.
Enter the source IP address of the disk log uploading.
Default
daily
00:00
0.0.0.0
source-ip
<address_ipv4> storage <name> upload
{enable | disable}
Enter a name for the storage log file. This option is only available when the current vdom is the management vdom.
Enable or disable uploading log files to a remote directory.
Enable upload to upload log files to an FTP server whenever a log file rolls.
Use the uploaddir, uploadip, uploadpass, uploadport, and uploaduser fields to add this information required to connect to the FTP server and upload the log files to a specific location on the server. disable
Use the uploadtype field to select the type of log files to upload.
Use the upload-delete-files field to delete the files from the hard disk once the FortiGate unit completes the file transfer.
All upload fields are available after enabling the upload command. upload-delete-files
{enable | disable} upload-destination { ftp-server} upload-ssl-conn
{default | high | low
| disable}
Enable or disable the removal of the log files once the
FortiGate unit has uploaded the log file to the FTP server.
Set upload destination. FTP server is the only option.
Set encryption strength for communications between the
FortiGate unit and FortiAnalyzer. Available when uploaddestination is fortianalyzer.
high — use SSL with 128-bit and larger key length algorithms: DHE-RSA-AES256-SHA, AES256-SHA,
EDH-RSA-DES-CBC3-SHA, DES-CBC3-SHA,
DES-CBC3-MD5, DHE-RSA-AES128-SHA, AES128-SHA enable ftp-server default uploaddir
<dir_name_str> uploadip
<class_ip>
low — use SSL with 64-bit or 56-bit key length algorithms without export restrictions: EDH-RSA-DES-CDBC-SHA,
DES-CBC-SHA, DES-CBC-MD5
default — use SSL with high strength algorithms and these medium-strength 128-bit key length algorithms:
RC4-SHA, RC4-MD5, RC4-MD
disable — disable the use of SSL.
Enter the name of the path on the FTP server where the log files will be transferred to. If you do not specify a remote directory, the log files are uploaded to the root directory of the FTP server.
Enter the IP address of the FTP server. This is required.
No default.
0.0.0.0
Fortinet Technologies Inc.
Page 285 FortiOS™ - CLI Reference for FortiOS 5.0
log disk setting
Variable
uploadpass
<passwd> uploadport
<port_integer> uploadsched
{enable | disable} uploadtime
<hour_integer> uploadtype
{attack event im spamfilter traffic virus voip webfilter} uploaduser
<user_str> uploadzip
{enable | disable}
Description Default
Enter the password required to connect to the FTP server.
This is required.
No default.
Enter the port number used by the FTP server. The default port is 21. Port 21 is the standard FTP port.
21
Enable log uploads at a specific time of the day. When set to disable, the FortiGate unit uploads the logs when the logs are rolled. disable
0
Enter the time of day (hour only) when the FortiGate unit uploads the logs. The uploadsched setting must first be set to enable.
Select the log files to upload to the FTP server. You can enter one or more of the log file types separated by spaces.
Use a space to separate the log file types. If you want to remove a log file type from the list or add a log file type to the list, you must retype the list with the log file type removed or added. traffic event spamfilter virus webfilter voip im
No default.
Enter the user account for the upload to the FTP server. This is required.
Enter enable to compress the log files after uploading to the FTP server. If disable is entered, the log files are uploaded to the FTP server in plain text format. disable
Fortinet Technologies Inc.
Page 286 FortiOS™ - CLI Reference for FortiOS 5.0
log
eventfilter
eventfilter
Use this command to configure event logging.
Syntax
config log eventfilter set
set
set
end set
set
set
set
wireless-activity {enable | disable}
Variable
event
{enable | disable} router
{enable | disable} system
{enable | disable}
Description
Log event messages. Must be enabled to make the following fields available.
Log router activity.
Default
enable enable
Log system activity messages, HA activity messages, CPU & memory usage, VIP realserver health monitoring, and AMC interface bypass mode messages.
Log user authentication messages.
enable enable user
{enable | disable} vpn
{enable | disable} wan-opt
{enable | disable} wireless-activity
{enable | disable}
Log IPSec negotiation messages, SSL user authentication, administration and session messages.
Log WAN optimization messages.
Log wireless activity.
enable enable enable
Fortinet Technologies Inc.
Page 287 FortiOS™ - CLI Reference for FortiOS 5.0
log {fortianalyzer | syslogd} override-filter
{fortianalyzer | syslogd} override-filter
Use this command within a VDOM to override the global configuration created with the config log {fortianalyzer | syslogd} filter command. The filter determines which types of log messages are sent to the FortiAnalyzer unit or syslog server. For syntax and descriptions, see
“{disk | fortianalyzer | fortianalyzer2 | fortianalyzer3 | memory | syslogd | syslogd2 | syslogd3
| webtrends | fortiguard} filter” on page 279 .
Fortinet Technologies Inc.
Page 288 FortiOS™ - CLI Reference for FortiOS 5.0
log fortianalyzer override-setting
fortianalyzer override-setting
Use this command within a VDOM to override the global configuration created with the config log fortianalyzer setting command. These settings configure the connection to the
FortiAnalyzer unit. For syntax and descriptions, see
“{fortianalyzer | fortianalyzer2 | fortianalyzer3} setting” on page 290
.
There is no config log fortianalyzer2 override-setting or config log fortianalyzer3 override-setting command.
Fortinet Technologies Inc.
Page 289 FortiOS™ - CLI Reference for FortiOS 5.0
log {fortianalyzer | fortianalyzer2 | fortianalyzer3} setting
{fortianalyzer | fortianalyzer2 | fortianalyzer3} setting
Use this command to configure the FortiGate unit to send log files to a FortiAnalyzer unit.
FortiAnalyzer units are network appliances that provide integrated log collection, analysis tools and data storage. Detailed log reports provide historical as well as current analysis of network and email activity to help identify security issues and reduce network misuse and abuse.
Using the CLI, you can send logs to up to three different FortiAnalyzer units for maximum failover protection of log data. After configuring logging to FortiAnalyzer units, the FortiGate unit will send the same log packets to all configured FortiAnalyzer units. Additional FortiAnalyzer units are configured using the fortianalyzer2 and fortianalyzer3 commands.
The FortiAnalyzer CLI commands are not cumulative. Using a syntax similar to the following is not valid: config log fortianalyzer fortianalyzer2 fortianalyzer3 setting
Syntax
config log {fortianalyzer |fortianalyzer2 | fortianalyzer3} setting set
set
set
set
enc-algorithm {default | high | low | disable}
set
gui-display {enable | disable}
set
ips-archive {enable | disable}
set
set
monitor-keepalive-period <int_seconds>
set
monitor-failure-retry-period <int_seconds>
set
set
set
set
set
upload-option {store-and-upload | realtime}
set
upload-interval {daily | weekly | monthly}
set
{sunday | monday | tuesday | wednesday | thursday | friday | saturday}
set
end
Variable Description
status {enable | disable} Enable or disable communication with the FortiAnalyzer unit.
conn-timeout
<seconds>
The other fields are available only if status is set to enable.
Enter the number of seconds before the FortiAnalyzer connection times out.
Default
disable
10
Fortinet Technologies Inc.
Page 290 FortiOS™ - CLI Reference for FortiOS 5.0
log {fortianalyzer | fortianalyzer2 | fortianalyzer3} setting
Variable
encrypt {enable | disable} enc-algorithm
{default | high | low
| disable}
Description
Enable to use IPSec VPN tunnel for communication.
When enabled, enc-algorithm is not available.
Default
disable
Disable to send data as plain text over SSL with the enc-
algorithm command.
Set encryption strength for communications between the
FortiGate unit and FortiAnalyzer.
default
high — use SSL with 128-bit and larger key length algorithms: DHE-RSA-AES256-SHA, AES256-SHA,
EDH-RSA-DES-CBC3-SHA, DES-CBC3-SHA,
DES-CBC3-MD5, DHE-RSA-AES128-SHA, AES128-SHA
low — use SSL with 64-bit or 56-bit key length algorithms without export restrictions: EDH-RSA-DES-CDBC-SHA,
DES-CBC-SHA, DES-CBC-MD5
default — use SSL with high strength algorithms and these medium-strength 128-bit key length algorithms:
RC4-SHA, RC4-MD5, RC4-MD
disable — disable the use of SSL.
Enable to display FortiAnalyzer Reports on the web-based manager.
Enable IPS packet archive.
disable enable gui-display
{enable | disable} ips-archive
{enable | disable} localid <identifier> monitor-keepaliveperiod <int_seconds> monitor-failure-retryperiod <int_seconds> psksecret <preshared_key> reliable
{enable | disable} server
<fortianalyzer_ipv4> source-ip
<address_ipv4> upload-option
{store-and-upload | realtime}
Enter an identifier up to 64 characters long. You must use the same identifier on the FortiGate unit and the
FortiAnalyzer unit.
No default.
Enter the interval in seconds between OFTP keepalive transmissions (for status and log buffer). Range 1 to 120.
5
Enter the time in seconds between connection retries (for status and log buffer). Range 1 to 2 147 483 647.
5
Enter the pre-shared key for the IPSec VPN tunnel.
No default.
This is needed only if encrypt is set to enable.
Enable to log to a syslog server using TCP, which ensures reliable connection setup and transmission of data.
disable
Enter the IP address of the FortiAnalyzer unit.
0.0.0.0
This field is only available when address-mode is set to static.
Enter the source IP address for the FortiAnalyzer,
FortiAnalyzer2 and FortiAnalyzer3 units.
0.0.0.0
Choose how logs are uploaded to a FortiAnalyzer unit:
realtime — Send logs directly to the FortiAnalyzer unit.
store-and-up load
store-and-upload — Log to hard disk, then upload on the schedule defined by upload-interval, uploadday and upload-time.
You cannot switch from realtime to store-andupload if any VDOM has disk logging disabled.
Fortinet Technologies Inc.
Page 291 FortiOS™ - CLI Reference for FortiOS 5.0
log {fortianalyzer | fortianalyzer2 | fortianalyzer3} setting
Variable
upload-interval
{daily | weekly | monthl y} upload-day <1-31> |
{sunday | monday | tues day | wednesday | thurs day | friday | saturday}
Description
Select how frequently logs are uploaded. This is available when upload-option is store-and-upload.
When upload-interval is monthly, enter the day of the month to upload logs.
When upload-interval is weekly, select the day of the week for log uploads.
Default
daily
No default.
This is available when upload-option is store-and-upload.
upload-time <hh:mm>
Enter the time of day for log uploads. This is available when upload-option is store-and-upload.
00:59
Fortinet Technologies Inc.
Page 292 FortiOS™ - CLI Reference for FortiOS 5.0
log fortiguard setting
fortiguard setting
Use this command for configuring FortiGuard Analysis Service settings.
The fortiguard setting command is only available when FortiGuard Analysis and
Management Service subscription-based services are enabled. The storage space is a specified amount, and varies, depending on the services requested.
Syntax
config log fortiguard setting set
enc-algorithm {default | high | low | disable}
set
set
end set
set
set
upload-option {enable | disable}
set
Variable
enc-algorithm
{default | high | low
| disable}
Description
Set encryption strength for communications between the FortiGate unit and FortiAnalyzer.
high — use SSL with 128-bit and larger key length algorithms: DHE-RSA-AES256-SHA, AES256-SHA,
EDH-RSA-DES-CBC3-SHA, DES-CBC3-SHA,
DES-CBC3-MD5, DHE-RSA-AES128-SHA,
AES128-SHA
low — use SSL with 64-bit or 56-bit key length algorithms without export restrictions:
EDH-RSA-DES-CDBC-SHA, DES-CBC-SHA,
DES-CBC-MD5
Default
default
default — use SSL with high strength algorithms and these medium-strength 128-bit key length algorithms:
RC4-SHA, RC4-MD5, RC4-MD
disable — disable the use of SSL.
quotafull {nolog | overwrite}
Enter the action to take when the specified storage space on the FortiGuard Analysis server is full. When you enter nolog, the FortiGate unit will stop logging, and overwrite will begin overwriting the oldest file. overwrite source-ip <ipv4_addr> status {enable | disable} upload-time <hh:mm>
Enter the source IP for communications to FAMS.
Enable or disable the FortiGuard Analysis service.
upload-interval <days_int> Enter frequency of log upload.
upload-option
{enable | disable}
Enable or disable logging uploading logs to FortiGuard.
disable
Enter time to roll logs.
0.0.0.0
disable
Fortinet Technologies Inc.
Page 293 FortiOS™ - CLI Reference for FortiOS 5.0
log
gui-display
gui-display
Use this command to configure how logs are displayed in the web-based manager.
Syntax
config log gui-display set
location {memory | disk | fortianalyzer | fortiguard}
end set
resolve-apps {enable | disable}
set
resolve-hosts {enable | disable}
Variable
location {memory | disk
| fortianalyzer | fortiguard} resolve-apps
{enable | disable} resolve-hosts
{enable | disable}
Description
Choose the location from which to display logs: memory, disk, FortiAnalyzer, or FortiGuard.
Enable to resolve unknown applications using the remote application database.
Enable to resolve IP addresses to hostnames using reverse-DNS lookup.
Default
memory enable enable
Fortinet Technologies Inc.
Page 294 FortiOS™ - CLI Reference for FortiOS 5.0
log memory setting
memory setting
Use this command to configure log settings for logging to the FortiGate system memory.
The FortiGate system memory has a limited capacity and only displays the most recent log entries. Traffic logs are not stored in the memory buffer, due to the high volume of traffic information. After all available memory is used, by default, the FortiGate unit begins to overwrite the oldest messages. All log entries are deleted when the FortiGate unit restarts.
Syntax
config log memory setting set
end set
Variable
diskfull {overwrite}
Description
Enter the action to take when the memory is reaching its capacity. The only option available is overwrite, which means that the FortiGate unit will begin overwriting the oldest file. status {enable | disable}
Enter enable to enable logging to the FortiGate system memory.
Default
overwrite disable
Fortinet Technologies Inc.
Page 295 FortiOS™ - CLI Reference for FortiOS 5.0
log memory global-setting
memory global-setting
Use this command to configure log threshold warnings, as well as the maximum buffer lines, for the FortiGate system memory.
The FortiGate system memory has a limited capacity and displays only the most recent log entries. Traffic logs are not stored in the memory buffer, due to the high volume of traffic information. After all available memory is used, by default, the FortiGate unit begins to overwrite the oldest log messages. All log entries are deleted when the FortiGate unit restarts.
Syntax
config log memory global-setting set
set
set
end set
Variable Description
full-final-warning-threshold
Enter to configure the final warning before reaching the threshold. You can enter a number between 3 and 100. full-first-warning-threshold
Enter to configure the first warning before reaching the threshold. You can enter a number between 1 and 98. full-second-warning-threshold Enter to configure the second warning before reaching the threshold. You can enter a number between 2 and 99. max-size <int>
Enter the maximum size of the memory buffer log, in bytes.
Default
95
75
90
98304
Fortinet Technologies Inc.
Page 296 FortiOS™ - CLI Reference for FortiOS 5.0
log
setting
setting
Use this command to configure general logging settings.
Syntax
config log setting set
brief-traffic-format {enable | disable}
set
set
fwpolicy-implicit-log {enable | disable}
set
fwpolicy6-implicit-log {enable | disable}
set
set
local-in-admin {enable | disable}
set
local-in-allow {enable | disable}
set
local-in-deny {enable | disable}
set
local-in-fortiguard {enable | disable}
set
local-in-other {enable | disable}
set
set
log-invalid-packet {enable | disable}
set
log-user-in-upper {enable | disable}
set
neighbor-event {enable | disable}
set
set
resolve-port {enable | disable}
set
user-anonymize {enable | disable}
end
Variable Description
brief-traffic-format
{enable | disable} daemon-log
{enable | disable} fwpolicy-implicit-log
{enable | disable} fwpolicy6-implicit-log
{enable | disable}
Use brief format for traffic log.
Collect daemon log.
Collect firewall implicit policy log.
Collect firewall implicit policy6 log.
gui-location <location>
Set which logs to display: disk, fortianalyzer, fortiguard, or memory.
local-in-admin
{enable | disable}
Collect local-in policy admin access log.
local-in-allow
{enable | disable} local-in-deny
{enable | disable} local-in-fortiguard
{enable | disable} local-in-other
{enable | disable} local-out
{enable | disable}
Collect local-in policy accepted log.
Collect local-in policy dropped log.
Collect local-in policy FortiGuard log.
Collect local-in-other policy log.
Collect local-out log.
enable enable enable disable
Default
disable disable disable disable fortiguard enable enable
Fortinet Technologies Inc.
Page 297 FortiOS™ - CLI Reference for FortiOS 5.0
log
Variable
log-invalid-packet
{enable | disable} log-user-in-upper
{enable | disable} neighbor-event
{enable | disable} resolve-ip
{enable | disable} resolve-port
{enable | disable} user-anonymize
{enable | disable}
Description
Enable ICSA compliant logs for the VDOM. Independent of traffic log settings, traffic log entries are generated:
Default
disable
• for all dropped ICMP packets
• for all dropped invalid IP packets
and
{disable | strict}” on page 531
• for session start and on session deletion
This setting is not rate limited. A large volume of invalid packets can dramatically increase the number of log entries, affecting device performance.
Collect log with user-in-upper.
disable
Collect neighbor-event log (ARP and IPv6 neighbor discovery events).
Resolve ip address in traffic log to domain name if possible.
Resolve port number in traffic log to service name if possible.
Enable or disable replacing user name with
“anonymous” in logs. disable disable disable disable
setting
Fortinet Technologies Inc.
Page 298 FortiOS™ - CLI Reference for FortiOS 5.0
log syslogd override-setting
syslogd override-setting
Use this command within a VDOM to override the global configuration created with the config log syslogd setting command. These settings configure the connection to a syslog server.
Syntax
config log syslogd override-setting set
set
set
set
facility {alert | audit | auth | authpriv | clock | cron
| daemon | ftp | kernel | local0 | local1 | local2 | local3
| local4 | local5 | local6 | local7 | lpr | mail | news | ntp
end set
set
set
set
Variable Description
override
{enable | disable}
Enable to use the override settings below. Disable to use the global configuration created with the config log syslogd setting command. status {enable | disable}
Enter enable to enable logging to a remote syslog server.
csv {enable | disable}
Enter enable to enable the FortiGate unit to produce the log in Comma Separated Value (CSV) format. If you do not enable CSV format the FortiGate unit produces plain text files.
Default
disable disable disable
Fortinet Technologies Inc.
Page 299 FortiOS™ - CLI Reference for FortiOS 5.0
log syslogd override-setting
Variable
facility {alert | audit
| auth | authpriv | clock
| cron | daemon | ftp
| kernel | local0 | local1
| local2 | local3 | local4
| local5 | local6 | local7
| lpr | mail | news | ntp
| syslog | user | uucp}
Description
Enter the facility type. facility identifies the source of the log message to syslog. You might want to change facility to distinguish log messages from different
FortiGate units. Available facility types are:
• alert: log alert
• audit: log audit
• auth: security/authorization messages
• authpriv: security/authorization messages (private)
• clock: clock daemon
• cron: cron daemon performing scheduled commands
• daemon: system daemons running background system processes
Default
local7 port <port_integer>
Enter the port number for communication with the syslog server.
reliable {disable | enable} Enable reliable delivery of syslog messages to the syslog server. When enabled, the FortiGate unit implements the
RAW profile of RFC 3195, sending log messages using
TCP protocol.
server <address_ipv4
| fqdn> source-ip
<address_ipv4>
• ftp: File Transfer Protocol (FTP) daemon
• kernel: kernel messages
• local0 – local7: reserved for local use
• lpr: line printer subsystem
• mail: email system
• news: network news subsystem
• ntp: Network Time Protocol (NTP) daemon
• syslog: messages generated internally by the syslog daemon
Enter the IP address of the syslog server that stores the logs.
514 disable
No default.
Enter source IP address for syslogd, syslog2 and syslog3
0.0.0.0
Fortinet Technologies Inc.
Page 300 FortiOS™ - CLI Reference for FortiOS 5.0
log {syslogd | syslogd2 | syslogd3} setting
{syslogd | syslogd2 | syslogd3} setting
Use this command to configure log settings for logging to a remote syslog server. You can configure the FortiGate unit to send logs to a remote computer running a syslog server.
Using the CLI, you can send logs to up to three different syslog servers. Configure additional syslog servers using syslogd2 and syslogd3 commands and the same fields outlined below.
Syslog CLI commands are not cumulative. Using a syntax similar to the following is not valid: config log syslogd syslogd2 syslogd3 setting
Syntax
config log {syslogd | syslogd2 | syslogd3} setting set
set
set
end set
set
set
set
Variable Description Default
status {enable | disable} Enter enable to enable logging to a remote syslog server. disable csv {enable | disable}
Enter enable to enable the FortiGate unit to produce the log in Comma Separated Value (CSV) format. If you do not enable CSV format the FortiGate unit produces plain text files.
disable
Fortinet Technologies Inc.
Page 301 FortiOS™ - CLI Reference for FortiOS 5.0
log {syslogd | syslogd2 | syslogd3} setting
Variable
facility {alert | audit | auth | authpriv | clock | cron | daemon | ftp | kernel | local0 | local1 | local2 | local3 | local4 | local5 | local6 | local7 | lpr | mail | news | ntp | syslog | user | uucp} port <port_integer> reliable {enable | disable} server <address_ipv4 |
FQDN> source-ip
<address_ipv4>
Description
Enter the facility type. facility identifies the source of the log message to syslog. You might want to change facility to distinguish log messages from different
FortiGate units. Available facility types are:
Default
local7
• alert: log alert
• audit: log audit
• auth: security/authorization messages
• authpriv: security/authorization messages (private)
• clock: clock daemon
• cron: cron daemon performing scheduled commands
• daemon: system daemons running background system processes
• ftp: File Transfer Protocol (FTP) daemon
• kernel: kernel messages
• local0 – local7: reserved for local use
• lpr: line printer subsystem
• mail: email system
• news: network news subsystem
• ntp: Network Time Protocol (NTP) daemon
• syslog: messages generated internally by the syslog daemon
Enter the port number for communication with the syslog server.
514 disable
Enable reliable delivery of syslog messages to the syslog server. When enabled, the FortiGate unit implements the
RAW profile of RFC 3195 for reliable delivery of log messages to the syslog server.
Reliable syslog protects log information through authentication and data encryption and ensures that the log messages are reliably delivered in the correct order.
Enter the IP address of the syslog server that stores the logs.
No default.
Host names must comply with RFC1035.
Enter source IP address for syslogd, syslog2 and syslog3
0.0.0.0
Fortinet Technologies Inc.
Page 302 FortiOS™ - CLI Reference for FortiOS 5.0
log webtrends setting
webtrends setting
Use this command to configure log settings for logging to a remote computer running a NetIQ
WebTrends firewall reporting server.
FortiGate log formats comply with WebTrends Enhanced Log Format (WELF) and are compatible with NetIQ WebTrends Security Reporting Center and Firewall Suite 4.1.
Syntax
config log webtrends setting set
end set
Variable Description
server <address_ipv4>
Enter the IP address of the WebTrends server that stores the logs.
Default
No default.
status {enable | disable} Enter enable to enable logging to a WebTrends server.
disable
Fortinet Technologies Inc.
Page 303 FortiOS™ - CLI Reference for FortiOS 5.0
netscan
Use these commands to configure the Endpoint network vulnerability scanner.
Note: Vulnerability scanning is not available in Transparent mode.
Page 304
netscan
assets
assets
Use this command to define assets (network devices and networks) to run network vulnerability scans on.
Syntax
config netscan assets edit
end
set win-password <pass_str> set win-username <id_str>
Variables Description
<asset_id_int>
Enter the unique ID number for this asset.
addr-type
{ip | range}
Select
Select ip to scan a single IP address. range to scan a range of IP addresses.
Default
ip
Note: You cannot specify authentication parameters for an address range.
auth-unix
(enable | disable}
Enable to allow the FortiGate unit to authenticate with a unix host during the vulnerability scan. If you enable this option you must enter a unix-username and a unix-password.
auth-windows
(enable | disable}
Enable to allow the FortiGate unit to authenticate with a Windows host during the vulnerability scan. If you enable this option you must enter a win-username and a win-password.
mode {discovery
| scan}
Select discovery to find assets with the specified IP address or address range.
name <string>
Enter an name of the asset.
scheduled
{enable | disable} start-ip
<address_ipv4> end-ip
<address_ipv4> unix-password
<pass_str>
Enable or disable including this asset in scheduled scans.
Enter the IP address of the asset to scan. If
Enter the password the FortiAnalyzer uses to authenticate with the
UNIX host.
addr-type is set to range enter the first IP address in the IP address range to scan.
If addr-type is set to range enter the last IP address in the IP address range to scan.
disable disable scan enable
0.0.0.0
0.0.0.0
This command appears only when auth is set to unix.
Fortinet Technologies Inc.
Page 305 FortiOS™ - CLI Reference for FortiOS 5.0
netscan assets
Variables
unix-username
<id_str> win-password
<pass_str> win-username
<id_str>
Description
Enter the username the FortiAnalyzer uses to authenticate with the UNIX host.
This command appears only when auth is set to unix.
Enter the password the FortiAnalyzer uses to authenticate with the
Windows host.
Enter the username the FortiAnalyzer uses to authenticate with the Windows host.
Default
Fortinet Technologies Inc.
Page 306 FortiOS™ - CLI Reference for FortiOS 5.0
netscan
settings
settings
Use this command to configure network vulnerability scanner settings that control when scans are run.
Syntax
config netscan settings set
set
os-detection {enable | disable | auto}
set
set
set
recurrence {daily | monthly | weekly}
set
scan-mode {full | quick | standard}
set
scheduled-pause {enable | disable | default}
set
service-detection {enable | disable | auto}
set
tcp-scan {enable | disable | auto}
end set
set
udp-scan {enable | disable | auto}
Variables
day-of-month <day_int>
Description
Enter the day of the month on which to run scans.
You can only select one day. This option is only available if schedule is enabled and recurrence is monthly.
day-of-week {monday | tuesday
| wednesday | thursday | friday | saturday | sunday}
Select the day of the week on which to run scans.
You can only select one day. This option is only available if schedule is enabled and recurrence is weekly.
os-detection {enable | disable
| auto}
Enable or disable host operating system detection, or select auto to use the default setting for this type of scan.
pause-from <time_str>
Enter the time, in hh:mm format, when network scanning pause begins.
pause-to <time_str>
Enter the time, in hh:mm format, when network scanning pause ends.
recurrence {daily | monthly | weekly} scan-mode {full | quick | standard}
Set scheduled scans to run once a day, once a month, or once a week.
Specify the scan mode to use:
full — scan all TCP and UDP ports
Default
1 sunday auto
00:00
00:00 weekly quick
quick — perform a quick scan of commonly used
TCP and UDP ports scheduled-pause
{enable | disable | default}
standard — perform a standard scan of more ports than the quick scan but not all ports.
Enable or disable scheduled pause in network scanning, or use default setting.
default
Fortinet Technologies Inc.
Page 307 FortiOS™ - CLI Reference for FortiOS 5.0
netscan
Variables
service-detection
{enable | disable | auto} tcp-scan {enable | disable
| auto} time <hh:mm> udp-scan {enable | disable
| auto}
settings
Description
Enable or disable explicit service detection, or select auto to use the default setting for this type of scan.
Enable or disable TCP scan, or select auto to use the default setting for this type of scan.
Default
auto auto
Enter the time of day on which to start a scan.
Enable or disable UDP scan, or select auto to use the default setting for this type of scan.
00:00 auto
Fortinet Technologies Inc.
Page 308 FortiOS™ - CLI Reference for FortiOS 5.0
pbx
Use the config pbx command to configure PBX feature of the FortiGate Voice unit.
This chapter describes the following commands:
Page 309
pbx
dialplan
dialplan
Use this command to add a dial plan and add rules to the dial plan. A dial plan rule indicates an outgoing destination to send calls to. You can add multiple rules to a dial plan. You add dial plans to extensions to control how to handle outgoing calls from the extension.
Syntax
config pbx dialplan
edit <pbx_dialplan_name> set comments <comment_string> config rule edit <rule_name_str>
set
set
callthrough {fxo1 | fxo2 | fxo3 | fx04
set
set
phone-no-beginwith <patern_str>
set
set
use-global-outgoing-prefix {no | yes}
end end
Variables Description
edit <pbx_dialplan_name> Enter the name for the dial plan. If you entering an existing dial plan, select Tab to get to the dial plan that you want to edit. comments
<comment_string> config rule edit <rule_name_str> action {allow | block}
Optionally enter a description of the dial plan.
Configure a new dial plan rule.
Enter the name of the dial plan rule to configure.
Set the action to allow if this dial plan rule should allow a call. Set the action to block if the dial plan should block a call. For example, if you want to block international calls you could set the Phone Number begin with to 011 and set the action to block.
callthrough {fxo1 | fxo2
| fxo3 | fx04
| <voip_providers>}
Select one or more destinations that the dial plan rule sends outgoing calls to. fxo1, fxo2, fxo3, and fx04 are the 4 PSTN interfaces.
<voip_providers> are the VoIP providers added to the FortiGate Voice. A dial plan rule can send calls to one or more destinations.
outgoing-prefix
<pattern_str> phone-no-beginwith
<patern_str>
If you set use-global-outgoing-prefix to no you can enter a different outgoing prefix for this dial plan.
Enter the leading digits of the phone number that this dial plan rule should match with. For example, a dial plan rule for toll free numbers in North America should begin with
18. The FortiGate Voice uses a best match to match a dialed number with a dial plan. So each dial plan should have a different Phone number Begin with setting. But you should plan your dial plan to make sure that unexpected matches do not occur.
Default
No default
No default
No default
No default
No default
No default null null
Fortinet Technologies Inc.
Page 310 FortiOS™ - CLI Reference for FortiOS 5.0
pbx
Variables
prepend <pattern_str>
Description
Add digits that should be prepended or added to the beginning of the dialed number before the call is forwarded to its destination. You can prepend digits at the beginning of a call of special dialing is required to reach and external phone system. use-global-outgoing-prefix
{no | yes}
Select yes if the dial plan rule should use the default outgoing prefix (usually 9). Select no to add a different outgoing-prefix.
Default
null yes
dialplan
Fortinet Technologies Inc.
Page 311 FortiOS™ - CLI Reference for FortiOS 5.0
pbx
did
did
Use this command to configure Direct Inward Dialing (DID). DID allows calls from external phone systems to dial directly to extensions added to the FortiGate Voice unit.
Syntax
config pbx did
end
set extension <extension_number> set comment <comment_string>
Variables
edit
<pbx_did_name> external-line {fxo1
| fxo2 | fxo3 | fx04
| <voip_providers>} cid-number
<phone_number> extension
<extension_number> comment
<comment_string>
Description
Enter the name for the Direct Inward Dial.
Default
No default.
Select one external system that can dial directly to an extension. fxo1, fxo2, fxo3, and fx04 are the 4 PSTN interfaces.
<voip_providers> are the VoIP providers added to the FortiGate Voice.
null
Enter the phone number dialed by a caller on the external system.
null
Enter the FortiGate Voice extension number the call is directed to. null
Enter a description, if applicable, about the direct inward dial configuration.
null
Fortinet Technologies Inc.
Page 312 FortiOS™ - CLI Reference for FortiOS 5.0
pbx
extension
extension
Use this command to add SIP phone extensions to the FortiGate Voice unit. You can add new extensions or reconfigure the existing ones. For example, you can label an extension by user name, or you can add an extension and set it as a host for conference calls, or you can get
FortiGate Voice unit to send email notifications to the users when they receive new voicemail messages.
FortiGate Voice unit uses the alertmail settings to access an SMTP server and send email notifications. Alertmail can be configured through config system alertmail command.
For more information about alertmail CLI command configuration refer to FortiGate CLI
Reference.
Syntax
config pbx extension
end
Variables Description
edit <extension_number>
Enter the extension number. The extension number has to match the config pbx global extension pattern.
attach {enable | disable}
Enable the voicemail message as an attachment in an email. auto-delete
{enable | disable} conference-host
<extension_number>
Enable to automatically delete voice mail.
Enter the extension number that will host the conference. dialplan <dialplan_name>
Enter the dial plan that you want to use for the extension.
Default
No default.
disable disable null null
Fortinet Technologies Inc.
Page 313 FortiOS™ - CLI Reference for FortiOS 5.0
pbx extension
Variables
email <user_email>
Description
Enter the user’s email address. This email address can be used to notify the user when they have a new voicemail message.
email-notify
{enable | disable}
Enable email notification. When email notification is enabled the user gets notified of each new voicemail messages.
first-name <first_name>
Enter the person’s first name. host-pin <host_password>
Enter the password for the conference call. The password must contain only numbers. The users need to enter this password to join the conference call.
Default
null disable null last-name
<surname_name>
Enter the surname of the person. macaddress <mac_address> Enter the MAC address of the SIP phone for the current extension. A typical MAC address consists of six double digit alpha-numeric characters separated by colons.
Colons must be used when entering the MAC address.
max-msg
<max_messages_allowed> nat {no | yes} recordable-flag
{enable | disable}
Enter the maximum number of voicemail messages that are allowed in a user’s voicemail inbox. null
00:00:00:
00:00:00
50
Enter to indicate that the phone is behind a NAT device. no
Enable conference recording. When enabled the conference call are recorded on FortiGate Voice unit’s hard drive.
disable secret <user_password>
Enter the user’s password for voicemail. type
{conference | sip-phone}
Enter the type of extension to configure.
sip-phone to configure a SIP phone extension
No default.
sip-phone
conference to add a conference bridge. Multiple users can call the conference bridge extension number enter the secret and have a conference call. A conference bridge only requires an extension number and a secret.
video {enable | disable}
Enable video conferencing.
vm-secret <user_password> Enter the user’s password for accessing their voicemail inbox. voicemail
{enable | disable}
Enable the extension to have voicemail. disable
No default.
enable
Fortinet Technologies Inc.
Page 314 FortiOS™ - CLI Reference for FortiOS 5.0
pbx
global
Use this command to configure voicemail settings such as limiting the length of voicemail messages, as well as the country and the extension pattern of the user.
Syntax
config pbx global set
set
set
block-blacklist {enable | disable}
set
set
set
set
set
set
extension-pattern <extension_pattern>
set
fax-admin-email <email_address>
set
ftgd-voice-server <server_address>
set
set
max-voicemail <max_length_seconds>
set
set
set
set
set
set
end set
voicemail-extension <access_number>
Variables
atxfer-dtmf <str> blindxfer-dtmf <str> block-blacklist {enable | disable} code-callpark <str> country-area
<country_name> country-code
<country_code> dtmf-callpark <str> efax-check-interval
<integer>
Description
The DTMF command to trigger an attended transfer.
The DTMF command to trigger a blind transfer.
Enable to block blacklist IP addresses.
Enter this numeric code to park the current call.
Enter the name of the country in which the FortiGate Voice unit is installed.
Enter the country code in which the FortiGate Voice unit is installed.
The DTMF command to trigger a call park.
Enter the efax polling interval from FortiGuard fax server.
The value range is 5 to 120 in minutes.
Default
*2
#1 enable
700
USA
1
#72
5
global
Fortinet Technologies Inc.
Page 315 FortiOS™ - CLI Reference for FortiOS 5.0
pbx global
Variables
extension-pattern
<extension_pattern>
Description
Enter a pattern that defines the valid extensions that can be added to the FortiGate Voice configuration. The pattern can include numbers that must be in every extension and upper case
Xs to indicate the number of digits. The extension range can only contain numbers and the letter
X.
Default
null
If you add numbers to the extension range, all extensions added to this FortiGate Voice unit must include the same numbers in the same location in the extension number. For example, if you include a 6 as the first digit, all extensions added this FortiGate Voice unit must begin with the number
6.
The
Xs indicate the number of digits in addition to the required number that each extension must have. For example,
6XXX indicates the extensions must start with the number 6 and be followed by any three numbers.
Usually you would add one or two numbers to the start of the extension range to identify the extensions for this PBX and follow this with enough Xs to be able to add the required number of extensions.
The extension range should not begin with the same number as the outgoing prefix.
fax-admin-email
<email_address> ftgd-voice-server
<server_address> local-area-code
<code_string> max-voicemail
<max_length_seconds> outgoing-prefix
<pattern_str> parking-slots <int>
Enter the email address of the fax administrator.
null
Enter the FortiGuard voice server address.
Enter the local area code for the country or region in which you are installing the FortiGate Voice unit.
Limit the length of voicemail messages in seconds. Set to 0 for no limit.
60 service.fo
rtivoice.c
om
408
The number that PBX users must dial to get an outside line.
For example, if users should dial 9 to get an outside line, add 9 to this field. The outgoing prefix should not be the same as the first number of the extension range.
9
The maximum number of calls that can be parked at the same time.
20 parking-time <int>
The length of time, in seconds, a call can be parked. If this time expires without the call being answered, the parked call will ring back to the extension from which it was parked.
45 ring-timeout <time_int> The number of seconds that an extension should be allowed to ring before going to voicemail.
rtp-hold-timeout
<time_int>
The amount of time in seconds that the extension will wait on hold for RTP packets before hanging up the call. 0 means no time limit.
20
0 rtp-timeout <time_int> The amount of time in seconds during an active call that the extension will wait for RTP packets before hanging up the call. 0 means no time limit.
voicemail-extension
<access_number>
Enter the voicemail extension number that a user will use to access their voicemail inbox.
60
*97
Fortinet Technologies Inc.
Page 316 FortiOS™ - CLI Reference for FortiOS 5.0
pbx
ringgrp
ringgrp
Use this command to add and configure the extension groups. An extension group here is referred to a ring group and is a group of extensions that can be called using one number. You can configure the ring group to call all of the extensions in the group at the same time or to call the extensions one at a time until someone answers.
The order in which the members are added to the ring group does not match the order in which the FortiGate Voice unit calls them.
Syntax
config pbx ringgrp
end
set voicemail-of-extension <extension_number>
Variables Description
edit <ring_group_name> Enter the name for the group. description
<description_str>
A description of the extension group.
member
<acd_group_member> no-answer-action
{hangup | ivr | voicemail}
Enter the ACD member for the group.
Enter the action that will be taken when none of the extensions in the ring group answers.
hangup — hand up and end the call.
ivr — return the caller to the attendant where they can try another extension.
Default
No default.
null
No default.
voicemail strategy
{ring-all | sequential} voicemail-of-extension
<extension_number>
voicemail — the caller is directed to the voicemail system where they can leave a message.
Control how the extensions in the group are called by the ring group.
ring-all — calls all of the extensions in the group at the same time.
sequential
sequential — calls the extensions in the group one at a time in the order in which they have been added to the group.
Enter the extension number to use for voicemail if no one answers the call and no-answer-action is set to voicemail.
null
Fortinet Technologies Inc.
Page 317 FortiOS™ - CLI Reference for FortiOS 5.0
pbx voice-menu
voice-menu
Use this command to configure the menu that callers will access when they call. The variable config press-<number> configures the settings for the type of ring group and the type of group associated with that number.
Syntax
config pbx voice-menu set
set
set
recorder-exten <extension_str> config [press-0 | press-1 | press-2 | press-3 | press-4 | press-
5 | press-6 | press-7 | press-8 | press-9]
set
type {directory | none | ring-group | voicemail}
set
end end
Variables Description
comment
<comment_string>
Enter a description of the voice-menu settings, if applicable.
password <ext_password> Enter the password to access recording a new IVR message.
recorder-exten
<extension_str> config [press-0 | press-1
| press-2 | press-3 | press-4
| press-5 | press-6 | press-7
| press-8 | press-9]
Enter the extension number for recording a new IVR message.
Use this command when configuring what action each number on the phone’s keypad will take. type {directory | none
| ring-group | voicemail}
For example, you want the personnel directory to come up every time someone presses 1; config press-1 variable would have the type directory selected in type.
Enter the type of action that is associated with the specific number on the phone’s keypad. For example, the office phone directory is heard when a caller presses 0 because config press-0 has directory as its type. ring-group <group_string> Enter to include a specific ring-group if you have select ring-group in type. This variable appears only when ring-group is selected in type.
Default
No default.
null
*30
No default.
No default.
null
Fortinet Technologies Inc.
Page 318 FortiOS™ - CLI Reference for FortiOS 5.0
pbx
sip-trunk
sip-trunk
Use this command to configure SIP server providers for the PBX. If your FortiGate Voice unit is installed in North America and the Country Code is set to 1 then you can use the FortiGuard
Voice service as your SIP service provider. (The default Country Code is 1. To change the
country code, see “pbx global” on page 315 .) The FortiGuard Voice service is supported only in
North America. If you install the FortiGate Voice unit elsewhere in the world and change the
Country Code, the FortiGuard Voice Service configuration is replaced by the SIP trunk configuration. You can use the SIP trunk configuration to add one or more SIP service providers to the FortiGate Voice configuration.
Syntax
config pbx voip-provider
edit <provider_name> set user <user_name> set domain {<VoIP_provider_address_ipv4>
set codec1 {alaw | g729 | none | ulaw}
end
set codec2 {alaw | g729 | none | ulaw} set video {enable | disable}
Variables
edit <provider_name> user <user_name>
Description
Enter the VoIP provider’s name.
Default
No default
Enter the user name for the provider. You can enter the phone number registered with this provider instead.
No default secret <password> domain
{<VoIP_provider_address_ipv4>
| <VoIP_provider_domain> } authuser <authuser>
Enter the password associated with the provider. No default
The VoIP provider’s domain name or IP address.
For example,
172.20.120.11 or voip.example.com.
Enter the authentication user for the account. display-name <display_name>
Enter the name that will be used as the caller ID name if the provider supports this feature.
No default
No default
No default registration-interval
<refresh_interval>
Enter a number for the refresh interval. account-type {static | dynamic}
Enter to define the type of account. dtmf-metod
{auto | inband | info | rfc2833}
Enter the DTMF method that will be used. codec {alaw | g729 | none | ulaw} Enter the most preferred Codec for the VoIP provider.
No default
No default.
No default ulaw
Fortinet Technologies Inc.
Page 319 FortiOS™ - CLI Reference for FortiOS 5.0
pbx
Variables
codec1
{alaw | g729 | none | ulaw} codec2
{alaw | g729 | none | ulaw} video {enable | disable}
sip-trunk
Description
Enter the second most preferred Codec for the
VoIP provider.
Default
none
Enter the third most preferred Codec for the VoIP provider.
none
Enable video capability if the provider supports this feature.
disable
Fortinet Technologies Inc.
Page 320 FortiOS™ - CLI Reference for FortiOS 5.0
report
Use these commands to configure SQL reports. You can use the command get report database schema to display the FortiGate SQL reporting database schema.
The command descriptions in this chapter have not been completely updated for FortiOS 5.0.
This chapter will be updated for a future version of this document.
Page 321
report
chart
chart
Use the following command to configure a chart or widget. You can edit the settings of existing widgets or you can add new widgets. To add a new widget you need to have a dataset for it as well as a title. You can also configure the widget to be a graph in various formats or a table and you can also optionally configure details about the appearance of the graph or table.
As you change chart format settings you can go to the Executive Summary page of the web-based manager and view the chart. Refresh your browser to see format changes. You must use the end command to exit from the config report chart command to view your changes in the widget.
Charts are called widgets in the Executive Summary on the web-based manager. In the web-based manager each widget has a name which is set using the comments field of the config report chart command. When you edit a chart you specify a chart name that is only used in the CLI. To determine the widget name of a chart you must edit it and view the comments setting.
Syntax
Due to the complexity and duplication in the chart command, the set commands are listed in simple alphabetical order.
Fortinet Technologies Inc.
config report chart edit
config category-series config column
edit
config value-series config x-series config y-series
end
Page 322 FortiOS™ - CLI Reference for FortiOS 5.0
report chart
set font-size <size_int> set footer-unit <string>
| none} set period {last24 | last7d} set scale-format {YYYY-MM-DD-HH-MM | YYYY-MM-DD | HH | YYYY-MM-
end
Variable
config category-series
Default
config column config mapping config value-series config x-series config y-series
Description
Configure the category settings required for a pie chart.
Configure columns for a table. To configure these settings style must be manual and type must be table. You can add multiple columns to the table and configure settings for each column.
Configure mapping for a table.
Configure the value settings required for a pie chart.
Configure settings for the x axis of a bar or line graph. To configure these settings style must be manual and type must be graph.
Configure settings for the y axis of a bar or line graph. To configure these settings style must be manual and type must be graph.
Fortinet Technologies Inc.
Page 323 FortiOS™ - CLI Reference for FortiOS 5.0
report chart
Variable
<chart_name>
<column_number>
Description
Enter the name of a new or existing chart. The
<chart_name> only appears in the CLI. The web-based manager includes widget names that are set using the comments field.
Enter the number of the column to configure.
Columns are numbered from the left starting at 1.
Default
<id> background <color_hex>
Identifies a mapping instance.
Enter the hexidecimal value for an HTML color to set the background color for a graph. The color value should begin with
0x. For example, the color
0xff0000 results in a red background.
caption <caption_str>
Add a caption text string.
caption-font-size <size_int>
Set the size of the font used to display a caption. 0 means the font size is set automatically. The font size range is 5 to 20.
color-palette <palette_hex>
Enter the hexidecimal value for an HTML color palette. The color palette value should begin with
0x.
comments <comment_str>
Enter the name of the widget. You use this name to select the widget when adding it to the Executive
Summary from the web-based manager. This name appears at the top of the widget when it is displayed in the Executive Summary.
0 databind <value_expr_str>
Enter an SQL databind value expression for binding data to the series being configured.
dataset <dataset_name>
Enter the name of the dataset that provides the data for this chart. Use the config report dataset command to add or edit data sets. The default configuration includes a number of pre-configured data sets.
detail-unit <unit_str>
Enter an abbreviation to display for the measurement unit, “MB”, for example.
detail-value <value-str> dimension {2D | 3D}
Define the value to appear in each column of a table.
Define whether bar and pie graphs will have a 2D or
3D display.
No default.
3D displayname <name_str> drill-down-chart <chartname> extra-databind
<value_expr_str> extra-y {disable |enable)
Set the name to be displayed for a mapping.
Enter the chart name to drill down into.
Enter an SQL databind value expression for binding extra data to the series being configured.
Enable or disable adding a second or extra set of data to the y-axis of a graph.
disable extra-y-legend
<legend_string> font-size <size_int>
Add a name to a second or extra set of data added to the y-axis of a graph.
Set the size of the font used to display a title. 0 means the font size is set automatically. The font size range is 5 to 20.
0 footer-unit <string>
Enter an abbreviation to display for the footer unit,
“MB”, for example.
Fortinet Technologies Inc.
Page 324 FortiOS™ - CLI Reference for FortiOS 5.0
report chart
Variable
footer-value <value-str> graph-type {bar | flow | line | none | pie} group <group_str> header-value <string> is-category {no | yes}
Description
Define the value to appear in the footer of a table.
If type is set to graph select the type of graph used to display information in the widget.
Enter a group string.
Define the value to appear in the header of a table.
Default
none
Specify whether an x axis of a graph displays categories or a series of values. no label-angle {45-degree | vertical | horizontal} legend {enable | disable}
Enable or disable the generation and display of a data legend.
legend-font-size <size_int>
Set the size of the font used to display a legend. 0 means the font size is set automatically. The font size range is 5 to 20.
enable
0 op {equal | greater | greaterequal | less | less-equal
| none} period {last24 | last7d}
Select the angle for displaying the x or y axis label.
Varies depending on the chart and series.
Set the mapping option none
Select the chart report period: last 24 hours or last seven days.
last7d
Set the format for displaying the date and time on the x-axis of a graph.
YYYY-MM-
DD-HH-MM scale-format
{YYYY-MM-DD-HH-MM
| YYYY-MM-DD | HH
| YYYY-MM-DD
| YYYY-MM | YYYY
| HH-MM | MM-DD} scale-number-of-step
<steps_int> scale-origin {max | min}
Set the number of steps on the horizontal axis of the graph. The range is 1 to 31.
Set the time start point and direction of time on the xaxis of the graph:
0 max scale-start {now | hh:mm yyyy/mm/dd} scale-step <step_int> scale-type datetime scale-unit {day | hour
| minute | month | year} max along the x-axis time is displayed in reverse starting at the origin of the graph with the scalestart time.
min along the x-axis time is displayed in the forward direction starting at the origin of the graph with the scale-start time.
Set the start time for the x-axis. now sets the start time to the time that the graph was generated. You can also specify a time and date. The year range is
2001-2050.
now
The number of scale-units in each x-axis scale step.
Only the datetime scale type is supported. Sets the x-axis to display dates and times.
The units of the scale-step on the x-axis.
0 datetime day
Fortinet Technologies Inc.
Page 325 FortiOS™ - CLI Reference for FortiOS 5.0
report
Variable
style {auto | manual}
Description
By default style is set to auto which means the appearance of the graph or chart in the widget is configured automatically. You can set style to manual to manually configure details about the appearance of the chart or graph in the widget.
title <title_str>
Enter the title of the graph or table. The title is optional and appears inside the widget above the graph or chart. This is not the name of the widget.
Use the comments field to add the title or name of the widget.
title-font-size <size_int>
Set the size of the font used to display the title. 0 means the font size is set automatically. The font size range is 5 to 20.
type {graph | table}
Configure whether this widget presents information in a graphical form as a graph or as a table of values.
If you select graph use the graph-type field to configure the type of graph.
unit <unit_str>
Enter the name of the units to be displayed on the xaxis.
value-type {integer | string}
Configure the mapping value to be an integer or a text string.
value1 {<value_int>
| <value_str>} value2 {<value_int>
| <value_str>} y-legend <legend_str>
Set the first mapping value.
Set a second mapping value if required.
Add a name for the data included on the y-axis of a graph.
Default
auto
0 graph integer
chart
Fortinet Technologies Inc.
Page 326 FortiOS™ - CLI Reference for FortiOS 5.0
report
dataset
dataset
Use the following command to configure report data sets. You can configure existing data sets or add new ones.
Expert knowledge of SQL is required to write and edit data set queries.
Syntax
config report dataset
edit <report_dataset> set query <SQL_statement> config field edit <field-id>
set
end set
type {text | integer | date | ip}
end
Variable
query
<SQL_statement>
Description
edit <report_dataset> Enter the name of an existing dataset or a new name. Press ? to view the list of existing datasets.
Enter the SQL statement that retrieves the required data from the database. Comprehensive knowledge of SQL queries is required. See the existing datasets for example SQL queries.
config field
You should configure fields only to modify the type or displayed name of the column for use in a table or chart.
edit <field-id>
Enter a field id from 1 to the number of SQL result fields in the
SQL query.
displayname <string> Enter the name for the field to be displayed in tables and charts.
type {text | integer
| date | ip}
Select the type of data in the field. All options are not available for all fields.
Default
text
Fortinet Technologies Inc.
Page 327 FortiOS™ - CLI Reference for FortiOS 5.0
report
layout
layout
Use this command configure report layouts. Layouts help you define the content of your reports. You can create sub-styles for page headers, page footers and the body section of the report. You can also schedule a reporting cycle and set a specific time and day for generating reports. You can select a layout from a pre-defined list or you can create your own report layout.
Once you have all layout parameters set, you can save it and use it in any report. You can use the following options to customize layouts or create new layouts.
Syntax
config report layout
set
set
set
cutoff-option {run-time | custom}
set
set
set
email-recipients <recipients_str>
set
set
set
schedule-type {demand | daily | weekly}
set
time <HH:MM> set day {sunday | monday | tuesday | wednesday | thursday | friday
set
set
options {include-table-of-contents | auto-numbering-heading
| view-chart-as-heading | show-html-navbar-before-heading} config page
set
set
column-break-before {heading1 | heading2 | heading3}
set
options {header-on-first-page | footer-on-first-page}
set
style <style name> config header
set
Fortinet Technologies Inc.
Page 328 FortiOS™ - CLI Reference for FortiOS 5.0
report layout
set
end
set img-src <text> config body-item
set
set
type {text | image | chart | misc}
set
set
set
text-component {heading1 | heading2 | heading3 | normal text}
set
set
set
set
chart-options {hide-title | include-no-data | show-caption}
set
misc-component {hline | page-break | column-break | sectionstart}
set
end end end
Variable
edit <layout name> title <text> cache-time-out
<seconds_int> cutoff-option
{run-time | custom}
Description
Enter the name of an existing layout or a new name.
Press
? to view the list of existing layouts.
Enter a title for the current report layout.
Enter the timeout period in seconds for cached datasets.
Range 0 to 86 400. Default is 604 800 seconds (1 week).
Select the end of the report period:
Default
86400 run-time
run-time — the report period ends when the report is run.
description <text>
custom — the report period ends at cutoff-time.
cutoff-time <time_str>
Enter the end of the report period in hh:mm format. This field is available when cutoff-option is custom.
Enter a description for the current layout.
email-recipients
<recipients_str> email-send
{enable | disable} format {html | pdf} schedule-type {demand
| daily | weekly}
Enter the email addresses of report recipients separated by semicolons. Available if email-send is enable.
Enable or disable sending of reports by email.
Select the layout format.
Select the schedule type for the report layout.
00:00
Null disable html daily
Fortinet Technologies Inc.
Page 329 FortiOS™ - CLI Reference for FortiOS 5.0
report layout
Variable
time <HH:MM>
Description
Enter the time for the report to be run.
HH: Hour value in two digit format 0-23
MM: Minute value 0-59.
schedule-type must be set in order for time option to be available.
day {sunday | monday
| tuesday | wednesday
| thursday | friday
| saturday} style-theme <theme name>
Select the day of the week for report to be run. option is only available when weekly.
day schedule-type is set to
Enter the name of an existing style theme or a new style theme name. More detail on style themes can be found in
section of this chapter. options
{include-table-of-conten ts
| auto-numbering-headin g | view-chart-as-heading
| show-html-navbar-befo re-heading}
Use following options to configure the report page design;
include-table-of-contents — select this option to include table of contents in the report.
auto-numbering-heading — select this option to include page numbers in the heading.
sunday
view-chart-as-heading — select this option to add heading for each chat automatically.
Default
00:00
show-html-navbar-before-heading — select this option to show html navigation bar before each heading.
config page
paper{A4|letter} column-break-before
{heading1 | heading2
| heading3} options
{header-on-first-page
| footer-on-first-page}
config header
style <style name>
Select the standard paper size.
Select the heading type which will include a column break in front of it.
Select one of these options to have the header or the footer on the first page of the report.
Enter the name of an existing style or a new name. Press
? to view the list of existing styles.
A4
config header-item
edit <item_id> style <style name> type {text | image} content <text> description <text> img-src <text>
Enter the id of an existing report item or a new id. Press
? to view the list of existing report item ids.
Enter the name of an existing style or a new name. Press
? to view the list of existing styles.
Select the report header item type.
text
Enter the content material for the header item. This option only available when type is set to text.
Enter the description of the image file. This option is only available when type is set to image.
Enter the name of the header item image file. For example image.jpg. This option is only available when type is set to image.
Fortinet Technologies Inc.
Page 330 FortiOS™ - CLI Reference for FortiOS 5.0
report
Variable config footer
style <style name>
Description Default
Enter the name of an existing style or a new name. Press
? to view the list of existing styles.
config footer-item
edit <item_id>
Enter the id of an existing report item or a new id. Press
? to view the list of existing report item ids.
style <style name> type {text | image} content <text> description <text> img-src <text>
config body-item
edit <item_id> type {text | image | chart
| misc} description <text>
Enter the id of an existing report body item or a new id.
Press
? to view the list of existing report body item ids.
Select the body item type.
style <style name> text
Enter the content material for the body item. This option only available when type is set to text or misc.
Enter the name of an existing style or a new name. Press
? to view the list of existing styles.
Select the text component type.
text text-component
{heading1 | heading2
| heading3 | normal text} content <text>
Enter the content material for the text component.
Headings are limited to only one line.
img-src <text>
Enter the name of an existing style or a new name. Press
? to view the list of existing styles.
Select the report footer item type.
text
Enter the content material for the footer item. This option only available when type is set to text.
Enter the description of the image file. This option is only available when type is set to image.
Enter the name of the footer item image file. For example image.jpg. This option is only available when type is set to image.
chart <chart name> chart-options {hide-title
| include-no-data
| show-caption}
Enter the name of the body item image file. For example image.jpg. This option is only available when type is set to image.
Enter the report item chart name. This option is only available when type is set to chart.
Select one of the following options to customize the chart.
hide-title: Hide chart title.
include-no-data: Include the chart with no data.
show-caption: Show chart caption.
layout
Fortinet Technologies Inc.
Page 331 FortiOS™ - CLI Reference for FortiOS 5.0
report
Variable
misc-component {hline
| page-break
| column-break | sectionstart}
Description
Select one of the following options to add a separator component to your report.
hline — add a horizontal line
page-break — add a page break
column-break — add a column break
section-start — add a section parameter1 <value_str>
Enter the parameter value for this body item.
Default
layout
Fortinet Technologies Inc.
Page 332 FortiOS™ - CLI Reference for FortiOS 5.0
report
style
style
Use this command configure the report styles. Report styles help you configure font, paragraph and page properties of your reports. For example you can set the font type, size and color as well as page background color and page margins. You can select a style from a pre-defined list or you can create your own report style. Once you have all style parameters set, you can save it and use it on any reports. You can use the following options to customize or create report styles.
Syntax
config report style
edit <style name> set options {font | text | color | align | size | margin
| lime | maroon | navy | olive | purple | red | silver
| teal | white | yellow | <color-value>} set bg-color {aqua | black | blue | fuchsia | gray | green
| lime | maroon | navy | olive | purple | red | silver
{aqua | black | blue | fuchsia | gray | green | lime
| maroon | navy | olive | purple | red | silver | teal
| white | yellow | <color-value>} set border-bottom <bottomwidth_int> {none | dotted | dashed
| solid} {aqua | black | blue | fuchsia | gray | green
| lime | maroon | navy | olive | purple | red | silver
{aqua | black | blue | fuchsia | gray | green | lime
| maroon | navy | olive | purple | red | silver | teal
| white | yellow | <color-value> set border-right <rightwidth_int> {none | dotted | dashed
| solid} {aqua | black | blue| fuchsia | gray | green
| lime | maroon | navy | olive | purple | red | silver
| teal | white | yellow | <color-value>
Fortinet Technologies Inc.
Page 333 FortiOS™ - CLI Reference for FortiOS 5.0
report
set padding-top <integer> set padding-bottom <integer>
end
Variable
Description
edit <style name>
Enter the name of an existing style or a new name. Press
? to view the list of existing styles.
options {font | text
| color | align | size
| margin | border
| padding | column} font-family {Verdana
| Arial | Helvetica
| Courier | Times} font-style
{normal|italic} font-weight
{normal | bold} font-size {xx-small
| x-small | small
| medium | large
| x-large | xx-large}
| 5-28 line-height
<integer | percentage> fg-color {aqua | black
| blue | fuchsia | gray
| green | lime | maroon
| navy | olive | purple
| red | silver | teal
| white | yellow
| <color-value>} bg-color {aqua | black
| blue | fuchsia | gray
| green | lime | maroon
| navy | olive | purple
| red | silver | teal
| white | yellow
| <color-value>}
Select report style feature for customization. For example, set font allows you to customize font properties.
Select one of the pre-defined font families for the current report style.
Select the style of the font.
Select the weight of the font.
Select one of the pre-defined font size options or enter a number between 5 and 28 which sets the font size in pixels.
Set the line height in pixels or percentage. For example 10 or
120%.
Select the foreground color from one of the pre-defined colors or enter 6 digit hex color code. For example 0033CC is for blue.
Select the background color from one of the pre-defined colors or enter 6 digit hex color code. For example FF0000 is for red.
align {left | center
| right | justify} height
<integer | percentage>
Select one of the text alignment options.
Enter the height of the report in pixels or percentage. For example 10 or 120%.
width
<integer | percentage>
Enter the height of the report in pixels or percentage. For example 10 or 120%.
margin-top <integer> Enter the top margin size in pixels.
Default
normal normal left
style
Fortinet Technologies Inc.
Page 334 FortiOS™ - CLI Reference for FortiOS 5.0
report style
Variable
Description
margin-bottom
<integer>
Enter the bottom margin size in pixels.
margin-left <integer> Enter the left margin size in pixels.
margin-right
<integer> border-top
<topwidth_int> {none
| dotted | dashed
| solid} {aqua | black
| blue | fuchsia | gray
| green | lime | maroon
| navy | olive | purple
| red | silver | teal
| white | yellow
| <color-value>} border-bottom
<bottomwidth_int>
{none | dotted
| dashed | solid}
{aqua | black | blue
| fuchsia | gray | green
| lime | maroon | navy
| olive | purple | red
| silver | teal | white
| yellow
| <color-value>} border-left
<leftwidth_int>
{none | dotted
| dashed | solid}
{aqua | black | blue
| fuchsia | gray | green
| lime | maroon | navy
| olive | purple | red
| silver | teal | white
| yellow
| <color-value> border-right
<rightwidth_int>
{none | dotted
| dashed | solid}
{aqua | black
| blue| fuchsia | gray
| green | lime | maroon
| navy | olive | purple
| red | silver | teal
| white | yellow
| <color-value> padding-top
<integer> padding-bottom
<integer>
Enter the right margin size in pixels.
Enter the top border width in pixels followed by the border style and the border color. Border color can be entered by name or 6 digit hex color code.
Enter the bottom border width in pixels followed by the border style and the border color. Border color can be entered by name or 6 digit hex color code.
Enter the left border width in pixels followed by the border style and the border color. Border color can be entered by name or 6 digit hex color code.
Enter the right border width in pixels followed by the border style and the border color. Border color can be entered by name or 6 digit hex color code.
Enter the top padding size in pixels.
Enter the bottom padding size in pixels.
Default
none none none none
Fortinet Technologies Inc.
Page 335 FortiOS™ - CLI Reference for FortiOS 5.0
report
Variable
Description
Default
padding-left
<integer> padding-right
<integer>
Enter the left padding size in pixels.
Enter the right padding size in pixels.
column-span
{none|all}
Select all for span across all columns or none for no span none column-gap <integer> Enter the column gap size in pixels.
style
Fortinet Technologies Inc.
Page 336 FortiOS™ - CLI Reference for FortiOS 5.0
report
summary
summary
Use this command to add widgets (also called charts) to the Executive Summary and to configure the schedule for updating the data displayed by the widget. The data is updated by executing the SQL query in the widget and refreshing the information displayed in the widget.
Syntax
config report summary edit
id <integer> set column {1 | 2} set day {sunday | monday | tuesday | wednesday | thursday
| friday | saturday} set schedule {daily | weekly} set time <hh:mm> set widget <widget_name>
end
Variable
id <integer> column {1 | 2}
Description
Enter the identification number for the log field.
Default
Select the name of the widget.
1 day {sunday | monday
| tuesday | wednesday
| thursday | friday
| saturday} schedule
{daily | weekly} time <hh:mm>
Set the day of the week to update the widget. Available if schedule is weekly.
Schedule the widget to update once a day or once a week. daily
Set the time of day to update the widget. You can set the time of day for weekly or daily updates.
sunday
00:00 widget
<widget_name>
Select the column of the Executive Summary to display the widget in.
Fortinet Technologies Inc.
Page 337 FortiOS™ - CLI Reference for FortiOS 5.0
report
theme
theme
Use this command configure themes for your reports. Themes help you configure some of the main characteristics of your report outlook. For example you can configure the page orientation of the report or create sub-styles for title headings. You can select a theme from a pre-defined list or you can create your own report theme. Once you have all theme parameters set, you can save it and use it on any reports. You can use the following options to customize or create report themes.
Syntax
config report theme
set
page-orient {portrait | landscape}
set
set
default-html-style <style_name>
set
default-pdf-style <style_name>
set
set
page-header-style <style_name>
set
page-footer-style <style name>
set
report-title-style <style name>
set
report-subtitle-style <style_name>
set
set
set
set
set
set
toc-heading1-style <style_name>
set
toc-heading2-style <style_name>
set
toc-heading3-style <style_name>
set
toc-heading4-style <style_name>
set
normal-text-style <style_name>
set
bullet-text-style <style_name>
set
numbered-text-style <style_name>
set
set
set
graph-chart-style <style_name>
set
table-chart-style <style_name>
set
table-chart-caption-style <style_name>
set
table-chart-head-style <style_name>
set
table-chart-odd-row-style <style_name>
end set
table-chart-even-row-style <style_name>
Variable
page-orient
{portrait | landscape}
Description
edit <theme name>
Enter the name of an existing theme or a new name. Press
? to view the list of existing themes.
Select the page orientation for the current report theme.
Default
portrait
Fortinet Technologies Inc.
Page 338 FortiOS™ - CLI Reference for FortiOS 5.0
report theme
Variable
column-count
{1 | 2 | 3} default-html-style
<style_name> default-pdf-style
<style_name> page-style
<style_name> page-header-style
<style_name> page-footer-style
<style name> report-title-style
<style name> report-subtitle-style
<style_name> heading1-style
<style_name> heading2-style
<style_name> heading3-style
<style_name> heading4-style
<style_name> toc-title-style
<style_name> toc-heading1-style
<style_name> toc-heading2-style
<style_name> toc-heading3-style
<style_name> toc-heading4-style
<style_name> normal-text-style
<style_name> bullet-text-style
<style_name> numbered-text-style
<style_name> image-style
<style_name> hline-style
<style_name>
Description
Enter the number of columns for the current report theme.
The maximum value is 3.
Enter the default html style name. Press
? to view the list of existing html styles.
Enter the default pdf style name. Press
? to view the list of existing pdf styles.
Default
1
Enter the default page style name. Press
? to view the list of existing page styles.
Enter the default page header style name. Press
? to view the list of existing page header styles.
Enter the default footer style name. Press
? to view the list of existing footer styles.
Enter the default report title style name. Press
? to view the list of existing report title styles.
Enter the default report subtitle style name. Press
? to view the list of existing report subtitle styles.
Enter the default heading1 style name. Press
? to view the list of existing heading1 styles.
Enter the default heading2 style name. Press
? to view the list of existing heading2 styles.
Enter the default heading3 style name. Press
? to view the list of existing heading3 styles.
Enter the default html style name. Press
? to view the list of existing html styles.
Enter the default table of contents style name. Press
? to view the list of existing table of contents styles.
Enter the default table of contents heading1 style name.
Press
? to view the list of existing table of contents heading1 styles.
Enter the default table of contents heading2 style name.
Press
? to view the list of existing table of contents heading2 styles.
Enter the default table of contents heading3 style name.
Press
? to view the list of existing table of contents heading3 styles.
Enter the default table of contents heading4 style name.
Press
? to view the list of existing table of contents heading4 styles.
Enter the default normal text style name. Press
? to view the list of existing normal text styles.
Enter the default bullet text style name. Press
? to view the list of existing bullet text styles.
Enter the default numbered text style name. Press
? to view the list of existing numbered text styles.
Enter the default image style name. Press
? to view the list of existing image styles.
Enter the default horizontal line style name. Press
? to view the list of existing horizontal line styles.
Fortinet Technologies Inc.
Page 339 FortiOS™ - CLI Reference for FortiOS 5.0
report
Variable
graph-chart-style
<style_name> table-chart-style
<style_name> table-chart-captionstyle <style_name> table-chart-head-style
<style_name> table-chart-odd-rowstyle <style_name> table-chart-even-rowstyle <style_name>
Description
Enter the default graph chart style name. Press
? to view the list of existing graph chart styles.
Enter the default table chart style name. Press list of existing table chart styles.
? to view the
Enter the default table chart caption style name. Press view the list of existing table chart caption styles.
Enter the default table chart header style name. Press view the list of existing table chart header styles.
view the list of existing table chart odd row styles.
? to
? to
Enter the default table chart odd row style name. Press
? to
Enter the default table chart even row style name. Press
? to view the list of existing table chart even row styles.
Default
theme
Fortinet Technologies Inc.
Page 340 FortiOS™ - CLI Reference for FortiOS 5.0
router
Routers move packets from one network segment to another towards a network destination.
When a packet reaches a router, the router uses data in the packet header to look up a suitable route on which to forward the packet to the next segment. The information that a router uses to make routing decisions is stored in a routing table. Other factors related to the availability of routes and the status of the network may influence the route selection that a router makes when forwarding a packet to the next segment.
The FortiGate unit supports many advanced routing functions and is compatible with industry standard Internet routers. The FortiGate unit can communicate with other routers to determine the best route for a packet.
The following router commands are available to configure options related to FortiGate unit router communications and packet forwarding:
Page 341
router access-list, access-list6
access-list, access-list6
Use this command to add, edit, or delete access lists. Access lists are filters used by FortiGate unit routing processes. For an access list to take effect, it must be called by a FortiGate unit routing process (for example, a process that supports RIP or OSPF). Use access-list6 for
IPv6 routing.
Each rule in an access list consists of a prefix (IP address and netmask), the action to take for this prefix (permit or deny), and whether to match the prefix exactly or to match the prefix and any more specific prefix.
If you are setting a prefix of 128.0.0.0, use the format 128.0.0.0/1. The default route, 0.0.0.0/0 can not be exactly matched with an access-list. A prefix-list must be used for this purpose. For
more information, see “router prefix-list, prefix-list6” on page 421 .
The FortiGate unit attempts to match a packet against the rules in an access list starting at the top of the list. If it finds a match for the prefix, it takes the action specified for that prefix. If no match is found the default action is deny.
Syntax
config router access-list, access-list6
edit <access_list_name> set comments <string>
config rule
set
set
exact-match {enable | disable}
set
prefix { <prefix_ipv4mask> | any }
end end set
prefix6 { <prefix_ipv6mask> | any } set wildcard <address_ipv4> <wildcard_mask>
The action
and prefix
fields are required. The exact-match
field is optional.
Variable
edit
<access_list_name> comments <string>
Description
Enter a name for the access list. An access list and a prefix list cannot have the same name.
Enter a descriptive comment. The max length is 127 characters.
config rule variables
edit <access_list_id>
Enter an entry number for the rule. The number must be an integer.
action {deny | permit}
Set the action to take for this prefix.
Default
No default.
No default.
No default.
permit
Fortinet Technologies Inc.
Page 342 FortiOS™ - CLI Reference for FortiOS 5.0
router access-list, access-list6
Variable
exact-match
{enable | disable} prefix {
<prefix_ipv4mask>
| any } prefix6 {
<prefix_ipv6mask>
| any } wildcard
<address_ipv4>
<wildcard_mask>
Description
By default, access list rules are matched on the prefix or any more specific prefix. Enable exact-match to match only the configured prefix.
Enter the prefix for this access list rule. Enter either:
Default
disable any
• IPv4 address and network mask
• any — match any prefix.
Enter the prefix for this IPv6 access list rule. Enter either: any
• IPv6 address and network mask
• any — match any prefix.
This variable is only used with config access-list6.
Enter the IP address and reverse (wildcard) mask to process. The value of the mask (for example,
0.0.255.0) determines which address bits to match. A value of 0 means that an exact match is required, while a binary value of 1 indicates that part of the binary network address does not have to match. You can specify discontinuous masks (for example, to process “even” or
“odd” networks according to any network address octet).
No default.
For best results, do not specify a wildcard attribute unless prefix is set to any.
This variable is only used with config access-list.
Fortinet Technologies Inc.
Page 343 FortiOS™ - CLI Reference for FortiOS 5.0
router
aspath-list
aspath-list
Use this command to set or unset BGP AS-path list parameters. By default, BGP uses an ordered list of Autonomous System (AS) numbers to describe the route that a packet takes to reach its destination. A list of these AS numbers is called the AS path. You can filter BGP routes using AS path lists.
When the FortiGate unit receives routing updates from other autonomous systems, it can perform operations on updates from neighbors and choose the shortest path to a destination.
The shortest path is determined by counting the AS numbers in the AS path. The path that has the least AS numbers is considered the shortest AS path.
Use the config router aspath-list command to define an access list that examines the
AS_PATH attributes of BGP routes to match routes. Each entry in the AS-path list defines a rule for matching and selecting routes based on the setting of the AS_PATH attribute. The default rule in an AS path list (which the FortiGate unit applies last) denies the matching of all routes.
Syntax
config router aspath-list
config rule
end set
set
end
The action and regexp fields are required.
Variable
edit
<aspath_list_name>
Description
Enter a name for the AS path list.
Default
No default.
config rule variables
edit <as_rule_id>
Enter an entry number for the rule. The number must be an integer.
action {deny | permit} regexp
<regexp_str>
Deny or permit operations on a route based on the value of the route’s AS_PATH attribute.
Specify the regular expression that will be compared to the
AS_PATH attribute (for example,
^730$).
No default.
No default.
Null
The value is used to match AS numbers. Delimit a complex regexp_str value using double-quotation marks.
Fortinet Technologies Inc.
Page 344 FortiOS™ - CLI Reference for FortiOS 5.0
router
auth-path
auth-path
Authentication based routing allows firewall policies to direct network traffic flows.
This command configures a RADIUS object on your FortiGate unit. The same object is required to be configured on the RADIUS server.
To configure authentication based routing on your FortiGate unit
1. Configure your FortiGate unit to communicate with a RADIUS authentication server.
2. Configure a user that uses the RADIUS server.
3. Add that user to a user group configured to use the RADIUS server.
4. Configure the router auth-path object.
5. Configure a custom service for RADIUS traffic.
6. Configure a service group that includes RADIUS traffic along with other types of traffic that will be allowed to pass through the firewall.
7. Configure a firewall policy that has route based authentication enabled.
The Fortinet Knowledge Base has an article on authentication based routing that provides a sample configuration for these steps.
The auth-path command is not available when the FortiGate unit is in Transparent mode.
Syntax
config router auth-path
end
set device <interface> set gateway <gway_ipv4>
Variable Description
edit <auth_path_name> Enter a name for the authentication path. device <interface>
Specify the interface for this path.
gateway <gway_ipv4>
Specify the gateway IP address for this path.
Default
No default.
No default.
Null.
Fortinet Technologies Inc.
Page 345 FortiOS™ - CLI Reference for FortiOS 5.0
router
bfd
Use this command to enable Bidirectional Forwarding Detection (BFD) when there is no dynamic routing active.
Syntax
config router bfd config neighbor edit <neighbor_IPv4_addr> set interface <if_name> end next end
Variable Description
<neighbor_IPv4_addr> Enter the neighbor’s IP address.
interface <if_name>
Enter the name of the interface to monitor.
Default
0.0.0.0
None.
bfd
Fortinet Technologies Inc.
Page 346 FortiOS™ - CLI Reference for FortiOS 5.0
router bgp
bgp
Use this command to set or unset BGP-4 routing parameters. BGP can be used to perform
Classless Interdomain Routing (CIDR) and to route traffic between different autonomous systems or domains using an alternative route if a link between a FortiGate unit and a BGP peer
(such as an ISP router) fails. FortiOS BGP4 complies with RFC 1771 and supports IPv4 addressing.
FortiOS supports IPv6 over BGP4 via the BGP4+ protocol defined in RFC 2545, and RFC 2858.
IPv6 configuration for BGP is accomplished with the aggregate-address6, network6, and redistribute6 variables. Also almost every variable in config neighbour has an IPv4 and
IPv6 version such as activate and activate6. Any variable ending with a “6” is an IPv6 variable.
When BGP is enabled, the FortiGate unit sends routing table updates to the upstream ISP router whenever any part of the routing table changes. The update advertises which routes can be used to reach the FortiGate unit. In this way, routes are made known from the border of the internal network outwards (routes are pushed forward) instead of relying on upstream routers to propagate alternative paths to the FortiGate unit.
FortiGate unit BGP supports the following extensions to help manage large numbers of BGP peers:
• Communities — The FortiGate unit can set the COMMUNITY attribute of a route to assign the route to predefined paths (see RFC 1997). The FortiGate unit can examine the
COMMUNITY attribute of learned routes to perform local filtering and/or redistribution.
• Internal BGP (IBGP) route reflectors — The FortiGate unit can operate as a route reflector or participate as a client in a cluster of IBGP peers (see RFC 1966).
• External BGP (EBGP) confederations — The FortiGate unit can operate as a confederation member, using its AS confederation identifier in all transactions with peers that are not members of its confederation (see RFC 3065).
Bi-directional Forwarding Detection (BFD) is a protocol used by BGP, and OSPF. It is used to quickly locate hardware failures in the network. Routers running BFD send unicast messages to each other, and if a timer runs out, meaning no messages have been received, on a connection then that unresponsive router is declared down. BFD then communicates this information to the routing protocol and the routing information is updated. BFD support can only be configured through the CLI.
Syntax
set
always-compare-med {enable | disable}
set
set
bestpath-as-path-ignore {enable | disable}
set
bestpath-cmp-confed-aspath {enable | disable}
set
bestpath-cmp-routerid {enable | disable}
set
bestpath-med-confed {enable | disable}
set
bestpath-med-missing-as-worst {enable | disable}
set
client-to-client-reflection {enable | disable}
set
set
confederation-identifier <peerid_integer>
set
set
dampening-max-suppress-time <minutes_integer>
set
dampening-reachability-half-life <minutes_integer>
set
dampening-reuse <reuse_integer>
Fortinet Technologies Inc.
Page 347 FortiOS™ - CLI Reference for FortiOS 5.0
router
set
dampening-route-map <routemap-name_str>
set
dampening-suppress <limit_integer>
set
dampening-unreachability-half-life <minutes_integer>
set
default-local-preference <preference_integer>
set
deterministic-med {enable | disable}
set
distance-external <distance_integer>
set
distance-internal <distance_integer>
set
distance-local <distance_integer>
set
ebgp-multipath {enable | disable}
set
enforce-first-as {disable | enable}
set
fast-external-failover {disable | enable}
set
graceful-restart {disable | enable}
set
graceful-restart-time <restart_time>
set
graceful-stalepath-time <stalepath_time>
set
graceful-update-delay <delay_time>
set
holdtime-timer <seconds_integer>
set
ibgp-multipath {enable | disable}
set
ignore_optional_capability {disable | enable}
set
keepalive-timer <seconds_integer>
set
log-neighbor-changes {disable | enable}
set
network-import-check {disable | enable}
set
set
set
synchronization {enable | disable} config admin-distance edit <route_entry_id>
set
set
neighbor-prefix <ip_and_netmask>
set
end
config aggregate-address, config aggregate-address6 edit <aggr_addr_id>
set
set
set
summary-only {enable | disable}
end
config aggregate-address, config aggregate-address6 edit <aggr_addr_id>
set
set
set
summary-only {enable | disable}
end
bgp
Fortinet Technologies Inc.
Page 348 FortiOS™ - CLI Reference for FortiOS 5.0
router bgp
Fortinet Technologies Inc.
config neighbor edit <neighbor_address_ipv4>
set
set
set
advertisement-interval <seconds_integer>
set
allowas-in <max_num_AS_integer>
set
allowas-in6 <max_num_AS_integer>
set
allowas-in-enable {enable | disable}
set
allowas-in-enable6 {enable | disable}
set
as-override {enable | disable}
set
as-override6 {enable | disable}
set
attribute-unchanged [as-path] [med] [next-hop]
set
attribute-unchanged6 [as-path] [med] [next-hop]
set
set
capability-default-originate {enable | disable}
set
capability-default-originate6 {enable | disable}
set
capability-dynamic {enable | disable}
set
capability-graceful-restart {enable | disable}
set
capability-graceful-restart6 {enable | disable}
set
capability-orf {both | none | receive | send}
set
capability-orf6 {both | none | receive | send}
set
capability-route-refresh {enable | disable}
set
connect-timer <seconds_integer>
set
default-originate-routemap <routemap_str>
set
default-originate-routemap6 <routemap_str>
set
set
distribute-list-in <access-list-name_str>
set
distribute-list-in6 <access-list-name_str>
set
distribute-list-out <access-list-name_str>
set
distribute-list-out6 <access-list-name_str>
set
dont-capability-negotiate {enable | disable}
set
ebgp-enforce-multihop {enable | disable}
set
ebgp-multihop-ttl <seconds_integer>
set
filter-list-in <aspath-list-name_str>
set
filter-list-in6 <aspath-list-name_str>
set
filter-list-out <aspath-list-name_str>
set
filter-list-out6 <aspath-list-name_str>
set
holdtime-timer <seconds_integer>
set
interface <interface-name_str>
set
keep-alive-timer <seconds_integer>
set
maximum-prefix <prefix_integer>
set
maximum-prefix6 <prefix_integer>
set
maximum-prefix-threshold <percentage_integer>
set
maximum-prefix-threshold6 <percentage_integer>
set
maximum-prefix-warning-only {enable | disable}
set
maximum-prefix-warning-only6 {enable | disable}
set
next-hop-self {enable | disable}
set
next-hop-self6 {enable | disable}
set
override-capability {enable | disable}
Page 349 FortiOS™ - CLI Reference for FortiOS 5.0
router bgp
Fortinet Technologies Inc.
set
set
set
prefix-list-in <prefix-list-name_str>
set
prefix-list-in6 <prefix-list-name_str>
set
prefix-list-out <prefix-list-name_str>
set
prefix-list-out6 <prefix-list-name_str>
set
set
remove-private-as {enable | disable}
set
remove-private-as6 {enable | disable}
set
retain-stale-time <seconds_integer>
set
route-map-in <routemap-name_str>
set
route-map-in6 <routemap-name_str>
set
route-map-out <routemap-name_str>
set
route-map-out6 <routemap-name_str>
set
route-reflector-client {enable | disable}
set
route-reflector-client6 {enable | disable}
set
route-server-client {enable | disable}
set
route-server-client6 {enable | disable}
set
send-community {both | disable | extended | standard}
set
send-community6 {both | disable | extended | standard}
set
set
soft-reconfiguration {enable | disable}
set
strict-capability-match {enable | disable}
set
unsuppress-map <route-map-name_str>
set
update-source <interface-name_str>
set
end
config network, config network6 edit <network_id>
set
set
set
end
config network, config network6 edit <network_id>
set
set
set
end
config redistribute, config redistribute6
{connected | static | rip | ospf}
set status {enable | disable} set route-map <route-map-name_str>
end
config redistribute, config redistribute6
{connected | static | rip | ospf} end
set status {enable | disable} set route-map <route-map-name_str>
Page 350 FortiOS™ - CLI Reference for FortiOS 5.0
router bgp
config router bgp
Use this command to enable a Border Gateway Protocol version 4 (BGP-4) process on the
FortiGate unit, define the interfaces making up the local BGP network (see the subcommand
“config network, config network6” on page 365
), and set operating parameters for
communicating with BGP neighbors (see the subcommand “config neighbor” on page 356
).
When multiple routes to the FortiGate unit exist, BGP attributes determine the best route and the FortiGate unit communicates this information to its BGP peers. The best route is added to the IP routing table of the BGP peer, which in turn propagates this updated routing information to upstream routers.
. To reduce the size of the BGP routing table and conserve network resources, you can optionally aggregate routes to the FortiGate unit. An aggregate route enables the FortiGate unit to advertise one block of contiguous IP addresses as a single, less-specific address. You can implement aggregate routing either by redistributing an
aggregate route (see the subcommand “config redistribute, config redistribute6” on page 366 )
or by using the conditional aggregate routing feature (see the subcommand
“config aggregateaddress, config aggregate-address6” on page 355 ).
In the following table, the as and router-id fields are required. All other fields are optional.
Variable
always-compare-med
{enable | disable}
Description
Enable or disable the comparison of MULTI_EXIT_DISC
(Multi Exit Discriminator or MED) attributes for identical destinations advertised by BGP peers in different autonomous systems. as <local_as_id> bestpath-as-path-ignore
{enable | disable}
Enable or disable the inclusion of an AS path in the selection algorithm for choosing a BGP route.
bestpath-cmp-confed-aspath
{enable | disable}
Enable or disable the comparison of the
AS_CONFED_SEQUENCE attribute, which defines an ordered list of AS numbers representing a path from the
FortiGate unit through autonomous systems within the local confederation.
bestpath-cmp-routerid
{enable | disable} bestpath-med-confed
{enable | disable}
Enter an integer to specify the local autonomous system
(AS) number of the FortiGate unit. The range is from 1 to
4 294 967 295. A value of
0 disables BGP. When the local_as_id number is different than the AS number of the specified BGP neighbor (see
), an External BGP (EBGP) session is started. Otherwise, an Internal BGP (IBGP) session is started.
Enable or disable the comparison of the router-ID values for identical EBGP paths.
Enable or disable the comparison of MED attributes for routes advertised by confederation EBGP peers.
Default
disable
0 disable disable disable disable
Fortinet Technologies Inc.
Page 351 FortiOS™ - CLI Reference for FortiOS 5.0
router
Variable
bestpath-med-missing-asworst {enable | disable}
Description
This field is available when bestpath-med-confed is set to enable.
Default
disable confederation-identifier
<peerid_integer> dampening {enable | disable}
When bestpath-med-confed is enabled, treat any confederation path with a missing MED metric as the least preferred path.
client-to-client-reflection
{enable | disable}
Enable or disable client-to-client route reflection between
IBGP peers. If the clients are fully meshed, route reflection may be disabled.
cluster-id <address_ipv4>
Set the identifier of the route-reflector in the cluster ID to which the FortiGate unit belongs. If
0 is specified, the
FortiGate unit operates as the route reflector and its router-id value is used as the cluster-id value. If the FortiGate unit identifies its own cluster ID in the
CLUSTER_LIST attribute of a received route, the route is ignored to prevent looping.
Set the identifier of the confederation to which the
FortiGate unit belongs. The range is from 1 to 65 535. dampening-max-suppresstime <minutes_integer>
Enable or disable route-flap dampening on all BGP routes. See RFC 2439. (A flapping route is unstable and continually transitions down and up.) If you set dampening, you may optionally set dampening-routemap or define the associated values individually using the dampening-* fields.
This field is available when dampening is set to enable.
dampening-reachabilityhalf-life <minutes_integer>
Set the maximum time (in minutes) that a route can be suppressed. The range is from 1 to 255. A route may continue to accumulate penalties while it is suppressed.
However, the route cannot be suppressed longer than minutes_integer.
This field is available when dampening is set to enable.
Set the time (in minutes) after which any penalty assigned to a reachable (but flapping) route is decreased by half.
The range is from 1 to 45.
dampening-reuse
<reuse_integer>
This field is available when dampening is set to enable.
Set a dampening-reuse limit based on accumulated penalties. The range is from 1 to 20 000. If the penalty assigned to a flapping route decreases enough to fall below the specified reuse_integer, the route is not suppressed.
dampening-route-map
<routemap-name_str>
This field is available when dampening is set to enable.
Specify the route-map that contains criteria for dampening. You must create the route-map before it can
be selected here. See “route-map” on page 438 and
“Using route maps with BGP” on page 440 .
dampening-suppress
<limit_integer>
This field is available when dampening is set to enable.
Set a dampening-suppression limit. The range is from 1 to
20 000. A route is suppressed (not advertised) when its penalty exceeds the specified limit.
enable
0.0.0.0
0 disable
60
15
750
Null.
2 000
bgp
Fortinet Technologies Inc.
Page 352 FortiOS™ - CLI Reference for FortiOS 5.0
router
Variable
dampening-unreachabilityhalf-life <minutes_integer> default-local-preference
<preference_integer> deterministic-med
{enable | disable} distance-external
<distance_integer> distance-internal
<distance_integer> distance-local
<distance_integer> ebgp-multipath
{enable | disable} enforce-first-as
{disable | enable} fast-external-failover
{disable | enable} graceful-restart
{disable | enable} graceful-restart-time
<restart_time> graceful-stalepath-time
<stalepath_time> graceful-update-delay
<delay_time> holdtime-timer
<seconds_integer>
Description
This field is available when dampening is set to enable.
Default
15
Set the time (in minutes) after which the penalty on a route that is considered unreachable is decreased by half. The range is from 1 to 45.
Set the default local preference value. A higher value signifies a preferred route. The range is from 0 to
4 294 967 295.
100
Enable or disable deterministic comparison of the MED attributes of routes advertised by peers in the same AS. disable
Set the administrative distance of EBGP routes. The range is from 1 to 255. If you set this value, you must also set values for distance-internal and distancelocal.
This field is available when distance-external is set.
20
200
Set the administrative distance of IBGP routes. The range is from 1 to 255.
This field is available when distance-external is set.
200
Set the administrative distance of local BGP routes. The range is from 1 to 255.
Enable or disable ECMP load balancing across multiple
(four) eBGP connections.
disable
Enable or disable the addition of routes learned from an
EBGP peer when the AS number at the beginning of the route’s AS_PATH attribute does not match the AS number of the EBGP peer.
disable enable
Immediately reset the session information associated with
BGP external peers if the link used to reach them goes down.
disable
Enable or disable BGP support for the graceful restart feature. Graceful restart limits the effects of software problems by allowing forwarding to continue when the control plane of the router fails. It also reduces routing flaps by stabilizing the network.
120
Set the time in seconds needed for neighbors to restart after a graceful restart. The range is 1 to 3600 seconds.
Available when graceful-restart is enabled.
Set the time in seconds to hold stale paths of restarting neighbors. The range is 1 to 3600 seconds. Available when graceful-restart is enabled.
Route advertisement and selection delay in seconds after a graceful restart. The range is 1 to 3600 seconds.
Available when graceful-restart is enabled.
The maximum amount of time in seconds that may expire before the FortiGate unit declares any BGP peer down. A keepalive message must be received every seconds_integer seconds, or the peer is declared down. The value can be 0 or an integer in the 3 to 65 535 range.
360
120
180
bgp
Fortinet Technologies Inc.
Page 353 FortiOS™ - CLI Reference for FortiOS 5.0
router bgp
Variable
ibgp-multipath
{enable | disable} ignore_optional_capability
{disable | enable} keepalive-timer
<seconds_integer>
Description
Enable or disable ECMP load balancing across multiple
(four) iBGP connections.
Default
disable
Don’t send unknown optional capability notification message.
disable
The frequency (in seconds) that a keepalive message is sent from the FortiGate unit to any BGP peer. The range is from 0 to 65 535. BGP peers exchange keepalive messages to maintain the connection for the duration of the session.
60
Enable or disable the logging of changes to BGP neighbor status.
disable log-neighborchanges
{disable | enable} network-importcheck
{disable | enable} router-id
<address_ipv4> scan-time
<seconds_integer> synchronization
{enable | disable}
Enable or disable the advertising of the BGP network in
IGP (see the subcommand
“config network, config network6” on page 365
).
Specify a fixed identifier for the FortiGate unit. A value of
0.0.0.0 is not allowed.
enable
0.0.0.0
If router-id is not explicitly set, the highest IP address of the VDOM will be used as the default router-id.
Configure the background scanner interval (in seconds) for next-hop route scanning. The range is from 5 to 60.
60
Only advertise routes from iBGP if routes are present in an interior gateway protocol (IGP) such as RIP or OSPF.
disable
Example
The following example defines the number of the AS of which the FortiGate unit is a member. It also defines an EBGP neighbor at IP address
10.0.1.2.
config router bgp set as 65001 set router-id 172.16.120.20
config neighbor edit 10.0.1.2
set remote-as 65100 end end
config admin-distance
Use this subcommand to set administrative distance modifications for bgp routes.
Variable
edit
<route_entry_id>
Description
Enter an ID number for the entry. The number must be an integer.
distance <integer>
The administrative distance to apply to the route. This value can be from 1 to 255.
Default
No default.
No default.
Fortinet Technologies Inc.
Page 354 FortiOS™ - CLI Reference for FortiOS 5.0
router bgp
Variable Description
neighbor-prefix
<ip_and_netmask>
Neighbor address prefix. This variable must be a valid IP address and netmask.
route-list <string>
The list of routes this distance will be applied to.
The routes in this list can only come from the access-list which can be viewed at config router access-list.
Default
No default.
No default.
Example
This example shows how to manually adjust the distance associated with a route. It shows adding 25 to the weight of the route, that it will apply to neighbor routes with an IP address of
192.168.0.0 and a netmask of 255.255.0.0, that are also permitted by the access-list
“downtown_office”.
config router bgp config admin-distance edit 1 set distance 25 end set neighbour-prefix 192.168.0.0 255.255.0.0
set route-list downtown_office end next
config aggregate-address, config aggregate-address6
Use this subcommand to set or unset BGP aggregate-address table parameters. The subcommand creates a BGP aggregate entry in the FortiGate unit routing table. Use config aggregate-address6 for IPv6 routing.
When you aggregate routes, routing becomes less precise because path details are not readily available for routing purposes. The aggregate address represents addresses in several autonomous systems. Aggregation reduces the length of the network mask until it masks only the bits that are common to all of the addresses being summarized.
The prefix field is required. All other fields are optional.
Variable
edit <aggr_addr_id> as-set {enable | disable} prefix
<address_ipv4mas k>
Description Default
Enter an ID number for the entry. The number must be an integer.
Enable or disable the generation of an unordered list of AS numbers to include in the path information. When as-set is enabled, a set-atomic-aggregate value (see
“Using route maps with BGP” on page 440
) does not have to be specified.
No default.
disable
Set an aggregate prefix. Include the IP address and netmask.
0.0.0.0
0.0.0.0
Fortinet Technologies Inc.
Page 355 FortiOS™ - CLI Reference for FortiOS 5.0
router
Variable
prefix6
<address_ipv6mas k> summary-only
{enable | disable}
Description
Set an aggregate IPv6 prefix. Include the IP address and netmask.
Enable or disable the advertising of aggregate routes only
(the advertising of specific routes is suppressed).
Default
::/0 disable
bgp
Example
This example shows how to define an aggregate prefix of
192.168.0.0/16. The as-set command enables the generation of an unordered list of AS numbers to include in the path information.
config router bgp config aggregate-address edit 1 set prefix 192.168.0.0/16 end set as-set enable end
config neighbor
Use this subcommand to set or unset BGP neighbor configuration settings. The subcommand adds a BGP neighbor configuration to the FortiGate unit.
You can add up to 1000 BGP neighbors, and optionally use MD5 authentication to password protect BGP sessions with those neighbors. (see RFC 2385)
You can clear all or some BGP neighbor connections (sessions) using the execute router clear bgp command (see
“execute router clear bgp” on page 978 ).
The remote-as field is required. All other fields are optional.
Variable
edit
<neighbor_address_ipv4> activate {enable | disable} activate6
{enable | disable} advertisement-interval
<seconds_integer>
Description
Enter the IP address of the BGP neighbor.
You can have up to 1000 configured neighbors.
Enable or disable the address family for the BGP neighbor.
Enable or disable the address family for the BGP neighbor (IPv6).
Set the minimum amount of time (in seconds) that the FortiGate unit waits before sending a BGP routing update to the BGP neighbor. The range is from 0 to 600.
Default
No default.
enable enable
30
Fortinet Technologies Inc.
Page 356 FortiOS™ - CLI Reference for FortiOS 5.0
router
Variable
allowas-in
<max_num_AS_integer>
Description
This field is available when allowas-in-enable is set to enable.
Default
unset
Set the maximum number of occurrences your AS number is allowed in.
When allowas-in-enable is disabled, your AS number is only allowed to appear once in an
AS_PATH.
allowas-in6
<max_num_AS_integer>
.
This field is available when
allowas-in-enable6 is set to enable.
When allowas-in-enable6 is disabled, your AS number is only allowed to appear once in an
AS_PATH.
unset allowas-in-enable
{enable | disable} allowas-in-enable6
{enable | disable}
Set the maximum number of occurrences your AS number is allowed in.
Enable or disable the readvertising of all prefixes containing duplicate AS numbers. Set the amount of time that must expire before readvertising through the allowas-in field.
disable
Enable or disable the readvertising of all prefixes containing duplicate AS numbers. Set the amount of time that must expire before readvertising through the allowas-in6 field.
disable
Enable or disable BGP AS override (for IPv4 traffic). disable as-override
{enable | disable} as-override6
{enable | disable} attribute-unchanged [as-path]
[med] [next-hop]
Enable or disable BGP AS override (for IPv6 traffic).
disable
Propagate unchanged BGP attributes to the BGP neighbor.
Empty set.
• To advertise unchanged AS_PATH attributes, select as-path.
• To advertise unchanged MULTI_EXIT_DISC attributes, select med.
• To advertise the IP address of the next-hop router interface (even when the address has not changed), select next-hop.
• An empty set is a supported value.
bgp
Fortinet Technologies Inc.
Page 357 FortiOS™ - CLI Reference for FortiOS 5.0
router
Variable
attribute-unchanged6 [aspath] [med] [next-hop]
Description
Propagate unchanged BGP attributes to the BGP neighbor.
• To advertise unchanged AS_PATH attributes, select as-path.
• To advertise unchanged MULTI_EXIT_DISC attributes, select med.
• To advertise the IP address of the next-hop router interface (even when the address has not changed), select next-hop.
• An empty set is a supported value.
Default
Empty set.
bgp
bfd {enable | disable} capability-default-originate
{enable | disable} capability-default-originate6
{enable | disable} capability-dynamic
{enable | disable} capability-graceful-restart
{enable | disable} capability-graceful-restart6
{enable | disable} capability-orf {both | none | receive | send} capability-orf6 {both | none | receive | send} capability-route-refresh
{enable | disable}
Enable to turn on Bi-Directional Forwarding
Detection (BFD) for this neighbor. This indicates that this neighbor is using BFD.
Enable or disable the advertising of the default route to IPv6 BGP neighbors.
disable
Enable or disable the advertising of the default route to BGP neighbors.
disable disable
Enable or disable the advertising of dynamic capability to BGP neighbors.
disable
Enable or disable the advertising of graceful-restart capability to BGP neighbors. disable
Enable or disable the advertising of graceful-restart capability to IPv6 BGP neighbors. disable disable
Enable advertising of Outbound Routing Filter (ORF) prefix-list capability to the BGP neighbor. Choose one of:
both — enable send and receive capability.
receive — enable receive capability.
send — enable send capability.
none — disable the advertising of ORF prefix-list capability.
•
Enable advertising of IPv6 ORF prefix-list capability to the BGP neighbor. Choose one of:
both — enable send and receive capability.
receive — enable receive capability.
send — enable send capability.
none — disable the advertising of IPv6 ORF prefixlist capability.
Enable or disable the advertising of route-refresh capability to the BGP neighbor. disable enable
Fortinet Technologies Inc.
Page 358 FortiOS™ - CLI Reference for FortiOS 5.0
router
Variable
connect-timer
<seconds_integer> default-originate-routemap
<routemap_str> default-originate-routemap6
<routemap_str> description <text_str> distribute-list-in
<access-list-name_str> distribute-list-in6
<access-list-name_str> distribute-list-out
<access-list-name_str> distribute-list-out6
<access-list-name_str> dont-capability-negotiate
{enable | disable} ebgp-enforce-multihop
{enable | disable} ebgp-multihop-ttl
<seconds_integer>
Description
Set the maximum amount of time (in seconds) that the FortiGate unit waits to make a connection with a
BGP neighbor before the neighbor is declared unreachable. The range is from 0 to 65 535.
Default
-1 (not set)
Advertise a default route out from the FortiGate unit to this neighbor using a route_map named
<routemap_str>. The route_map name can be up to 35 characters long and is defined using the config router route_map command.
Null.
For more information, see
“router route-map” on page 438 .
Advertise a default route out from the FortiGate unit to this neighbor using a route_map named
<routemap_str>. The route_map name can be up to
35 characters long and is defined using the config router route_map command.
Null.
Enter a one-word (no spaces) description to associate with the BGP neighbor configuration settings.
Null.
Limit route updates from the BGP neighbor based on the Network Layer Reachability Information (NLRI) defined in the specified access list. You must create the access list before it can be selected here. See
“router access-list, access-list6” on page 342 .
Null.
Limit route updates from the IPv6 BGP neighbor based on the Network Layer Reachability
Information (NLRI) defined in the specified access list. You must create the access list before it can be selected here. See
“router access-list, access-list6” on page 342 .
Null
Limit route updates to the BGP neighbor based on the NLRI defined in the specified access list. You must create the access list before it can be selected
here. See “router access-list, access-list6” on page 342 .
Null.
Limit route updates to the IPv6 BGP neighbor based on the NLRI defined in the specified access list. You must create the access list before it can be selected
here. See “router access-list, access-list6” on page 342 .
Null
Enable or disable capability negotiations with the
BGP neighbor.
disable disable
Enable or disable the enforcement of Exterior BGP
(EBGP) multihops.
This field is available when ebgp-enforcemultihop is set to enable.
255
Define a TTL value (in hop counts) for BGP packets sent to the BGP neighbor. The range is from 1 to 255.
bgp
Fortinet Technologies Inc.
Page 359 FortiOS™ - CLI Reference for FortiOS 5.0
router
Variable
filter-list-in
<aspath-list-name_str> filter-list-in6
<aspath-list-name_str> filter-list-out
<aspath-list-name_str> filter-list-out6
<aspath-list-name_str> holdtime-timer
<seconds_integer> interface <interfacename_str> keep-alive-timer
<seconds_integer> maximum-prefix
<prefix_integer>
Description Default
Limit inbound BGP routes according to the specified
AS-path list. You must create the AS-path list before
it can be selected here. See “router aspath-list” on page 344 .
Null.
Null Limit inbound IPv6 BGP routes according to the specified AS-path list. You must create the AS-path list before it can be selected here. See
“router aspath-list” on page 344 .
Limit outbound BGP routes according to the specified AS-path list. You must create the AS-path list before it can be selected here. See
“router aspath-list” on page 344 .
Null.
Limit outbound IPv6 BGP routes according to the specified AS-path list. You must create the AS-path list before it can be selected here. See
“router aspath-list” on page 344 .
Null
The amount of time (in seconds) that must expire before the FortiGate unit declares the BGP neighbor down. This value overrides the global holdtime-
“config router bgp” on page 351 ). A keepalive message must be
received every seconds_integer from the BGP neighbor or it is declared down. The value can be 0 or an integer in the 3 to 65 535 range.
-1 (not set)
This field is available when graceful-restart is set to enabled.
Specify a descriptive name for the BGP neighbor interface.
Null.
The frequency (in seconds) that a keepalive message is sent from the FortiGate unit to the BGP neighbor.
This value overrides the global keep-alive-timer value (see subcommand
“config router bgp” on page 351 ). The range is from 0 to 65 535.
-1 (not set) unset
Set the maximum number of NLRI prefixes to accept from the BGP neighbor. When the maximum is reached, the FortiGate unit disconnects the BGP neighbor. The range is from 1 to 4 294 967 295.
Changing this value on the FortiGate unit does not disconnect the BGP neighbor. However, if the neighbor goes down because it reaches the maximum number of prefixes and you increase the maximum-prefix value afterward, the neighbor will be reset.
bgp
Fortinet Technologies Inc.
Page 360 FortiOS™ - CLI Reference for FortiOS 5.0
router
Variable
maximum-prefix6
<prefix_integer> maximum-prefix-threshold
<percentage_integer> maximum-prefix-threshold6
<percentage_integer> maximum-prefix-warningonly
{enable | disable} maximum-prefix-warningonly6 {enable | disable} next-hop-self
{enable | disable} next-hop-self6
{enable | disable} override-capability
{enable | disable} passive {enable | disable} password <string>
Description
Set the maximum number of NLRI prefixes to accept from the IPv6 BGP neighbor. When the maximum is reached, the FortiGate unit disconnects the BGP neighbor. The range is from 1 to 4 294 967 295.
Default
unset
Changing this value on the FortiGate unit does not disconnect the BGP neighbor. However, if the neighbor goes down because it reaches the maximum number of prefixes and you increase the maximum-prefix value afterward, the neighbor will be reset.
This field is available when maximum-prefix is set.
75
Specify the threshold (as a percentage) that must be exceeded before a warning message about the maximum number of NLRI prefixes is displayed. The range is from 1 to 100.
This field is available when maximum-prefix6 is set.
75
Specify the threshold (as a percentage) that must be exceeded before a warning message about the maximum number of NLRI prefixes is displayed. The range is from 1 to 100.
This field is available when maximum-prefix is set.
disable
Enable or disable the display of a warning when the maximum-prefix-threshold has been reached.
This field is available when maximum-prefix6 is set.
disable
Enable or disable the display of a warning when the maximum-prefix-threshold6 has been reached.
Enable or disable advertising of the FortiGate unit’s
IP address (instead of the neighbor’s IP address) in the NEXT_HOP information that is sent to IBGP peers.
disable disable
Enable or disable advertising of the FortiGate unit’s
IP address (instead of the neighbor’s IP address) in the NEXT_HOP information that is sent to IBGP peers.
disable
Enable or disable IPv6 addressing for a BGP neighbor that does not support capability negotiation.
Enable or disable the sending of Open messages to
BGP neighbors.
disable
Enter password used in MD5 authentication to protect BGP sessions. (RFC 2385)
Null.
bgp
Fortinet Technologies Inc.
Page 361 FortiOS™ - CLI Reference for FortiOS 5.0
router
Variable
prefix-list-in
<prefix-list-name_str> prefix-list-in6
<prefix-list-name_str> prefix-list-out
<prefix-list-name_str> prefix-list-out6
<prefix-list-name_str> remote-as <id_integer> remove-private-as
{enable | disable} remove-private-as6
{enable | disable} restart_time
<seconds_integer> retain-stale-time
<seconds_integer> route-map-in
<routemap-name_str>
Fortinet Technologies Inc.
bgp
Description Default
Limit route updates from a BGP neighbor based on the Network Layer Reachability Information (NLRI) in the specified prefix list. The prefix list defines the
NLRI prefix and length advertised in a route. You must create the prefix list before it can be selected
here. See “router prefix-list, prefix-list6” on page 421 .
Null.
Limit route updates from an IPv6 BGP neighbor based on the Network Layer Reachability
Information (NLRI) in the specified prefix list. The prefix list defines the NLRI prefix and length advertised in a route. You must create the prefix list before it can be selected here. See
“router prefix-list, prefix-list6” on page 421 .
Null
Limit route updates to a BGP neighbor based on the
NLRI in the specified prefix list. The prefix list defines the NLRI prefix and length advertised in a route. You must create the prefix list before it can be selected
here. See “router prefix-list, prefix-list6” on page 421 .
Null.
Limit route updates to an IPv6 BGP neighbor based on the NLRI in the specified prefix list. The prefix list defines the NLRI prefix and length advertised in a route. You must create the prefix list before it can be selected here. See
“router prefix-list, prefix-list6” on page 421 .
Null unset
Adds a BGP neighbor to the FortiGate unit configuration and sets the AS number of the neighbor. The range is from 1 to 65 535. If the number is identical to the FortiGate unit AS number, the FortiGate unit communicates with the neighbor using internal BGP (IBGP). Otherwise, the neighbor is an external peer and the FortiGate unit uses EBGP to communicate with the neighbor.
Remove the private AS numbers from outbound updates to the BGP neighbor.
disable
Remove the private AS numbers from outbound updates to the IPv6 BGP neighbor.
disable
0
Sets the time until a restart happens. The time until the restart can be from 0 to 3600 seconds.
This field is available when capabilitygraceful-restart is set to enable.
0
Specify the time (in seconds) that stale routes to the
BGP neighbor will be retained. The range is from 1 to
65 535. A value of 0 disables this feature.
Limit route updates or change the attributes of route updates from the BGP neighbor according to the specified route map. You must create the route-map before it can be selected here. See
“Using route maps with BGP” on page 440 .
Null.
Page 362 FortiOS™ - CLI Reference for FortiOS 5.0
router
Variable
route-map-in6
<routemap-name_str> route-map-out
<routemap-name_str> route-map-out6
<routemap-name_str> route-reflector-client
{enable | disable} route-reflector-client6
{enable | disable} route-server-client
{enable | disable} route-server-client6
{enable | disable} send-community {both | disable | extended | standard}
Description
Limit route updates or change the attributes of route updates from the IPv6 BGP neighbor according to the specified route map. You must create the routemap before it can be selected here.
Default
Null
Limit route updates or change the attributes of route updates to the BGP neighbor according to the specified route map. You must create the route-map before it can be selected here. See
“Using route maps with BGP” on page 440 .
Null.
Limit route updates or change the attributes of route updates to the IPv6 BGP neighbor according to the specified route map. You must create the route-map before it can be selected here.
Null
This field is available when remote-as is identical to
the FortiGate unit AS number (see “as
).
disable
Enable or disable the operation of the FortiGate unit as a route reflector and identify the BGP neighbor as a route-reflector client.
Inbound routes for route reflectors can change the next-hop, local-preference, med, and as-path attributes of IBGP routes for local route selection, while outbound IBGP routes do not take into effect these attributes.
This field is available when remote-as is identical to the FortiGate unit AS number.
disable
Enable or disable the operation of the FortiGate unit as a route reflector and identify the BGP neighbor as a route-reflector client.
Inbound routes for route reflectors can change the next-hop, local-preference, med, and as-path attributes of IBGP routes for local route selection, while outbound IBGP routes do not take into effect these attributes.
Enable or disable the recognition of the BGP neighbor as route-server client.
Enable or disable the recognition of the IPv6 BGP neighbor as route-server client.
Enable sending the COMMUNITY attribute to the
BGP neighbor. Choose one of:
standard — advertise standard capabilities.
extended — advertise extended capabilities.
both — advertise extended and standard capabilities.
disable — disable the advertising of the
COMMUNITY attribute.
disable disable both
bgp
Fortinet Technologies Inc.
Page 363 FortiOS™ - CLI Reference for FortiOS 5.0
router
Variable
send-community6 {both | disable | extended | standard}
Description
Enable sending the COMMUNITY attribute to the
IPv6 BGP neighbor. Choose one of:
standard — advertise standard capabilities
extended — advertise extended capabilities
both — advertise extended and standard capabilities
Default
both soft-reconfiguration6
{enable | disable}
disable — disable the advertising of the
COMMUNITY attribute.
shutdown {enable | disable}
Administratively enable or disable the BGP neighbor.
disable soft-reconfiguration
{enable | disable}
Enable or disable the FortiGate unit to store unmodified updates from the BGP neighbor to support inbound soft-reconfiguration.
disable
Enable or disable the FortiGate unit to store unmodified updates from the IPv6 BGP neighbor to support inbound soft-reconfiguration.
disable strict-capability-match
{enable | disable} unsuppress-map
<route-map-name_str>
Enable or disable strict-capability negotiation matching with the BGP neighbor.
Specify the name of the route-map to selectively unsuppress suppressed routes. You must create the route-map before it can be selected here. See
“Using route maps with BGP” on page 440
.
disable
Null.
unsuppress-map6
<route-map-name_str>
Specify the name of the route-map to selectively unsuppress suppressed IPv6 routes. You must create the route-map before it can be selected here.
Null update-source
<interface-name_str>
Specify the name of the local FortiGate unit interface to use for TCP connections to neighbors. The IP address of the interface will be used as the source address for outgoing updates.
Null.
weight <weight_integer> unset Apply a weight value to all routes learned from a neighbor. A higher number signifies a greater preference. The range is from 0 to 65 535.
Example
This example shows how to set the AS number of a BGP neighbor at IP address 10.10.10.167 and enter a descriptive name for the configuration.
config router bgp config neighbor edit 10.10.10.167
set remote-as 2879 end set description BGP_neighbor_Site1 end
bgp
Fortinet Technologies Inc.
Page 364 FortiOS™ - CLI Reference for FortiOS 5.0
router
config network, config network6
Use this subcommand to set or unset BGP network configuration parameters. The subcommand is used to advertise a BGP network (that is, an IP prefix) — you specify the IP addresses making up the local BGP network. Use config network6 for IPv6 routing.
When you enable the network-import-check attribute in the config router bgp
subcommand, (see “ network-import-check {disable | enable}” on page 354
) and you specify a BGP network prefix through the config network subcommand, the FortiGate unit searches its routing table for a matching entry. If an exact match is found, the prefix is advertised. A route-map can optionally be used to modify the attributes of routes before they are advertised.
The prefix field is required. All other fields are optional.
bgp
Variable
edit <network_id> backdoor
{enable | disable} prefix
<address_ipv4mask> prefix6
<address_ipv6mask> route-map
<routemapname_str>
Description Default
Enter an ID number for the entry. The number must be an integer.
Enter the IP address and netmask that identifies the BGP network to advertise.
Enter the IP address and netmask that identifies the BGP network to advertise.
No default.
Enable or disable the route as a backdoor, which causes an administrative distance of 200 to be assigned to the route.
Backdoor routes are not advertised to EBGP peers.
disable
0.0.0.0
0.0.0.0
::/0
Specify the name of the route-map that will be used to modify the attributes of the route before it is advertised.
You must create the route-map before it can be selected here. See
“Using route maps with BGP” on page 440 .
Null.
Example
This example defines a BGP network at IP address
10.0.0.0/8. A route map named
BGP_rmap1 is used to modify the attributes of the local BGP routes before they are advertised.
config router bgp config network edit 1 set prefix 10.0.0.0/8 end set route-map BGP_rmap1 end config router route-map edit BGP_rmap1 config rule edit 1 end set set-community no-export end
Fortinet Technologies Inc.
Page 365 FortiOS™ - CLI Reference for FortiOS 5.0
router bgp
config redistribute, config redistribute6
Use this subcommand to set or unset BGP redistribution table parameters. Use config redistribute6 for IPv6 routing. You can enable BGP to provide connectivity between connected, static, RIP, and/or OSPF routes. BGP redistributes the routes from one protocol to another. When a large internetwork is divided into multiple routing domains, use the subcommand to redistribute routes to the various domains. As an alternative, you can use the config network subcommand to advertise a prefix to the BGP network (see
“config network, config network6” on page 365
).
The BGP redistribution table contains four static entries. You cannot add entries to the table.
The entries are defined as follows:
• connected — Redistribute routes learned from a direct connection to the destination network.
• isis — Redistribute routes learned from ISIS.
• static — Redistribute the static routes defined in the FortiGate unit routing table.
• rip — Redistribute routes learned from RIP.
• ospf — Redistribute routes learned from OSPF.
When you enter the subcommand, end the command with one of the four static entry names
(that is, config redistribute {connected | isis | static | rip | ospf}).
The status and route-map fields are optional.
Variable
route-map
<route-map-name_str>
Description
status {enable | disable} Enable or disable the redistribution of connected, static, RIP, or OSPF routes.
Specify the name of the route map that identifies the routes to redistribute. You must create the route map before it can be selected here. See
“router route-map” on page 438 and
“Using route maps with BGP” on page 440 . If a route map is
not specified, all routes are redistributed to BGP.
Default
disable
Null
Example
The following example changes the status and route-map fields of the connected entry.
config router bgp config redistribute connected set status enable set route-map rmap1 end end
Fortinet Technologies Inc.
Page 366 FortiOS™ - CLI Reference for FortiOS 5.0
router community-list
community-list
Use this command to identify BGP routes according to their COMMUNITY attributes (see RFC
1997). Each entry in the community list defines a rule for matching and selecting routes based on the setting of the COMMUNITY attribute. The default rule in a community list (which the
FortiGate unit applies last) denies the matching of all routes.
You add a route to a community by setting its COMMUNITY attribute. A route can belong to more than one community. A route may be added to a community because it has something in common with the other routes in the group (for example, the attribute could identify all routes to satellite offices).
When the COMMUNITY attribute is set, the FortiGate unit can select routes based on their
COMMUNITY attribute values.
Syntax
config router community-list
set
config rule
set
set
set
end end
The action field is required. All other fields are optional.
Variable
edit
<community_name> type {standard | expanded}
Description
Enter a name for the community list.
Specify the type of community to match. If you select expanded, you must also specify a config rule regexp value. See
<regular_expression>” on page 368
config rule variables
edit
<community_rule_id> action {deny | permit}
Enter an entry number for the rule. The number must be an integer.
Deny or permit operations on a route based on the value of the route’s COMMUNITY attribute.
Default
No default.
standard
No default.
No default.
Fortinet Technologies Inc.
Page 367 FortiOS™ - CLI Reference for FortiOS 5.0
router community-list
Variable Description
match <criteria> This field is available when set type is set to standard.
Specify the criteria for matching a reserved community.
Default
Null regexp
<regular_express ion>
• Use decimal notation to match one or more
COMMUNITY attributes having the syntax
AA:NN, where
AA represents an AS, and NN is the community identifier. Delimit complex expressions with double-quotation marks (for example,
“123:
234 345:456”).
• To match all routes in the Internet community, type internet.
• To match all routes in the LOCAL_AS community, type local-AS. Matched routes are not advertised locally.
• To select all routes in the NO_ADVERTISE community, type no-advertise. Matched routes are not advertised.
• To select all routes in the NO_EXPORT community, type no-export. Matched routes are not advertised to EBGP peers. If a confederation is configured, the routes are advertised within the confederation.
This field is available when set type is set to expanded.
Null
Specify an ordered list of COMMUNITY attributes as a regular expression. The value or values are used to match a community. Delimit a complex regular_expression value using double-quotation marks.
Fortinet Technologies Inc.
Page 368 FortiOS™ - CLI Reference for FortiOS 5.0
router
gwdetect
gwdetect
Use this command to verify a valid connection with one or more servers.
Dead gateway detection, or interface status detection, consists of the unit confirming that packets sent from an interface result in a response from a server. You can use up to three different protocols to confirm that an interface can connect to the server. Usually the server is the next-hop router that leads to an external network or the Internet. Interface status detection sends a packet using the configured protocols. If a response is received from the server, the unit assumes the interface can connect to the network. If a response is not received, the unit assumes that the interface cannot connect to the network.
Syntax
config router gwdetect
end
set server <servername_string> set source-ip <ipv4_addr>
The action field is required. All other fields are optional.
Variable Description
edit <index_ID>
Enter an integer ID for this gwdetect entry.
failtime <attempts_int>
Enter the number of failed attempts to contact the server for declaring the ping server lost.
gateway-ip <IPv4_addr> Enter the IP address of the gateway used to ping the server.
ha-priority <priority_int> Select the HA election priority. Valid range is 1 to 50.
The default is 1.
Default
No default.
5
0.0.0.0
1
This setting is not synchronized by HA.
interface
<interface_name>
Specify the interface that connects to the server.
interval <seconds_int>
Enter the seconds between attempts to contact the server.
null
5 protocol {ping |tcpecho | udp-echo} server
<servername_string>
Select the protocol to be used when contacting the server.
Enter the server name. It must comply with RFC1035.
source-ip <ipv4_addr>
Enter the IP address that is checking the gateway. ping
No default.
0.0.0.0
If none is selected, one will be automatically selected from the interface
Fortinet Technologies Inc.
Page 369 FortiOS™ - CLI Reference for FortiOS 5.0
router
isis
isis
IS-IS is described in RFC 1142 . You can enable and configure IS-IS on your FortiGate unit if this routing protocol is in use on your network.
For each routing protocol, you can also use a redistribute command to redistribute IS-IS routes with the other protocol. For example, to redistribute IS-IS routes over OSFP enter: config router ospf config redistribute isis end end set status enable config router isis set
adjacency-check {enable | disable}
set
auth-keychain-l1 <keychain_str>
set
auth-keychain-l2 <keychain_str>
set
set
set
set
set
auth-sendonly-l1 {enable | disable}
set
auth-sendonly-l2 {enable | disable}
set
default-originate {enable | disable}
set
dynamic-hostname {enable | disable}
set
ignore-lsp-errors {enable | disable}
set
is-type {level-1 | level-1-2 | level-2-only}
set
lsp-gen-interval-l1 <interval_int>
set
lsp-gen-interval-l2 <interval_int>
set
lsp-refresh-interval <interval_int>
set
max-lsp-lifetime <lifetime_int>
set
| transition-l2 | wide | wide-l1 | wide-l2 | wide-transition
| wide-transition-l1 | wide-transition-l2}
set
overload-bit {enable | disable}
set
set
overload-bit-suppress external interlevel
set
redistribute-l1 {enable | disable}
set
redistribute-l1-list <access_list_str>
set
redistribute-l2 {enable | disable}
set
redistribute-l2-list <access_list_str>
set
spf-interval-exp-l1 <min_delay_int> <max_delay_int>
set
spf-interval-exp-l2 <min_delay_int> <max_delay_int>
Fortinet Technologies Inc.
Page 370 FortiOS™ - CLI Reference for FortiOS 5.0
router
Fortinet Technologies Inc.
config isis-interface edit <interface_str>
set
auth-keychain-l1 <keychain_str>
set
auth-keychain-l2 <keychain_str>
set
set
set
set
set
auth-send-only-l1 {enable | disable}
set
auth-send-only-l2 {enable | disable}
set
circuit-type {level-1 | level-1-2 | level-2-only}
set
csnp-interval-l1 <interval_int>
set
csnp-interval-l2 <interval_int>
set
hello-interval-l1 <interval_int>
set
hello-interval-l2 <interval_int>
set
hello-multiplier-l1 <multipler_int>
set
hello-multiplier-l2 <multipler_int>
set
hello-padding {enable | disable}
set
set
lsp-retransmit-interval <interval_int>
set
set
set
set
set
network-type {broadcast | point-to-point}
set
set
set
set
set
wide-metric-l2 <metric_int> config isis-net edit <id>
set
end
set
level {level-1 | level-1-2 | level-2}
set
prefix <prefix_ipv4> <prefix_mask>
end
isis
Page 371 FortiOS™ - CLI Reference for FortiOS 5.0
router
Variable
adjacency-check
{enable | disable} auth-keychain-l1
<keychain_str> auth-keychain-l2
<keychain_str> auth-mode-l1
{md5 | password} auth-mode-l2
{md5 | password} auth-password-l1
<password> auth-password-l2
<password> auth-sendonly-l1
{enable | disable} auth-sendonly-l2
{enable | disable} default-originate
{enable | disable} dynamic-hostname
{enable | disable} ignore-lsp-errors
{enable | disable} is-type {level-1
| level-1-2
| level-2-only} lsp-gen-interval-l1
<interval_int> lsp-gen-interval-l2
<interval_int> lsp-refresh-interval
<interval_int> max-lsp-lifetime
<lifetime_int>
Description
Enable to check neighbor protocol support.
Default
disable
Authentication key-chain for level 1 PDUs. Available when auth-mode-l1 is set to md5.
Authentication key-chain for level 2 PDUs. Available when auth-mode-l2 is set to md5.
Level 1 authentication mode. password
Level 2 authentication mode.
password
Authentication password for level 1 PDUs. Available when auth-keychain-11 is set to password.
Authentication password for level 2 PDUs. Available when auth-keychain-12 is set to password.
Level 1 authentication send-only.
disable
Level 2 authentication send-only.
Control distribution of default information.
disable disable
Enable dynamic hostname.
Enable to ignore LSPs with bad checksums.
disable disable
Set the ISIS level to use. IS-IS routers are designated as being: Level 1 (intra-area); Level 2 (inter area); or Level 1-2
(both). level-1-2
Minimum interval for level 1 link state packet (LSP) regenerating. Range 1 to 120.
30
Minimum interval for level 2 LSP regenerating. Range 1 to
120.
30
LSP refresh time in seconds. Range 1 to 65535 seconds.
900
Maximum LSP lifetime in seconds. Range 350 to 65535 seconds.
1200
isis
Fortinet Technologies Inc.
Page 372 FortiOS™ - CLI Reference for FortiOS 5.0
router
Variable
metric-style {narrow
| narrow-transition
| narrow-transition-l1
| narrow-transition-l2
| transition | transitionl1 | transition-l2 | wide
| wide-l1 | wide-l2
| wide-transition
| wide-transition-l1
| wide-transition-l2}
Description
Use old-style (ISO 10589) or new-style packet formats.
• narrow Use old style of TLVs with narrow metric.
• narrow-transition narrow, and accept both styles of TLVs during transition.
• narrow-transition-l1 narrow-transition level-1 only.
• narrow-transition-l2 narrow-transition level-2 only.
Default
narrow
• transition Send and accept both styles of TLVs during transition.
• transition-l1 transition level-1 only.
• transition-l2 transition level-2 only.
• wide Use new style of TLVs to carry wider metric.
• wide-l1 wide level-1 only.
• wide-l2 wide level-2 only.
• wide-transition wide, and accept both styles of
TLVs during transition.
• wide-transition-l1 wide-transition level-1 only.
• wide-transition-l2 wide-transition level-2 only.
overload-bit
{enable | disable}
Signal other routers not to use us in SPF.
overload-bit-on-startup Set overload-bit only temporarily after reboot. Range is 5-
86400 seconds. Enter unset overload-bit-onstartup to disable. Entering set overload-bit-onstartup 0 is invalid.
overload-bit-suppress external interlevel
Suppress overload-bit for the specific prefixes. You can suppress the overload-bit for external prefixes, internal prefixes or both. Enter unset overload-bit-suppress to disable.
redistribute-l1
{enable | disable} redistribute-l1-list
<access_list_str> redistribute-l2
{enable | disable} redistribute-l2-list
<access_list_str> spf-interval-exp-l1
<min_delay_int>
<max_delay_int> spf-interval-exp-l2
<min_delay_int>
<max_delay_int>
Redistribute level 1 routes into level 2. If enabled, configure redistribute-l1-list.
Access-list for redistribute l1 to l2. Available if redistribute-l1 enabled.
Redistribute level 2 routes into level 1. If enabled, configure redistribute-l2-list.
Access-list for redistribute l2 to l1. Available if redistribute-l2 enabled.
Level 1 SPF calculation delay in milliseconds. Enter the maximum and maximum delay between receiving a change to the level 1 SPF calculation in milliseconds.
Level 2 SPF calculation delay. Enter the maximum and maximum delay between receiving a change to the level 2
SPF calculation in milliseconds.
disable
0 disable
(null) disable
(null)
500 50000
500 50000
isis
Fortinet Technologies Inc.
Page 373 FortiOS™ - CLI Reference for FortiOS 5.0
router
config isis-interface
Configure and enable FortiGate unit interfaces for IS-IS.
Variable Description Default
edit <interface_str> auth-keychain-l1
<keychain_str> auth-keychain-l2
<keychain_str> auth-mode-l1
{md5 | password} auth-mode-l2
{md5 | password} auth-password-l1
<password> auth-password-l2
<password> auth-send-only-l1
{enable | disable} auth-send-only-l2
{enable | disable} circuit-type {level-1
| level-1-2
| level-2-only} csnp-interval-l1
<interval_int> csnp-interval-l2
<interval_int> hello-interval-l1
<interval_int> hello-interval-l2
<interval_int> hello-multiplier-l1
<multipler_int> hello-multiplier-l2
<multipler_int> hello-padding
{enable | disable} lsp-interval
<interval_int>
Edit an IS-IS interface.
Authentication key-chain for level 1 PDUs. Available when auth-mode-l1 is set to md5.
Authentication key-chain for level 2 PDUs. Available when auth-mode-l2 is set to md5.
Level 1 authentication mode.
Level 2 authentication mode.
Authentication password for level 1 PDUs. Available when auth-keychain-11 is set to password.
Authentication password for level 2 PDUs. Available when auth-keychain-12 is set to password.
Level 1 authentication send-only.
Level 2 authentication send-only.
Set the ISIS circuit type to use for the interface. IS-IS routers are designated as being: Level 1 (intra-area); Level 2 (inter area); or Level 1-2 (both).
Level 1 CSNP interval. The range is 1-65535 seconds.
Level 2 CSNP interval. The range is 1-65535 seconds.
Level 1 hello interval. The range is 1-65535 seconds. Set to 0 for a one-second hold time.
Level 2 hello interval. The range is 1-65535 seconds. Set to 0 for a one-second hold time.
Level 1 multiplier for Hello holding time. The range is 2 to
100.
Level 2 multiplier for Hello holding time. The range is 2 to
100.
Enable or disable adding padding to IS-IS hello packets.
LSP transmission interval (milliseconds). The range is 1-
4294967295.
password password disable disable level-1-2
10
10
10
10
3
3 disable
33 lsp-retransmit-interval
<interval_int> mesh-group
{enable | disable}
LSP retransmission interval (seconds). The range is 1-65535.
Enable IS-IS mesh group.
mesh-group-id
<id_int>
Mesh group ID. The range is 0-4294967295. A value of 0 means the mesh group is blocked.
metric-l1 <metric_int> Level 1 metric for interface. The range is 1-63.
metric-l2 <metric_int> Level 2 metric for interface. The range is 1-63.
5 disable
0
10
10
isis
Fortinet Technologies Inc.
Page 374 FortiOS™ - CLI Reference for FortiOS 5.0
router
Variable
network-type
{broadcast
| point-to-point} priority-l1
<priority_int> priority-l2
<priority_int> status
{enable | disable} wide-metric-l1
<metric_int> wide-metric-l2
<metric_int>
Description
Set the IS-IS interface's network type.
Level 1 priority. The range is 0-127.
Level 2 priority. The range is 0-127.
Enable the interface for IS-IS.
Level 1 wide metric for the interface. The range is 1-
16777214.
Level 2 wide metric for the interface. The range is 1-
16777214.
config isis-net
Add IS-IS networks.
Variable Description
edit <id>
Add the ID number of the IS-IS network net <user_defined> Enter a user defined IS-IS network in the form xx.xxxx. ...
.xxxx.xx.
Default
64
64 disable
10
10
:
Default config redistribute {bgp | connected | ospf | rip | static}
Redistribute routes from other routing protocols using IS-IS.
Variable Description
status {enable | disable} Enable or disable redistributing the selected protocol’s routes.
protocol {bgp
| connected | ospf | rip
| static} metric <metric_int> metric-type
{external | internal} level {level-1 | level-1-2
| level-2}
The name of the protocol that to redistribute ISIS routes to.
Set the metric. Range is 0-4261412864.
Set the metric type.
Set the ISIS level type to use for distributing routes. IS-IS routers are designated as being: Level 1 (intra-area); Level 2
(inter area); or Level 1-2 (both). routemap
<routmap_name>
Enter a routemap name.
Default
disable
0 internal level-2
(null)
isis
Fortinet Technologies Inc.
Page 375 FortiOS™ - CLI Reference for FortiOS 5.0
router
config summary-address
Add IS-IS summary addresses.
Variable
edit <id> level {level-1
| level-1-2
| level-2} prefix
<prefix_ipv4>
<prefix_mask>
Description Default
Add the ID number of the summary address.
Set the ISIS level to use for the summary database. IS-IS routers are designated as being: Level 1 (intra-area); Level 2 (inter area); or
Level 1-2 (both). level-2
The summary address prefix and netmask.
0.0.0.0
0.0.0.0
isis
Fortinet Technologies Inc.
Page 376 FortiOS™ - CLI Reference for FortiOS 5.0
router
key-chain
key-chain
Use this command to manage RIP version 2 authentication keys. You can add, edit or delete keys identified by the specified key number.
RIP version 2 uses authentication keys to ensure that the routing information exchanged between routers is reliable. For authentication to work, both the sending and receiving routers must be set to use authentication, and must be configured with the same keys.
A key chain is a list of one or more keys and the send and receive lifetimes for each key. Keys are used for authenticating routing packets only during the specified lifetimes. The FortiGate unit migrates from one key to the next according to the scheduled send and receive lifetimes.
The sending and receiving routers should have their system dates and times synchronized, but overlapping the key lifetimes ensures that a key is always available even if there is some difference in the system times. For how to to ensure that the FortiGate unit system date and time are correct, see “config system global” on page 243 .
Syntax
config router key-chain
config key
set
set
end set
end
The accept-lifetime, key-string, and send-lifetime fields are required.
Variable
edit <key_chain_name>
config key variables
edit <key_id>
Description
Enter a name for the key chain list.
Default
No default.
Enter an ID number for the key entry. The number must be an integer.
No default.
Fortinet Technologies Inc.
Page 377 FortiOS™ - CLI Reference for FortiOS 5.0
router key-chain
Variable Description
accept-lifetime <start> <end> Set the time period during which the key can be received. The start time has the syntax hh:mm: ss day month year. The end time provides a choice of three settings:
hh:mm:ss day month year
Default
No default.
<integer> — a duration from 1 to 2147483646 seconds
infinite — for a key that never expires
The valid settings for hh:mm:ss day month year are:
hh — 0 to 23
mm — 0 to 59
ss — 0 to 59
day — 1 to 31
month — 1 to 12
year — 1993 to 2035 key-string <password>
Note: A single digit will be accepted for hh, mm,
ss, day, or month fields.
The
<password_str> can be up to 35 characters long.
send-lifetime <start> <end>
Set the time period during which the key can be sent. The start time has the syntax hh:mm:ss day month year. The end time provides a choice of three settings:
No default.
No default.
hh:mm:ss day month year
<integer> — a duration from 1 to 2147483646 seconds
infinite — for a key that never expires
The valid settings for hh:mm:ss day month year are:
hh — 0 to 23
mm — 0 to 59
ss — 0 to 59
day — 1 to 31
month — 1 to 12
year — 1993 to 2035
Note: A single digit will be accepted for hh, mm,
ss, day, or month fields.
Fortinet Technologies Inc.
Page 378 FortiOS™ - CLI Reference for FortiOS 5.0
router multicast
multicast
A FortiGate unit can operate as a Protocol Independent Multicast (PIM) version 2 router.
FortiGate units support PIM sparse mode (RFC 4601) and PIM dense mode (RFC 3973) and can service multicast servers or receivers on the network segment to which a FortiGate unit interface is connected. Multicast routing is not supported in Transparent mode (TP mode).
To support PIM communications, the sending/receiving applications and all connecting PIM routers in between must be enabled with PIM version 2. PIM can use static routes, RIP, OSPF, or BGP to forward multicast packets to their destinations. To enable source-to-destination packet delivery, either sparse mode or dense mode must be enabled on the PIM-router interfaces. Sparse mode routers cannot send multicast messages to dense mode routers. In addition, if a FortiGate unit is located between a source and a PIM router, two PIM routers, or is connected directly to a receiver, you must create a firewall policy manually to pass encapsulated (multicast) packets or decapsulated data (IP traffic) between the source and destination.
A PIM domain is a logical area comprising a number of contiguous networks. The domain contains at least one Boot Strap Router (BSR), and if sparse mode is enabled, a number of
Rendezvous Points (RPs) and Designated Routers (DRs). When PIM is enabled on a FortiGate unit, the FortiGate unit can perform any of these functions at any time as configured.
Sparse mode
Initially, all candidate BSRs in a PIM domain exchange bootstrap messages to select one BSR to which each RP sends the multicast address or addresses of the multicast group(s) that it can service. The selected BSR chooses one RP per multicast group and makes this information available to all of the PIM routers in the domain through bootstrap messages. PIM routers use the information to build packet distribution trees, which map each multicast group to a specific
RP. Packet distribution trees may also contain information about the sources and receivers associated with particular multicast groups.
When a FortiGate unit interface is configured as a multicast interface, sparse mode is enabled on it by default to ensure that distribution trees are not built unless at least one downstream receiver requests multicast traffic from a specific source. If the sources of multicast traffic and their receivers are close to each other and the PIM domain contains a dense population of active receivers, you may choose to enable dense mode throughout the PIM domain instead.
An RP represents the root of a non-source-specific distribution tree to a multicast group. By joining and pruning the information contained in distribution trees, a single stream of multicast packets (for example, a video feed) originating from the source can be forwarded to a certain
RP to reach a multicast destination.
Each PIM router maintains a Multicast Routing Information Base (MRIB) that determines to which neighboring PIM router join and prune messages are sent. An MRIB contains reversepath information that reveals the path of a multicast packet from its source to the PIM router that maintains the MRIB.
To send multicast traffic, a server application sends IP traffic to a multicast group address. The locally elected DR registers the sender with the RP that is associated with the target multicast group. The RP uses its MRIB to forward a single stream of IP packets from the source to the members of the multicast group. The IP packets are replicated only when necessary to distribute the data to branches of the RP’s distribution tree.
To receive multicast traffic, a client application can use Internet Group Management Protocol
(IGMP) version 1 (RFC 1112), 2 (RFC 2236), or 3 (RFC 3376) control messages to request the traffic for a particular multicast group. The locally elected DR receives the request and adds the
Fortinet Technologies Inc.
Page 379 FortiOS™ - CLI Reference for FortiOS 5.0
router multicast
host to the multicast group that is associated with the connected network segment by sending a join message towards the RP for the group. Afterward, the DR queries the hosts on the connected network segment continually to determine whether the hosts are active. When the
DR no longer receives confirmation that at least one member of the multicast group is still active, the DR sends a prune message towards the RP for the group.
Dense mode
The packet organization used in sparse mode is also used in dense mode. When a multicast source begins to send IP traffic and dense mode is enabled, the closest PIM router registers the
IP traffic from the multicast source (S) and forwards multicast packets to the multicast group address (G). All PIM routers initially broadcast the multicast packets throughout the PIM domain to ensure that all receivers that have requested traffic for multicast group address G can access the information if needed.
To forward multicast packets to specific destinations afterward, the PIM routers build distribution trees based on the information in multicast packets. Upstream PIM routers depend on prune/graft messages from downstream PIM routers to determine if receivers are actually present on directly connected network segments. The PIM routers exchange state refresh messages to update their distribution trees. FortiGate units store this state information in a Tree
Information Base (TIB), which is used to build a multicast forwarding table. The information in the multicast forwarding table determines whether packets are forwarded downstream. The forwarding table is updated whenever the TIB is modified.
PIM routers receive data streams every few minutes and update their forwarding tables using the source (S) and multicast group (G) information in the data stream. Superfluous multicast traffic is stopped by PIM routers that do not have downstream receivers—PIM routers that do not manage multicast groups send prune messages to the upstream PIM routers. When a receiver requests traffic for multicast address G, the closest PIM router sends a graft message upstream to begin receiving multicast packets.
For more information on Multicast routing, see the FortiGate Multicast Technical Note .
Syntax
set
igmp-state-limit <limit_integer>
set
multicast-routing {enable | disable}
set
set
route-threshold <threshold_integer> config interface edit <interface_name>
set
cisco-exclude-genid {enable | disable}
set
dr-priority <priority_integer>
set
hello-holdtime <holdtime_integer>
set
hello-interval <hello_integer>
set
set
neighbour-filter <access_list_name>
set
set
pim-mode {sparse-mode | dense-mode}
set
propagation-delay <delay_integer>
set
rp-candidate {enable | disable}
set
rp-candidate-group <access_list_name>
set
rp-candidate-interval <interval_integer>
set
rp-candidate-priority <priority_integer>
Fortinet Technologies Inc.
Page 380 FortiOS™ - CLI Reference for FortiOS 5.0
router multicast
Fortinet Technologies Inc.
set
state-refresh-interval <refresh_integer>
set
set
end config join-group
end config igmp set
access-group <access_list_name>
set
immediate-leave-group <access_list_name>
set
last-member-query-count <count_integer>
set
last-member-query-interval <interval_integer>
set
query-interval <interval_integer>
set
query-max-response-time <time_integer>
set
query-timeout <timeout_integer>
set
router-alert-check { enable | disable }
set
end end
set cisco-register-checksum {enable | disable} set cisco-register-checksum-group <access_list_name>
set cisco-crp-prefix {enable | disable} set cisco-ignore-rp-set-priority {enable | disable}
set message-interval <interval_integer> set register-rate-limit <rate_integer>
end
config rp-address
end set
set
Page 381 FortiOS™ - CLI Reference for FortiOS 5.0
router multicast
config router multicast
You can configure a FortiGate unit to support PIM using the config router multicast CLI command. When PIM is enabled, the FortiGate unit allocates memory to manage mapping information. The FortiGate unit communicates with neighboring PIM routers to acquire mapping information and if required, processes the multicast traffic associated with specific multicast groups.
The end-user multicast client-server applications must be installed and configured to initiate
Internet connections and handle broadband content such as audio/video information.
Client applications send multicast data by registering IP traffic with a PIM-enabled router. An end-user could type in a class D multicast group address, an alias for the multicast group address, or a call-conference number to initiate the session.
Rather than sending multiple copies of generated IP traffic to more than one specific IP destination address, PIM-enabled routers encapsulate the data and use the one multicast group address to forward multicast packets to multiple destinations. Because one destination address is used, a single stream of data can be sent. Client applications receive multicast data by requesting that the traffic destined for a certain multicast group address be delivered to them— end-users may use phone books, a menu of ongoing or future sessions, or some other method through a user interface to select the address of interest.
A class D address in the 224.0.0.0 to 239.255.255.255 range may be used as a multicast group address, subject to the rules assigned by the Internet Assigned Numbers Authority (IANA). All class D addresses must be assigned in advance. Because there is no way to determine in advance if a certain multicast group address is in use, collisions may occur (to resolve this problem, end-users may switch to a different multicast address).
To configure a PIM domain
1. If you will be using sparse mode, determine appropriate paths for multicast packets.
2. Make a note of the interfaces that will be PIM-enabled. These interfaces may run a unicast routing protocol.
3. If you will be using sparse mode and want multicast packets to be handled by specific
(static) RPs, record the IP addresses of the PIM-enabled interfaces on those RPs.
4. Enable PIM version 2 on all participating routers between the source and receivers. On
FortiGate units, use the config router multicast command to set global operating parameters.
5. Configure the PIM routers that have good connections throughout the PIM domain to be candidate BSRs.
6. If sparse mode is enabled, configure one or more of the PIM routers to be candidate RPs.
7. If required, adjust the default settings of PIM-enabled interface(s).
All fields are optional.
Fortinet Technologies Inc.
Page 382 FortiOS™ - CLI Reference for FortiOS 5.0
router multicast
Variable
igmp-state-limit
<limit_integer>
Description
If memory consumption is an issue, specify a limit on the number of IGMP states (multicast memberships) that the FortiGate unit will store.
Default
3200
This value represents the maximum combined number of IGMP states (multicast memberships) that can be handled by all interfaces. Traffic associated with excess
IGMP membership reports is not delivered. The range is from
96 to 64 000.
multicast-routing
{enable | disable}
Enable or disable PIM routing.
route-limit <limit_integer> If memory consumption is an issue, set a limit on the number of multicast routes that can be added to the
FortiGate unit routing table. The range is from
1 to
2 147 483 674.
route-threshold
<threshold_integer>
Specify the number of multicast routes that can be added to the FortiGate unit’s routing table before a warning message is displayed. The route-threshold value must be lower than the route-limit value. The range is from 1 to
2 147 483 674.
disable
21474836
74
21474836
74
config interface
Use this subcommand to change interface-related PIM settings, including the mode of operation (sparse or dense). Global settings do not override interface-specific settings.
All fields are optional.
Variable
edit <interface_name> cisco-exclude-genid
{enable | disable} dr-priority
<priority_integer>
Description
Enter the name of the FortiGate unit interface on which to enable PIM protocols.
This field applies only when pim-mode is sparse-mode.
Default
No default.
disable
Enable or disable including a generation ID in hello messages sent to neighboring PIM routers. A GenID value may be included for compatibility with older Cisco IOS routers.
This field applies only when pim-mode is sparse-mode.
1
Assign a priority to FortiGate unit Designated Router (DR) candidacy. The range is from 1 to 4 294 967 294. The value is compared to that of other DR interfaces connected to the same network segment, and the router having the highest DR priority is selected to be the DR. If two DR priority values are the same, the interface having the highest IP address is selected.
Fortinet Technologies Inc.
Page 383 FortiOS™ - CLI Reference for FortiOS 5.0
router multicast
Variable
hello-holdtime
<holdtime_integer> hello-interval
<hello_integer>
Description
Specify the amount of time (in seconds) that a PIM neighbor may consider the information in a hello message to be valid. The range is from 1 to 65 535.
Default
105
If the hello-interval attribute is modified and the hello-holdtime attribute has never been set explicitly, the hello-holdtime attribute is automatically set to 3.5 x hello-interval.
Set the amount of time (in seconds) that the FortiGate unit waits between sending hello messages to neighboring
PIM routers. The range is from 1 to 65 535.
30 multicast-flow
<flowname>
Changing the hello-interval attribute may automatically update the hello-holdtime attribute .
Connect the named multicast flow to this interface.
Multicast flows are defined in the
command.
neighbour-filter
<access_list_name>
Establish or terminate adjacency with PIM neighbors having the IP addresses given in the specified access list.
For more information on access lists, see
“router accesslist, access-list6” on page 342
.
passive {enable | disable}
Enable or disable PIM communications on the interface without affecting IGMP communications.
pim-mode {sparse-mode | dense-mode}
Select the PIM mode of operation. Choose one of:
sparse-mode — manage PIM packets through distribution trees and multicast groups.
No default.
Null disable sparsemode propagation-delay
<delay_integer> rp-candidate {enable | disable} rp-candidate-group
<access_list_name>
dense-mode — enable multicast flooding.
This field is available when pim-mode is set to dense-mode.
Specify the amount of time (in milliseconds) that the
FortiGate unit waits to send prune-override messages.
The range is from 100 to 5 000.
This field is available when pim-mode is set to sparse-mode.
500 disable
Enable or disable the FortiGate unit interface to offer
Rendezvous Point (RP) services.
RP candidacy is advertised to certain multicast groups.
These groups are based on the multicast group prefixes given in the specified access list. For more information on access lists, see
“access-list, access-list6” on page 342 .
Null rp-candidate-interval
<interval_integer>
This field is available when rp-candidate is set to enable and pim-mode is set to sparse-mode.
This field is available when rp-candidate is set to enable and pim-mode is set to sparse-mode.
Set the amount of time (in seconds) that the FortiGate unit waits between sending RP announcement messages. The range is from 1 to 16 383.
60
Fortinet Technologies Inc.
Page 384 FortiOS™ - CLI Reference for FortiOS 5.0
router multicast
Variable
rp-candidate-priority
<priority_integer> state-refresh-interval
<refresh_integer>
Description
This field is available when rp-candidate is set to enable and pim-mode is set to sparse-mode.
Default
192
Assign a priority to FortiGate unit Rendezvous Point (RP) candidacy. The range is from 0 to 255. The BSR compares the value to that of other RP candidates that can service the same multicast group, and the router having the highest RP priority is selected to be the RP for that multicast group. If two RP priority values are the same, the
RP candidate having the highest IP address on its RP interface is selected.
This field is available when pim-mode is set to dense-mode.
60
This attribute is used when the FortiGate unit is connected directly to the multicast source. Set the amount of time (in seconds) that the FortiGate unit waits between sending state-refresh messages. The range is from 1 to 100. When a state-refresh message is received by a downstream router, the prune state on the downstream router is refreshed. static-group <flowname>
Statically join this interface to the named multicast group.
The interface does not need to have seen any IGMP joins
from any host. Multicast flows are defined in the router multicast-flow command.
ttl-threshold <ttl_integer>
Specify the minimum Time-To-Live (TTL) value (in hops) that an outbound multicast packet must have in order to be forwarded from this interface. The range is from 0 to
255.
No default.
1
Specifying a high value (for example, 195) prevents PIM packets from being forwarded through the interface.
config join-group variables
edit address
<address_ipv4>
Cause the FortiGate unit interface to activate (IGMP join) the multicast group associated with the specified multicast group address.
config igmp variables
access-group
<access_list_name> immediate-leave-group
<access_list_name>
No default.
Specify which multicast groups that hosts on the connected network segment may join based on the multicast addresses given in the specified access list. For more information on access lists, see
“router access-list, access-list6” on page 342 .
This field applies when version is set to 2 or 3.
Null.
Null.
Configure a FortiGate unit DR to stop sending traffic and
IGMP queries to receivers after receiving an IGMP version
2 group-leave message from any member of the multicast groups identified in the specified access list. For more information on access lists, see
“router access-list, access-list6” on page 342 .
Fortinet Technologies Inc.
Page 385 FortiOS™ - CLI Reference for FortiOS 5.0
router multicast
Variable
last-member-query-count
<count_integer>
Description
This field applies when version is set to 2 or 3.
Specify the number of times that a FortiGate unit DR sends an IGMP query to the last member of a multicast group after receiving an IGMP version 2 group-leave message.
last-member-query-interval
<interval_integer>
This field applies when version is set to 2 or 3.
Set the amount of time (in milliseconds) that a FortiGate unit DR waits for the last member of a multicast group to respond to an IGMP query. The range is from 1000 to
25 500. If no response is received before the specified time expires and the FortiGate unit DR has already sent an
IGMP query last-member-query-count times, the
FortiGate unit DR removes the member from the group and sends a prune message to the associated RP.
query-interval
<interval_integer>
Set the amount of time (in seconds) that a FortiGate unit
DR waits between sending IGMP queries to determine which members of a multicast group are active. The range is from 1 to 65 535.
query-max-response-time
<time_integer> query-timeout
<timeout_integer> router-alert-check { enable
| disable } version {1 | 2 | 3}
Default
2
1000
125
Set the maximum amount of time (in seconds) that a
FortiGate unit DR waits for a member of a multicast group to respond to an IGMP query. The range is from 1 to 25. If no response is received before the specified time expires, the FortiGate unit DR removes the member from the group.
10
Set the amount of time (in seconds) that must expire before a FortiGate unit begins sending IGMP queries to the multicast group that is managed through the interface.
The range is from 60 to 300. A FortiGate unit begins sending IGMP queries if it does not receive regular IGMP queries from another DR through the interface.
255
Enable to require the Router Alert option in IGMP packets.
disabled
3
Specify the version number of IGMP to run on the interface. The value can be 1, 2, or 3. The value must match the version used by all other PIM routers on the connected network segment.
config pim-sm-global
These global settings apply only to sparse mode PIM-enabled interfaces. Global PIM settings do not override interface-specific PIM settings.
If sparse mode is enabled, you can configure a DR to send multicast packets to a particular RP by specifying the IP address of the RP through the config rp-address variable. The IP address must be directly accessible to the DR. If multicast packets from more than one multicast group can pass through the same RP, you can use an access list to specify the associated multicast group addresses.
Fortinet Technologies Inc.
Page 386 FortiOS™ - CLI Reference for FortiOS 5.0
router multicast
To send multicast packets to a particular RP using the config rp-address subcommand, the ip-address field is required. All other fields are optional.
Variable
accept-register-list
<access_list_name>
Description
Cause a FortiGate unit RP to accept or deny register packets from the source IP addresses given in the specified access list. For more information on access lists, see
“router access-list, access-list6” on page 342 .
bsr-allow-quick-refresh {enable
| disable}
Enable or disable accepting BSR quick refresh packets from neighbors.
bsr-candidate {enable | disable} Enable or disable the FortiGate unit to offer its services as a Boot Strap Router (BSR) when required.
bsr-priority <priority_integer>
This field is available when bsr-candidate is set to enable.
Default
Null disable disable
0
Assign a priority to FortiGate unit BSR candidacy.
The range is from 0 to 255. This value is compared to that of other BSR candidates and the candidate having the highest priority is selected to be the BSR.
If two BSR priority values are the same, the BSR candidate having the highest IP address on its BSR interface is selected.
bsr-interface <interface_name> This field is available when bsr-candidate is set to enable.
Null bsr-hash <hash_integer> cisco-crp-prefix {enable | disable} cisco-ignore-rp-set-priority
{enable | disable}
Specify the name of the PIM-enabled interface through which the FortiGate unit may announce BSR candidacy.
This field is available when bsr-candidate is set to enable.
10
Set the length of the mask (in bits) to apply to multicast group addresses in order to derive a single
RP for one or more multicast groups. The range is from 0 to 32. For example, a value of 24 means that the first 24 bits of the group address are significant.
All multicast groups having the same seed hash belong to the same RP.
Enable or disable a FortiGate unit RP that has a group prefix number of 0 to communicate with a
Cisco BSR. You may choose to enable the attribute if required for compatibility with older Cisco BSRs.
disable disable
Enable or disable a FortiGate unit BSR to recognize
Cisco RP-SET priority values when deriving a single
RP for one or more multicast groups. You may choose to enable the attribute if required for compatibility with older Cisco RPs.
Fortinet Technologies Inc.
Page 387 FortiOS™ - CLI Reference for FortiOS 5.0
router multicast
Variable
cisco-register-checksum
{enable | disable} cisco-register-checksum-group
<access_list_name> message-interval
<interval_integer> register-rate-limit
<rate_integer> register-rp-reachability {enable
| disable} register-source {disable | interface | ip-address}
Identify on which PIM packets to perform a wholepacket register checksum based on the multicast group addresses in the specified access list. For more information on access lists, see
“router accesslist, access-list6” on page 342 . You may choose to
register checksums on entire PIM packets for compatibility with older Cisco IOS routers.
Set the amount of time (in seconds) that the
FortiGate unit waits between sending periodic PIM join/prune messages (sparse mode) or prune messages (dense mode). The value must be identical to the message interval value set on all other PIM routers in the PIM domain. The range is from 1 to
65 535.
60
Set the maximum number of register messages per
(S,G) per second that a FortiGate unit DR can send for each PIM entry in the routing table. The range is from
0 to 65 535, where 0 means an unlimited number of register messages per second.
0
Enable or disable a FortiGate unit DR to check if an
RP is accessible prior to sending register messages. enable ip-address
If the FortiGate unit acts as a DR, enable or disable changing the IP source address of outbound register packets to one of the following IP addresses. The IP address must be accessible to the RP so that the RP can respond to the IP address with a Register-Stop message. Choose one of:
disable — retain the IP address of the FortiGate unit
DR interface that faces the RP.
register-source-interface
<interface_name>
Description
Enable or disable performing a register checksum on entire PIM packets. A register checksum is performed on the header only by default. You may choose to enable register checksums on the whole packet for compatibility with older Cisco IOS routers.
This field is available when cisco-registerchecksum is set to enable.
Default
disable
Null
interface — change the IP source address of a register packet to the IP address of a particular
FortiGate unit interface. The register-sourceinterface attribute specifies the interface name.
ip-address — change the IP source address of a register packet to a particular IP address. The register-source-ip attribute specifies the IP address.
Enter the name of the FortiGate unit interface.
This field is only available when register-source is set to interface.
Null
Fortinet Technologies Inc.
Page 388 FortiOS™ - CLI Reference for FortiOS 5.0
router multicast
Variable
register-source-ip
<address_ipv4> register-suppression
<suppress_integer> rp-register-keepalive
<keepalive_integer>
Description
This field is available when register-source is set to address.
Default
0.0.0.0
Enter the IP source address to include in the register message.
Enter the amount of time (in seconds) that a
FortiGate unit DR waits to start sending data to an
RP after receiving a Register-Stop message from the
RP. The range is from 1 to 65 535.
60
185
If the FortiGate unit acts as an RP, set the frequency
(in seconds) with which the FortiGate unit sends keepalive messages to a DR. The range is from 1 to
65 535. The two routers exchange keepalive messages to maintain a link for as long as the source continues to generate traffic.
If the register-suppression attribute is modified on the RP and the rp-register-keepalive attribute has never been set explicitly, the rpregister-keepalive attribute is set to (3 x register-suppression) + 5 automatically.
spt-threshold {enable | disable} Enable or disable the FortiGate unit to build a
Shortest Path Tree (SPT) for forwarding multicast packets.
spt-threshold-group
<access_list_name>
Build an SPT only for the multicast group addresses given in the specified access list. For more
information on access lists, see “router access-list, access-list6” on page 342 .
enable
Null.
ssm {enable | disable}
This field is only available when spt-threshold is set to enable.
This field is available when the IGMP version is set to
3. enable
Enable or disable Source Specific Multicast (SSM) interactions (see RFC 3569).
ssm-range <access_list_name> Enable SSM only for the multicast addresses given in the specified access list. For more information on access lists, see
“router access-list, access-list6” on page 342 .
Null.
By default, multicast addresses in the 232.0.0.0 to
232.255.255.255 (232/8) range are used to support
SSM interactions.
This field is only available when ssm is set to enable.\
Fortinet Technologies Inc.
Page 389 FortiOS™ - CLI Reference for FortiOS 5.0
router
Variable config rp-address variables
edit <rp_id> ip-address <address_ipv4> group <access_list_name>
multicast
Description
Only used when pim-mode is sparse-mode.
Default
Enter an ID number for the static RP address entry.
The number must be an integer.
Specify a static IP address for the RP.
No default.
0.0.0.0
Configure a single static RP for the multicast group addresses given in the specified access list. For more information on access lists, see
“router accesslist, access-list6” on page 342 .
Null.
If an RP for any of these group addresses is already known to the BSR, the static RP address is ignored and the RP known to the BSR is used instead.
Fortinet Technologies Inc.
Page 390 FortiOS™ - CLI Reference for FortiOS 5.0
router
multicast6
multicast6
Use this command to configure the FortiGate unit as an IPv6 Protocol Independent Multicast
(PIM) version 2 router.
Syntax
config router multicast6 set
multicast-routing {enable | disable}
config interface
set
hello-holdtime <holdtime_integer>
set
hello-interval <hello_integer>
end config pim-sm-global config rp-address edit <id_int> end set
end end
Variable
multicast-routing
{enable | disable}
Description
Enable or disable IPv6 multicast routing.
config interface fields
edit <interface_name>
Enter the name of the FortiGate unit interface on which to enable PIM protocols.
hello-holdtime
<holdtime_integer>
Specify the amount of time (in seconds) that a PIM neighbor may consider the information in a hello message to be valid. The range is from 1 to 65 535.
Default
disable
No default.
105 hello-interval
<hello_integer>
If the hello-interval attribute is modified and the hello-holdtime attribute has never been set explicitly, the hello-holdtime attribute is automatically set to 3.5 x hello-interval.
Set the amount of time (in seconds) that the
FortiGate unit waits between sending hello messages to neighboring PIM routers. The range is from 1 to 65 535.
30
Changing the hello-interval attribute may automatically update the hello-holdtime attribute .
config pim-sm-global / config rp-address fields
ip6-address <ip6_addr>
Enter the RP router IP address.
::
Fortinet Technologies Inc.
Page 391 FortiOS™ - CLI Reference for FortiOS 5.0
router multicast-flow
multicast-flow
Use this command to configure the source allowed for a multicast flow when using PIM-SM or
PIM-SSM.
Syntax
config router multicast-flows
edit <flowname_str> set comments <comment_str>
config flows
set
end set
end
Variable Description
edit <flowname_str>
Enter a name for this flow.
comments <comment_str> Optionally, enter a descriptive comment.
edit <id>
Enter the ID number for this flow.
group-addr <group_ipv4> Enter the multicast group IP address.
Range 224.0.0.0 - 239.255.255.255
source-addr <src_ipv4>
Enter the source IP address.
Default
0.0.0.0
0.0.0.0
Fortinet Technologies Inc.
Page 392 FortiOS™ - CLI Reference for FortiOS 5.0
router ospf
ospf
Use this command to configure Open Shortest Path First (OSPF) protocol settings on the
FortiGate unit. More information on OSPF can be found in RFC 2328.
OSPF is a link state protocol capable of routing larger networks than the simpler distance vector
RIP protocol. An OSPF autonomous system (AS) or routing domain is a group of areas connected to a backbone area. A router connected to more than one area is an area border router (ABR). Routing information is contained in a link state database. Routing information is communicated between routers using link state advertisements (LSAs).
Bi-directional Forwarding Detection (BFD) is a protocol used by BGP and OSPF. It is used to quickly locate hardware failures in the network. Routers running BFD communicate with each other, and if a timer runs out on a connection then that router is declared down. BFD then communicates this information to the routing protocol and the routing information is updated.
BFD support can only be configured through the CLI.
Syntax
set
abr-type {cisco | ibm | shortcut | standard}
set
auto-cost-ref-bandwidth <mbps_integer>
set
bfd {enable | disable | global}
set
database-overflow {enable | disable}
set
database-overflow-max-lsas <lsas_integer>
set
database-overflow-time-to-recover <seconds_integer>
set
default-information-metric <metric_integer>
set
default-information-metric-type {1 | 2}
set
default-information-originate {always | disable | enable}
set
default-information-route-map <name_str>
set
default-metric <metric_integer>
set
set
distance-external <distance_integer>
set
distance-inter-area <distance_integer>
set
distance-intra-area <distance_integer>
set
distribute-list-in <access_list_name>
set
set
restart-mode {graceful-restart | lls | none}
set restart-period set
rfc1583-compatible {enable | disable}
set
set
spf-timers <delay_integer> <hold_integer> config area
set
authentication {md5 | none | text}
set
set
nssa-default-information-originate {enable | disable}
set
nssa-default-information-originate-metric <metric>
set
nssa-default-information-originate-metric-type {1 | 2}
set
nssa-redistribution {enable | disable}
set
nssa-translator-role {always | candidate | never}
set
shortcut {default | disable | enable}
Fortinet Technologies Inc.
Page 393 FortiOS™ - CLI Reference for FortiOS 5.0
router
Fortinet Technologies Inc.
ospf
set
stub-type {no-summary | summary}
set
config filter-list
set
set
end config range
set
set
set
set
substitute-status {enable | disable}
end config virtual-link
set
authentication {md5 | none | text}
set
authentication-key <password_str>
set
dead-interval <seconds_integer>
set
hello-interval <seconds_integer>
set
set
set
retransmit-interval <seconds_integer>
set
transmit-delay <seconds_integer>
end end
config distribute-list edit <distribute-list_id>
end end set
set
protocol {connected | rip | static}
config neighbor edit <neighbor_id>
set
set
end end set
poll-interval <seconds_integer>
set
config network edit <network_id>
set
set
end end
Page 394 FortiOS™ - CLI Reference for FortiOS 5.0
router
config ospf-interface edit <ospf_interface_name>
set
authentication {md5 | none | text}
set
authentication-key <password_str>
set
set
database-filter-out {enable | disable}
set
dead-interval <seconds_integer>
set
hello-interval <seconds_integer>
set
set
set
md5-key <id_integer> <key_str>
set
set
set
set
set
set
set
retransmit-interval <seconds_integer>
set
set
transmit-delay <seconds_integer>
end end
{bgp | connected | static | rip} set
set
set
set
set
end
config summary-address edit <summary-address_id>
set
end end end set
set
ospf
Fortinet Technologies Inc.
Page 395 FortiOS™ - CLI Reference for FortiOS 5.0
router ospf
config router ospf
Use this command to set the router ID of the FortiGate unit. Additional configuration options are supported.
The router-id field is required. All other fields are optional.
Variable
abr-type {cisco | ibm | shortcut | standard}
Description
Specify the behavior of a FortiGate unit acting as an
OSPF area border router (ABR) when it has multiple attached areas and has no backbone connection.
Selecting the ABR type compatible with the routers on your network can reduce or eliminate the need for configuring and maintaining virtual links. For more information, see RFC 3509.
auto-cost-ref-bandwidth
<mbps_integer>
Enter the Mbits per second for the reference bandwidth. Values can range from 1 to 65535.
bfd {enable | disable | global}
Select one of the Bidirectional Forwarding Detection
(BFD) options for this interface.
Default
standard
1000 disable database-overflow
{enable | disable} database-overflow-max-lsas
<lsas_integer> database-overflow-time-torecover <seconds_integer> default-information-metric
<metric_integer>
• enable - start BFD on this interface
• disable - stop BFD on this interface
• global - use the global settings instead of explicitly setting BFD per interface.
For the global settings see “system bfd
{enable | disable}” on page 672 .
Enable or disable dynamically limiting link state database size under overflow conditions. Enable this command for FortiGate units on a network with routers that may not be able to maintain a complete link state database because of limited resources.
If you have enabled database-overflow, set the limit for the number of external link state advertisements (LSAs) that the FortiGate unit can keep in its link state database before entering the overflow state. The lsas_integer must be the same on all routers attached to the OSPF area and the OSPF backbone. The valid range for lsas_integer is 0 to 4294967294.
Enter the time, in seconds, after which the FortiGate unit will attempt to leave the overflow state. If seconds_integer is set to 0, the FortiGate unit will not leave the overflow state until restarted. The valid range for seconds_integer is 0 to 65535.
Specify the metric for the default route set by the default-information-originate command.
The valid range for metric_integer is 1 to
16777214.
disable
10000
300
10
Fortinet Technologies Inc.
Page 396 FortiOS™ - CLI Reference for FortiOS 5.0
router
Variable
default-information-metrictype {1 | 2}
Description
Specify the OSPF external metric type for the default route set by the default-informationoriginate command.
Enter enable to advertise a default route into an
OSPF routing domain.
Default
2 disable default-information-originate
{always | disable | enable}
Use always to advertise a default route even if the
FortiGate unit does not have a default route in its routing table. default-information-route-map
<name_str>
If you have set default-informationoriginate to always, and there is no default route in the routing table, you can configure a route map to define the parameters that OSPF uses to advertise the default route. default-metric
<metric_integer> distance <distance_integer>
Specify the default metric that OSPF should use for redistributed routes. The valid range for metric_integer is 1 to 16777214.
Configure the administrative distance for all OSPF routes. Using administrative distance you can specify the relative priorities of different routes to the same destination. A lower administrative distance indicates a more preferred route. The valid range for distance_integer is 1 to 255.
Change the administrative distance of all external
OSPF routes. The range is from 1 to 255.
distance-external
<distance_integer> distance-inter-area
<distance_integer> distance-intra-area
<distance_integer> distribute-list-in
<access_list_name>
Change the administrative distance of all inter-area
OSPF routes. The range is from 1 to 255.
Change the administrative distance of all intra-area
OSPF routes. The range is from 1 to 255.
Limit route updates from the OSPF neighbor based on the Network Layer Reachability Information (NLRI) defined in the specified access list. You must create the access list before it can be selected here. See
“router access-list, access-list6” on page 342 .
passive-interface <name_str>
OSPF routing information is not sent or received through the specified interface.
restart-mode {graceful-restart | lls | none}
Select the restart mode from:
• graceful-restart - (also known as hitless restart) when FortiGate unit goes down it advertises to neighbors how long it will be down to reduce traffic
Null
10
110
110
110
110
Null
No default.
none restart-period <time_int>
• lls - Enable Link-local Signaling (LLS) mode
• none - hitless restart (graceful restart) is disabled
Enter the time in seconds the restart is expected to take.
120
ospf
Fortinet Technologies Inc.
Page 397 FortiOS™ - CLI Reference for FortiOS 5.0
router ospf
Variable
rfc1583-compatible
{enable | disable} router-id <address_ipv4> spf-timers <delay_integer>
<hold_integer>
Description
Enable or disable RFC 1583 compatibility. RFC 1583 compatibility should be enabled only when there is another OSPF router in the network that only supports
RFC 1583.
Default
disable
When RFC 1583 compatibility is enabled, routers choose the path with the lowest cost. Otherwise, routers choose the lowest cost intra-area path through a non-backbone area.
Set the router ID. The router ID is a unique number, in
IP address dotted decimal format, that is used to identify an OSPF router to other OSPF routers within an area. The router ID should not be changed while
OSPF is running.
0.0.0.0
A router ID of 0.0.0.0 is not allowed.
Change the default shortest path first (SPF) calculation delay time and frequency.
The delay_integer is the time, in seconds, between when OSPF receives information that will require an SPF calculation and when it starts an SPF calculation. The valid range for delay_integer is 0 to 4294967295.
5 10
The hold_integer is the minimum time, in seconds, between consecutive SPF calculations. The valid range for hold_integer is 0 to 4294967295.
OSPF updates routes more quickly if the SPF timers are set low; however, this uses more CPU. A setting of
0 for spf-timers can quickly use up all available
CPU.
Example
This example shows how to set the OSPF router ID to 1.1.1.1 for a standard area border router: config router ospf set abr-type standard end set router-id 1.1.1.1
config area
Use this subcommand to set OSPF area related parameters. Routers in an OSPF autonomous system (AS) or routing domain are organized into logical groupings called areas. Areas are linked together by area border routers (ABRs). There must be a backbone area that all areas can connect to. You can use a virtual link to connect areas that do not have a physical connection to the backbone. Routers within an OSPF area maintain link state databases for their own areas.
FortiGate units support the three main types of areas—stub areas, Not So Stubby areas (NSSA), and regular areas. A stub area only has a default route to the rest of the OSPF routing domain.
NSSA is a type of stub area that can import AS external routes and send them to the backbone, but cannot receive AS external routes from the backbone or other areas. All other areas are considered regular areas.
Fortinet Technologies Inc.
Page 398 FortiOS™ - CLI Reference for FortiOS 5.0
router ospf
You can use the config filter-list subcommand to control the import and export of LSAs into and out of an area. For more information, see
“config filter-list variables” on page 400
.
You can use access or prefix lists for OSPF area filter lists. For more information, see
“router access-list, access-list6” on page 342 and
“router prefix-list, prefix-list6” on page 421
.
You can use the config range subcommand to summarize routes at an area boundary. If the network numbers in an area are contiguous, the ABR advertises a summary route that includes all the networks within the area that are within the specified range. See
“config range variables” on page 400 .
You can configure a virtual link using the config virtual-link subcommand to connect an
connected area to reach the backbone. The transit area cannot be a stub area. Virtual links can only be set up between two ABRs.
If you define a filter list, the direction and list fields are required. If you define a range, the prefix field is required. If you define a virtual link, the peer field is required. All other fields are optional.
If you configure authentication for interfaces, the authentication configured for the area is overridden.
Variable
authentication {md5 | none | text}
Description
edit <area_address_ipv4> Type the IP address of the area. An address of 0.0.0.0 indicates the backbone area.
Define the authentication used for OSPF packets sent and received in this area. Choose one of:
Default
No default.
none
none — no authentication is used.
text — the authentication key is sent as plain text.
md5 — the authentication key is used to generate an MD5 hash.
Both text mode and MD5 mode only guarantee the authenticity of the OSPF packet, not the confidentiality of the information in the packet.
In text mode the key is sent in clear text over the network, and is only used to prevent network problems that can occur if a misconfigured router is mistakenly added to the area.
default-cost
<cost_integer>
Authentication passwords or keys are defined per interface. For more information, see
“config ospfinterface” on page 405 .
Enter the metric to use for the summary default route in a stub area or not so stubby area (NSSA). A lower default cost indicates a more preferred route.
10 nssa-default-informationoriginate
{enable | disable} nssa-default-informationoriginate-metric
<metric>
The valid range for cost_integer is 1 to 16777214.
Enter enable to advertise a default route in a not so stubby area. Affects NSSA ABRs or NSSA Autonomous
System Boundary Routers only.
Specify the metric (an integer) for the default route set by the nssa-default-information-originate field. disable
10
Fortinet Technologies Inc.
Page 399 FortiOS™ - CLI Reference for FortiOS 5.0
router ospf
Variable
nssa-default-informationoriginate-metric-type
{1 | 2} nssa-redistribution
{enable | disable} nssa-translator-role
{always | candidate | never}
Description
Specify the OSPF external metric type for the default route set by the nssa-default-information-originate field.
Default
2
Enable or disable redistributing routes into a NSSA area.
enable
A NSSA border router can translate the Type 7 LSAs used for external route information within the NSSA to Type 5
LSAs used for distributing external route information to other parts of the OSPF routing domain. Usually a NSSA will have only one NSSA border router acting as a translator for the NSSA.
candidate
You can set the translator role to always to ensure this
FortiGate unit always acts as a translator if it is in a NSSA, even if other routers in the NSSA are also acting as translators.
You can set the translator role to candidate to have this
FortiGate unit participate in the process for electing a translator for a NSSA.
You can set the translator role to never to ensure this
FortiGate unit never acts as the translator if it is in a NSSA.
Use this command to specify area shortcut parameters.
disable shortcut {default | disable
| enable} stub-type
{no-summary | summary} type
{nssa | regular | stub}
Enter no-summary to prevent an ABR sending summary
LSAs into a stub area. Enter summary to allow an ABR to send summary LSAs into a stub area.
Set the area type:
• Select nssa for a not so stubby area.
• Select regular for a normal OSPF area.
• Select stub for a stub area.
summary regular
This is not available for area 0.0.0.0.
For more information, see
.
config filter-list variables edit <filter-list_id> direction {in | out} list <name_str>
Enter an ID number for the filter list. The number must be an integer.
Set the direction for the filter. Enter in to filter incoming packets. Enter out to filter outgoing packets.
Enter the name of the access list or prefix list to use for this filter list.
config range variables edit <range_id> advertise
{enable | disable} prefix
<address_ipv4mask> substitute
<address_ipv4mask>
Enter an ID number for the range. The number must be an integer in the
0 to 4 294 967 295 range.
Enable or disable advertising the specified range.
No default.
enable
Specify the range of addresses to summarize.
Enter a prefix to advertise instead of the prefix defined for the range. The prefix
0.0.0.0 0.0.0.0 is not allowed.
No default.
out
Null.
0.0.0.0
0.0.0.0
0.0.0.0
0.0.0.0
Fortinet Technologies Inc.
Page 400 FortiOS™ - CLI Reference for FortiOS 5.0
router
Variable Description
substitute-status {enable | disable}
Enable or disable using a substitute prefix.
config virtual-link variables edit <vlink_name>
Enter a name for the virtual link.
authentication
{md5 | none | text}
Default
disable
Define the type of authentication used for OSPF packets sent and received over this virtual link. Choose one of:
none — no authentication is used.
text — the authentication key is sent as plain text.
md5 — the authentication key is used to generate an MD5 hash.
No default.
none
Both text mode and MD5 mode only guarantee the authenticity of the OSPF packet, not the confidentiality of the information in the packet.
authentication-key
<password_str> dead-interval
<seconds_integer> hello-interval
<seconds_integer>
In text mode the key is sent in clear text over the network, and is only used only to prevent network problems that can occur if a misconfigured router is mistakenly added to the area.
Enter the password to use for text authentication. The maximum length for the authentication-key is 15 characters.
*
(No default.)
The authentication-key used must be the same on both ends of the virtual link.
This field is only available when authentication is set to text.
The time in seconds to wait for a hello packet before declaring a router down. The value of the deadinterval should be four times the value of the hellointerval.
Both ends of the virtual link must use the same value for dead-interval.
The valid range for seconds_integer is 1 to 65535.
The time, in seconds, between hello packets.
40
10
Both ends of the virtual link must use the same value for hello-interval.
The value for dead-interval should be four times larger than the hello-interval value.
The valid range for seconds_integer is 1 to 65535.
ospf
Fortinet Technologies Inc.
Page 401 FortiOS™ - CLI Reference for FortiOS 5.0
router ospf
Variable
md5-key
<id_integer><key_str> peer <address_ipv4> retransmit-interval
<seconds_integer> transmit-delay
<seconds_integer>
Description
This field is available when authentication is set to md5.
Enter the key ID and password to use for
MD5 authentication. Example: set md5-key 6 "ENC yYKaPSrY89CeXn66WUybbLZQ5YM="
Both ends of the virtual link must use the same key ID and key.
Default
No default.
The valid range for id_integer is 1 to 255. key_str is an alphanumeric string of up to 16 characters.
The router id of the remote ABR.
0.0.0.0
0.0.0.0 is not allowed.
The time, in seconds, to wait before sending a LSA retransmission. The value for the retransmit interval must be greater than the expected round-trip delay for a packet.
The valid range for seconds_integer is 1 to 65535.
The estimated time, in seconds, required to send a link state update packet on this virtual link.
5
1
OSPF increments the age of the LSAs in the update packet to account for transmission and propagation delays on the virtual link.
Increase the value for transmit-delay on low speed links.
The valid range for seconds_integer is 1 to 65535.
Example
This example shows how to configure a stub area with the id 15.1.1.1, a stub type of summary, a default cost of 20, and MD5 authentication. config router ospf config area edit 15.1.1.1
set type stub end set stub-type summary set default-cost 20 set authentication md5 end
Fortinet Technologies Inc.
Page 402 FortiOS™ - CLI Reference for FortiOS 5.0
router ospf
This example shows how to use a filter list named acc_list1 to filter packets entering area
15.1.1.1.
config router ospf config area edit 15.1.1.1
config filter-list edit 1 set direction in set list acc_list1 end end
This example shows how to set the prefix for range 1 of area 15.1.1.1.
config router ospf config area edit 15.1.1.1
config range edit 1 set prefix 1.1.0.0 255.255.0.0
end end
This example shows how to configure a virtual link.
config router ospf config area edit 15.1.1.1
config virtual-link edit vlnk1 set peer 1.1.1.1
end end
config distribute-list
Use this subcommand to filter the networks for routing updates using an access list. Routes not matched by any of the distribution lists will not be advertised.
You must configure the access list that you want the distribution list to use before you configure the distribution list. To configure an access list, see
“router access-list, access-list6” on page 342 .
The access-list and protocol fields are required.
Variable Description
edit <distribute-list_id>
Enter an ID number for the distribution list. The number must be an integer.
access-list <name_str>
Enter the name of the access list to use for this distribution list.
protocol
{connected | rip | static}
Advertise only the routes discovered by the specified protocol and that are permitted by the named access list.
Default
No default.
Null connected
Fortinet Technologies Inc.
Page 403 FortiOS™ - CLI Reference for FortiOS 5.0
router
Example
This example shows how to configure distribution list 2 to use an access list named acc_list1 for all static routes.
config router ospf config distribute-list edit 2 set access-list acc_list1 end set protocol static end
config neighbor
Use this subcommand to manually configure an OSPF neighbor on non-broadcast networks.
OSPF packets are unicast to the specified neighbor address. You can configure multiple neighbors.
The ip field is required. All other fields are optional.
Variable
edit <neighbor_id> cost <cost_integer> ip <address_ipv4> poll-interval
<seconds_integer> priority
<priority_integer>
Description Default
Enter an ID number for the OSPF neighbor. The number must be an integer.
No default.
10
Enter the cost to use for this neighbor. The valid range for cost_integer is 1 to 65535.
Enter the IP address of the neighbor.
Enter the time, in seconds, between hello packets sent to the neighbor in the down state. The value of the poll interval must be larger than the value of the hello interval. The valid range for seconds_integer is 1 to 65535.
Enter a priority number for the neighbor. The valid range for priority_integer is 0 to 255.
1
0.0.0.0
10
ospf
Example
This example shows how to manually add a neighbor.
config router ospf config neighbor edit 1 set ip 192.168.21.63
end end
Fortinet Technologies Inc.
Page 404 FortiOS™ - CLI Reference for FortiOS 5.0
router ospf
config network
Use this subcommand to identify the interfaces to include in the specified OSPF area. The prefix field can define one or multiple interfaces.
The area and prefix fields are required.
Variable
edit <network_id>
Description
Enter an ID number for the network. The number must be an integer.
area <id-address_ipv4>
The ID number of the area to be associated with the prefix.
prefix <address_ipv4mask> Enter the IP address and netmask for the OSPF network.
Default
No default.
0.0.0.0
0.0.0.0
0.0.0.0
Example
Use the following command to enable OSPF for the interfaces attached to networks specified by the IP address 10.0.0.0 and the netmask 255.255.255.0 and to add these interfaces to area
10.1.1.1.
config router ospf config network edit 2 set area 10.1.1.1
end set prefix 10.0.0.0 255.255.255.0
end
config ospf-interface
Use this subcommand to configure interface related OSPF settings.
The interface field is required. All other fields are optional.
If you configure authentication for the interface, authentication for areas is not used.
Variable
edit
<ospf_interface_name>
Description Default
Enter a descriptive name for this OSPF interface configuration. To apply this configuration to a FortiGate unit interface, set the
No default.
Fortinet Technologies Inc.
Page 405 FortiOS™ - CLI Reference for FortiOS 5.0
router
Variable
authentication
{md5 | none | text} authentication-key
<password_str> bfd {enable | disable} cost <cost_integer> database-filter-out
{enable | disable} dead-interval
<seconds_integer> hello-interval
<seconds_integer> interface <name_str>
Description
Define the authentication used for OSPF packets sent and received by this interface. Choose one of:
none — no authentication is used.
text — the authentication key is sent as plain text.
md5 — the authentication key is used to generate an MD5 hash.
Default
none
Both text mode and MD5 mode only guarantee the authenticity of the update packet, not the confidentiality of the routing information in the packet.
In text mode the key is sent in clear text over the network, and is only used only to prevent network problems that can occur if a misconfigured router is mistakenly added to the network.
All routers on the network must use the same authentication type.
This field is available when authentication is set to text.
No default.
Enter the password to use for text authentication.
The authentication-key must be the same on all neighboring routers.
The maximum length for the authentication-key is 15 characters.
Select to enable Bi-directional Forwarding Detection (BFD).
It is used to quickly detect hardware problems on the network.
This command enables this service on this interface.
Specify the cost (metric) of the link. The cost is used for shortest path first calculations.
Enable or disable flooding LSAs out of this interface.
10 disable
The time, in seconds, to wait for a hello packet before declaring a router down. The value of the dead-interval should be four times the value of the hello-interval.
40
All routers on the network must use the same value for dead-interval.
The valid range for seconds_integer is 1 to 65535.
The time, in seconds, between hello packets.
10
All routers on the network must use the same value for hello-interval.
The value of the dead-interval should be four times the value of the hello-interval.
The valid range for seconds_integer is 1 to 65535.
Enter the name of the interface to associate with this OSPF configuration. The interface might be a virtual IPSec or GRE interface.
Null.
ospf
Fortinet Technologies Inc.
Page 406 FortiOS™ - CLI Reference for FortiOS 5.0
router
Variable
ip <address_ipv4> md5-key <id_integer>
<key_str> mtu <mtu_integer> mtu-ignore
{enable | disable} network-type <type> prefix-length <int>
Description
Enter the IP address of the interface named by the interface field.
Default
0.0.0.0
It is possible to apply different OSPF configurations for different IP addresses defined on the same interface.
This field is available when authentication is set to md5.
No default.
Enter the key ID and password to use for
MD5 authentication. Example: set md5-key 6 "ENC yYKaPSrY89CeXn66WUybbLZQ5YM="
You can add more than one key ID and key pair per interface. However, you cannot unset one key without unsetting all of the keys.
The key ID and key must be the same on all neighboring routers.
The valid range for id_integer is 1 to 255. key_str is an alphanumeric string of up to 16 characters.
Change the Maximum Transmission Unit (MTU) size included in database description packets sent out this interface. The valid range for mtu_integer is 576 to
65535.
1500
Use this command to control the way OSPF behaves when the Maximum Transmission Unit (MTU) in the sent and received database description packets does not match.
disable
When mtu-ignore is enabled, OSPF will stop detecting mismatched MTUs and go ahead and form an adjacency.
When mtu-ignore is disabled, OSPF will detect mismatched MTUs and not form an adjacency.
mtu-ignore should only be enabled if it is not possible to reconfigure the MTUs so that they match on both ends of the attempted adjacency connection.
Specify the type of network to which the interface is connected.
broadcast
OSPF supports four different types of network. This command specifies the behavior of the OSPF interface according to the network type. Choose one of: broadcast non-broadcast point-to-multipoint point-to-multipoint-non-broadcast point-to-point
If you specify non-broadcast, you must also configure neighbors using
“config neighbor” on page 404 .
Set the size of the OSPF hello network mask. Range
0 to 32.
0
ospf
Fortinet Technologies Inc.
Page 407 FortiOS™ - CLI Reference for FortiOS 5.0
router
Variable
priority
<priority_integer>
Description
Set the router priority for this interface.
Router priority is used during the election of a designated router (DR) and backup designated router (BDR).
An interface with router priority set to 0 can not be elected
DR or BDR. The interface with the highest router priority wins the election. If there is a tie for router priority, router ID is used.
Default
1
Point-to-point networks do not elect a DR or BDR; therefore, this setting has no effect on a point-to-point network.
resync-timeout
<integer>
The valid range for priority_integer is 0 to 255.
Enter the synchronizing timeout for graceful restart interval in seconds. This is the period for this interface to synchronize with a neighbor.
40 retransmit-interval
<seconds_integer>
The time, in seconds, to wait before sending a LSA retransmission. The value for the retransmit interval must be greater than the expected round-trip delay for a packet. The valid range for seconds_integer is 1 to 65535.
status {enable | disable} Enable or disable OSPF on this interface.
transmit-delay
<seconds_integer>
The estimated time, in seconds, required to send a link state update packet on this interface.
5 enable
1
OSPF increments the age of the LSAs in the update packet to account for transmission and propagation delays on the interface.
Increase the value for transmit-delay on low speed links.
The valid range for seconds_integer is 1 to 65535.
Example
This example shows how to assign an OSPF interface configuration named test to the interface named internal and how to configure text authentication for this interface.
config router ospf config ospf-interface edit test set interface internal end set ip 192.168.20.3
set authentication text set authentication-key a2b3c4d5e end
ospf
Fortinet Technologies Inc.
Page 408 FortiOS™ - CLI Reference for FortiOS 5.0
router ospf
config redistribute
Use this subcommand to redistribute routes learned from BGP, RIP, static routes, or a direct connection to the destination network.
The OSPF redistribution table contains four static entries. You cannot add entries to the table.
The entries are defined as follows:
• bgp — Redistribute routes learned from BGP.
• connected — Redistribute routes learned from a direct connection to the destination network.
• isis — Redistribute routes learned from ISIS.
• static — Redistribute the static routes defined in the FortiGate unit routing table.
• rip — Redistribute routes learned from RIP.
When you enter the subcommand, end the command with one of the four static entry names
(that is, config redistribute {bgp | connected | isis | static | rip}).
All fields are optional.
Variable Description
metric <metric_integer> Enter the metric to be used for the redistributed routes. The metric_integer range is from 1 to 16777214.
metric-type {1 | 2}
Specify the external link type to be used for the redistributed routes.
routemap <name_str>
Enter the name of the route map to use for the redistributed routes. For information on how to configure route maps, see
“router route-map” on page 438
.
status {enable | disable} Enable or disable redistributing routes.
tag <tag_integer>
Specify a tag for redistributed routes.
Default
10
2
Null disable
0
The valid range for tag_integer is 0 to 4294967295.
Example
This example shows how to enable route redistribution from RIP, using a metric of 3 and a route map named rtmp2.
config router ospf config redistribute rip set metric 3 set routemap rtmp2 end set status enable
Fortinet Technologies Inc.
Page 409 FortiOS™ - CLI Reference for FortiOS 5.0
router ospf
config summary-address
Use this subcommand to summarize external routes for redistribution into OSPF. This command works only for summarizing external routes on an Autonomous System Boundary Router
(ASBR). For information on summarization between areas, see
the OSPF link-state database.
The prefix field is required. All other fields are optional.
Variable Description
edit <summary-address_id>
Enter an ID number for the summary address. The number must be an integer.
advertise {enable | disable}
Advertise or suppress the summary route that matches the specified prefix.
prefix <address_ipv4mask>
Enter the prefix (IP address and netmask) to use for the summary route. The prefix
0.0.0.0 0.0.0.0 is not allowed.
tag <tag_integer>
Specify a tag for the summary route.
Default
No default.
enable
0.0.0.0
0.0.0.0
0
The valid range for tag_integer is 0 to 4294967295.
Fortinet Technologies Inc.
Page 410 FortiOS™ - CLI Reference for FortiOS 5.0
router
ospf6
ospf6
Use this command to configure OSPF routing for IPv6 traffic.
IP version 6 for OSPF is supported through Open Shortest Path First version 3 (OSPFv3) defined in RFC 2740. This includes the Authentication/Confidentiality for OSPFv3.
For more information on OSPF features in general, see “config router ospf” on page 396 .
Syntax
config router ospf6 set
abr-type {cisco | ibm | standard}
set
auto-cost-ref-bandwidth <mbps_integer>
set
default-metric <metric_integer>
set
set
set
spf-timers <delay_integer> <hold_integer>
config area
set
set
nssa-default-information-originate {enable | disable}
set
nssa-default-information-originate-metric <metric>
set
nssa-default-information-originate-metric-type {1 | 2}
set
nssa-redistribution {enable | disable}
set
nssa-translator-role {always | candidate | never}
set
stub-type {no-summary | summary}
set
end
config ospf6-interface edit <ospf6_interface_name>
set
set
set
dead-interval <seconds_integer>
set
hello-interval <seconds_integer>
set
set
set
set
retransmit-interval <seconds_integer>
set
set
transmit-delay <seconds_integer>
config neighbor
end end set
set
poll-interval <seconds_integer>
set
end
Fortinet Technologies Inc.
Page 411 FortiOS™ - CLI Reference for FortiOS 5.0
router ospf6
{bgp | connected | rip | static} set
set
set
end set
end
Variable
abr-type
{cisco | ibm | standard}
Description
Specify the behavior of a FortiGate unit acting as an
OSPF area border router (ABR) when it has multiple attached areas and has no backbone connection.
Selecting the ABR type compatible with the routers on your network can reduce or eliminate the need for configuring and maintaining virtual links. For more information, see RFC 3509.
auto-cost-ref-bandwidth
<mbps_integer> default-metric
<metric_integer>
Enter the Mbits per second for the reference bandwidth. Values can range from 1 to 65535.
Specify the default metric that OSPF should use for redistributed routes. The valid range for metric_integer is 1 to 16777214.
passive-interface
<name_str>
OSPF routing information is not sent or received through the specified interface.
router-id <address_ipv6>
Set the router ID. The router ID is a unique number, in
IP address dotted decimal format, that is used to identify an OSPF router to other OSPF routers within an area. The router ID should not be changed while
OSPF is running.
Default
standard
1000
10
No default.
:: spf-timers <delay_integer>
<hold_integer>
A router ID of 0.0.0.0 is not allowed.
Change the default shortest path first (SPF) calculation delay time and frequency.
5 10
The delay_integer is the time, in seconds, between when OSPF receives information that will require an
SPF calculation and when it starts an SPF calculation.
The valid range for delay_integer is 0 to
4294967295.
The hold_integer is the minimum time, in seconds, between consecutive SPF calculations. The valid range for hold_integer is 0 to 4294967295.
OSPF updates routes more quickly if the SPF timers are set low; however, this uses more CPU. A setting of
0 for spf-timers can quickly use up all available
CPU.
config area
Use this subcommand to set OSPF area related parameters. Routers in an OSPF autonomous system (AS) or routing domain are organized into logical groupings called areas. Areas are linked together by area border routers (ABRs). There must be a backbone area that all areas can connect to. You can use a virtual link to connect areas that do not have a physical connection to the backbone. Routers within an OSPF area maintain link state databases for their own areas.
Fortinet Technologies Inc.
Page 412 FortiOS™ - CLI Reference for FortiOS 5.0
router ospf6
You can use the config range subcommand to summarize routes at an area boundary. If the network numbers in an area are contiguous, the ABR advertises a summary route that includes all the networks within the area that are within the specified range. See
“config range variables” on page 400 .
You can configure a virtual link using the config virtual-link subcommand to connect an
connected area to reach the backbone. The transit area cannot be a stub area. Virtual links can only be set up between two ABRs.
Variable
edit
<area_address_ipv6> default-cost
<cost_integer> nssa-defaultinformation-originate
{enable | disable} nssa-defaultinformation-originatemetric <metric>
Description Default
Type the IP address of the area. An address of :: indicates the backbone area.
No default.
10
Enter the metric to use for the summary default route in a stub area or not so stubby area (NSSA). A lower default cost indicates a more preferred route.
The valid range for cost_integer is 1 to 16777214.
Enter enable to advertise a default route in a not so stubby area. Affects NSSA ABRs or NSSA Autonomous
System Boundary Routers only.
Specify the metric (an integer) for the default route set by the nssa-default-information-originate field. disable
10
Range 0-16 777 214.
Specify the OSPF external metric type for the default route set by the nssa-default-information-originate field.
2
Enable or disable redistributing routes into a NSSA area.
enable nssa-defaultinformation-originatemetric-type {1 | 2} nssa-redistribution
{enable | disable} nssa-translator-role
{always | candidate
| never}
A NSSA border router can translate the Type 7 LSAs used for external route information within the NSSA to Type 5
LSAs used for distributing external route information to other parts of the OSPF routing domain. Usually a NSSA will have only one NSSA border router acting as a translator for the NSSA.
candidate
You can set the translator role to always to ensure this
FortiGate unit always acts as a translator if it is in a NSSA, even if other routers in the NSSA are also acting as translators.
You can set the translator role to candidate to have this
FortiGate unit participate in the process for electing a translator for a NSSA.
You can set the translator role to never to ensure this
FortiGate unit never acts as the translator if it is in a NSSA.
stub-type {no-summary
| summary}
Select the type of communication with the stub area.
Choose one of: summary
no-summary — prevent an ABR sending summary LSAs into a stub area.
summary — allow an ABR to send summary LSAs into a stub area.
Fortinet Technologies Inc.
Page 413 FortiOS™ - CLI Reference for FortiOS 5.0
router ospf6
Variable
type
{regular | stub | nssa}
Description
For the type of area, choose one of:
regular — for a normal OSPF area.
stub — for a stub area that has limited connections to other areas.
Default
regular
nssa — for a not so stubby area
config range Variables
edit <range_id>
Enter an ID number for the range. The number must be an integer in the
0 to 4 294 967 295 range.
advertise
{enable | disable} prefix6
<address_ipv6mask>
Enable or disable advertising the specified range.
Specify the range of addresses to summarize.
No default.
enable
::/0
config virtual-link Variables
edit <vlink_name> dead-interval
<seconds_integer>
Enter a name for the virtual link.
The time, in seconds, to wait for a hello packet before declaring a router down. The value of the deadinterval should be four times the value of the hellointerval.
No default.
40
Both ends of the virtual link must use the same value for dead-interval.
hello-interval
<seconds_integer>
The valid range for seconds_integer is 1 to 65535.
The time, in seconds, between hello packets.
Both ends of the virtual link must use the same value for hello-interval.
The valid range for seconds_integer is 1 to 65535.
peer <address_ipv4>
The router id of the remote ABR.
retransmit-interval
<seconds_integer> transmit-delay
<seconds_integer>
10
0.0.0.0
0.0.0.0 is not allowed.
The time, in seconds, to wait before sending a LSA retransmission. The value for the retransmit interval must be greater than the expected round-trip delay for a packet.
The valid range for seconds_integer is 1 to 65535.
The estimated time, in seconds, required to send a link state update packet on this virtual link.
5
1
OSPF increments the age of the LSAs in the update packet to account for transmission and propagation delays on the virtual link.
Increase the value for transmit-delay on low speed links.
The valid range for seconds_integer is 1 to 65535.
Fortinet Technologies Inc.
Page 414 FortiOS™ - CLI Reference for FortiOS 5.0
router ospf6
config ospf6-interface
Use this subcommand to change interface related OSPF settings. The interface field is required. All other fields are optional.
Variable
edit
<ospf6_interface_name> area-id <ip4_addr> cost <cost_integer> dead-interval
<seconds_integer>
Description Default
Enter a descriptive name for this OSPF interface configuration. To apply this configuration to a FortiGate
unit interface, set the interface <name_str>
attribute.
Enter the area ID in A.B.C.D IPv4 format.
Specify the cost (metric) of the link. The cost is used for shortest path first calculations. Range 1 to 65 535. Use 0 for auto-cost.
0.0.0.0
0
40
The time, in seconds, to wait for a hello packet before declaring a router down. The value of the deadinterval should be four times the value of the hellointerval.
No default.
All routers on the network must use the same value for dead-interval.
The valid range for seconds_integer is 1 to 65535.
The time, in seconds, between hello packets. hello-interval
<seconds_integer>
10
All routers on the network must use the same value for hello-interval.
The valid range for seconds_integer is 1 to 65535.
interface <name_str>
Enter the name of the interface to associate with this
OSPF configuration. The interface might be a virtual
IPSec or GRE interface.
network-type <type_str> Choose the network type, one of: broadcast, non-broadcast, point-to-point, point-to-multipoint, point-to-multipoint-non-broadcast.
priority
<priority_integer>
Set the router priority for this interface.
Router priority is used during the election of a designated router (DR) and backup designated router (BDR).
Null broadcast
1 retransmit-interval
<seconds_integer> status
{enable | disable}
An interface with router priority set to 0 can not be elected DR or BDR. The interface with the highest router priority wins the election. If there is a tie for router priority, router ID is used.
Point-to-point networks do not elect a DR or BDR; therefore, this setting has no effect on a point-to-point network.
The valid range for priority_integer is 0 to 255.
The time, in seconds, to wait before sending a LSA retransmission. The value for the retransmit interval must be greater than the expected round-trip delay for a packet. The valid range for seconds_integer is 1 to
65535.
5
Enable or disable OSPF on this interface.
enable
Fortinet Technologies Inc.
Page 415 FortiOS™ - CLI Reference for FortiOS 5.0
router ospf6
Variable
transmit-delay
<seconds_integer>
Description
The estimated time, in seconds, required to send a link state update packet on this interface.
Default
1
OSPF increments the age of the LSAs in the update packet to account for transmission and propagation delays on the interface.
Increase the value for transmit-delay on low speed links.
The valid range for seconds_integer is 1 to 65535.
config neighbor variables
edit <neighbor_addr>
Enter the IPv6 link local address of the neighbor.
cost <cost_integer> poll-interval
<seconds_integer> priority
<priority_integer>
Enter the cost to use for this neighbor. The valid range for cost_integer is 1 to 65535.
Enter the time, in seconds, between hello packets sent to the neighbor in the down state. The value of the poll interval must be larger than the value of the hello interval.
The valid range for seconds_integer is 1 to 65535.
Enter a priority number for the neighbor. The valid range for priority_integer is 0 to 255.
No default.
10
10
1
config redistribute
Use this subcommand to redistribute routes learned from BGP, RIP, static routes, or a direct connection to the destination network.
The OSPF redistribution table contains four static entries. You cannot add entries to the table.
The entries are defined as follows:
• bgp — Redistribute routes learned from BGP.
• connected — Redistribute routes learned from a direct connection to the destination network.
• isis — Redistribute routes learned from ISIS.
• static — Redistribute the static routes defined in the FortiGate unit routing table.
• rip — Redistribute routes learned from RIP.
When you enter the subcommand, end the command with one of the four static entry names
(that is, config redistribute {bgp | connected | isis | rip | static}).
All fields are optional.
Variable Description
metric <metric_integer> Enter the metric to be used for the redistributed routes.
The metric_integer range is from 1 to 16777214.
metric-type {1 | 2}
Specify the external link type to be used for the redistributed routes.
routemap <name_str>
Enter the name of the route map to use for the redistributed routes. status {enable | disable} Enable or disable redistributing routes.
Default
10
2
Null.
disable
Fortinet Technologies Inc.
Page 416 FortiOS™ - CLI Reference for FortiOS 5.0
router policy, policy6
policy, policy6
Use this command to add, move, edit or delete a route policy. When you create a policy route, any packets that match the policy are forwarded to the IP address of the next-hop gateway through the specified outbound interface.
You can configure the FortiGate unit to route packets based on:
• a source address
• a protocol, service type, or port range
• the inbound interface
• type of service (TOS)
When the FortiGate unit receives a packet, it starts at the top of the policy routing list and attempts to match the packet with a policy in ascending order. If no packets match the policy route, the FortiGate unit routes the packet using the routing table. Route policies are processed before static routing. You can change the order of policy routes using the move command.
For static routing, any number of static routes can be defined for the same destination. When multiple routes for the same destination exist, the FortiGate unit chooses the route having the lowest administrative distance. Route redundancy is not available for policy routing: any packets that match a route policy are forwarded according to the route specified in the policy.
Type of service (TOS) is an 8-bit field in the IP header that enables you to determine how the IP datagram should be delivered, with such criteria as delay, priority, reliability, and minimum cost.
Each quality helps gateways determine the best way to route datagrams. A router maintains a
ToS value for each route in its routing table. The lowest priority TOS is 0, the highest is 7 - when bits 3, 4, and 5 are all set to 1. The router tries to match the TOS of the datagram to the TOS on one of the possible routes to the destination. If there is no match, the datagram is sent over a zero TOS route. Using increased quality may increase the cost of delivery because better performance may consume limited network resources. For more information see RFC 791 and
RFC 1349.
Table 1: The role of each bit in the IP header TOS 8-bit field bits 0, 1, 2 Precedence
Some networks treat high precedence traffic as more important traffic. Precedence should only be used within a network, and can be used differently in each network. Typically you do not care about these bits.
bit 3 Delay
When set to 1, this bit indicates low delay is a priority. This is useful for such services as VoIP where delays degrade the quality of the sound.
bit 4 bit 5
Throughput
When set to 1, this bit indicates high throughput is a priority. This is useful for services that require lots of bandwidth such as video conferencing.
Reliability
When set to 1, this bit indicates high reliability is a priority. This is useful when a service must always be available such as with
DNS servers.
Fortinet Technologies Inc.
Page 417 FortiOS™ - CLI Reference for FortiOS 5.0
router policy, policy6
Table 1: The role of each bit in the IP header TOS 8-bit field bit 6 bit 7
Cost
When set to 1, this bit indicates low cost is a priority. Generally there is a higher delivery cost associated with enabling bits 3,4, or 5, and bit 6 indicates to use the lowest cost route.
Reserved for future use
Not used at this time.
The two fields tos and tos-mask enable you to configure type of service support on your
FortiGate unit. tos-mask enables you to only look at select bits of the 8-bit TOS field in the IP header. This is useful as you may only care about reliability for some traffic, and not about the other TOS criteria.
The value in tos is used to match the pattern from tos-mask. If it matches, then the rest of the policy is applied. If the mask doesn’t match, the next policy tries to match if its configured, and eventually default routing is applied if there are no other matches.
You need to use tos-mask to remove bits from the pattern you don’t care about, or those bits will prevent a match with your tos pattern.
Syntax
config router policy, policy6
move <seq-num1> {before | after} <seq-num2> edit <policy_integer>
set start-port <port_integer> set start-source-port <port_integer> set tos <hex_mask>
end
Use the router policy6 command for IPv6 policy routes. The input-device field is required. All other fields are optional.
Variable
move <seq-num1>
{before | after} <seq-num2> edit <policy_integer>
Description
Move policy <seq-num1> to before or after policy.
<seq-num2>.
Default
No default.
Enter an ID number for the route policy. The number must be an integer.
No default.
Fortinet Technologies Inc.
Page 418 FortiOS™ - CLI Reference for FortiOS 5.0
router policy, policy6
Variable
dst
<dest-address_ipv4mask>
Description
Match packets that have this destination IP address and netmask.
Default
IPv4:
0.0.0.0 0.0.0.0
end-port <port_integer>
IPv6:
The end port number of a port range for a policy route. Match packets that have this destination port range. You must configure both the start-port and end-port fields for destination-port-range matching to take effect. To specify a range, the start-port value must be lower than the endport value. To specify a single port, the startport value must be identical to the end-port value. The port_integer range is 0 to 65 535.
::/0
65 535
For protocols other than 6 (TCP), 17 (UDP), and 132
(SCTP) the port number is ignored.
end-source-port
<port_integer>
Set port range for source IP. Use in combination with start-source-port. Available when protocol is 6 (TCP), 17 (UDP), or 132 (SCTP).
65 535 gateway <address_ipv4>
Send packets that match the policy to this next hop router.
0.0.0.0
input-device
<interface-name_str> output-device
<interface-name_str>
Match packets that are received on this interface.
Send packets that match the policy out this interface. protocol <protocol_integer> To perform policy routing based on the value in the protocol field of the packet, enter the protocol number to match. The Internet Protocol Number is found in the IP packet header. RFC 5237 describes protocol numbers and you can find a list of the assigned protocol numbers here . The range is from
0 to 255. A value of
0 disables the feature.
Null
Null
0
Commonly used protocol settings include 6 to route
TCP sessions, 17 for UDP sessions, 1 for ICMP sessions, 47 for GRE sessions, and 92 for multicast sessions.
src
<source-address_ipv4mask>
For protocols other than 6 (TCP), 17 (UDP), and 132
(SCTP) the port number is ignored.
Match packets that have this source IP address and netmask.
IPv4:
0.0.0.0 0.0.0.0
IPv6:
::/0
Fortinet Technologies Inc.
Page 419 FortiOS™ - CLI Reference for FortiOS 5.0
router
Variable
start-port <port_integer> start-source-port
<port_integer> tos <hex_mask> tos-mask <hex_mask>
policy, policy6
Description
The start port number of a port range for a policy route. Match packets that have this destination port range. You must configure both the start-port and end-port fields for destination-port-range matching to take effect. To specify a range, the start-port value must be lower than the endport value. To specify a single port, the startport value must be identical to the end-port value. The port_integer range is 0 to 65 535.
Default
1
For protocols other than 6 (TCP), 17 (UDP), and 132
(SCTP) the port number is ignored.
Set port range for source IP. Use in combination with end-source-port. Available when protocol is
6 (TCP), 17 (UDP), or 132 (SCTP).
1
The type of service (TOS) mask to match after applying the tos-mask. This is an 8-bit hexadecimal pattern that can be from
“00” to “FF”.
Null
The tos mask attempts to match the quality of service for this profile. Each bit in the mask represents a different aspect of quality. A tos mask of “0010” would indicate reliability is important, but with normal delay and throughput. The hex mask for this pattern would be “
04”.
This value determines which bits in the IP header’s
TOS field are significant. This is an 8-bit hexadecimal mask that can be from
“00” to “FF”.
Null
Typically, only bits 3 through 6 are used for TOS, so it is necessary to mask out the other bits. To mask out everything but bits 3 through 6, the hex mask would be “1E”.
Fortinet Technologies Inc.
Page 420 FortiOS™ - CLI Reference for FortiOS 5.0
router prefix-list, prefix-list6
prefix-list, prefix-list6
Use this command to add, edit, or delete prefix lists. A prefix list is an enhanced version of an access list that allows you to control the length of the prefix netmask. Prefix lists are called by routing protocols such as RIP or OSPF.
Each rule in a prefix list consists of a prefix (IP address and netmask), the action to take for this prefix (permit or deny), and maximum and minimum prefix length settings.
The FortiGate unit attempts to match a packet against the rules in a prefix list starting at the top of the list. If it finds a match for the prefix it takes the action specified for that prefix. If no match is found the default action is deny. A prefix-list should be used to match the default route
0.0.0.0/0.
config router setting uses prefix-list to filter the displayed routes. For more information, see
Syntax
config router prefix-list, prefix-list6
edit <prefix_list_name> set comments <string>
config rule
set
set
set
end set
prefix {<address_ipv4mask> | any}
set
prefix6 {<address_ipv6mask> | any}
end
The action and prefix fields are required. All other fields are optional.
Variable Description
edit <prefix_list_name>
Enter a name for the prefix list. A prefix list and an access list cannot have the same name.
config rule variables
edit <prefix_rule_id> action {deny | permit} comments <string> ge <length_integer> le <length_integer>
Default
No default.
Enter an entry number for the rule. The number must be an integer.
Set the action to take for this prefix.
No default.
permit
Enter a description of this access list entry. The description can be up to 127 characters long.
Match prefix lengths that are greater than or equal to this number. The setting for ge should be less than the setting for le. The setting for ge should be greater than the netmask set for prefix. length_integer can be any number from 0 to 32.
0
Match prefix lengths that are less than or equal to this number. The setting for le should be greater than the setting for ge. length_integer can be any number from
0 to 32.
32
Fortinet Technologies Inc.
Page 421 FortiOS™ - CLI Reference for FortiOS 5.0
router prefix-list, prefix-list6
Variable
prefix
{<address_ipv4mask> | any} prefix6
{<address_ipv6mask> | any}
Description
Enter the prefix (IPv4 address and netmask) for this prefix list rule or enter any to match any prefix. The length of the netmask should be less than the setting for ge. If prefix is set to any, ge and le should not be set.
Default
0.0.0.0
0.0.0.0
This variable only available for prefix-list command.
Enter the prefix (IPv6 address and netmask) for this prefix list rule or enter any to match any prefix. The length of the netmask should be less than the setting for ge. If prefix6 is set to any, ge and le should not be set.
::/0
This variable only available for prefix-list6 command.
Fortinet Technologies Inc.
Page 422 FortiOS™ - CLI Reference for FortiOS 5.0
router
rip
Use this command to configure the Routing Information Protocol (RIP) on the FortiGate unit. RIP is a distance-vector routing protocol intended for small, relatively homogeneous networks. RIP uses hop count as its routing metric. Each network is usually counted as one hop. The network diameter is limited to 15 hops with 16 hops.
The FortiOS implementation of RIP supports RIP version 1 (see RFC 1058) and RIP version 2
(see RFC 2453). RIP version 2 enables RIP messages to carry more information, and to support simple authentication and subnet masks.
update_timer cannot be larger than timeout_timer and garbage_timer. Attempts to do so will generate an error.
rip
Syntax
set
default-information-originate {enable | disable}
set
default-metric <metric_integer>
set
set
set
set
set
config distance edit <distance_id>
set
set
set
end
set
set
set
listname <access/prefix-listname_str>
set
end
set
set
set
set
set
set
send-version2-broadcast {enable | disable}
set
split-horizon {poisoned | regular}
set
split-horizon-status {enable | disable}
end
Fortinet Technologies Inc.
Page 423 FortiOS™ - CLI Reference for FortiOS 5.0
router
config neighbor edit <neighbor_id>
set
end
config network edit <network_id>
set
end
config offset-list edit <offset_list_id>
set
set
set
set
set
end
{connected | static | ospf | bgp}
end
set routemap <name_str> set status {enable | disable}
config router rip
Use this command to specify RIP operating parameters.
All fields are optional.
Variable
garbage-timer
<timer_integer>
Description
The time in seconds that must elapse after the timeout interval for a route expires, before RIP deletes the route.
If RIP receives an update for the route after the timeout timer expires but before the garbage timer expires then the entry is switched back to reachable.
Default
default-information-originate
{enable | disable}
Enter enable to advertise a default static route into RIP. disable default-metric
<metric_integer>
For non-default routes in the static routing table and directly connected networks the default metric is the metric that the FortiGate unit advertises to adjacent routers. This metric is added to the metrics of learned routes. The default metric can be a number from 1 to 16.
1
120
RIP timer defaults are effective in most configurations. All routers and access servers in the network should have the same RIP timer settings.
The update timer interval can not be larger than the garbage timer interval.
passive-interface <name_str> Block RIP broadcasts on the specified interface. You can use
“config neighbor” on page 429 and the passive
interface command to allow RIP to send unicast updates to the specified neighbor while blocking broadcast updates on the specified interface.
No default.
rip
Fortinet Technologies Inc.
Page 424 FortiOS™ - CLI Reference for FortiOS 5.0
router
Variable
timeout-timer
<timer_integer> update-timer
<timer_integer> version {1 2}
Description
The time interval in seconds after which a route is declared unreachable. The route is removed from the routing table. RIP holds the route until the garbage timer expires and then deletes the route. If RIP receives an update for the route before the timeout timer expires, then the timeout-timer is restarted. If RIP receives an update for the route after the timeout timer expires but before the garbage timer expires then the entry is switched back to reachable. The value of the timeout timer should be at least three times the value of the update timer.
Default
180
RIP timer defaults are effective in most configurations. All routers and access servers in the network should have the same RIP timer settings.
The update timer interval can not be larger than the timeout timer interval.
The time interval in seconds between RIP updates.
30
RIP timer defaults are effective in most configurations. All routers and access servers in the network should have the same RIP timer settings.
The update timer interval can not be larger than timeout or garbage timer intervals.
Enable sending and receiving RIP version 1 packets, RIP version 2 packets, or both for all RIP-enabled interfaces.
You can override this setting on a per interface basis using the
receive-version {1 2} and send-version {1 2}
fields described under “config interface” on page 427 .
2
Example
This example shows how to enable the advertising of a default static route into RIP, enable the sending and receiving of RIP version 1 packets, and raise the preference of local routes in the static routing table (the default metric) from the default of 1 to 5 - those routes well be less preferred.
config router rip set default-information-originate enable end set version 1 set default-metric 5
rip
Fortinet Technologies Inc.
Page 425 FortiOS™ - CLI Reference for FortiOS 5.0
router
config distance
Use this subcommand to specify an administrative distance. When different routing protocols provide multiple routes to the same destination, the administrative distance sets the priority of those routes. The lowest administrative distance indicates the preferred route.
If you specify a prefix, RIP uses the specified distance when the source IP address of a packet matches the prefix.
The distance field is required. All other fields are optional.
Variable
edit <distance_id> access-list
<name_str> distance
<distance_integer> prefix
<address_ipv4mask>
Description
Enter an ID number for the distance. The number must be an integer.
Default
No default.
Enter the name of an access list. The distances associated with the routes in the access list will be modified. To create an access list, see
“router access-list, access-list6” on page 342 .
Null
Enter a number from 1 to 255, to set the administrative distance.
0
This field is required.
Optionally enter a prefix to apply the administrative distance to.
0.0.0.0
0.0.0.0
rip
Example
This example shows how to change the administrative distance to 10 for all IP addresses that match the internal_example access-list.
config router rip config distance edit 1 set distance 10 end set access-list internal_example end
config distribute-list
Use this subcommand to filter incoming or outgoing updates using an access list or a prefix list.
If you do not specify an interface, the filter will be applied to all interfaces. You must configure the access list or prefix list that you want the distribution list to use before you configure the distribution list. For more information on configuring access lists and prefix lists, see
“router access-list, access-list6” on page 342 and
“router prefix-list, prefix-list6” on page 421
.
Fortinet Technologies Inc.
Page 426 FortiOS™ - CLI Reference for FortiOS 5.0
router
The direction and listname fields are required. All other fields are optional.
Variable
edit <distribute_list_id> direction {in | out}
Description
Enter an ID number for the distribution list. The number must be an integer.
Set the direction for the filter.
Enter in to filter incoming packets that originate from other routers.
Default
No default.
out
Enter out to filter outgoing packets the FortiGate unit is sending to other routers.
interface <name_str>
Enter the name of the interface to apply this distribution list to. If you do not specify an interface, this distribution list will be used for all interfaces.
listname
<access/prefix-listname_str>
Enter the name of the access list or prefix list to use for this distribution list.
Null
Null status {enable | disable}
The prefix or access list used must be configured before configuring the distribute-list.
Enable or disable this distribution list.
disable
Example
This example shows how to configure and enable a distribution list to use an access list named allowed_routers for incoming updates on the external interface.
config router rip config distribute-list edit 1 set direction in end set interface external set listname allowed_routers set status enable end
config interface
Use this subcommand to configure RIP version 2 authentication, RIP version send and receive for the specified interface, and to configure and enable split horizon.
Authentication is only available for RIP version 2 packets sent and received by an interface. You must set auth-mode to none when receive-version or send-version are set to 1 or 1 2
(both are set to
1 by default).
A split horizon occurs when a router advertises a route it learns over the same interface it learned it on. In this case the router that gave the learned route to the last router now has two entries to get to another location. However, if the primary route fails that router tries the second route to find itself as part of the route and an infinite loop is created. A poisoned split horizon will still advertise the route on the interface it received it on, but it will mark the route as unreachable. Any unreachable routes are automatically removed from the routing table. This is also called split horizon with poison reverse.
rip
Fortinet Technologies Inc.
Page 427 FortiOS™ - CLI Reference for FortiOS 5.0
router
All fields are optional.
Variable
auth-keychain
<name_str>
Description
edit <interface_name>
Type the name of the FortiGate unit interface that is linked to the RIP network. The interface might be a virtual IPSec or GRE interface.
Enter the name of the key chain to use for authentication for RIP version 2 packets sent and received by this interface. Use key chains when you want to configure multiple keys. For information on how to configure key chains, see
auth-mode
{none | text | md5}
Use the auth-mode field to define the authentication used for RIP version 2 packets sent and received by this interface. Choose one of:
Default
No default.
Null.
none
none — no authentication is used.
text — the authentication key is sent as plain text.
md5 — the authentication key is used to generate an MD5 hash.
Both text mode and MD5 mode only guarantee the authenticity of the update packet, not the confidentiality of the routing information in the packet.
auth-string
<password_str> receive-version {1 2} send-version {1 2}
In text mode the key is sent in clear text over the network.
Text mode is usually used only to prevent network problems that can occur if an unwanted or misconfigured router is mistakenly added to the network.
Use the auth-string field to specify the key.
Enter a single key to use for authentication for RIP version
2 packets sent and received by this interface. Use authstring when you only want to configure one key. The key can be up to 35 characters long.
Null
RIP routing messages are UDP packets that use port 520.
Choose one of:
No default.
1 — configure RIP to listen for RIP version 1 messages on an interface.
2 — configure RIP to listen for RIP version 2 messages on an interface.
1 2 — configure RIP to listen for both RIP version 1 and
RIP version 2 messages on an interface.
RIP routing messages are UDP packets that use port 520.
Choose one of:
No default.
1 — configure RIP to send for RIP version 1 messages on an interface.
2 — configure RIP to send for RIP version 2 messages on an interface.
1 2 — configure RIP to send for both RIP version 1 and
RIP version 2 messages on an interface.
rip
Fortinet Technologies Inc.
Page 428 FortiOS™ - CLI Reference for FortiOS 5.0
router
Variable
send-version2-broadcast
{enable | disable}
Description
Enable or disable sending broadcast updates from an interface configured for RIP version 2. split-horizon
{poisoned | regular} split-horizon-status
{enable | disable}
Default
disable
RIP version 2 normally multicasts updates. RIP version 1 can only receive broadcast updates.
Configure RIP to use either regular or poisoned split horizon on this interface. Choose one of:
regular — prevent RIP from sending updates for a route back out on the interface from which it received that route. poisoned
poisoned — send updates with routes learned on an interface back out the same interface but mark those routes as unreachable.
Enable or disable split horizon for this interface. Split horizon is enabled by default. enable
Disable split horizon only if there is no possibility of creating a counting to infinity loop when network topology changes.
Example
This example shows how to configure the external interface to send and receive RIP version 2, to use MD5 authentication, and to use a key chain called test1.
config router rip config interface edit external set receive-version 2 end set send-version 2 set auth-mode md5 set auth-keychain test1 end
config neighbor
Use this subcommand to enable RIP to send unicast routing updates to the router at the specified address. You can use the neighbor subcommand and
to allow RIP to send unicast updates to the specified neighbor while blocking broadcast updates on the specified interface. You can configure multiple neighbors.
The ip field is required. All other fields are optional.
Variable Description
edit <neighbor_id>
Enter an ID number for the RIP neighbor. The number must be an integer.
ip <address_ipv4>
Enter the IPv4 address of the neighboring router to which to send unicast updates.
Default
No default.
0.0.0.0
rip
Fortinet Technologies Inc.
Page 429 FortiOS™ - CLI Reference for FortiOS 5.0
router
Example
This example shows how to specify that the router at 192.168.21.20 is a neighbor.
config router rip config neighbor edit 1 set ip 192.168.21.20
end end
config network
Use this subcommand to identify the networks for which to send and receive RIP updates. If a network is not specified, interfaces in that network will not be advertised in RIP updates. The prefix field is optional.
Variable
edit <network_id>
Description
Enter an entry number for the RIP network. The number must be an integer.
prefix <address_ipv4mask> Enter the IPv4 address and netmask for the RIP network.
Default
No default.
0.0.0.0
0.0.0.0
rip
Example
Use the following command to enable RIP for the interfaces attached to networks specified by the IP address 10.0.0.0 and the netmask 255.255.255.0.
config router rip config network edit 2 set prefix 10.0.0.0 255.255.255.0
end end
config offset-list
Use this subcommand to add the specified offset to the metric (hop count) of a route from the offset list. The access-list, direction, and offset fields are required. All other fields are optional.
Variable Description
edit <offset_list_id>
Enter an ID number for the offset list. The number must be an integer.
access-list <name_str> Enter the name of the access list to use for this offset list.
The access list is used to determine which routes to add
the metric to. For more information, see “router accesslist, access-list6” on page 342 .
direction {in | out}
Enter in to apply the specified offset to the metrics of routes originating on other routers—incoming routes.
Default
No default.
Null out
Enter out to apply the specified offset to the metrics of routes leaving from the FortiGate unit—outgoing routes.
interface <name_str>
Enter the name of the interface to match for this offset list. Null
Fortinet Technologies Inc.
Page 430 FortiOS™ - CLI Reference for FortiOS 5.0
router
Variable
offset
<metric_integer>
Description
Enter the offset number to add to the metric. The metric is the hop count. The
metric_integer range is from 1 to
16, with 16 being unreachable.
Default
0
For example if a route has already has a metric of 5, an offset of 10 will increase the metric to 15 for that route.
Enable or disable this offset list.
disable status
{enable | disable}
Example
This example shows how to configure and enable offset list ID number 5. This offset list entry adds a metric of 3 to incoming routes that match the access list named acc_list1 on the external interface.
config router rip config offset-list edit 5 set access-list acc_list1 end end set direction in set interface external set offset 3 set status enable
config redistribute
Use this subcommand to advertise routes learned from OSPF, BGP, static routes, or a direct connection to the destination network.
The RIP redistribution table contains four static entries. You cannot add entries to the table. The entries are defined as follows:
• bgp — Redistribute routes learned from BGP.
• connected — Redistribute routes learned from a direct connection to the destination network.
• isis — Redistribute routes learned from ISIS.
• ospf — Redistribute routes learned from OSPF.
• static — Redistribute the static routes defined in the FortiGate unit routing table.
When you enter the subcommand, end the command with one of the four static entry names
(that is, config redistribute {bgp | connected | isis | ospf | static}). All fields are optional.
Variable Description
metric <metric_integer> Enter the metric value to be used for the redistributed routes. The
metric_integer range is from 0 to 16.
routemap <name_str>
Enter the name of the route map to use for the redistributed routes. For information on how to configure route maps, see
“router route-map” on page 438 .
status {enable | disable}
Enable or disable advertising non-RIP routes.
Default
0
Null.
disable
rip
Fortinet Technologies Inc.
Page 431 FortiOS™ - CLI Reference for FortiOS 5.0
router
ripng
ripng
Use this command to configure the “next generation” Routing Information Protocol (RIPng) on the FortiGate unit. RIPng is a distance-vector routing protocol intended for small, relatively homogeneous, IPv6 networks. RIPng uses hop count as its routing metric. Each network is usually counted as one hop. The network diameter is limited to 15 hops. RIPng is defined in
RFC 2080.
Syntax
config router ripng set
default-information-originate {enable | disable}
set
default-metric <metric_integer>
set
set
set
set
config aggregate-address edit <entry-id>
set
end
set
set
set
end
edit <entry-id>config distribute-list
set
set
set
listname <access/prefix-listname_str>
set
end
set
split-horizon {poisoned | regular}
set
split-horizon-status {enable | disable}
end
config neighbor edit <neighbor_id>
set
end
config offset-list edit <offset_list_id>
set
set
set
set
Fortinet Technologies Inc.
Page 432 FortiOS™ - CLI Reference for FortiOS 5.0
router ripng
set
end
{connected | static | ospf | bgp}
end
set routemap <name_str> set status {enable | disable}
All fields are optional.
Variable
default-information-originate
{enable | disable} default-metric
<metric_integer> garbage-timer
<timer_integer>
Description
Enter enable to advertise a default static route into
RIPng.
Default
disable
For non-default routes in the static routing table and directly connected networks the default metric is the metric that the FortiGate unit advertises to adjacent routers. This metric is added to the metrics of learned routes. The default metric can be a number from 1 to
16.
1
The time in seconds that must elapse after the timeout interval for a route expires, before RIPng deletes the route. If RIPng receives an update for the route after the timeout timer expires but before the garbage timer expires then the entry is switched back to reachable.
120
RIP timer defaults are effective in most configurations.
All routers and access servers in the network should have the same RIP timer settings.
The update timer interval can not be larger than the garbage timer interval.
Range
5 to 2 147 483 647 seconds.
passive-interface <name_str> Block RIPng broadcasts on the specified interface. You can use
and the passive interface command to allow RIPng to send unicast updates to the specified neighbor while blocking broadcast updates on the specified interface.
No default.
Fortinet Technologies Inc.
Page 433 FortiOS™ - CLI Reference for FortiOS 5.0
router ripng
Variable
timeout-timer
<timer_integer>
Description
The time interval in seconds after which a route is declared unreachable. The route is removed from the routing table. RIP holds the route until the garbage timer expires and then deletes the route. If RIP receives an update for the route before the timeout timer expires, then the timeout-timer is restarted. If RIP receives an update for the route after the timeout timer expires but before the garbage timer expires then the entry is switched back to reachable. The value of the timeout timer should be at least three times the value of the update timer.
Default
180
RIP timer defaults are effective in most configurations.
All routers and access servers in the network should have the same RIP timer settings.
The update timer interval can not be larger than the timeout timer interval.
Range
5 to 2 147 483 647 seconds.
update-timer <timer_integer> The time interval in seconds between RIP updates.
RIP timer defaults are effective in most configurations.
All routers and access servers in the network should have the same RIP timer settings.
The update timer interval can not be larger than timeout or garbage timer intervals.
Range
5 to 2 147 483 647 seconds.
30
config aggregate-address
Use this subcommand to configure aggregate address prefixes.
Variable
edit <entry-id>
Description
Enter an entry number for the aggregate address list.
prefix6 <aggregate_prefix>
Enter the prefix for the aggregate address.
Default
::/0
config distance
Use this subcommand to specify an administrative distance. When different routing protocols provide multiple routes to the same destination, the administrative distance sets the priority of those routes. The lowest administrative distance indicates the preferred route. The distance field is required. All other fields are optional.
If you specify a prefix, RIP uses the specified distance when the source IP address of a packet matches the prefix.
Variable
edit <distance_id>
Description
Enter an ID number for the distance. The number must be an integer. access-list6 <name_str> Enter the name of an access list. The distances associated with the routes in the access list will be modified. To create an access list, see
“router access-list, access-list6” on page 342 .
Default
No default.
Null
Fortinet Technologies Inc.
Page 434 FortiOS™ - CLI Reference for FortiOS 5.0
router ripng
Variable Description
distance <distance_int> Enter a number from 1 to 255, to set the administrative distance.
prefix6
<address_ipv6mask>
Default
0
This field is required.
Optionally enter a prefix to apply the administrative distance to.
::/0
Example
This example shows how to change the administrative distance to 10 for all IP addresses that match the internal_example access-list.
config router rip config distance edit 1 set distance 10 end set access-list internal_example end
config distribute-list
Use this subcommand to filter incoming or outgoing updates using an access list or a prefix list.
If you do not specify an interface, the filter will be applied to all interfaces. You must configure the access list or prefix list that you want the distribution list to use before you configure the distribution list. For more information on configuring access lists and prefix lists, see
“router access-list, access-list6” on page 342 and
“router prefix-list, prefix-list6” on page 421
.
The direction and listname fields are required. All other fields are optional.
Variable
direction {in | out}
Description
edit <distribute_list_id> Enter an entry number for the distribution list. The number must be an integer.
Set the direction for the filter. Enter in to filter incoming packets. Enter out to filter outgoing packets.
interface <name_str>
Enter the name of the interface to apply this distribution list to. If you do not specify an interface, this distribution list will be used for all interfaces.
listname <listname_str> Enter the name of the access list or prefix list to use for this distribution list.
status {enable | disable} Enable or disable this distribution list.
Default
No default.
out
Null
Null disable
config interface
Use this subcommand to configure and enable split horizon. All fields are optional.
A split horizon occurs when a router advertises a route it learns over the same interface it learned it on. In this case the router that gave the learned route to the last router now has two entries to get to another location. However, if the primary route fails that router tries the second route to find itself as part of the route and an infinite loop is created. A poisoned split horizon will still advertise the route on the interface it received it on, but it will mark the route as
Fortinet Technologies Inc.
Page 435 FortiOS™ - CLI Reference for FortiOS 5.0
router ripng
unreachable. Any unreachable routes are automatically removed from the routing table. This is also called split horizon with poison reverse.
Variable
split-horizon
{poisoned | regular}
Description
edit <interface_name> Type the name of the FortiGate unit interface that is linked to the RIP network. The interface might be a virtual IPSec or GRE interface.
Configure RIP to use either regular or poisoned split horizon on this interface. Choose one of:
regular — prevent RIP from sending updates for a route back out on the interface from which it received that route.
Default
No default.
poisoned split-horizon-status
{enable | disable}
poisoned — send updates with routes learned on an interface back out the same interface but mark those routes as unreachable.
Enable or disable split horizon for this interface. Split horizon is enabled by default. enable
Disable split horizon only if there is no possibility of creating a counting to infinity loop when network topology changes.
config neighbor
Use this subcommand to enable RIPng to send unicast routing updates to the router at the specified address. You can use the neighbor subcommand and
to allow RIPng to send unicast updates to the specified neighbor while blocking broadcast updates on the specified interface. You can configure multiple neighbors.
All fields are required.
Variable Description
edit <neighbor_id> Enter an entry number for the RIPng neighbor. The number must be an integer.
interface <name>
The interface that connects to the neighbor. ip6 <address_ipv6> Enter the IP address of the neighboring router to which to send unicast updates.
Default
No default.
No default.
::
config offset-list
Use this subcommand to add the specified offset to the metric (hop count) of a route from the offset list. The access-list6, direction, and offset fields are required. All other fields are optional.
Variable
edit <offset_list_id>
Description
Enter an entry number for the offset list. The number must be an integer.
access-list6 <name_str> Enter the name of the access list to use for this offset list.
The access list is used to determine which routes to add the metric to.
direction {in | out}
Enter in to apply the offset to the metrics of incoming routes. Enter out to apply the offset to the metrics of outgoing routes.
interface <name_str>
Enter the name of the interface to match for this offset list.
Default
No default.
Null out
Null
Fortinet Technologies Inc.
Page 436 FortiOS™ - CLI Reference for FortiOS 5.0
router ripng
Variable Description
offset <metric_integer>
Enter the offset number to add to the metric. The metric is the hop count. The
metric_integer range is from 1 to 16, with 16 being unreachable.
status {enable | disable} Enable or disable this offset list.
Default
0 disable
config redistribute
Use this subcommand to redistribute routes learned from OSPF, BGP, static routes, or a direct connection to the destination network.
The RIPng redistribution table contains four static entries. You cannot add entries to the table.
The entries are defined as follows:
• bgp — Redistribute routes learned from BGP.
• connected — Redistribute routes learned from a direct connection to the destination network.
• isis — Redistribute routes learned from ISIS.
• ospf — Redistribute routes learned from OSPF.
• static — Redistribute the static routes defined in the FortiGate unit routing table.
When you enter the subcommand, end the command with one of the four static entry names
(that is, config redistribute {bgp | connected | isis | ospf | static}).
All fields are optional.
Variable Description
metric <metric_integer> Enter the metric value to be used for the redistributed routes.
The
metric_integer range is from 0 to 16.
routemap <name_str>
Enter the name of the route map to use for the redistributed routes. status {enable | disable} Enable or disable redistributing routes.
Default
0
Null disable
Fortinet Technologies Inc.
Page 437 FortiOS™ - CLI Reference for FortiOS 5.0
router
route-map
route-map
Use this command to add, edit, or delete route maps. To use the command to limit the number of received or advertised BGP and RIP routes and routing updates using route maps, see
“Using route maps with BGP” on page 440 , and RIP
“config redistribute” on page 409 .
Route maps provide a way for the FortiGate unit to evaluate optimum routes for forwarding packets or suppressing the routing of packets to particular destinations. Compared to access lists, route maps support enhanced packet-matching criteria. In addition, route maps can be configured to permit or deny the addition of routes to the FortiGate unit routing table and make changes to routing information dynamically as defined through route-map rules.
The FortiGate unit compares the rules in a route map to the attributes of a route. The rules are examined in ascending order until one or more of the rules in the route map are found to match one or more of the route attributes:
• When a single matching match-* rule is found, changes to the routing information are made as defined through the rule’s set-ip-nexthop, set-metric, set-metric-type, and/or set-tag settings.
• If no matching rule is found, no changes are made to the routing information.
• When more than one match-* rule is defined, all of the defined match-* rules must evaluate to TRUE or the routing information is not changed.
• If no match-* rules are defined, the FortiGate unit makes changes to the routing information only when all of the default match-* rules happen to match the attributes of the route.
The default rule in the route map (which the FortiGate unit applies last) denies all routes. For a route map to take effect, it must be called by a FortiGate unit routing process.
Any fields and rules that to not appear here can be found in the BGP route-map section. See
“Using route maps with BGP” on page 440 .
Syntax
config router route-map
edit <route_map_name> set comments <string>
config rule
set
set
set
match-ip-address <access/prefix-listname_str>
end end set
match-ip-nexthop <access/prefix-listname_str>
set
set
set
set
set
set
set
Fortinet Technologies Inc.
Page 438 FortiOS™ - CLI Reference for FortiOS 5.0
router route-map
All fields are optional.
Variable edit <route_map_name> comments <string>
Description
Enter a name for the route map.
Enter a description for this route map name.
config rule variables
edit <route_map_rule_id>
Enter an entry number for the rule. The number must be an integer.
action {deny | permit}
Enter permit to permit routes that match this rule.
Enter deny to deny routes that match this rule.
match-interface <name_str> Enter the name of the local FortiGate unit interface that will be used to match route interfaces. match-ip-address
<access/prefix-listname_str> match-ip6-address
<access/prefix-listname_str> match-ip-nexthop
<access/prefix-listname_str> match-ip6-nexthop
<access/prefix-listname_str> match-metric
<metric_integer> match-route-type {1 | 2}
Match a route if the destination address is included in the specified access list or prefix list.
Match a route if the destination IPv6 address is included in the specified access6 list or prefix6 list.
Match a route that has a next-hop router address included in the specified access list or prefix list.
Match a route that has a next-hop router address included in the specified access6 list or prefix6 list.
Match a route with the specified metric. The metric can be a number from 1 to 16.
Match a route that has the external type set to 1 or
2.
match-tag <tag_integer>
This field is available when set-tag is set.
Default
No default.
No default.
No default.
permit
Null
Null
Null
Null
Null
0 external-type1
0
Match a route that has the specified tag. set-ip-nexthop
<address_ipv4> set-ip6-nexthop
<address_ipv6>
Set the next-hop router address for a matched route.
Set the next-hop router IPv6 address for a matched route.
0.0.0.0
::0 set-ip6-nexthop-local
<address_ipv6>
Set the next-hop router local IPv6 address for a matched route.
Set a tag value for a matched route.
::0 set-metric <metric_integer>
Set a metric value of 1 to 16 for a matched route.
0 set-metric-type {1 | 2}
Set the type for a matched route.
external-type1 set-tag <tag_integer> 0
Fortinet Technologies Inc.
Page 439 FortiOS™ - CLI Reference for FortiOS 5.0
router route-map
Example
This example shows how to add a route map list named rtmp2 with two rules. The first rule denies routes that match the IP addresses in an access list named acc_list2. The second rule permits routes that match a metric of 2 and changes the metric to 4.
config router route-map edit rtmp2 config rule edit 1 set match-ip-address acc_list2 set action deny next edit 2 end set match-metric 2 set action permit set set-metric 4 end
Using route maps with BGP
When a connection is established between BGP peers, the two peers exchange all of their BGP route entries. Afterward, they exchange updates that only include changes to the existing routing information. Several BGP entries may be present in a route-map table. You can limit the number of received or advertised BGP route and routing updates using route maps. Use the config router route-map command to create, edit, or delete a route map.
When you specify a route map for the dampening-route-map value through the config router bgp command (see
“dampening-route-map <routemap-name_str>” on page 352 ), the
FortiGate unit ignores global dampening settings. You cannot set global dampening settings for the FortiGate unit and then override those values through a route map.
Syntax
config router route-map
edit <route_map_name> set comments <string>
config rule
set
match-as-path <aspath-list-name_str>
set
match-community <community-list-name_str>
set
match-community-exact {enable | disable}
set
match-origin {egp | igp | incomplete | none}
set
set-aggregator-as <id_integer>
set
set-aggregator-ip <address_ipv4>
set
set-aspath <id_integer> <id_integer> <id_integer> ...
set
set-atomic-aggregate {enable | disable}
set
set-community-delete <community-list-name_str>
set
set
set-community-additive {enable | disable}
Fortinet Technologies Inc.
Page 440 FortiOS™ - CLI Reference for FortiOS 5.0
router route-map
set
set-dampening-reachability-half-life <minutes>
set
set-dampening-reuse <reuse_integer>
set
set-dampening-suppress <suppress_integer>
set
set-dampening-max-suppress <minutes>
set
set-dampening-unreachability-half-life <minutes>
set
set-extcommunity-rt <AA:NN> <AA:NN> <AA:NN> ...
set
set-extcommunity-soo <AA:NN> <AA:NN> <AA:NN> ...
set
set-local-preference <preference_integer>
set
set-originator-id <address_ipv4>
set
set-origin {egp | igp | incomplete | none}
set
end
All fields are optional.
Variable
edit <route_map_name> comments <string>
Description
Enter a name for the route map.
Enter a description for this route map name.
config rule variables
edit <route_map_rule_id>
Enter an entry number for the rule. The number must be an integer.
match-as-path
<aspath-list-name_str>
Enter the AS-path list name that will be used to match
BGP route prefixes. You must create the AS-path list
before it can be selected here. See “router aspath-list” on page 344 .
match-community
<community-list-name_str>
Enter the community list name that will be used to match BGP routes according to their COMMUNITY attributes. You must create the community list before it can be selected here. See
“router community-list” on page 367 .
match-community-exact
{enable | disable}
This field is only available when set.
match-community is
Default
No default.
No default.
No default.
Null
Null disable match-origin {egp | igp
| incomplete | none}
Enable or disable an exact match of the BGP route community specified by the match-community field.
Enter a value to compare to the ORIGIN attribute of a routing update: none
egp — set the value to the NLRI learned from the
Exterior Gateway Protocol (EGP). The FortiGate unit has the second-highest preference for routes of this type.
igp — set the value to the NLRI learned from a protocol internal to the originating AS. The FortiGate unit has the highest preference for routes learned through Internal Gateway Protocol (IGP).
incomplete — match routes that were learned some other way (for example, through redistribution).
none — disable the matching of BGP routes based on the origin of the route.
Fortinet Technologies Inc.
Page 441 FortiOS™ - CLI Reference for FortiOS 5.0
router route-map
Variable
set-aggregator-as
<id_integer> set-aggregator-ip
<address_ipv4> set-aspath <id_integer>
<id_integer> <id_integer>
...
Description
Set the originating AS of an aggregated route. The value specifies at which AS the aggregate route originated. The range is from 1 to 65 535. The setaggregator-ip value must also be set to further identify the originating AS.
This field is available when set-aggregator-as is set.
Default
unset
0.0.0.0
Set the IP address of the BGP router that originated the aggregate route. The value should be identical to the FortiGate unit router-id value (see
Modify the FortiGate unit AS_PATH attribute and add to it the AS numbers of the AS path belonging to a
BGP route. The resulting path describes the autonomous systems along the route to the destination specified by the NLRI. The range is from 1 to 65 535.
No default.
The set-aspath value is added to the beginning of the AS_SEQUENCE segment of the AS_PATH attribute of incoming routes, or to the end of the
AS_SEQUENCE segment of the AS_PATH attribute of outgoing routes.
Enclose all AS numbers in quotes if there are multiple occurrences of the same id_integer. Otherwise the AS path may be incomplete.
set-atomic-aggregate
{enable | disable}
Enable or disable a warning to upstream routers through the ATOMIC_AGGREGATE attribute that address aggregation has occurred on an aggregate route. This value does not have to be specified when an as-set value is specified in the aggregate-address table (see
“config aggregate-address, config aggregate-address6” on page 355
).
set-community-delete
<community-list-name_str>
Remove the COMMUNITY attributes from the BGP routes identified in the specified community list. You must create the community list first before it can be selected here (see
“router community-list” on page 367 ).
disable
Null
Fortinet Technologies Inc.
Page 442 FortiOS™ - CLI Reference for FortiOS 5.0
router route-map
Variable Description
set-community <criteria>
Set the COMMUNITY attribute of a BGP route.
set-community-additive
{enable | disable} set-dampeningreachability-half-life
<minutes> set-dampening-reuse
<reuse_integer>
Default
No default.
• Use decimal notation to set a specific
COMMUNITY attribute for the route. The value has the syntax
AA:NN, where AA represents an AS, and
NN is the community identifier. Delimit complex expressions with double-quotation marks (for example,
“123:234 345:456”).
• To make the route part of the Internet community, select internet.
• To make the route part of the LOCAL_AS community, select local-AS.
• To make the route part of the NO_ADVERTISE community, select no-advertise.
• To make the route part of the NO_EXPORT community, select no-export.
This field is available when set-community is set.
disable
Enable or disable the appending of the setcommunity value to a BGP route.
Set the dampening reachability half-life of a BGP route
(in minutes). The range is from 1 to 45.
0 set-dampening-suppress
<suppress_integer> set-dampening-maxsuppress <minutes> set-dampeningunreachability-half-life
<minutes> set-extcommunity-rt
<AA:NN> <AA:NN>
<AA:NN> ...
set-extcommunity-soo
<AA:NN> <AA:NN>
<AA:NN> ...
set-local-preference
<preference_integer>
Set the value at which a dampened BGP route will be reused. The range is from 1 to 20 000. If you set setdampening-reuse, you must also set setdampening-suppress and set-dampening-maxsuppress.
Set the limit at which a BGP route may be suppressed.
The range is from 1 to 20 000. See also
“dampeningsuppress <limit_integer>” on page 352 .
0
0
Set maximum time (in minutes) that a BGP route can be suppressed. The range is from 1 to 255. See also
“
dampening-max-suppress-time” in
“dampeningmax-suppress-time <minutes_integer>” on page 352 .
0
0
Set the unreachability half-life of a BGP route (in minutes). The range is from 1 to 45. See also
“dampening-unreachability-half-life
<minutes_integer>” on page 353 .
Set the target extended community (in decimal notation) of a BGP route. The COMMUNITY attribute value has the syntax
AA:NN, where AA represents an
AS, and
NN is the community identifier.
Set the site-of-origin extended community (in decimal notation) of a BGP route. The COMMUNITY attribute value has the syntax
AA:NN, where AA represents an
AS, and
NN is the community identifier.
Set the LOCAL_PREF value of an IBGP route. The value is advertised to IBGP peers. The range is from 0 to 4 294 967 295. A higher number signifies a preferred route among multiple routes to the same destination.
No default.
No default.
0
Fortinet Technologies Inc.
Page 443 FortiOS™ - CLI Reference for FortiOS 5.0
router
Variable
set-originator-id
<address_ipv4> set-origin {egp | igp
| incomplete | none} set-weight
<weight_integer>
route-map
Description
Set the ORIGINATOR_ID attribute, which is equivalent to the router-id of the originator of the route in the local AS. Route reflectors use this value to prevent routing loops.
Default
0.0.0.0
Set the ORIGIN attribute of a local BGP route. Choose one of: none
egp — set the value to the NLRI learned from the
Exterior Gateway Protocol (EGP).
igp — set the value to the NLRI learned from a protocol internal to the originating AS.
incomplete — if not egp or igp.
none — disable the ORIGIN attribute.
Set the weight of a BGP route. A route’s weight has the most influence when two identical BGP routes are compared. A higher number signifies a greater preference. The range is from 0 to 2 147 483 647.
0
Fortinet Technologies Inc.
Page 444 FortiOS™ - CLI Reference for FortiOS 5.0
router
setting
setting
Use this command to define a prefix list as a filter to show routes.
Command
config router setting set
end set
Variable
hostname <name_str>
Description
Enter the hostname for this virtual domain router. (1-14 characters) show-filter <prefix_list> Select the prefix-list to use as a filter for showing routes.
Default
Fortinet Technologies Inc.
Page 445 FortiOS™ - CLI Reference for FortiOS 5.0
router
static
static
Use this command to add, edit, or delete static routes for IPv4 traffic. For IPv6 traffic, use the static6 command at
.
You add static routes to manually control traffic exiting the FortiGate unit. You configure routes by specifying destination IP addresses and network masks and adding gateways for these destination addresses. Gateways are the next-hop routers to which traffic that matches the destination addresses in the route are forwarded.
You can adjust the administrative distance of a route to indicate preference when more than one route to the same destination is available. The lower the administrative distance, the greater the preferability of the route. If the routing table contains several entries that point to the same destination (the entries may have different gateways or interface associations), the FortiGate unit compares the administrative distances of those entries, selects the entries having the lowest distances, and installs them as routes in the FortiGate unit forwarding table. Any ties are resolved by comparing the routes’ priority, with lowest priority being preferred. As a result, the
FortiGate unit forwarding table only contains routes having the lowest distances to every possible destination.If both administrative distance and priority are tied for two or more routes, an equal cost multi-path (ECMP) situation occurs. ECMP is available to static and OSPF routing. By default in ECMP, a source IP address hash will be used to determine the selected route. This hash value is based on the pre-NATed source IP address. This method results in all traffic originating from the same source IP address always using the same path. This is the
Source based ECMP option, with Weighted, and Spill-over being the other two optional methods. The option is determined by the CLI command set v4-ecmp-mode in config system setting. Source Based is the default method. Weighted ECMP uses the weight field to direct more traffic to routes with larger weights. In spill-over or usage-based ECMP, the
FortiGate unit distributes sessions among ECMP routes based on how busy the FortiGate interfaces added to the routes are. For more information on ECMP, see
“system settings” on page 670 .
Syntax
config router static
edit <sequence_number> set blackhole {enable | disable}
end
set priority <integer> set weight <integer>
The dst and gateway fields are required when blackhole is disabled. When blackhole is enabled, the dst field is required. All other fields are optional.
Variable
edit
<sequence_number> blackhole
{enable | disable}
Description Default
Enter a sequence number for the static route. The sequence number may influence routing priority in the FortiGate unit forwarding table.
No default.
disable
Enable or disable dropping all packets that match this route.
This route is advertised to neighbors through dynamic routing protocols as any other static route.
Fortinet Technologies Inc.
Page 446 FortiOS™ - CLI Reference for FortiOS 5.0
router
Variable
device
<interface_name> distance <distance> dst <destinationaddress_ipv4mask> dynamic-gateway
{enable | disable} gateway <gatewayaddress_ipv4> priority <integer> weight <integer>
Description
This field is available when blackhole is set to disable.
Default
Null
Enter the name of the FortiGate unit interface through which to route traffic. Use ‘?’ to see a list of interfaces.
Enter the administrative distance for the route. The distance value may influence route preference in the FortiGate unit routing table. The range is an integer from 1-255. See also config system interface “distance <distance_integer>” on page 259 .
10
Enter the destination IPv4 address and network mask for this route.
0.0.0.0
0.0.0.0
You can enter
0.0.0.0 0.0.0.0 to create a new static default route.
When enabled, dynamic-gateway hides the gateway variable for a dynamic interface, such as a DHCP or PPPoE interface. When the interface connects or disconnects, the corresponding routing entries are updated to reflect the change.
This field is available when blackhole is set to disable.
disable
0.0.0.0
Enter the IPv4 address of the next-hop router to which traffic is forwarded.
The administrative priority value is used to resolve ties in route selection. In the case where both routes have the same priority, such as equal cost multi-path (ECMP), the IP source hash (based on the pre-NATed IP address) for the routes will be used to determine which route is selected.The priority range is an integer from 0 to 4294967295. Lower priority routes are preferred routes.
0
This field is only accessible through the CLI.
Add weights to ECMP static routes if the ECMP route failover and load balance method is set to weighted.
0
Enter weights for ECMP routes. More traffic is directed to routes with higher weights.
This option is available when the v4-ecmp-mode field of the config system settings command is set to weightbased. For more information, see
.
static
Fortinet Technologies Inc.
Page 447 FortiOS™ - CLI Reference for FortiOS 5.0
router
static6
static6
Use this command to add, edit, or delete static routes for IPv6 traffic. For IPv4 static routes, see
You add static routes to specify the destination of traffic exiting the FortiGate unit. You configure routes by adding destination IP addresses and network masks and adding gateways for these destination addresses. The gateways are the next-hop routers to which traffic that matches the destination addresses in the route are forwarded.
You can configure static routes for IPv6 traffic on FortiGate units that run in NAT/Route mode.
Syntax
config router static6
end
The device
, dst
, and gateway
fields are all required.
Variable
edit <sequence_number> device <interface_name> distance <distance> dst
<destination-address_ipv6mask> gateway
<gateway-address_ipv6> priority <integer>
Description
Enter a sequence number for the static route.
Default
No default.
The name of the FortiGate unit interface through which to route traffic.
Null
Enter the administrative distance for the route.
The distance value may influence route preference in the FortiGate unit routing table. The range is an integer from 1-255. See also config system interface “distance <distance_integer>” on page 259 .
10
The destination IPv6 address and netmask for this route.
::/0
You can enter
::/0 to create a new static default route for IPv6 traffic.
The IPv6 address of the next-hop router to which traffic is forwarded.
::
0
The administrative priority value is used to resolve ties in route selection. The priority range is an integer from 0 to 4294967295. Lower priority routes are preferred routes.
This field is only accessible through the CLI.
Fortinet Technologies Inc.
Page 448 FortiOS™ - CLI Reference for FortiOS 5.0
spamfilter
Use email filter commands to create a banned word list, configure filters based on email addresses, ip addresses, and MIME headers, and to configure the FortiGuard-Antispam service.
This chapter contains the following sections:
Page 449
spamfilter
bwl
bwl
Use this command to filter email based on the sender’s email address or address pattern.
The FortiGate email filters are applied in the following order:
For SMTP
1. IP address BWL check - Last hop IP
2. DNSBL & ORDBL check, IP address FortiGuard check, HELO DNS lookup
3. E-mail address BWL check
4. MIME headers check
5. IP address BWL check (for IPs extracted from “Received” headers)
6. Return e-mail DNS check, FortiGuard Antispam check (for IPs extracted from “Received” headers, and URLs in email content)
7. Banned word check
For POP3 and IMAP
1. E-mail address BWL check
2. MIME headers check, IP BWL check
3. Return e-mail DNS check, FortiGuard Antispam check, DNSBL & ORDBL check
4. Banned word check
For SMTP, POP3, and IMAP using the email address
The FortiGate unit compares the email address or domain of the sender to the list in sequence.
If a match is found, the corresponding action is taken. If no match is found, the email is passed on to the next email filter.
The FortiGate unit can filter email from specific senders or all email from a domain (such as example.net). Each email address can be marked as clear or spam.
Use Perl regular expressions or wildcards to add email address patterns to the list.
Use this command to filter email based on the IP or subnet address.
The FortiGate email filters are generally applied in the following order:
For SMTP, POP3, and IMAP using the IP address
The FortiGate unit compares the IP address of the sender to the list in sequence. If a match is found, the corresponding action is taken. If no match is found, the email is passed on to the next email filter.
Enter an IP address and mask in one of two formats:
• x.x.x.x/x.x.x.x, for example 192.168.10.23/255.255.255.0
• x.x.x.x/x, for example 192.168.10.23/24
Configure the FortiGate unit to filter email from specific IP addresses. Mark each IP address as clear, spam, or reject. Filter single IP addresses, or a range of addresses at the network level by configuring an address and mask.
Fortinet Technologies Inc.
Page 450 FortiOS™ - CLI Reference for FortiOS 5.0
spamfilter bwl
Syntax
config spamfilter bwl edit
<list_int> set name <list_str> set comment <comment_str>
config entries edit
set type email set
set
set
pattern-type {regexp | wildcard}
end set
edit
set type ip set
action {clear | reject | spam}
set
set
ip4-subnet {<address_ipv4mask>}
set
ip6-subnet {<address_ipv6mask>}
end set
Variable
<list_int>
<list_str>
<comment_str>
<entry_id> type {email | ip} action {clear | spam}
Description
A unique number to identify the email black/white list.
Default
The name of the email black/white list.
The comment attached to the email black/white list.
A unique number to identify the entry.
Select whether pattern is by email address or IP address.
If type is email: ip spam
Enter clear to exempt the email from the rest of the spam filters. Enter spam to apply the spam action configured in the profile.
action {clear | reject | spam} If type is ip: spam
Enter clear to exempt the email from the rest of the email filters. Enter reject to drop any current or incoming sessions. Enter spam to apply the spam action. addr-type {ipv4 | ipv6}
Select whether IPv4 or IPv6 addresses will be used.
Available if type is ip.
email-pattern <email_str>
Enter the email address pattern using wildcards or
Perl regular expressions. Available if type is email.
ip4-subnet
{<address_ipv4mask>}
The trusted IPv4 IP address and subnet mask in the format
192.168.10.23 255.255.255.0 or
192.168.10.23/24. Available if type is ip.
ip6-subnet
{<address_ipv6mask>}
The trusted IPv6 IP address.
This is available when type is ip and addr-type is ipv6. ipv4
No default
No default
Fortinet Technologies Inc.
Page 451 FortiOS™ - CLI Reference for FortiOS 5.0
spamfilter
Variable
pattern-type
{regexp | wildcard} status {enable | disable}
Description Default
Enter the pattern-type for the email address. Choose from wildcards or Perl regular expressions. Available if type is email.
wildcard
Enable or disable scanning for each email address.
enable
bwl
Fortinet Technologies Inc.
Page 452 FortiOS™ - CLI Reference for FortiOS 5.0
spamfilter
bword
bword
Use this command to add or edit and configure options for the email filter banned word list.
The FortiGate email filters are applied in the following order:
For SMTP
1. IP address BWL check - Last hop IP
2. DNSBL & ORDBL check, IP address FortiGuard check, HELO DNS lookup
3. E-mail address BWL check
4. MIME headers check
5. IP address BWL check (for IPs extracted from “Received” headers)
6. Return e-mail DNS check, FortiGuard Antispam check (for IPs extracted from “Received” headers, and URLs in email content)
7. Banned word check
For POP3 and IMAP
1. E-mail address BWL check
2. MIME headers check, IP BWL check
3. Return e-mail DNS check, FortiGuard Antispam check, DNSBL & ORDBL check
4. Banned word check
For SMTP, POP3, and IMAP
Control spam by blocking email messages containing specific words or patterns. If enabled, the
FortiGate unit searches for words or patterns in email messages. If matches are found, values assigned to the words are totalled. If a user-defined threshold value is exceeded, the message is marked as spam. If no match is found, the email message is passed along to the next filter.
Use Perl regular expressions or wildcards to add banned word patterns to the list. Add one or more banned words to sort email containing those words in the email subject, body, or both.
Words can be marked as spam or clear. Banned words can be one word or a phrase up to 127 characters long.
If a single word is entered, the FortiGate unit blocks all email that contain that word. If a phrase is entered, the FortiGate unit blocks all email containing the exact phrase. To block any word in a phrase, use Perl regular expressions.
Perl regular expression patterns are case sensitive for email filter banned words. To make a word or phrase case insensitive, use the regular expression
/i. For example, /bad language/i blocks all instances of bad language regardless of case. Wildcard patterns are not case sensitive.
Fortinet Technologies Inc.
Page 453 FortiOS™ - CLI Reference for FortiOS 5.0
spamfilter bword
Syntax
config spamfilter bword edit
<list_int> set name <list_str> set comment <comment_str>
config entries edit
set
set
language {french | japanese | korean | simch | spanish
set
set
pattern-type {regexp | wildcard}
set
set
end set
Variable
<list_int>
<list_str>
<comment_str>
<banned_word_int> action {clear | spam}
Description
A unique number to identify the banned word list.
The name of the banned word list.
The comment attached to the banned word list.
A unique number to identify the banned word or pattern.
Default
Enter clear to allow the email. Enter spam to apply the spam action.
spam language {french
| japanese | korean | simch
| spanish | thai | trach
| western}
Enter the language character set used for the banned word or phrase. Choose from French, Japanese, Korean,
Simplified Chinese, Thai, Traditional Chinese, or Western.
western pattern
<banned_word_str> pattern-type {regexp | wildcard} score <int>
Enter the banned word or phrase pattern using regular expressions or wildcards.
Enter the pattern type for the banned word (pattern).
Choose from regular expressions or wildcard.
No default.
wildcard
A numerical weighting applied to the banned word. The score values of all the matching words appearing in an email message are added, and if the total is greater than the spamwordthreshold value, the message is processed according to the spam action setting. The score for a banned word is counted once even if the word appears multiple times in an email message.
10 status {enable | disable}
Enable or disable scanning email for each banned word.
enable where {all | body | subject} Enter where in the email to search for the banned word or phrase.
all
Fortinet Technologies Inc.
Page 454 FortiOS™ - CLI Reference for FortiOS 5.0
spamfilter
dnsbl
dnsbl
Use this command to configure email filtering using DNS-based Blackhole List (DNSBL) or
Open Relay Database List (ORDBL) servers. DSNBL and ORDBL settings are configured with this command but DSNBL and ORDBL filtering is enabled within each profile.
The FortiGate email filters are generally applied in the following order:
For SMTP
1. IP address BWL check - Last hop IP
2. DNSBL & ORDBL check, IP address FortiGuard check, HELO DNS lookup
3. E-mail address BWL check
4. MIME headers check
5. IP address BWL check (for IPs extracted from “Received” headers)
6. Return e-mail DNS check, FortiGuard Antispam check (for IPs extracted from “Received” headers, and URLs in email content)
7. Banned word check
For POP3 and IMAP
1. E-mail address BWL check
2. MIME headers check, IP BWL check
3. Return e-mail DNS check, FortiGuard Antispam check, DNSBL & ORDBL check
4. Banned word check
For SMTP, POP3, and IMAP
The FortiGate unit compares the IP address or domain name of the sender to any database lists configured in sequence. If a match is found, the corresponding action is taken. If no match is found, the email is passed on to the next email filter.
Some spammers use unsecured third party SMTP servers to send unsolicited bulk email. Using
DNSBLs and ORDBLs is an effective way to tag or reject spam as it enters the network. These lists act as domain name servers that match the domain of incoming email to a list of IP addresses known to send spam or allow spam to pass through.
There are several free and subscription servers available that provide reliable access to continually updated DNSBLs and ORDBLs. Please check with the service being used to confirm the correct domain name for connecting to the server.
Because the FortiGate unit uses the server domain name to connect to the DNSBL or ORDBL server, it must be able to look up this name on the DNS server. For information on configuring
DNS, see “system dns” on page 508 .
Fortinet Technologies Inc.
Page 455 FortiOS™ - CLI Reference for FortiOS 5.0
spamfilter dnsbl
Syntax
config spamfilter dnsbl edit
<list_int> set name <list_str> set comment <comment_str>
config entries edit
set
set
end set
Variable
<list_int>
<list_str>
<comment_str>
Description
A unique number to identify the DNSBL list.
The name of the DNSBL header list.
The comment attached to the DNSBL header list.
<server_int> action {reject | spam}
A unique number to identify the DNSBL server.
Enter reject to stop any further processing of the current session and to drop an incoming connection at once. Enter spam to identify email as spam.
server <fqdn>
Enter the domain name of a DNSBL server or an ORDBL server.
status {enable | disable}
Enable or disable querying the server named in the server string.
Default
spam
No default.
enable
Fortinet Technologies Inc.
Page 456 FortiOS™ - CLI Reference for FortiOS 5.0
spamfilter
fortishield
fortishield
Use this command to configure the settings for the FortiGuard-Antispam Service.
The FortiGate email filters are applied in the following order:
For SMTP
1. IP address BWL check - Last hop IP
2. DNSBL & ORDBL check, IP address FortiGuard check, HELO DNS lookup
3. E-mail address BWL check
4. MIME headers check
5. IP address BWL check (for IPs extracted from “Received” headers)
6. Return e-mail DNS check, FortiGuard Antispam check (for IPs extracted from “Received” headers, and URLs in email content)
7. Banned word check
For POP3 and IMAP
1. E-mail address BWL check
2. MIME headers check, IP BWL check
3. Return e-mail DNS check, FortiGuard Antispam check, DNSBL & ORDBL check
4. Banned word check
For SMTP, POP3, and IMAP
FortiGuard-Antispam Service is an antispam system from Fortinet that includes an IP address black list, a URL black list, and email filtering tools. The IP address black list contains IP addresses of email servers known to be used to generate Spam. The URL black list contains found in Spam email.
FortiGuard-Antispam Service compiles the IP address and URL list from email captured by spam probes located around the world. Spam probes are email addresses purposely configured to attract spam and identify known spam sources to create the antispam IP address and URL list. FortiGuard-Antispam Service combines IP address and URL checks with other email filter techniques in a two-pass process.
On the first pass, if spamfsip is selected in the profile, FortiGuard-Antispam Service extracts the SMTP mail server source address and sends the IP address to a FortiGuard-Antispam
Service server to see if this IP address matches the list of known spammers. If spamfsurl is selected in the profile, FortiGuard-Antispam Service checks the body of email messages to extract any URL links. These URL links will be sent to a FortiGuard-Antispam Service server to see if any of them is listed. Typically spam messages contain URL links to advertisements (also called spamvertizing).
If an IP address or URL match is found, FortiGuard-Antispam Service terminates the session. If
FortiGuard-Antispam Service does not find a match, the mail server sends the email to the recipient.
As each email is received, FortiGuard-Antispam Service performs the second antispam pass by checking the header, subject, and body of the email for common spam content. If FortiGuard-
Antispam Service finds spam content, the email is tagged or dropped.
Fortinet Technologies Inc.
Page 457 FortiOS™ - CLI Reference for FortiOS 5.0
spamfilter fortishield
Syntax
config spamfilter fortishield set
spam-submit-force {enable | disable}
end set
set
spam-submit-txt2htm {enable | disable}
Variable
spam-submit-force
{enable | disable} spam-submit-srv
<url_str> spam-submit-txt2htm
{enable | disable}
Description
Enable or disable force insertion of a new mime entity for the submission text.
Default
enable
The host name of the FortiGuard-Antispam Service server. The FortiGate unit comes preconfigured with the host name. Use this command only to change the host name.
www.nospammer.net
Enable or disable converting text email to HTML. enable
Fortinet Technologies Inc.
Page 458 FortiOS™ - CLI Reference for FortiOS 5.0
spamfilter
iptrust
Use this command to add an entry to a list of trusted IP addresses.
If the FortiGate unit sits behind a company’s Mail Transfer Units, it may be unnecessary to check email IP addresses because they are internal and trusted. The only IP addresses that need to be checked are those from outside of the company. In some cases, external IP addresses may be added to the list if it is known that they are not sources of spam.
Syntax
config spamfilter iptrust edit
<list_int> set name <list_str> set comment <comment_str>
config entries edit
set
set
ip4-subnet {<address_ipv4mask>}
end set
ip6-subnet {<address_ipv6mask>}
set
Variable
addr-type {ipv4 | ipv6}
<list_int>
<list_str>
<comment_str>
<address_int> ip4-subnet
{<address_ipv4mask>} ip6-subnet
{<address_ipv6mask>} status {enable | disable}
Description
Select whether IPv4 or IPv6 addresses will be used.
ipv4
A unique number to identify the IP trust list.
The name of the IP trust list.
The comment attached to the IP trust list.
A unique number to identify the address.
The trusted IPv4 IP address and subnet mask in the format
192.168.10.23 255.255.255.0 or
192.168.10.23/24.
The trusted IPv6 IP address. This is available when addr-type is ipv6.
Enable or disable the IP address.
Default
No default
No default enable
iptrust
Fortinet Technologies Inc.
Page 459 FortiOS™ - CLI Reference for FortiOS 5.0
spamfilter
mheader
mheader
Use this command to configure email filtering based on the MIME header. MIME header settings are configured with this command but MIME header filtering is enabled within each profile.
The FortiGate email filters are applied in the following order:
For SMTP
1. IP address BWL check - Last hop IP
2. DNSBL & ORDBL check, IP address FortiGuard check, HELO DNS lookup
3. E-mail address BWL check
4. MIME headers check
5. IP address BWL check (for IPs extracted from “Received” headers)
6. Return e-mail DNS check, FortiGuard Antispam check (for IPs extracted from “Received” headers, and URLs in email content)
7. Banned word check
For POP3 and IMAP
1. E-mail address BWL check
2. MIME headers check, IP BWL check
3. Return e-mail DNS check, FortiGuard Antispam check, DNSBL & ORDBL check
4. Banned word check
For SMTP, POP3, and IMAP
The FortiGate unit compares the MIME header key-value pair of incoming email to the list pair in sequence. If a match is found, the corresponding action is taken. If no match is found, the email is passed on to the next email filter.
MIME (Multipurpose Internet Mail Extensions) headers are added to email to describe content type and content encoding, such as the type of text in the email body or the program that generated the email. Some examples of MIME headers include:
• X-mailer: outgluck
• X-Distribution: bulk
• Content_Type: text/html
• Content_Type: image/jpg
The first part of the MIME header is called the header key, or just header. The second part is called the value. Spammers often insert comments into header values or leave them blank.
These malformed headers can fool some spam and virus filters.
Use the MIME headers list to mark email from certain bulk mail programs or with certain types of content that are common in spam messages. Mark the email as spam or clear for each header configured.
Use Perl regular expressions or wildcards to add MIME header patterns to the list. MIME header entries are case sensitive.
Fortinet Technologies Inc.
Page 460 FortiOS™ - CLI Reference for FortiOS 5.0
spamfilter mheader
Syntax
config spamfilter mheader edit
<list_int> set name <list_str> set comment <comment_str>
config entries edit
set
set
end set
end set
set
pattern-type {regexp | wildcard}
Variable
<list_int>
<list_str>
<comment_str>
Description
A unique number to identify the MIME header list.
The name of the MIME header list.
<mime_int>
A unique number to identify the MIME header.
action {clear | spam}
Enter clear to exempt the email from the rest of the email filters. Enter spam to apply the spam action.
fieldbody <mime_str>
Enter the MIME header (key, header field body) using wildcards or Perl regular expressions.
fieldname <mime_str>
Enter the MIME header value (header field name) using wildcards or Perl regular expressions. Do not include a trailing colon.
pattern-type
{regexp | wildcard} status
{enable | disable}
The comment attached to the MIME header list.
Enter the pattern-type for the MIME header. Choose from wildcards or Perl regular expressions.
Enable or disable scanning email headers for the MIME header and header value defined in the fieldbody and fieldname strings.
Default
spam
No default.
No default.
wildcard enable
Fortinet Technologies Inc.
Page 461 FortiOS™ - CLI Reference for FortiOS 5.0
spamfilter
options
options
Use this command to set the spamfilter DNS query timeout.
Syntax
config spamfilter options set
end
Variable Description Default
dns-timeout <timeout_int> Set the DNS query timeout in the range 1 to 30 seconds. 7
Fortinet Technologies Inc.
Page 462 FortiOS™ - CLI Reference for FortiOS 5.0
spamfilter
profile
profile
Use this command to configure UTM email filtering profiles for firewall policies. Email filtering profiles configure how Email filtering and FortiGuard Antispam is applied to sessions accepted by a firewall policy that includes the Email filtering profile.
Syntax
config spamfilter profile edit
| spamfsphish | spamfssubmit | spamfsurl | spamhdrcheck
config {imap | imaps | mapi | pop3 | pop3s | smtp | smtps}
set
set
set
tag-type {subject | header} [spaminfo]
set
set
set
local-override {enable | disable}
end
config {gmail | msn-hotmail | yahoo-mail}
set
end end
Default Variable
<name_str> comment
<comment_str> flow-based
{enable | disable} spam-bwl-table
<index_int> spam-log
{enable | disable}
Description
Enter the name of the email filtering profile.
Optionally enter a description of up to 63 characters of the email filter profile.
Enable or disable flow-based spam filtering.
Enter the ID number of the email filter IP address black/white list to be used with the profile.
Enable or disable logging for email filtering.
disable
0 disable
Fortinet Technologies Inc.
Page 463 FortiOS™ - CLI Reference for FortiOS 5.0
spamfilter profile
Variable Description
spam-bword-threshold
<value_int>
If the combined scores of the banned word patterns appearing in an email message exceed the threshold value, the message will be processed according to the
Spam Action setting.
spam-bword-table
<index_int> spam-emaddr-table
<index_int> spam-filtering
{enable | disable} spam-iptrust-table
<index_int> spam-mheader-table
<index_int> spam-rbl-table
<index_int> options {bannedword
| spambwl
| spamfschksum
| spamfsip
| spamfsphish
| spamfssubmit
| spamfsurl
| spamhdrcheck
| spamraddrdns
| spamrbl}
Enter the ID number of the email filter banned word list to be used.
Enter the ID number of the email filter email address list to be used.
Enable or disable spam filtering.
Enter the ID number of the email filter IP trust list to be used with the profile.
Enter the ID number of the email filter MIME header list to be used with the profile.
Enter the ID number of the email filter DNSBL list to be used with the profile.
Select actions, if any, the FortiGate unit will perform with email traffic.
bannedword — block email containing content in the banned word list. spambwl — filter email using a black/white list.
spamfsphish — detect phishing URLs in email.
spamfsip — filter email using the FortiGuard Antispam filtering IP address blacklist.
Default
10
0
0 disable
0
0
0 spamfssubmit spamfssubmit — add a link to the message body allowing users to report messages incorrectly marked as spam. If an email message is not spam, click the link in the message to report the false positive.
spamfsurl — filter email using the FortiGuard Antispam filtering URL blacklist.
spamhdrcheck — filter email using the MIME header list.
spamaddrdns — filter email using a return email DNS check.
spamrbl — filter email using configured DNS-based
Blackhole List (DNSBL) and Open Relay Database List
(ORDBL) servers.
Separate multiple options with a space. To remove an option from the list or add an option to the list, retype the list with the option removed or added.
Fortinet Technologies Inc.
Page 464 FortiOS™ - CLI Reference for FortiOS 5.0
spamfilter profile
config {imap | imaps | mapi | pop3 | pop3s | smtp | smtps}
Configure spam filtering options for the IMAP, IMAPS, MAPI, POP3, POP3S, SMTP, and SMTPS email protocols.
Variable
action {discard
| pass | tag}
Description
Select the action that this profile uses for filtered email.
Tagging appends custom text to the subject or header of email identified as spam. When scan or streaming mode
(also called splice) is selected, the FortiGate unit can only discard spam email. Discard immediately drops the connection. Without streaming mode or scanning enabled, chose to discard, pass, or tag spam.
Default discard discard — do not pass email identified as spam.
pass — disable spam filtering.
tag — tag spam email with text configured using the tagmsg option and the location set using the tag-type option.
Enable or disable logging.
log
{enable | disable} tag-type {subject
| header}
[spaminfo] disable
Select to affix the tag to either the MIME header or the subject line, and whether or not to append spam information to the spam header, when an email is detected as spam. Also configure tag-msg.
subject spaminfo tag-msg
<message_str>
If you select to add the tag to the subject line, the FortiGate unit will convert the entire subject line, including tag, to
UTF-8 by default. This improves display for some email clients that cannot properly display subject lines that use more than one encoding.
Enter a word or phrase (tag) to affix to email identified as spam.
Spam
When typing a tag, use the same language as the FortiGate unit’s current administrator language setting. Tagging text using other encodings may not be accepted.
To correctly enter the tag, your SSH or telnet client must also support your language’s encoding. Alternatively, you can use the web-based manager’s CLI widget to enter the tag.
Tags must not exceed 64 bytes. The number of characters constituting 64 bytes of data varies by text encoding, which may vary by the FortiGate administrator language setting.
hdrip
{enable | disable} local-override
{enable | disable}
Tags containing space characters, such as multiple words or phrases, must be surrounded by quote characters (
‘)to be accepted by the CLI.
For smtp and smtps. Select to check header IP addresses for spamfsip, spamrbl, and spamipbwl filters.
For smtp and smtps. Select to override SMTP or SMTPS remote check, which includes IP RBL check, IP FortiGuard antispam check, and HELO DNS check, with the locally defined black/white antispam list. disable disable
Fortinet Technologies Inc.
Page 465 FortiOS™ - CLI Reference for FortiOS 5.0
spamfilter
config {gmail | msn-hotmail | yahoo-mail}
Configure spam filtering options for GMail, MSN Hotmail, or Yahoo mail.
Variable Description
log {enable | disable}
Enable or disable logging.
Default
disable
profile
Fortinet Technologies Inc.
Page 466 FortiOS™ - CLI Reference for FortiOS 5.0
switch-controller
Use these commands to manage an external FortiSwitch unit. These commands are available on the FortiGate-100D.
This chapter describes the following commands:
Page 467
switch-controller managed-switch
managed-switch
Use this command to configure a managed FortiSwitch unit.
Syntax
config switch-controller managed-switch edit
end config ports edit
set
vlan <switch-controller_vlan_name>
set
end set
Variable
<switch_id> description <text_str> name <name_str>
<port-name> fsw-wan1-admin
{enable | discovered | disable} fsw-wan2-admin
{enable | discovered | disable} fsw-wan1-peer <port_str> fsw-wan2-peer <port_str>
config ports variables
speed <speed_str>
Description
Enter a number to identify this FortiSwitch unit.
No default.
Optionally, enter a description.
Enter a name to identify this switch
Enter the FortiSwitch port name, such as port1.
Set FortiSwitch WAN1 admin status.
Set FortiSwitch WAN2 admin status.
Set FortiSwitch WAN1 peer port.
Set FortiSwitch WAN2 peer port.
Default
No default.
status {up | down} vlan
<switch-controller_vlan_name>
Read-only fields
dot1x-enable dot1x-status image-download progress
Set port speed. Enter set speed ? to see a list of valid speed settings.
Set port status: up or down.
Enter the name of the VLAN to which this port belongs.
auto up vsw.root
Fortinet Technologies Inc.
Page 468 FortiOS™ - CLI Reference for FortiOS 5.0
switch-controller
vlan
Use this command to set the switchctl VLAN configuration.
Syntax
config switch-controller vlan edit
end
set security {open | captive-portal | 8021x} set usergroup <group>
Variable
<switch-VLAN-name> auth {usergroup | radius} color {color_int>}
Description Default
Enter the switch VLAN name.
Select authentication by user group or by RADIUS server. available when security is 8021x.
usergroup
Select the icon color for the web-based manager:
1
vlan
comments <text_str> portal-message-override-group
<groupname_str> radius-server <server_str> selected-usergroups <group1>
[<group2> ... <groupn>] security {open | captive-portal
| 8021x} usergroup <group>
Enter a comment about this VLAN.
Set the captive portal replacement message override group. This is available when security is captive-portal.
Enter the IP address or FQDN of the RADIUS server.
This is available when security is 8021x and auth is radius.
Enter the user groups that can authenticate using the captive portal. This is available when security is captive-portal.
Select the type of security to apply. open provides no security.
This is available when security is 8021x and auth is usergroup.
No default.
open
No default.
Read-only fields
vlanid <id_int> vdom <vdom_name>
Current VLAN ID. Range 1 to 4094.
Current VDOM name.
Fortinet Technologies Inc.
Page 469 FortiOS™ - CLI Reference for FortiOS 5.0
system
Use system commands to configure options related to the overall operation of the FortiGate unit, including. This chapter contains the following sections:
replacemsg device-detection-portal
(continued overleaf...)
Page 470
system
(continued)
Fortinet Technologies Inc.
Page 471 FortiOS™ - CLI Reference for FortiOS 5.0
system 3g-modem custom
3g-modem custom
Use this command to configure the FortiGate unit for an installed 3G wireless PCMCIA modem.
Syntax
config system 3g-modem custom edit <entry_id>
set vendor <vendor_str> set model <model_str>
end
set product-id <pid_hex> set vendor-id <vid_hex> set class-id <cid_hex> set init-str <init_str>
Variable Description
vendor <vendor_str>
Enter the vendor name.
model <model_str>
Enter the modem model name.
product-id <pid_hex>
Enter the USB product ID. Valid range is 0x0000 - 0xFFFF.
vendor-id <vid_hex>
Enter the USB vendor ID. Valid range is 0x0000 - 0xFFFF.
class-id <cid_hex> init-str <init_str>
Enter the USB interface class. Valid range is 0x00 - 0xFF
Enter the initialization string in hexadecimal format, even length.
Default
Fortinet Technologies Inc.
Page 472 FortiOS™ - CLI Reference for FortiOS 5.0
system
accprofile
accprofile
Use this command to add access profiles that control administrator access to FortiGate features. Each FortiGate administrator account must include an access profile. You can create access profiles that deny access, allow read only, or allow both read and write access to
FortiGate features.
You cannot delete or modify the super_admin access profile, but you can use the super_admin profile with more than one administrator account.
Syntax
config system accprofile
edit <profile-name> set menu-file <filedata> set scope {global | vdom}
set <access-group> <access-level>
config fwgrp-permission set
address {none | read | read-write}
set
device {none | read | read-write}
set
others {none | read | read-write}
set
policy {none | read | read-write}
set
profile {none | read | read-write}
set
schedule {none | read | read-write}
set
service {none | read | read-write}
end config loggrp-permission set
config {none | read | read-write}
end set
data-access {none | read | read-write}
end config utmgrp-permission set
antivirus {none | read | read-write}
set
application-control {none | read | read-write}
set
data-loss-prevention {none | read | read-write}
set
icap {none | read | read-write}
set
ips {none | read | read-write}
set
netscan {none | read | read-write}
set
spamfilter {none | read | read-write}
set
voip {none | read | read-write}
set
webfilter {none | read | read-write}
Variable
edit <profile-name> menu-file <filedata> scope {global | vdom}
Description
Enter a new profile name to create a new profile. Enter an existing profile name to edit that profile.
No default.
Enter the name of the base64-encoded file of data to configure the menu display on the FortiGate unit. For future use.
Enter scope administrator access: global or a single
VDOM.
Default
No default.
vdom
Fortinet Technologies Inc.
Page 473 FortiOS™ - CLI Reference for FortiOS 5.0
system accprofile
Variable
<access-group>
Description
Enter the feature group for which you are configuring access: admingrp administrator accounts and access profiles authgrp user authentication, including local users,
RADIUS servers, LDAP servers, and user groups endpointcontrol-grp fwgrp loggrp endpoint control (Endpoint NAC) configuration firewall configuration log and report configuration including log settings, viewing logs and alert email settings
Default
No default.
mntgrp execute batch commands maintenance commands: reset to factory defaults, format log disk, reboot, restore and shutdown interfaces, dhcp servers, zones netgrp No default.
get system status get system arp table config system arp-table execute dhcp lease-list execute dhcp lease-clear router configuration routegrp sysgrp system configuration except accprofile, admin and autoupdate updategrp FortiGuard antivirus and IPS updates, manual and automatic utmgrp vpngrp
UTM configuration
VPN configuration wanoptgrp WAN optimization configuration wifi WiFi configuration
<access-level>
Enter the level of administrator access to this feature: custom configures custom access for fwgrp, loggrp or utmgrp access selections only no access none read readwrit e read-only access read and write access
config fwgrp-permission fields. Available if fwgrp is set to custom
address
{none | read | read-write} device
{none | read | read-write} others
{none | read | read-write}
Enter the level of administrator access to firewall addresses.
Enter the level of administrator access to netscan device identification configurations.
Enter the level of administrator access to virtual IP configurations. none none none
Fortinet Technologies Inc.
Page 474 FortiOS™ - CLI Reference for FortiOS 5.0
system accprofile
Variable
policy
{none | read | read-write} profile
{none | read | read-write} schedule
{none | read | read-write} service
{none | read | read-write}
Description
Enter the level of administrator access to firewall policies.
Enter the level of administrator access to firewall profiles.
Enter the level of administrator access to firewall schedules.
Enter the level of administrator access to firewall service definitions.
Default
none none none none config loggrp-permission fields. Available if loggrp is set to custom.
config
{none | read | read-write}
Enter the level of administrator access to the logging configuration.
data-access
{none | read | read-write}
Enter the level of administrator access to the log data.
none none
config utmgrp-permission fields. Available if utmgrp is set to custom.
antivirus
{none | read | read-write} application-control
{none | read | read-write} data-loss-prevention
{none | read | read-write} icap
{none | read | read-write} ips
{none | read | read-write} netscan
{none | read | read-write} spamfilter
{none | read | read-write} voip
{none | read | read-write} webfilter
{none | read | read-write}
Enter the level of administrator access to antivirus configuration data.
Enter the level of administrator access to application control data.
Enter the level of administrator access to data loss prevention (DLP) data.
Enter the level of administrator access to Internet
Content Adaptation Protocol configuration.
Enter the level of administrator access to intrusion prevention (IP) data.
Enter the level of administrator access to network scans.
Enter the level of administrator access to spamfilter data.
Enter the level of administrator access to VOIP data.
Enter the level of administrator access to web filter data.
none none none none none none none none none
Fortinet Technologies Inc.
Page 475 FortiOS™ - CLI Reference for FortiOS 5.0
system
admin
admin
Use this command to add, edit, and delete administrator accounts. Administrators can control what data modules appear in the FortiGate unit system dashboard by using the config system admin command. Administrators must have read and write privileges to make dashboard web-based manager modifications.
Use the default admin account or an account with system configuration read and write privileges to add new administrator accounts and control their permission levels. Each administrator account except the default admin must include an access profile. You cannot delete the default super admin account or change the access profile (super_admin). In addition, there is also an access profile that allows read-only super admin privileges, super_admin_readonly. The super_admin_readonly profile cannot be deleted or changed, similar to the super_admin profile. This read-only super-admin may be used in a situation where it is necessary to troubleshoot a customer configuration without making changes.
You can authenticate administrators using a password stored on the FortiGate unit or you can perform authentication with RADIUS, LDAP, or TACACS+ servers. When you use RADIUS authentication, you can authenticate specific administrators or you can allow any account on the RADIUS server to access the FortiGate unit as an administrator.
For users with super_admin access profile, you can reset the password in the CLI.
For a user ITAdmin with the access profile super_admin, to set the password to 123456: config system admin edit ITAdmin end set password 123456
For a user ITAdmin with the access profile super_admin, to reset the password from 123456 to the default ‘empty’ or ‘null’: config system admin edit ITAdmin end unset password 123456
If you type ‘set password ?’ in the CLI, you will have to enter the new password and the old password in order for the change to be effective. In this case, you will NOT be able to reset the password to ‘empty’ or ‘null’.
You can configure an administrator to only be allowed to log in at certain times. The default setting allows administrators to log in any time.
A vdom/access profile override feature supports authentication of administrators via RADIUS.
The admin user will be have access depending on which vdom they are restricted to and their associated access profile. This feature is only available to wildcard admins. There can only be one vdom-override user per system.
You can define trusted hosts for all of your administrators to increase the security of your network by further restricting administrative access. When you set trusted hosts for all administrators, the FortiGate unit does not respond to administrative access attempts from any other hosts. The trusted hosts you define apply both to the web-based manager and to the CLI when accessed through Telnet or SSH. CLI access through the console connector is not affected.
Fortinet Technologies Inc.
Page 476 FortiOS™ - CLI Reference for FortiOS 5.0
system admin
Syntax
config system admin edit <name_str>
| memory |disk} set {ip6-trusthost1 | ip6-trusthost2 | ip6-trusthost3
| ip6-trusthost4 | ip6-trusthost5 | ip6-trusthost6
| ip6-trusthost7 | ip6-trusthost8 | ip6-trusthost9
| trusthost5 | trusthost6 | trusthost7 | trusthost8
| trusthost9 | trusthost10} <address_ipv4mask>
set two-factor {enable | disable} set vdom <vdom_name> set wildcard {enable | disable}
config dashboard edit <id> set
set
set
set
set
end config dashboard-tab
set
set
end
Fortinet Technologies Inc.
Page 477 FortiOS™ - CLI Reference for FortiOS 5.0
system
end
Variable
accprofile
<profile-name> accprofile-override
{enable | disable} allow-remove-adminsession {enable | disable} comments
<comments_string> force-password-change
{enable | disable}
Description Default
Enter the name of the access profile to assign to this administrator account. Access profiles control administrator access to FortiGate features.
No default.
disable
Enable authentication server override of the administrator access profile. Note: This redirection will not occur if HTTPS & SSL-VPN are enabled on the same port.
enable
Disable to prevent other administrators from closing the session. This field is available for accounts with the super_admin profile.
null
Enter the last name, first name, email address, phone number, mobile phone number, and pager number for this administrator. Separate each attribute with a comma, and enclose the string in double-quotes. The total length of the string can be up to 128 characters. (Optional) disable
Enable to require this administrator to change password at next login. Disabling this option does not prevent required password change due to password policy violation or expiry.
This is available only if password policy is enabled.
See “system password-policy” on page 603 .
Enable guest authentication.
disable guest-auth
{enable | disable} guest-usergroups
<groups_list> gui-log-display
{| fortianalyzer
| fortiguard
| memory |disk}
{ip6-trusthost1
| ip6-trusthost2
| ip6-trusthost3
| ip6-trusthost4
| ip6-trusthost5
| ip6-trusthost6
| ip6-trusthost7
| ip6-trusthost8
| ip6-trusthost9
| ip6-trusthost10}
<address_ipv6mask> password
<admin_password> password-expire <date>
<time>
Enter the user groups used for guests.
Select the device from which logs are displayed in the web-based manager.
Any IPv6 address and netmask from which the administrator can connect to the FortiGate unit.
If you want the administrator to be able to access the FortiGate unit from any address, set the trusted hosts to ::/0.
Enter the password for this administrator. It can be up to 64 characters in length.
Enter the date and time that this administrator’s password expires. Enter zero values for no expiry.
Date format is YYYY-MM-DD. Time format is HH:
MM:SS.
No default.
disk or memory, depending on model
::/0 null
0000-00-00
00:00:00
admin
Fortinet Technologies Inc.
Page 478 FortiOS™ - CLI Reference for FortiOS 5.0
system
Variable Description
peer-auth
{disable | enable}
Set to enable peer certificate authentication (for
HTTPS admin access). If peer-auth is enabled, two-factor is not available.
peer-group <peer-grp>
Name of peer group defined under c onfig user peergrp or user group defined under config user group. Used for peer certificate authentication (for HTTPS admin access).
radius-vdom-override
{enable | disable} remote-auth
{enable | disable} remote-group <name>
Enable RADIUS authentication override for the
(wildcard only) administrator.
Enable or disable authentication of this administrator using a remote RADIUS, LDAP, or TACACS+ server.
Enter the administrator user group name, if you are using RADIUS, LDAP, or TACACS+ authentication.
Default
disable null disable disable
No default.
schedule
<schedule-name> sms-phone
<cell_phone_number>
This is only available when remote-auth is enabled.
Restrict times that an administrator can log in.
Defined in config firewall schedule. Null indicates that the administrator can log in at any time.
null
Enter the telephone number of the cellular phone where the SMS text message will be sent containing the token code for two-factor authentication. null sms-provider <string>
Typically the format does not include the country code, but does include the other digits of the cell phone number. Verify the correct format with the cell phone provider.
Select an SMS provider from the list of configured entries.
No default.
ssh-public-key1
"<key-type>
<key-value>" ssh-public-key2
"<key-type>
<key-value>" ssh-public-key3
"<key-type>
<key-value>"
{trusthost1 | trusthost2
| trusthost3 | trusthost4
| trusthost5 | trusthost6
| trusthost7 | trusthost8
| trusthost9 | trusthost10}
<address_ipv4mask>
This is the cell phone service provider, and the list of providers is configured with the command
“system sms-server” on page 679 .
You can specify the public keys of up to three SSH clients. These clients are authenticated without being asked for the administrator password. You must create the public-private key pair in the SSH client application.
No default.
No default.
<key type> is ssh-dss for a DSA key or ssh-rsa for an RSA key.
No default.
<key-value> is the public key string of the SSH client.
Any IPv4 address or subnet address and netmask from which the administrator can connect to the
FortiGate unit.
If you want the administrator to be able to access the FortiGate unit from any address, set the trusted hosts to 0.0.0.0 and the netmask to 0.0.0.0.
0.0.0.0 0.0.0.0
admin
Fortinet Technologies Inc.
Page 479 FortiOS™ - CLI Reference for FortiOS 5.0
system admin
Variable
two-factor
{enable | disable} vdom <vdom_name> wildcard
{enable | disable}
Description
Enable to use two-factor authentication with this admin account. When enabled, one of FortiToken, email, or SMS text message to a cellular phone is used as the second factor.
Enter the name of the VDOM this account belongs to. (Optional)
Enable wildcard to allow all accounts on an authentication server to log on to the FortiGate unit as administrator. Disable wildcard if you want to allow only the specified administrator to log on.
This is available when remote-auth is enabled.
config dashboard variables
<module_id>
Enter the number of this widget. Use 0 to create a new widget instance.
widget-type
<module_name>
Name of the system dashboard or usage widget to configure. For a list of the available widget types, enter: column
<column_number> status {close | open}
<custom_options> set widget-type ?
Column in which the dashboard module appears.
Values
1 or 2. Available for all dashboard modules.
Set whether the widget is open or closed on the dashboard.
The custom options for the usage and dashboard widgets are listed in the “Dashboard and usage widget variables” section.
config dashboard-tab variables
edit <tab_int> columns {1 | 2} name <name_str>
Enter tab number of new dashboard.
Select one or two-column format.
Enter a name for the tab.
Dashboard and usage widget variables
alert
Configure the information displayed on the alert message console by enabling or disabling the following options:
show-admin-auth — admin authentication failures
show-amc-bypass — AMC interface bypasses
show-conserve-mode — conserve mode alerts
show-device-update — device updates
show-disk-failure — disk failure alerts
show-fds-quota — FortiGuard alerts
show-fds-update — FortiGuard updates
show-firmware-change — firmware images
show-policy-overflow — policy too large (> 64kB)
show-power-supply — power supply alerts
show-system-restart — system restart alerts
Default
disable
No default.
disable
No default.
0
Depends on widget
No default.
2
No default.
enable enable enable enable enable disable enable enable enable enable enable
Fortinet Technologies Inc.
Page 480 FortiOS™ - CLI Reference for FortiOS 5.0
system
Variable
app-usage jsconsole licinfo
Description
Configure the operation of the top application usage widget:
Default
display-format {chart | table}— display data in a chart or a table.
refresh-interval <interval_int> — set the time interval for updating the widget display in the range
10 to 240 seconds or 0 to disable
report-by {application | destination | protocol |
source}— set the attribute by which to report application usage.
resolve-host {disable | enable}— display host names (instead of IP addresses).
show-auth-use {disable | enable}— include the user name of authenticated users.
chart
0 source disable disable
sort-by {bytes | msg-counts}— sort information by data ( bytes) or number of session (msg-counts).
bytes
top-n <results_int> — set the number of results to display. The default value displays the top 10 results.
10
vdom <vdom_str> — display results for a specific
VDOM.
Set the dashboard column and open and closed status of the CLI console widget.
Set the dashboard column and open and closed status of the License information widget.
No default.
admin
Fortinet Technologies Inc.
Page 481 FortiOS™ - CLI Reference for FortiOS 5.0
system
Variable
protocol-usage
Description
For the top protocol usage widget set the column and open and closed status and set the following options:
Default
display-format {chart | line}— display data as a bytes-per-protocol bar chart or a color-coded bytesover-time line graph.
chart
protocols <integer> — select the protocols to display by entering the sum of the desired protocol values:
0
•
1 Browsing
•
2 DNS
•
4 Email
•
8 FTP
•
16 Gaming
•
32 Instant Messaging
•
64 Newsgroups
•
128 P2P
•
256 Streaming
•
512 TFTP
•
1024 VoIP
•
2048 Generic TCP
•
4096 Generic UDP
•
8192 Generic ICMP
•
16384 Generic IP
time-period — the time period in minutes that the display covers. The default is 1440 (24 hours).
1440
admin
Fortinet Technologies Inc.
Page 482 FortiOS™ - CLI Reference for FortiOS 5.0
system
Variable
sessions sessions-history show-forward-traffic
{enable | disable} show-local-traffic
{enable | disable} sort-by
{bandwidth | session} statistics storage sysinfo sysop
Description
For the top session dashboard widget set the dashboard column and open and closed status and set the following options:
Default
aggregate-hosts {enable | disable} — enable or disable aggregation of hosts in the widget.
chart
display-format {chart | table} — display data in a chart or a table.
(null)
dst-interface — set destination interface filter for session display ipboth
ip-version — set Internet Protocol version of sessions to display:
IPv4, IPv6, or ipboth.
refresh-interval <interval_int> — set the time interval for updating the widget display in the range
10 to 240 seconds or 0 to disable.
0 bytes
sort-by {bytes | msg-counts} — sort information by the amount of data ( bytes) or the number of session
( msg-counts).
10
top-n <results_int> — set the number of results to display. The default value displays the top 10 results.
No default.
vdom <vdom_str> — display results for a specific
VDOM.
Set the dashboard column, chart color, and viewtype.
Enable or disable display of forward traffic in
Sessions widget. Forward traffic is any traffic through the FortiGate that has a policy id.
Enable or disable display of local traffic in Sessions widget. Local traffic is traffic to/from the FortiGate unit (no policy id).
Choose sort by bandwidth or session for sessionsbandwidth widget.
Set the dashboard column and open and closed status of the log and archive statistics dashboard widget.
Set the dashboard column and open and closed status of the log and archive storage dashboard widget.
Set the dashboard column and open and closed status of the system information dashboard widget.
Set the dashboard column and open and closed status of the unit operation dashboard widget.
disable disable bytes
admin
Fortinet Technologies Inc.
Page 483 FortiOS™ - CLI Reference for FortiOS 5.0
system
Variable
sysres
Description
For the system resources dashboard widget set the dashboard column and open and closed status and set the following options:
Default
chart-color <color_int> — select the chart color for the historical display. Default is 1.
admin
tr-history
cpu-display-type {average | each} — select display of each core or average of all cores on multicore processor models.
view-type {historical | real-time} — select historical graph or current value dial display.
time-period <minutes_int> — set time period in minutes for historical display
For the traffic history dashboard widget set the dashboard column and open and closed status and set the following options:
refresh {disable | enable} — enable automatically refreshing the display
interface <interface_name> — name of interface monitored for traffic history data.
tr-history-period1, tr-history-period2,
tr-history-period3 — time period (seconds) for each of the three history graphs. To disable a graph, set its period to
0.
Fortinet Technologies Inc.
Page 484 FortiOS™ - CLI Reference for FortiOS 5.0
system
amc
amc
Use this command to configure AMC ports on your FortiGate unit.
Syntax
config system amc set
{dw1 | dw2} {adm-fb8 | adm-fe8 | adm-xb2 | adm-xd4 | adm-xe2
end set
{sw1 | sw2} {asm-ce4 | asm-cx4 | asm-disk | asm-fb4 | asm-et4
Variable
{dw1 | dw2}
{adm-fb8
| adm-fe8
| adm-xb2
| adm-xd4
| adm-xe2
| auto | none}
{sw1 | sw2}
{asm-ce4
| asm-cx4
| asm-disk
| asm-fb4
| asm-et4
| asm-fx2
| auto | none}
Description
Configure this double width AMC slot for the following type of module.
adm-fb8 — AMC double width 8G NP2 accelerated network interface module adm-fe8 — AMC double width 8G FE8 accelerated network interface module adm-xb2 — AMC double width 2XG NP2 accelerated network interface module adm-xd4 — AMC double width 4XG XD4 accelerated network interface module adm-xe2 — AMC double width 2XG XE2 accelerated network interface module auto — support any card that is inserted none — not configured, disable slot
Configure this single width AMC port for the following type of card.
asm-ce4 — AMC single width, 4G CE4 accelerated network interface module asm-cx4 — AMC single width, 4G bypass asm-disk — AMC Single width SCSI hard disk card, such as
ASM-S08 asm-fb4 — AMC single width 4G NP2 accelerated network interface module asm-et4 — AMC single width T1/E1 network interface module asm-fx2 — AMC single width, 2G bypass auto — support any single width card none — not configured, disable slot
Default
auto auto
Fortinet Technologies Inc.
Page 485 FortiOS™ - CLI Reference for FortiOS 5.0
system
arp-table
arp-table
Use this command to manually configure add ARP table entries to the FortiGate unit. ARP table entries consist of a interface name, an IP address, and a MAC address.
Limits for the number of ARP table entries are software limits set by the FortiGate configuration as documented in the
FortiGate Maximum Values Matrix
document.
This command is available per VDOMs.
Syntax
config system arp-table edit <table_value>
set interface <port> set ip <address_ipv4>
end
Variable Description
interface <port> ip <address_ipv4>
Enter the interface this ARP entry is associated with
Enter the IP address of the ARP entry.
mac <mac_address>
Enter the MAC address of the device entered in the table, in the form of xx:xx:xx:xx:xx:xx.
Default
No default
No default.
No default.
Fortinet Technologies Inc.
Page 486 FortiOS™ - CLI Reference for FortiOS 5.0
system auto-install
auto-install
Use this command to configure automatic installation of firmware and system configuration from a USB disk when the FortiGate unit restarts. This command is available only on units that have a USB disk connection.
If you set both configuration and firmware image update, both occur on the same reboot. The
FortiGate unit will not reload a firmware or configuration file that is already loaded.
Third-party USB disks are supported; however, the USB disk must be formatted as a FAT16 drive. No other partition type is supported.
To format your USB Disk when its connected to your FortiGate unit, at the CLI prompt type
“ exe usb-disk format”.
To format your USB disk when it is connected to a Windows system, at the command prompt type “ format <drive_letter>: /FS:FAT /V:<drive_label>” where
<drive_letter> is the letter of the connected USB drive you want to format, and
<drive_label> is the name you want to give the USB disk volume for identification.
This command is available only when a USB key is installed on the FortiGate unit. Formatting your USB disk will delete all information on your USB disk.
Syntax
config system auto-install set
auto-install-config {enable | disable}
set
auto-install-image {enable | disable}
set
end set
Variable Description Default
auto-install-config
{enable | disable} auto-install-image
{enable | disable}
Enable or disable automatic loading of the system configuration from a USB disk on the next reboot.
Enable or disable automatic installation of firmware from a
USB disk on the next reboot.
disable disable default-config-file
Enter the name of the configuration file on the USB disk.
fgt_system.conf
default-image-file
Enter the name of the image file on the USB disk.
image.out
Fortinet Technologies Inc.
Page 487 FortiOS™ - CLI Reference for FortiOS 5.0
system autoupdate push-update
autoupdate push-update
Use this command to configure push updates. The FortiGuard Distribution Network (FDN) can push updates to FortiGate units to provide the fastest possible response to critical situations such as software exploits or viruses. You must register the FortiGate unit before it can receive push updates.
When you configure a FortiGate unit to allow push updates, the FortiGate unit sends a SETUP message to the FDN. The next time an update is released, the FDN notifies all FortiGate units that are configured for push updates that a new update is available. Within 60 seconds of receiving a push notification, the FortiGate unit requests an update from the FDN.
By using this command, you can enable or disable push updates. You can also configure push
IP address and port overrides. If the FDN must connect to the FortiGate unit through a NAT device, you must configure port forwarding on the NAT device and add the port forwarding information to the push update override configuration.
You cannot receive push updates through a NAT device if the external IP address of the NAT device is dynamic (for example, set using PPPoE or DHCP).
Syntax
config system autoupdate push-update set
set
set
end set
Variable
port <FDN_port>
Description
status {enable | disable} Enable or disable FDN push updates.
override
{enable | disable} address <push_ipv4>
Enable an override of push updates. Select enable if the
FortiGate unit connects to the FDN through a NAT device.
Enter the External IP address that the FDN connects to if you want to enable push override. This is the address of the external interface of your NAT device.
Enter the port that the FDN connects to. This can be port
9443 by default or a different port that you assign.
Default
disable disable
0.0.0.0
9443
Fortinet Technologies Inc.
Page 488 FortiOS™ - CLI Reference for FortiOS 5.0
system autoupdate schedule
autoupdate schedule
Use this command to enable or disable scheduled FDN updates at regular intervals throughout the day, once a day, or once a week.
To have your FortiGate unit to update at a random time during a particular hour, select a time that includes 60 minutes as this will choose a random time during that hour for the scheduled update.
Syntax
config system autoupdate schedule set
set
frequency {every | daily | weekly}
set
end set
Variable Description
status {enable | disable}
Enable or disable scheduled updates.
frequency
{every | daily | weekly}
Schedule the FortiGate unit to check for updates every hour, once a day, or once a week. Set interval to one of the following:
Default
enable every time <hh:mm> day <day_of_week> every — Check for updates periodically. Set time to the time interval to wait between updates.
daily — Check for updates once a day. Set time to the time of day to check for updates.
weekly — Check for updates once a week. Set day to the day of the week to check for updates. Set time to the time of day to check for updates.
Enter the time at which to check for updates.
00:00 hh — 00 to 23 mm — 00-59, or 60 for random minute
Enter the day of the week on which to check for updates.
Enter one of:
Sunday, Monday, Tuesday, Wednesday,
Thursday, Friday, or Saturday.
This option is available only when frequency is set to weekly.
Monday
Fortinet Technologies Inc.
Page 489 FortiOS™ - CLI Reference for FortiOS 5.0
system autoupdate tunneling
autoupdate tunneling
Use this command to configure the FortiGate unit to use a proxy server to connect to the
FortiGuard Distribution Network (FDN). You must enable tunneling so that you can use the proxy server, and also add the IP address and port required to connect to the proxy server. If the proxy server requires authentication, add the user name and password required to connect to the proxy server.
The FortiGate unit connects to the proxy server using the HTTP CONNECT method, as described in RFC 2616. The FortiGate unit sends a HTTP CONNECT request to the proxy server
(optionally with authentication information) specifying the IP address and port required to connect to the FDN. The proxy server establishes the connection to the FDN and passes information between the FortiGate unit and the FDN.
The CONNECT method is used mostly for tunneling SSL traffic. Some proxy servers do not allow CONNECT to connect to any port; proxy servers restrict the allowed ports to the well known ports for HTTPS and perhaps some other similar services. FortiGate autoupdates use
HTTPS on port 8890 to connect to the FDN, so your proxy server may need to be configured to allow connections on this port.
Syntax
config system autoupdate tunneling set
set
set
end set
set
Variable
password <password>
Description
address <proxy_address> The IP address or fully qualified domain name of the proxy server.
The password to connect to the proxy server if one is required.
port <proxy_port>
The port required to connect to the proxy server.
status {enable | disable}
Enable or disable tunneling.
username <name>
The user name used to connect to the proxy server.
Default
No default.
No default.
0 disable
No default.
Fortinet Technologies Inc.
Page 490 FortiOS™ - CLI Reference for FortiOS 5.0
system
aux
aux
Use this command to configure the AUX port. You can use a modem connected to the AUX port to remotely connect to a console session on the FortiGate unit
The main difference between the standard console port and the AUX port is that the standard console port is for local serial console connections only. An AUX port cannot accept a modem connection to establish a remote console connection. The AUX console port allows you to establish a local connection, but it has some limitations the standard console port does not have.
• The AUX port will not display the booting messages that the standard console connection displays.
• The AUX port will send out modem initializing strings (AT strings) that will appear on an AUX console session at the start.
Syntax
config system aux set baudrate <baudrate> end
<baudrate> is the speed of the connection. It can be set to one of the following: 9600, 19200,
38400, 57600, or 115200. The default is 9600.
Ensure devices on both ends of the connection are set to the same baudrate.
Fortinet Technologies Inc.
Page 491 FortiOS™ - CLI Reference for FortiOS 5.0
system
bug-report
bug-report
Use this command to configure a custom email relay for sending problem reports to Fortinet customer support.
Syntax
config system bug-report set
set
set
set
set
end set
Variable
auth {no | yes}
Enter yes if the SMTP server requires authentication or no if it does not. mailto <email_address>
The email address for bug reports. The default is [email protected]. password <password>
If the SMTP server requires authentication, enter the password required.
server <servername> username <name>
Description
The SMTP server to use for sending bug report email.
The default server is fortinetvirussubmit.com
A valid user name on the specified SMTP server. The default user name is bug_report.
Default
no
See description.
No default.
See description.
See description.
username-smtp
<account_name>
A valid user name on the specified SMTP server. The default user name is bug_report.
See description.
Fortinet Technologies Inc.
Page 492 FortiOS™ - CLI Reference for FortiOS 5.0
system
bypass
bypass
Use this command to configure bypass operation on FortiGate models 600C and 1000C. This is available in transparent mode only.
Syntax
config system bypass set
bypass-timeout {2 | 4 | 6 | 8 | 10 | 12 | 14}
end set
bypass-watchdog {enable | disable}
set
poweroff-bypass {enable | disable}
Variable
bypass-timeout {2 | 4
| 6 | 8 | 10 | 12 | 14} bypass-watchdog
{enable | disable} poweroff-bypass
{enable | disable}
Description
Set the time in seconds to wait before entering bypass mode after the system becomes unresponsive.
Enable or disable monitoring for bypass condition.
Enable bypass function.
Default
10 disable disable
To enable power off bypass, you must enable both bypass-watchdog and poweroffbypass.
Fortinet Technologies Inc.
Page 493 FortiOS™ - CLI Reference for FortiOS 5.0
system central-management
central-management
Use this command to configure a central management server for this FortiGate unit. Central management uses a remote server to backup, restore configuration, and monitor the FortiGate unit. The remote server can be either a FortiManager or a FortiGuard server.
This command replaces the config system fortimanager command from earlier versions.
Syntax
config system central-management set
set
type {fortiguard | fortimanager }
set
schedule-config-restore {enable | disable}
set
schedule-script-restore {enable | disable}
set
allow-monitor {enable | disable}
set
allow-push-configuration {enable | disable}
set
allow-pushd-firmware {enable | disable}
set
allow-remote-firmware-upgrade {enable | disable}
set
enc-algorithm {default | high | low}
set
fortimanager-fds-override {enable | disable}
set
set
set
use-elbc-vdom {enable | disable}
end set
Variable
mode
{normal | backup}
Description
Select the mode:
Default
normal normal — normal central management mode type {fortiguard
| fortimanager } backup — backup central management mode
Select the type of management server as one of - fortiguard or fortimanager. You can enable remote management from a FortiManager unit or the FortiGuard
Analysis and Management Service.
schedule-config-restore
{enable | disable} schedule-script-restore
{enable | disable} allow-monitor
{enable | disable} allow-pushconfiguration
{enable | disable} allow-pushd-firmware
{enable | disable} allow-remote-firmwareupgrade
{enable | disable}
Select to enable scheduling the restoration of your
FortiGate unit’s configuration.
Select to enable the restoration of your FortiGate unit’s configuration through scripts.
Select to allow the remote service to monitor your
FortiGate unit.
Select to enable firmware image push updates for your
FortiGate unit.
Select to enable push firmware.
Select to allow the remote service to upgrade your
FortiGate unit with a new firmware image. fortimanager enable enable enable enable enable enable
Fortinet Technologies Inc.
Page 494 FortiOS™ - CLI Reference for FortiOS 5.0
system central-management
Variable
enc-algorithm
{default | high | low}
Description
Set encryption strength for communications between the
FortiGate unit and FortiManager or FortiAnalyzer.
Default
default high — 128-bit and larger key length algorithms:
DHE-RSA-AES256-SHA, AES256-SHA,
EDH-RSA-DES-CBC3-SHA, DES-CBC3-SHA,
DES-CBC3-MD5, DHE-RSA-AES128-SHA,
AES128-SHA low — 64-bit or 56-bit key length algorithms without export restrictions: EDH-RSA-DES-CDBC-SHA,
DES-CBC-SHA, DES-CBC-MD5 default — high strength algorithms and these medium-strength 128-bit key length algorithms:
RC4-SHA, RC4-MD5, RC4-MD fmg <fmg_ipv4>
Enter the IP address or FQDN of the remote
FortiManager server.
fmg-source-ip
<address_ipv4> fortimanager-fdsoverride
{enable | disable} use-elbc-vdom
{enable | disable}
Enter the source IP address to use when connecting to
FortiManager.
Enable global FortiManager override of FortiGuard service.
When enabled, FortiManager manages FortiGate through config sync vdom interface.
vdom <name_string>
Enter the name of the vdom to use when communicating with the FortiManager unit.
null null disable disable root
This field is optional.
Fortinet Technologies Inc.
Page 495 FortiOS™ - CLI Reference for FortiOS 5.0
system
console
console
Use this command to set the console command mode, the number of lines displayed by the console, and the baud rate.
If this FortiGate unit is connected to a FortiManager unit running scripts, output must be set to standard for scripts to execute properly.
Syntax
config system console set
set
set
end set
Variable
baudrate <speed>
Description
Set the console port baudrate. Select one of 9600,
19200, 38400, 57600, or 115200.
login {enable | disable} mode {batch | line}
Enable or disable logon via console.
Set the console mode to line or batch. Used for autotesting only.
output {standard | more}
Set console output to standard (no pause) or more
(pause after each screen is full, resume on keypress).
This setting applies to show or get commands only.
Default
9600 enable line more
Fortinet Technologies Inc.
Page 496 FortiOS™ - CLI Reference for FortiOS 5.0
system
ddns
Use this command to configure Dynamic Domain Name Service. If an interface of your
FortiGate unit uses a dynamic IP address, you can arrange with a DDNS service to provide a domain name from which traffic is redirected to your network. The DDNS service is updated whenever the IP address changes.
DDNS is available only in NAT/Route mode.
Syntax
config system ddns edit
set ddns-server <ddns_service> set ddns-ttl <ttl_int> set ddns-username <ddns_username>
end
set ddns-zone <zone_str> set monitor-interface <interfaces>
Variable Description
<index_int>
Enter the unique index number for this DDNS entry.
ddns-auth {tsig | disable}
Enable TSIG authentication for the generic DDNS server. ddns-key <base64_str> ddns-keyname
<keyname_str> ddns-domain
<ddns_domain_name>
DDNS update key in base 64 encoding. Available when ddns-auth is tsig.
DDNS update keyname. Available when ddns-auth is tsig.
Enter the fully qualified domain name to use for the
DDNS. This is the domain name you have registered with your DDNS.
Default
disable
No default.
No default.
No default.
ddns-password
<ddns_password> ddns-server-ip
<ipv4_addr> ddns-sn <serno_str>
This field is available for some DDNS service providers.
Enter the password to use when connecting to the
DDNS server.
No default.
This is not available when ddns-server is dipdns.net.
Enter the DDNS server IP address for genericDDNS server.
Enter the DDNS serial number (dipdns.net).
0.0.0.0
No default.
ddns
Fortinet Technologies Inc.
Page 497 FortiOS™ - CLI Reference for FortiOS 5.0
system
Variable
ddns-server
<ddns_service> ddns-ttl <ttl_int> ddns-username
<ddns_username> ddns-zone <zone_str> monitor-interface
<interfaces>
Description
Select a DDNS server to use. The client software for these services is built into the FortiGate firmware. The
FortiGate unit can only connect automatically to a
DDNS server for these supported clients.
dhs.org — supports members.dhs.org and dnsalias.com.
dipdns.net — supports dipdnsserver.dipdns.com.
dyndns.org — supports members.dyndns.org.
dyns.net — supports www.dyns.net.
easydns.com — supports members.easydns.com.
FortiGuardDDNS — supports FortiGuard DDNS service.
genericDDNS — supports DDNS server (RFC 2136) defined in ddns-server-ip.
now.net.cn — supports ip.todayisp.com.
ods.org — supports ods.org.
tzo.com — supports rh.tzo.com.
vavic.com — supports ph001.oray.net(Peanut Hull).
Enter the time-to-live value for DDNS packets.
Enter the user name to use when connecting to the
DDNS server.
Default
No default.
300
No default.
This is not available when ddns-server is dipdns.net.
Enter a name for your DDNS zone. Available if ddns-server is genericDDNS.
No default.
Select the network interfaces that use DDNS service.
No default.
ddns
Fortinet Technologies Inc.
Page 498 FortiOS™ - CLI Reference for FortiOS 5.0
system dedicated-mgmt
dedicated-mgmt
Use this command to configure the dedicated management port. This port is in the hidden
VDOM dmgmt-vdom, which cannot be made the management VDOM. Therefore, the dedicated management port supports CLI access for configuration but does not permit management traffic such as firmware update or unit registration.
Syntax
config system dedicated-mgmt set
set
set
dhcp-server {enable | disable}
end set
Variable
status {enable | disable}
Enable dedicated management port.
default-gateway <IPv4_addr>
Enter the default gateway address. dhcp-server {enable | disable} Enable or disable the DHCP server for the management port.
interface <port_name>
Description Default
enable
192.168.1.1
disable
Enter the interface to be used for management.
mgmt
Fortinet Technologies Inc.
Page 499 FortiOS™ - CLI Reference for FortiOS 5.0
system dhcp reserved-address
dhcp reserved-address
Use this command to reserve an IP address for a particular client identified by its device MAC address and type of connection. The DHCP server then always assigns the reserved IP address to the client. You can define up to 200 reserved addresses.
This command is deprecated. Use the config reserved-address subcommand of the
system dhcp server command instead.
For this configuration to take effect, you must configure at least one DHCP server using the config system dhcp server command, see
“system dhcp server” on page 501
.
Syntax
config system dhcp reserved-address edit <id_int>
set ip <address_ipv4> set mac <address_hex>
end
Variable Description
ip <address_ipv4>
Enter the IPv4 address.
mac <address_hex>
Enter the MAC address.
type {regular | ipsec}
Enter the type of the connection to be reserved: regular — Client connecting through regular
Ethernet ipsec — Client connecting through IPSec VPN
Default
0.0.0.0
00:00:00:00:00:00 regular
Fortinet Technologies Inc.
Page 500 FortiOS™ - CLI Reference for FortiOS 5.0
system dhcp server
dhcp server
Use this command to add one or more DHCP servers for any FortiGate interface. As a DHCP server, the interface dynamically assigns IP addresses to hosts on a network connected to the interface.
You can use the config system dhcp reserved command to reserve an address for a
specific MAC address. For more information see “system dhcp reserved-address” on page 500 .
This command is available only in NAT/Route mode.
Syntax
config system dhcp server
Fortinet Technologies Inc.
Page 501 FortiOS™ - CLI Reference for FortiOS 5.0
system dhcp server
config exclude-range
set
set
config ip-range
set
set
config reserved-address
set
set
set
end end
Variable
edit
<server_index_int>
Description
Enter an integer ID for the DHCP server. The sequence number may influence routing priority in the FortiGate unit forwarding table.
Enable or disable this DHCP server.
status
{enable | disable} auto-configuration
{enable | disable} conflicted-ip-timeout
<timeout_int>
Enable or disable automatic configuration.
default-gateway
<address_ipv4> dns-server1
<address_ipv4> dns-server2
<address_ipv4> dns-server3
<address_ipv4> dns-service {default
| specify | local} domain
<domain_name_str>
Default
enable enable
Enter the time in seconds to wait after a conflicted IP address is removed from the DHCP range before it can be reused.
Valid range is from 60 to 8640000 seconds (1 minute to 100 days).
1800
The IP address of the default gateway that the DHCP server assigns to DHCP clients.
0.0.0.0
0.0.0.0
The IP address of the first DNS server that the DHCP server assigns to DHCP clients. Used if dns-service is set to specify.
The IP address of the second DNS server that the DHCP server assigns to DHCP clients. Used if dns-service is set to specify.
The IP address of the third DNS server that the DHCP server assigns to DHCP clients. Used if dns-service is set to specify.
Select default to assign DHCP clients the DNS servers added to the FortiGate unit using the config system dns command.
0.0.0.0
0.0.0.0
specify
Select specify to specify the DNS servers that this DHCP server assigns to DHCP clients. Use the dns-server# options to add DNS servers to this DHCP server configuration.
Select local to use this FortiGate unit as a DNS server.
Domain name suffix for the IP addresses that the DHCP server assigns to DHCP clients.
Fortinet Technologies Inc.
Page 502 FortiOS™ - CLI Reference for FortiOS 5.0
system dhcp server
Variable
interface
<interface_name> ip-mode
{range | usrgrp} netmask <mask> ntp-server1
<ipv4_addr> ntp-server2
<ipv4_addr> ntp-server3
<ipv4_addr> ntp-service {default
| specify | local}
Description
The FortiGate unit interface that this DHCP server can assign
IP addresses from. Devices connected to this interface can get their IP addresses from this DHCP server. You can only add one DHCP server to an interface.
Default
range
Configure whether an IPsec DHCP server assigns IP addresses based on the IP address range added to the configuration or based on the user group of the IPsec VPN user.
Visible only when server-type is set to ipsec.
Set the DHCP lease release delay in seconds for DHCP-over-
IPSec tunnels when the tunnel goes down.
60 ipsec-lease-hold
<release_seconds>
A value of 0 disables the forced expiry of the DHCP-over-
IPSec leases.
Visible only when server-type is set to ipsec.
lease-time <seconds>
The interval in seconds after which a DHCP client must ask the DHCP server for new settings. The lease duration must be between 300 and 864,000 seconds (10 days).
Set lease-time to 0 for an unlimited lease time.
The DHCP client netmask assigned by the DHCP server.
The IP addresses of up to three NTP servers.
604800
(7 days)
0.0.0.0
0.0.0.0
0.0.0.0
0.0.0.0
specify
Select default to use system NTP settings.
Select specify to specify the NTP servers that this DHCP server assigns to DHCP clients. Use the ntp-server# options to add NTP servers to this DHCP server configuration.
Select local to use this FortiGate unit as an NTP server.
Fortinet Technologies Inc.
Page 503 FortiOS™ - CLI Reference for FortiOS 5.0
system dhcp server
Variable
option1
<option_code>
[<option_hex>] option2
<option_code>
[<option_hex>] option3
<option_code>
[<option_hex>] option4
<option_code>
[<option_hex>] option5
<option_code>
[<option_hex>] option6
<option_code>
[<option_hex>] server-type
{ipsec | regular}
Description
The DHCP server can send up to six custom DHCP options. option_code is the DHCP option code in the range 1 to
255. option_hex is an even number of hexadecimal characters. For detailed information about DHCP options, see RFC 2132, DHCP Options and BOOTP Vendor
Extensions.
Enter the type of client to serve:
Default
0 regular vci-match
{enable | disable} vci-string <string> wifi-ac1 <ipv4_addr> wifi-ac2 <ipv4_addr> wifi-ac3 <ipv4_addr> wins-server1
<wins_ipv4> wins-server2
<wins_ipv4> wins-server3
<wins_ipv4> regular client connects through regular Ethernet ipsec client connects through IPsec VPN
Enable to turn on vendor class identifier (VCI) matching.
When enabled only DHCP requests with the matching VCI string will be served.
Enter the VCI names to match when vci-match is enabled.
Separate strings with spaces.
The IP addresses of up to three WiFi controllers.
The IP address of the first WINS server that the DHCP server assigns to DHCP clients.
disable
No default.
0.0.0.0
0.0.0.0
0.0.0.0
0.0.0.0
The IP address of the second WINS server that the DHCP server assigns to DHCP clients.
0.0.0.0
The IP address of the third WINS server that the DHCP server assigns to DHCP clients.
0.0.0.0
config exclude-range fields
edit <excl_range_int> Enter an integer ID for this exclusion range.
Configure a range of IP addresses to exclude from the list of
DHCP addresses that are available. You can add up to 16 exclusion ranges of IP addresses that the FortiGate DHCP server cannot assign to DHCP clients.
end-ip <end_ipv4>
The end IP address in the exclusion range. The start IP and end IP must be in the same subnet.
start-ip <start_ipv4>
The start IP address in the exclusion range. The start IP and end IP must be in the same subnet.
config ip-range fields
No default.
0.0.0.0
0.0.0.0
Fortinet Technologies Inc.
Page 504 FortiOS™ - CLI Reference for FortiOS 5.0
system dhcp server
Variable
edit <ip_range_int>
Description
Enter an integer ID for this IP address range.
Default
No default.
Configure the range of IP addresses that this DHCP server can assign to DHCP clients. You can add up to 16 ranges of
IP addresses that the FortiGate DHCP server can assign to
DHCP clients.
end-ip <address_ipv4> The end IP in the IP addresses range that this DHCP server assigns to DHCP clients. The IP range is defined by the start-ip and the end-ip fields which should both be in the same subnet.
start-ip
<address_ipv4>
The starting IP for the range of IP addresses that this DHCP server assigns to DHCP clients. The IP range is defined by the start-ip and the end-ip fields which should both be in the same subnet.
0.0.0.0
0.0.0.0
config reserved-address fields
edit <id_int>
Enter an ID number for this IP address entry.
description <desc_str> Optionally, enter a description for the host.
ip <ipv4_addr>
Enter an IP address to reserve. It will be bound to this MAC address. mac <mac_addr>
Configure one or more IP addresses that are reserved. These addresses cannot be given out by the DHCP server. There can be a maximum of 16 entries.
Enter a MAC address that will be bound to this IP address. If this MAC address comes up in the DHCP list, it will be ignored.
No default.
0.0.0.0
00:00:00:
00:00:00
Fortinet Technologies Inc.
Page 505 FortiOS™ - CLI Reference for FortiOS 5.0
system dhcp6 server
dhcp6 server
Use this command to add one or more IPv6 DHCP servers for any FortiGate interface. As a
DHCP server, the interface dynamically assigns IP addresses to hosts on a network connected to the interface.
This command is available in NAT/Route mode only.
Syntax
config system dhcp6 server
end end set
set
Variable Description
edit <server_index_int> Enter an integer ID for the DHCP server. The sequence number may influence routing priority in the FortiGate unit forwarding table.
status {enable | disable} Enable or disable this DHCP server.
dns-service
{default | specify}
Select default to assign DHCP clients the DNS servers added to the FortiGate unit using the config system dns command. Select specify to specify the DNS servers that this DHCP server assigns to DHCP clients.
Use the dns-server# options to add DNS servers to this
DHCP server configuration.
dns-server1
<address_ipv6> dns-server2
<address_ipv6>
The IP address of the first DNS server that the DHCP server assigns to DHCP clients. Used if dns-service is set to specify.
The IP address of the second DNS server that the DHCP server assigns to DHCP clients. Used if dns-service is set to specify.
dns-server3
<address_ipv6>
The IP address of the third DNS server that the DHCP server assigns to DHCP clients. Used if dns-service is set to specify.
Default
enable specify
::
::
::
Fortinet Technologies Inc.
Page 506 FortiOS™ - CLI Reference for FortiOS 5.0
system dhcp6 server
Variable
domain
<domain_name_str> interface
<interface_name> lease-time <seconds>
Description
Domain name suffix for the IP addresses that the DHCP server assigns to DHCP clients.
Default
null
The FortiGate unit interface that this DHCP server can assign IP addresses from. Devices connected to this interface can get their IP addresses from this DHCP server.
You can only add one DHCP server to an interface.
null
The interval in seconds after which a DHCP client must ask the DHCP server for new settings. The lease duration must be between 300 and 864,000 seconds (10 days).
604800
(7 days) option1 <option_code>
[<option_hex>] option2 <option_code>
[<option_hex>] option3 <option_code>
[<option_hex>] subnet <mask> config ip-range
Set lease-time to 0 for an unlimited lease time.
The first, second, and third custom DHCP options that can be sent by the DHCP server. option_code is the DHCP option code in the range 1 to 255. option_hex is an even number of hexadecimal characters. For detailed information about DHCP options, see RFC 2132, DHCP
Options and BOOTP Vendor Extensions.
0
The DHCP client netmask assigned by the DHCP server.
::/0
Configure the range of IP addresses that this DHCP server can assign to DHCP clients.
Enter an integer ID for this IP address range.
edit <ip_range_int>
You can add up to 16 ranges of IP addresses that the
FortiGate DHCP server can assign to DHCP clients.
start-ip <address_ipv6>
The starting IP for the range of IP addresses that this
DHCP server assigns to DHCP clients. The IP range is defined by the start-ip and the end-ip fields which should both be in the same subnet.
end-ip <end_ipv6>
The end IP address for the range of IP addresses that this
DHCP server assigns to DHCP clients. The IP range is defined by the start-ip and the end-ip fields which should both be in the same subnet.
::
::
Fortinet Technologies Inc.
Page 507 FortiOS™ - CLI Reference for FortiOS 5.0
system
dns
Use this command to set the DNS server addresses. Several FortiGate functions, including sending email alerts and URL blocking, use DNS.
Syntax
config system dns set
cache-notfound-responses {enable | disable}
set
set
set
set
set
set
end set
set
Variable Description
cache-notfound-responses
{enable | disable}
Enable to cache NOTFOUND responses from the DNS server.
dns-cache-limit <integer> Set maximum number of entries in the DNS cache.
dns-cache-ttl <int>
Enter the duration, in seconds, that the DNS cache retains information.
domain <domain_name> Set the local domain name (optional).
ip6-primary <dns_ipv6>
Enter the primary IPv6 DNS server IP address. ip6-secondary <dns_ip6> Enter the secondary IPv6 DNS server IP address. primary <dns_ipv4>
Enter the primary DNS server IP address. secondary <dns_ip4>
Enter the secondary DNS IP server address. source-ip <ipv4_addr>
Enter the IP address for communications to DNS server.
Default
disable
5000
1800
No default.
::
::
208.91.112.53
208.91.112.52
0.0.0.0
dns
Fortinet Technologies Inc.
Page 508 FortiOS™ - CLI Reference for FortiOS 5.0
system dns-database
dns-database
Use this command to configure the FortiGate DNS database so that DNS lookups from an internal network are resolved by the FortiGate DNS database. To configure the DNS database you add zones. Each zone has its own domain name.
You then add entries to each zone. An entry is an host name and the IP address it resolves to.
You can also specify if the entry is an IPv4 address (A), an IPv6 address (AAAA), a name server
(NS), a canonical name (CNAME), or a mail exchange (MX) name.
Syntax
config system dns-database
config dns-entry
set
canonical-name <canonical_name_string>
set
set
set
end set
set
set
set
type {A | AAAA | MX | NS | CNAME}
end
Variable
edit <zone-string> domain <domain>
Description
Enter the DNS zone name. This is significant only on the FortiGate unit itself.
Set the domain name here — when matching lookup, use this zone name to match DNS queries.
Default
No default.
allow-transfer <ipv4_addr>
DNS zone transfer ip address list.
No default.
authoritative {enable | disable} Enable to declare this as an authoritative zone.
enable contact <email_string> hostmaster
Enter the email address of the administrator for this zone. If the email address is in this zone, you can enter just the username portion of the email address.
No default.
Fortinet Technologies Inc.
Page 509 FortiOS™ - CLI Reference for FortiOS 5.0
system dns-database
Variable Description
Enter the source IP address to use when forwarding to the DNS server.
Default
forwarder <ipv4_addr>
Enter the ip address of the dns zone forwarder.
ip-master <ipv4_addr>
Enter the IP address of the master DNS server.
This is available when type is slave.
primary-name <name_string>
Enter the domain name of the default DNS server for this zone.
No default.
No default dns source-ip <ipv4_addr> 0.0.0.0
status {enable | disable} ttl <int>
Select to enable this DNS zone entry.
Set the packet time-to-live in seconds. Range 0 to 2 147 483 647.
enable
86400 type {master | slave}
Select the type of this zone. master view {public | shadow} master — manage entries directly.
slave — import entries from outside source
Select the type of view for this zone: shadow
public — to service public clients
shadow — to service internal clients
This value cannot be changed once set.
This setting can be used in conjunction with config
system dns-server entries, where the
mode of a zone can be set to recursive. A recursive mode on a zone means DNS requests sent to the FortiGate will first check the Shadow
DNS Database and if no entry is found, will then forward to the system DNS setting.
config dns-entry variables
edit <entry-id> canonical-name
<canonical_name_string> hostname
<hostname_string> ip <ip_address>
Enter the canonical name of the host. This is available if type is CNAME.
Enter the name of the host.
Null
Null
0.0.0.0
ipv6 <ipv6_address> preference
<preference_value> status
{enable | disable}
Enter the IP address (IPv4) of the host. This is available if type is A.
Enter the IP address (IPv6) of the host. This is available if type is AAAA.
Enter the preference level.
0 is the highest preference. This is available if type is MX.
Enable the DNS entry.
::
10 enable
Fortinet Technologies Inc.
Page 510 FortiOS™ - CLI Reference for FortiOS 5.0
system dns-database
Variable
ttl <entry_ttl_value>
Description
Optionally, override the zone time-to-live value.
Range 0 to 2 147 483 647 seconds.
type {A | AAAA | MX | NS
| CNAME}
Set to 0 to use zone ttl value.
A — IPv4 host
AAAA — IPv6 host
CNAME — alias
MX — mail server
NS — name server
Default
0
A
Fortinet Technologies Inc.
Page 511 FortiOS™ - CLI Reference for FortiOS 5.0
system
dns-server
Use this command to configure the dns-server on a particular interface.
dns-server
Syntax
config system dns-server edit <intf_name> end
set mode {forward-only | non-recursive | recursive}
Variable
mode {forward-only
| non-recursive | recursive}
Description
Select the mode the dns-server for this interface will use.
forward-only — Forward query to the DNS server configured for the FortiGate unit.
non-recursive — Look up domain name in local database. Do not relay the request to the DNS server configured for the FortiGate unit. See
on page 367.
recursive — Look up domain name in local database. If the entry is not found, relay the request to the DNS server configured for the FortiGate unit.
Default
recursive
Fortinet Technologies Inc.
Page 512 FortiOS™ - CLI Reference for FortiOS 5.0
system
elbc
elbc
Use this command to set the chassis load balancing (ELBC) information for the FortiOS unit.
Unit must be in Transparent mode.
A FortiTrunk is a group of backplane slots where the fabric can load balance traffic. In order for this to happen, the trunk members (the blades) are responsible for sending their heartbeats over the fabric channel to the FortiSwitch. If blades are standalone each sends a heartbeat, but if they are in a FGCP HA cluster, only one heart beat is sent and the load balanced traffic is forwarded to the primary HA unit.
Syntax
config system elbc set
mode {none | content-cluster | dual-forticontroller
| forticontroller | forti-trunk | service-group}
set
graceful-upgrade {enable | disable}
set
end set
inter-chassis-support {enable | disable}
Variable
mode {none
| content-cluster
| dual-forticontroller
| forticontroller
| forti-trunk
| service-group}
Description
Select the ELBC mode to use.
• none — no ELBC operation
• content-cluster — load balance UTM traffic
• forticontroller — FortiController
• forti-trunk — use the FortiTrunk feature.
• service-group — full support of enhanced load balance cluster graceful-upgrade
{enable | disable}
Enable to upgrade the HA cluster when using ELBCv3. It will upgrade the primary unit after first upgrading the other units in the cluster. hb-device <intf_name> Specify the heartbeat interface for FortiTrunk mode.
inter-chassis-support
{enable | disable}
Enable or disable content cluster (aka. HAoC) interchassis support. When enabled, B1 and B2 on the FSW-
5203B will become a static link-aggregate, and will be used as HA hbdevs. FSW-5203B within a chassis cannot use the switch inter-connect as an HA hbdev when "inter-chassis-support" is enabled, and must be connected via B1/B2 instead. Disabling "inter-chassissupport" destroys the link-aggregate and resumes using the switch interconnect as the HA hbdev.
Default
none enable
No default.
disable
Fortinet Technologies Inc.
Page 513 FortiOS™ - CLI Reference for FortiOS 5.0
system email-server
email-server
Use this command to configure the FortiGate unit to access an SMTP server to send alert emails. This command is global in scope.
Syntax
config system email-server set
authenticate {enable | disable}
set
set
set
set
security {none | smtps | starttls}
set
server {<name-str> | <address_ipv4>}
set
end set
set
Variable Description
authenticate {enable | disable}
Enable SMTP authentication if the FortiGate unit is required to authenticate before using the SMTP server.
Default
disable password <password_str>
This field is accessible only if type is custom and server is defined.
Enter the password that the FortiGate unit needs to access the SMTP server.
No default.
This field is accessible only if type is custom, authenticate is enabled and server is defined.
port <port_integer>
Change the TCP port number that the FortiGate unit uses to connect to the SMTP server. The standard SMTP port is 25. You can change the port number if the SMTP server has been configured to use a different port.
reply-to <reply-to_str>
Optionally, specify the reply-to email address. security {none | smtps | starttls} Select the security profile to use for email.
server
{<name-str> | <address_ipv4>}
Enter the name of the SMTP server, in the format smtp.domain.com, to which the FortiGate unit should send email. Alternately, the IP address of the SMTP server can be entered. The SMTP server can be located on any network connected to the FortiGate unit.
source-ip <address_ipv4> source-ip6 <address_ipv6> username <username_str>
Enter the SMTP server source IPv4 address.
Enter the SMTP server source IPv6 address.
Enter the user name for the SMTP server that the
FortiGate unit uses to send alert emails.
25
No default.
none
No default.
No default.
No default.
No default.
This variable is accessible only if authenticate is enabled and server is defined.
Fortinet Technologies Inc.
Page 514 FortiOS™ - CLI Reference for FortiOS 5.0
system
fips-cc
fips-cc
Use this command to set the FortiGate unit into FIPS-CC mode.
Enable Federal Information Processing Standards-Common Criteria (FIPS-CC) mode. This is an enhanced security mode that is valid only on FIPS-CC-certified versions of the FortiGate firmware.
When switching to FIPS-CC mode, you will be prompted to confirm, and you will have to login.
When you enable FIPS-CC mode, all of the existing configuration is lost.
Syntax
config system fips-cc set
entropy-token {enable | disable | dynamic}
end set
Variable
entropy-token
{enable | disable
| dynamic}
Description
Set use of FortiTRNG token at boot-up in FIPS-CC mode: enable — token required disable — token not required
Default
dynamic dynamic — token used if present status {enable | disable}
Enable to select FIPS-CC mode operation for the FortiGate unit.
disable
Fortinet Technologies Inc.
Page 515 FortiOS™ - CLI Reference for FortiOS 5.0
system
fortiguard
fortiguard
Use this command to configure communications with the FortiGuard Distribution Network (FDN) for FortiGuard subscription services such as:
• FortiGuard Antivirus and IPS
• FortiGuard Web Filtering and Antispam
• FortiGuard Analysis and Management Service
• FortiGuard DNS-based web filtering
For FortiGuard Antivirus and IPS, Web Filtering and Antispam, you can alternatively use this command to configure the FortiGate unit to communicate with a FortiManager system, which can act as a private FortiGuard Distribution Server (FDS) for those services.
By default, FortiGate units connect to the FDN using a set of default connection settings. You can override these settings to use IP addresses and port numbers other than the defaults. For example, if you have a FortiManager unit, you might download a local copy of FortiGuard service updates to the FortiManager unit, then redistribute those updates by configuring each
FortiGate unit’s server override feature to connect to the FortiManager unit’s private FDS IP address.
If the FortiGate unit is unable to connect to the FDN, verify connectivity on required ports. For a list of required ports, see the Fortinet Knowledge Center article Traffic Types and TCP/UDP
Ports Used by Fortinet Products .
Remote administration by a FortiManager system is mutually exclusive with remote administration by FortiGuard Analysis and Management Service. For information about
Syntax
config system fortiguard set
set
set
set
set
service-account-passwd <pwd_str>
set
set
antispam-cache {enable | disable}
set
set
antispam-cache-mpercent <ram_int>
set
set
antispam-force-off {enable | disable}
set
set
antispam-timeout <timeout_int>
set
avquery-cache {enable | disable}
set
set
avquery-cache-mpercent <max_int>
set
avquery-force-off {enable | disable}
set
Fortinet Technologies Inc.
Page 516 FortiOS™ - CLI Reference for FortiOS 5.0
system
set
set
set
webfilter-cache {enable | disable}
set
set
set
webfilter-force-off {enable | disable}
set
set
end set
set
webfilter-timeout <timeout_int>
Variable
port {53 | 8888}
Description
Enter the port to use for rating queries to the FortiGuard
Web Filtering or FortiGuard Antispam service.
Default
53
Enter the IP address of the FortiDDNS service.
0.0.0.0
ddns-server-ip
<IPv4_addr> ddns-server-port
<port_int> service-account-id
<id_str>
Enter the port used for FortiDDNS service.
443
Enter the Service Account ID to use with communications with FortiGuard Analysis Service or
FortiGuard Management Service.
No default.
service-accountpasswd <pwd_str> antispam-cache
{enable | disable}
Enter the Service Account password to use for
FortiGuard Analysis Service or FortiGuard Management
Service.
No default.
load-balance-servers
<number>
Enter the number of FortiGuard servers to connect to.
By default, the FortiGate unit always uses the first server in its FortiGuard server list to connect to the
FortiGuard network and load-balance-servers is set to
1. You can increase this number up to 20 if you want the FortiGate unit to use a different FortiGuard server each time it contacts the FortiGuard network. If you set load-balance-servers to 2, the FortiGate unit alternates between checking the first two servers in the FortiGuard server list.
1
Enable or disable caching of FortiGuard Antispam query results, including IP address and URL block list.
enable antispam-cache-ttl
<ttl_int> antispam-cachempercent <ram_int>
Enabling the cache can improve performance because the FortiGate unit does not need to access the FDN or
FortiManager unit each time the same IP address or
URL appears as the source of an email. When the cache is full, the least recently used cache entry is replaced.
Enter a time to live (TTL), in seconds, for antispam cache entries. When the TTL expires, the cache entry is removed, requiring the FortiGate unit to query the FDN or FortiManager unit the next time that item occurs in scanned traffic. Valid TTL ranges from 300 to 86400 seconds.
1800
Enter the maximum percentage of memory (RAM) to use for antispam caching. Valid percentage ranges from
1 to 15.
2
fortiguard
Fortinet Technologies Inc.
Page 517 FortiOS™ - CLI Reference for FortiOS 5.0
system fortiguard
Variable Description
antispam-expiration The expiration date of the FortiGuard Antispam service contract.
Default
N/A antispam-force-off
{enable | disable} antispam-license antispam-timeout
<timeout_int> avquery-cache
{enable | disable}
This variable can be viewed with the get command, but cannot be set.
Enable to stop FortiGuard Antispam service on this
FortiGate unit.
The interval of time between license checks for the
FortiGuard Antispam service contract.
disable
7
This variable can be viewed with the get command, but cannot be set.
Enter the FortiGuard Antispam query timeout. Valid timeout ranges from 1 to 30 seconds.
7
Enable or disable caching of FortiGuard Antivirus query results.
enable avquery-cache-ttl
<ttl_int> avquery-cachempercent <max_int> avquery-force-off
{enable | disable} avquery-license
Enabling the cache can improve performance because the FortiGate unit does not need to access the FDN each time the same IP address or URL appears as the source of an email. When the cache is full, the least recently used cache entry is replaced.
Enter a time to live (TTL), in seconds, for antivirus cache entries. When the TTL expires, the cache entry is removed, requiring the FortiGate unit to query the FDN or FortiManager unit the next time that item occurs in scanned traffic. Valid TTL ranges from 300 to 86400 seconds.
1800
Enter the maximum memory to be used for FortiGuard
Antivirus query caching. Valid percentage ranges from 1 to 15.
2
Enable to stop FortiGuard Antivirus service on this
FortiGate unit.
disable
The interval of time between license checks for the
FortiGuard Antivirus service contract.
Unknown
This variable can be viewed with the get command, but cannot be set.
avquery-expiration
The expiration date of the FortiGuard Antivirus service contract.
avquery-timeout
<timeout_int> webfilter-cache
{enable | disable}
This variable can be viewed with the get command, but cannot be set.
Enter the time limit in seconds for the FortiGuard
Antivirus service query timeout. Valid timeout ranges from 1 to 30.
Enable or disable caching of FortiGuard Web Filtering query results, including category ratings for URLs.
Enabling the cache can improve performance because the FortiGate unit does not need to access the FDN or
FortiManager unit each time the same IP address or
URL is requested. When the cache is full, the least recently used cache entry is replaced.
N/A
7 enable
Fortinet Technologies Inc.
Page 518 FortiOS™ - CLI Reference for FortiOS 5.0
system
Variable
webfilter-cache-ttl
<ttl_int>
Description
Enter a time to live (TTL), in seconds, for web filtering cache entries. When the TTL expires, the cache entry is removed, requiring the FortiGate unit to query the FDN or FortiManager unit the next time that item occurs in scanned traffic. Valid TTL ranges from 300 to 86400 seconds.
webfilter-expiration The expiration date of the FortiGuard Web Filtering service contract.
Default
3600
N/A webfilter-force-off
{enable | disable} webfilter-license
This variable can be viewed with the get command, but cannot be set.
Enable to stop FortiGuard Webfilter service on this
FortiGate unit.
disable
The interval of time between license checks for the
FortiGuard Web Filtering service contract. Initially, this value is unknown, and is set after contacting the FDN to validate the FortiGuard Web Filtering license.
Unknown webfilter-sdnsserver-ip webfilter-sdnsserver-port webfilter-timeout
<timeout_int>
This variable can be viewed with the get command, but cannot be set.
Enter the IP address of the FortiDNS server. This is used for DNS-based web filtering.
Enter the FortiGuard Web Filtering query timeout. Valid timeout ranges from 1 to 30 seconds.
0.0.0.0
Enter the TCP port of the FortiDNS server. This is used for DNS-based web filtering.
443
15
fortiguard
Fortinet Technologies Inc.
Page 519 FortiOS™ - CLI Reference for FortiOS 5.0
system
fortisandbox
Use this command to configure the FortiGate unit to use the FortiSandbox appliance.
Syntax
config system fortisandbox set
set
set
end set
set
enc-algorithm {enable | disable}
Variable
enc-algorithm
{enable | disable}
Description
status {enable | disable} Enable use of FortiSandbox.
server <server_ip>
Enter the FortiSandbox server IP address.
email <email_addr> source-ip <ip_addr>
Enter the notifier email address.
Enter the source IP address to use for communication to FortiSandbox.
Enable or disable use of SSL encryption for
FortiSandbox data.
Default
No default.
No default.
fortisandbox
Fortinet Technologies Inc.
Page 520 FortiOS™ - CLI Reference for FortiOS 5.0
system geoip-override
geoip-override
Use this command to override geolocation mappings that are not correct in the FortiGate init's database.
Syntax
config system geoip-override edit
<name_str> set description <desc_str>
config ip-range edit
set
end set
end
Variable Description
<name_str> description
<desc_str>
<range_id>
Enter a name for this geolocation override.
Enter a description for this geolocation override.
Maximum length 128 characters.
Enter a integer ID for this range entry.
start-ip
<IPv4_addr>
Enter the first IP address of the range.
end-ip <IPv4_addr>
Enter the last IP address of the range.
Default
No default.
No default.
No default.
No default.
No default.
Fortinet Technologies Inc.
Page 521 FortiOS™ - CLI Reference for FortiOS 5.0
system
gi-gk
gi-gk
This command configures the settings for the FortiOS Carrier Gi gateway firewall. This firewall is used in the anti-overbilling configuration, and can be enabled on a per interface basis. For more information see
“system interface” on page 555 .
Syntax
config system gi-gk set
end set
Variable Description
context <id_integer>
Enter the context ID for the Gi gateway firewall port <tcp_port>
Enter the TCP port to listen to. Valid range is from 0 to
65535.
Default
0
Fortinet Technologies Inc.
Page 522 FortiOS™ - CLI Reference for FortiOS 5.0
system
global
global
Use this command to configure global settings that affect various FortiGate systems and configurations.
Runtime-only config mode was introduced in FortiOS v3.0 MR2. This mode allows you to try out commands that may put your FortiGate unit into an unrecoverable state normally requiring a physical reboot. In runtime-only config mode you can set a timeout so after a period of no input activity the FortiGate unit will reboot with the last saved configuration. Another option in runtime-only configuration mode is to manually save your configuration periodically to preserve your changes. For more information see
set cfg-save {automatic | manual | revert}
set
Syntax
config system global set
admin-concurrent {enable | disable}
set
admin-console-timeout <secs_int>
set
admin-https-pki-required {enable | disable}
set
admin-https-redirect {enable | disable}
set
admin-lockout-duration <time_int>
set
admin-lockout-threshold <failed_int>
set
admin-maintainer {enable | disable}
set
set
admin-reset-button {enable | disable}
set
set
admin-server-cert { self-sign | <certificate> }
set
set
admin-ssh-grace-time <time_int>
set
set
admin-ssh-v1 {enable | disable}
set
admin-telnet-port <port_number>
set
admintimeout <admin_timeout_minutes>
set
allow-traffic-redirect {enable | disable}
set
anti-replay {disable | loose | strict}
set
set
set
set
auth-keepalive {enable | disable}
set
auth-policy-exact-match {enable | disable}
set
av-failopen {idledrop | off | one-shot | pass}
set
av-failopen-session {enable | disable}
set
set
set
set
cfg-save {automatic | manual | revert}
set
set
check-protocol-header {loose | strict}
set
check-reset-range {disable | strict}
set
clt-cert-req {enable | disable}
Fortinet Technologies Inc.
Page 523 FortiOS™ - CLI Reference for FortiOS 5.0
system
Fortinet Technologies Inc.
set
csr-ca-attribute {enable | disable}
set
daily-restart {enable | disable}
set
detection-summary {enable | disable}
set
set
elbc-status {enable | disable}
set
endpoint-control-fds-access {enable | disable}
set
endpoint-control-portal-port <endpoint_port>
set
explicit-proxy-auth-timeout <seconds_int>
set
fds-statistics {enable | disable}
set
fds-statistics-period <minutes>
set
set
fmc-xg2-load-balance {disable | enable}
set
set
fwpolicy-implicit log {enable | disable}
set
fwpolicy6-implicit log {enable | disable}
set
gui-antivirus {enable | disable}
set
gui-application-control {enable | disable}
set
gui-ap-profile {disable | enable}
set
gui-central-nat-table {disable | enable}
set
gui-certificates {enable | disable}
set
gui-client-reputation {enable | disable}
set
set
gui-dns-database {disable | enable}
set
gui-dynamic-profile-display {disable | enable}
set
gui-dynamic-routing {enable | disable}
set
gui-endpoint-control {enable | disable}
set
gui-explicit-proxy {enable | disable}
set
set
gui-implicit-policy {disable | enable}
set
set
gui-ipsec-manual-key {enable | disable}
set
set
gui-lines-per-page <gui_lines>
set
gui-load-balance {disable | enable}
set
gui-multicast-policy {enable | disable}
set
gui-multiple-utm-profiles {enable | disable}
set
gui-nat46-64 {enable | disable}
set
gui-object-tags {enable | disable}
set
gui-policy-based-ipsec {enable | disable}
set
gui-replacement-message-groups {enable | disable}
set
gui-spamfilter {enable | disable}
set
gui-sslvpn-personal-bookmarks {enable | disable}
set
gui-sslvpn-realms {enable | disable}
set
gui-voip-profile {disable | enable}
set
set
gui-vulnerability-scan {enable | disable}
set
gui-wanopt-cache {enable | disable}
set
gui-webfilter {enable | disable}
Page 524
global
FortiOS™ - CLI Reference for FortiOS 5.0
system global
Fortinet Technologies Inc.
set
gui-wireless-controller {enable | disable}
set
gui-wireless-opensecurity {enable | disable}
set
set
http-obfuscate {header-only | modified | no-error | none}
set
ie6workaround {enable | disable}
set
internal-switch-mode {hub | interface | switch}
set
internal-switch-speed {100full | 100half | 10full | 10half
set
ip-src-port-range <start_port>-<end_port>
set
ipsec-hmac-offload {disable | enable}
set
set
set
set
lcdprotection {enable | disable}
set
ldapconntimeout <ldaptimeout_msec>
set
login-timestamp {enable | disable}
set
log-user-in-upper {enable | disable}
set
set
set
set
set
set
optimize {antivirus | throughput}
set
optimize-ssl {enable | disable}
set
phase1-rekey {enable | disable}
set
policy-auth-concurrent <limit_int>
set
per-user-bwl {enable | disable}
set
pre-login-banner {enable | disable}
set
proxy-worker-count <count_int>
set
post-login-banner {enable | disable}
set
set
set
registration-notification {disable | enable}
set
remoteauthtimeout <timeout_sec>
set
reset-sessionless-tcp {enable | disable}
set
set
revision-backup-on-logout {enable | disable}
set
revision-image-auto-backup {enable | disable}
set
set
send-pmtu-icmp {enable | disable}
set
service-expire-notification {disable | enable}
set
show-backplane-intf {enable | disable}
set
sql-logging {enable | disable}
set
sp-load-balance {enable | disable}
set
sslvpn-cipher-hardware-acceleration {enable | disable}
set
sslvpn-kxp-hardware-acceleration {enable | disable}
set
sslvpn-pkce2-hardware-acceleration {enable | disable}
set
sslvpn-max-worker-count <count_int>
set
sslvpn-personal-bookmark-mgmt {enable | disable}
Page 525 FortiOS™ - CLI Reference for FortiOS 5.0
system global
set
sslvpn-worker-count <count_int>
set
strict-dirty-session-check {enable | disable}
set
strong-crypto {enable | disable}
set
strong-crypto {enable | disable}
set
switch-controller {enable | disable}
set
switch-controller-reserved-network <ipv4mask>
set
set
set
set
tcp-timewait-timer <seconds_int>
set
set
tos-based-priority {low | medium | high}
set
tp-mc-skip-policy {enable | disable}
set
two-factor-email-expiry <seconds_int>
set
two-factor-sms-expiry <seconds_int>
set
set
usb-wan-auth-type {none | pap | chap}
set
set
set
set
use-usb-wan {enable | disable}
set
set
set
vip-arp-range {unlimited | restricted}
set
virtual-server-count <integer>
set
virtual-server-hardware-acceleration {enable | disable}
set
set
set
wifi-ca-certificate <ca_cert-name>
set
wimax-4g-usb {enable | disable}
set
wireless-controller {enable | disable}
set
wireless-controller-port <port_int>
end set
Variable
admin-concurrent
{enable | disable} admin-console-timeout
<secs_int> admin-https-pki-required
{enable | disable}
Description
Enable to allow concurrent administrator logins.
When disabled, the FortiGate unit restricts concurrent access from the same admin user name but on a different IP address.
Default
enable
Use policy-auth-concurrent for firewall authenticated users.
Set a console login timeout that overrides the admintimeout value. Range 15 to 300 seconds. A zero value disables this timeout.
0 disable
Enable to allow user to login by providing a valid certificate if PKI is enabled for HTTPS administrative access. Default setting disable allows admin users to log in by providing a valid certificate or password.
Fortinet Technologies Inc.
Page 526 FortiOS™ - CLI Reference for FortiOS 5.0
system global
Variable
admin-https-redirect
{enable | disable} admin-lockout-duration
<time_int> admin-lockout-threshold
<failed_int>
Description
Enable redirection of HTTP administration access to
HTTPS. This is not available on low-crypto units.
Set the administration account’s lockout duration in seconds for the firewall. Repeated failed login attempts will enable the lockout. Use adminlockout-threshold to set the number of failed attempts that will trigger the lockout.
60
3
Set the threshold, or number of failed attempts, before the account is locked out for the adminlockout-duration.
Default
disable
Enables or disables the special hidden “maintainer” user login, which is used for password recovery.
enable admin-maintainer
{enable | disable} admin-port <port_number> Enter the port to use for HTTP administrative access.
admin-reset-button
{enable | disable}
Enable or disable use of FortiGate unit reset button.
Even if enabled, the button is active for only 30 seconds after boot-up.
admin-scp
{enable | disable} admin-server-cert { self-sign | <certificate> }
When enabled, the “maintainer” account can log in from the console after a hard reboot (power off, power on) using the password “bcpb” followed by the FortiGate unit serial number. You have limited time to complete this login.
Enable to allow system configuration download by the secure copy (SCP) protocol.
Select the admin https server certificate to use.
Choices include self-sign, and the filename of any installed certificates.
admin-sport
<port_number> admin-ssh-grace-time
<time_int>
Enter the port to use for HTTPS administrative access.
80 enable disable self-sign
443
Enter the maximum time permitted between making an SSH connection to the FortiGate unit and authenticating. Range is 10 to 3600 seconds.
120
Enter the port to use for SSH administrative access.
22 admin-ssh-port
<port_number> admin-ssh-v1
{enable | disable} admin-telnet-port
<port_number> admintimeout
<admin_timeout_minutes>
Enable compatibility with SSH v1.0.
Enter the port to use for telnet administrative access.
Set the number of minutes before an idle administrator times out. This controls the amount of inactive time before the administrator must log in again. The maximum admintimeout interval is 480 minutes (8 hours). disable
23
5 allow-traffic-redirect
{enable | disable}
To improve security keep the idle timeout at the default value of 5 minutes.
Under some conditions, it is undesirable to have traffic routed back on the same interface. In that case, set allow-traffic-redirect to disable.
enable
Fortinet Technologies Inc.
Page 527 FortiOS™ - CLI Reference for FortiOS 5.0
system global
Variable
anti-replay {disable | loose
| strict}
Description
Set the level of checking for packet replay and TCP sequence checking (or TCP Sequence (SYN) number checking). All TCP packets contain a
Sequence Number (SYN) and an Acknowledgement
Number (ACK). The TCP protocol uses these numbers for error free end-to-end communications.
TCP sequence checking can also be used to validate individual packets.
Default
strict
FortiGate units use TCP sequence checking to make sure that a packet is part of a TCP session. By default, if a packet is received with sequence numbers that fall out of the expected range, the
FortiGate unit drops the packet. This is normally a desired behavior, since it means that the packet is invalid. But in some cases you may want to configure different levels of anti-replay checking if some of your network equipment uses non-RFC methods when sending packets. You can set antireplay protection to the following settings: disable No anti-replay protection.
loose Perform packet sequence checking and
ICMP anti-replay checking with the following criteria:
• The SYN, FIN, and RST bit can not appear in the same packet.
• The FortiGate unit does not allow more than 1
ICMP error packet to go through the FortiGate unit before it receives a normal TCP or UDP packet.
• If the FortiGate unit receives an RST packet, and check-reset-range is set to strict the
FortiGate unit checks to determine if its sequence number in the RST is within the un-
ACKed data and drops the packet if the sequence number is incorrect. strict Performs all of the loose checking but for each new session also checks to determine of the
TCP sequence number in a SYN packet has been calculated correctly and started from the correct value for each new session. Strict anti-replay checking can also help prevent SYN flooding.
If any packet fails a check it is dropped. If “loginvalid-packet {enable | disable}” on page 298
is enabled a log message is written for each packet that fails a check.
HTTPS server certificate for policy authentication.
auth-cert <cert-name>
Self-sign is the built in certificate but others will be listed as you add them.
auth-http-port <http_port> Set the HTTP authentication port. <http_port> can be from 1 to 65535. self-sign
1000
Fortinet Technologies Inc.
Page 528 FortiOS™ - CLI Reference for FortiOS 5.0
system
Variable
auth-https-port
<https_port> auth-keepalive
{enable | disable} auth-policy-exact-match
{enable | disable} av-failopen
{idledrop | off | one-shot | pass}
Description
Set the HTTPS authentication port.
<https_port> can be from 1 to 65535.
Default
1003 disable
Enable to extend the authentication time of the session through periodic traffic to prevent an idle timeout.
disable
Enable to require traffic to exactly match an authenticated policy with a policy id and IP address to pass through. When disabled, only the IP needs to match. pass
Set the action to take if the unit is running low on memory or the proxy connection limit has been reached. Valid options are idledrop, off, oneshot, and pass.
• idledrop — drop connections based on the clients that have the most connections open.
This is most useful for Windows applications, and can prevent malicious bots from keeping an idle connection open to a remote server.
• off — stop accepting new AV sessions when entering conserve mode, but continue to process current active sessions.
• one-shot — bypass the antivirus system when memory is low. You must enter off or pass to restart antivirus scanning.
• pass — bypass the antivirus system when memory is low. Antivirus scanning resumes when the low memory condition is resolved.
av-failopen-session
{enable | disable}
When enabled and a proxy for a protocol runs out of room in its session table, that protocol goes into failopen mode and enacts the action specified by av-failopen.
Enable/disable batch mode. batch-cmdb
{enable | disable}
Batch mode is used to enter a series of commands, and executing the commands as a group once they
are loaded. For more information, see “execute batch” on page 910 .
block-session-timer <int>
Enter the time duration for blocked sessions. Range:
1 to 300 seconds.
cert-chain-max <int>
Set maximum depth for a certificate chain.
disable enable
30
8
global
Fortinet Technologies Inc.
Page 529 FortiOS™ - CLI Reference for FortiOS 5.0
system
Variable
cfg-save {automatic | manual | revert} cfg-revert-timeout
<seconds> check-protocol-header
{loose | strict}
Description
Set the method for saving the FortiGate system configuration and enter into runtime-only configuration mode. Methods for saving the configuration are:
• automatic — automatically save the configuration after every change.
• manual — manually save the configuration using the
• revert — manually save the current configuration and then revert to that saved configuration after cfg-revert-timeout expires.
Default
automatic
Switching to automatic mode disconnects your session.
This command is used as part of the runtime-only configuration mode.
See
“execute cfg reload” on page 914 for more
information.
Enter the timeout interval in seconds. If the administrator makes a change and there is no activity for the timeout period, the FortiGate unit will automatically revert to the last saved configuration.
Default timeout is 600 seconds.
600
This command is available only when cfg-save is set to revert.
This command is part of the runtime-only configuration mode. See
“execute cfg reload” on page 914
for more information.
Select the level of checking performed on protocol headers.
• loose — the FortiGate unit performs basic header checking to verify that a packet is part of a session and should be processed. Basic header checking includes verifying that the layer-
4 protocol header length, the IP header length, the IP version, the IP checksum, IP options are correct, etc.
• strict — the FortiGate unit does the same checking as above plus it verifies that ESP packets have the correct sequence number, SPI, and data length.
loose
If the packet fails header checking it is dropped by
the FortiGate unit and logged if “log-invalid-packet
{enable | disable}” on page 298 is enabled.
global
Fortinet Technologies Inc.
Page 530 FortiOS™ - CLI Reference for FortiOS 5.0
system global
Variable
check-reset-range
{disable | strict} clt-cert-req
{enable | disable} csr-ca-attribute
{enable | disable} daily-restart
{enable | disable} detection-summary
{enable | disable} dst {enable | disable} elbc-status
{enable | disable} endpoint-control-fdsaccess {enable | disable} endpoint-control-portalport <endpoint_port> explicit-proxy-authtimeout <seconds_int> fds-statistics
{enable | disable}
Description
Configure ICMP error message verification.
Default
disable
• disable — the FortiGate unit does not validate
ICMP error messages.
• strict — If the FortiGate unit receives an ICMP error packet that contains an embedded IP(A,B) |
TCP(C,D) header, then if FortiOS can locate the
A:C
->B:D session it checks to make sure that the sequence number in the TCP header is within the range recorded in the session. If the sequence number is not in range then the ICMP
packet is dropped. If “log-invalid-packet
{enable | disable}” on page 298
is enabled the
FortiGate unit logs that the ICMP packet was dropped. Strict checking also affects how the anti-replay option checks packets.
Enable to require a client certificate before an administrator logs on to the web-based manager using HTTPS.
disable enable
Enable to use the CA attribute in your certificate.
Some CA servers reject CSRs that have the CA attribute.
Enable to restart the FortiGate unit every day.
disable
The time of the restart is controlled by restarttime.
Disable to prohibit the collection of detection summary statistics for FortiGuard.
Enable or disable daylight saving time.
enable enable
If you enable daylight saving time, the FortiGate unit adjusts the system time when the time zone changes to daylight saving time and back to standard time.
This attribute is enabled by default. When enabled the system will await the base channel heartbeat that will configure the system into ELBCv3 mode.
Disabling this command will not disable ELBCv3 mode once the FortiGate has already configured itself for ELBCv3 mode. See
.
enable enable
Enable or disable access to FortiGuard servers for non-compliant endpoints.
Enter the port number from 1 to 65535 for the endpoint control portal port for FortiClient downloads.
8009
300
Enter the timeout, in seconds, for idle explicit web proxy sessions. Range: 1 to 600 seconds.
Enable or disable AV/IPS signature reporting.
enable
If necessary, disable to avoid error messages on HA subordinate units during an AV/IPS update.
Fortinet Technologies Inc.
Page 531 FortiOS™ - CLI Reference for FortiOS 5.0
system global
Variable
fds-statistics-period
<minutes> fgd-alert-subscription
{advisory latest-threat latest-virus latest-attack new-virus-db new-attack-db}
Description
Select the number of minutes in the FDS report period. Range is 1 to 1440 minutes.
Select what to retrieve from FortiGuard: advisory — FortiGuard advisories, report and news alerts latest-attack — latest FortiGuard attack alerts latest-threat — latest FortiGuard threats alerts latest-virus — latest FortiGuard virus alerts new-antivirus-db — FortiGuard AV database release alerts new-attack-db — FortiGuard IPS database release alerts.
fmc-xg2-load-balance
{disable | enable}
Enable to start XG2 load balancing. forticlient-reg-port <int>
Change the FortiClient registration port. This might be necessary if the default port is used for some other purpose.
Default
60 null disable
8010 fwpolicy-implicit log
{enable | disable} fwpolicy6-implicit log
{enable | disable} gui-antivirus
{enable | disable} gui-application-control
{enable | disable} gui-ap-profile {disable | enable}
The registration IP address is the IP address of the interface whose listen-for-forticlient-registration is enabled.
Enable to log when a session uses an implicit policy
(IPv4).
disable
Enable to log when a session uses an implicit policy
(IPv6).
disable
Enable or disable antivirus profiles in the web-based manager.
enable
Enable or disable application control options in the web-based manager.
enable
Enable or disable custom AP profile configuration options on the web-based manager.
Enable or disable central NAT table configuration options and display on the web-based manager.
enable, except disable on model 30D disable gui-central-nat-table
{disable | enable} gui-certificates
{enable | disable}
Enable or disable display of certificate configuration in the web-based manager.
Enabled on rack-mount units.
enable gui-client-reputation
{enable | disable}
Enable or disable display of client reputation configuration in the web-based manager.
gui-dlp {enable | disable}
Enables Data Leak Prevention in the web-based manager.
gui-dns-database {disable | enable} gui-dynamic-profiledisplay {disable | enable}
Enable to display the DNS database menu in the web-based manager interface.
Enable to display dynamic profile feature controls in the web-based manager.
Depends on model.
disable enable
Fortinet Technologies Inc.
Page 532 FortiOS™ - CLI Reference for FortiOS 5.0
system global
Variable
gui-dynamic-routing
{enable | disable}
Description Default
Enable dynamic routing in the web-based manager.
If disabled, the Routing menu is removed. Static routing is available in System > Network > Routing and route monitoring in System > Monitor >
Routing Monitor.
Depends on model.
Enable to display the endpoint control feature in the web-based manager.
enable gui-endpoint-control
{enable | disable} gui-explicit-proxy
{enable | disable}
Enable or disable display of Explicit Proxy configuration options on the web-based manager.
gui-icap {disable | enable} Enable or disable ICAP configuration options on the web-based manager.
gui-implicit-policy
{disable | enable}
Enable or disable implicit firewall policy configuration options on the web-based manager.
gui-ips {enable | disable}
Enable or disable display of the IPS sensors in the web-based manager gui-ipsec-manual-key
{enable | disable}
Enable to display the IPsec manual key page on the web-based manager.
gui-ipv6 {enable | disable} Enable or disable IPv6 configuration options on the web-based manager.
gui-lines-per-page
<gui_lines> gui-load-balance
{disable | enable}
Set the number of lines displayed on table lists.
Range is from 20 - 1000 lines per page.
Enable or disable display of Load Balance in webbased manager Firewall Objects menu.
Enabled on rack-mount units.
disable enable enable disable disable
50 disable gui-multicast-policy
{enable | disable} gui-multiple-utm-profiles
{enable | disable} gui-nat46-64
{enable | disable} gui-object-tags
{enable | disable}
Enables or disables display of multicast firewall policies in the web-based manager.
Enables or disables display of multiple UTM profiles in the web-based manager.
Enables or disables display of NAT46 and NAT64 settings in the web-based manager.
Enable or disable object tagging and object coloring configuration options on the web-based manager.
disable enable disable disable gui-policy-based-ipsec
{enable | disable} gui-replacement-messagegroups {enable | disable}
Enable or disable display of policy-based IPsec VPN options in the web-based manager.
Enable or disable display of Replacement Message
Groups feature in the web-based manager.
disable
Enabled on rack-mount units. enable gui-spamfilter
{enable | disable} gui-sslvpn-personalbookmarks
{enable | disable}
Enable or disable display of spamfilter profiles in the web-based manager.
Enable personal SSL VPN bookmark management in the SSLVPN portal.
Depends on model.
gui-sslvpn-realms
{enable | disable} gui-voip-profile {disable | enable}
Enable SSL VPN realms in the web-based manager.
Enable or disable VoIP profile configuration options on the web-based manager.
gui-vpn {enable | disable}
Enable or disable VPN tunnel configuration in the web-based manager.
disable disable enable
Fortinet Technologies Inc.
Page 533 FortiOS™ - CLI Reference for FortiOS 5.0
system global
Variable
gui-vulnerability-scan
{enable | disable} gui-wanopt-cache
{enable | disable}
Description
Enable or disable display of the vulnerability scan in the web-based manager.
Enable or disable display of WAN Optimization configuration options on the web-based manager.
Default
enable
Enabled on rack-mount units.
enable gui-webfilter
{enable | disable} gui-wireless-controller
{enable | disable}
Enable or disable display of webfilter profiles in the web-based manager
Enable or disable display of the wireless controller configuration in the web-based manager.
gui-wireless-opensecurity
{enable | disable}
Enable or disable display of open security option for
SSID in the web-based manager.
hostname <unithostname> Enter a name to identify this FortiGate unit. A hostname can only include letters, numbers, hyphens, and underlines. No spaces are allowed.
enable, except disable on model 30D disable
FortiGate serial number.
http-obfuscate
{header-only | modified
| no-error | none} ie6workaround
{enable | disable}
While the hostname can be longer than 16 characters, if it is longer than 16 characters it will be truncated and end with a ‘‘~” to indicate it has been truncated. This shortened hostname will be displayed in the CLI, and other locations the hostname is used.
Some models support hostnames up to 35 characters.
By default the hostname of your FortiGate unit is its serial number which includes the model.
Set the level at which the identity of the FortiGate web server is hidden or obfuscated in the browser address field, including URLs provided via SSL VPN
Bookmarks (web mode only).
none
none — do not hide the FortiGate web server identity.
header-only — hides the HTTP server banner.
modified — provides modified error responses.
no-error — suppresses error responses.
Enable or disable the work around for a navigation bar freeze issue caused by using the FortiGate web-based manager with Internet Explorer 6.
disable
Fortinet Technologies Inc.
Page 534 FortiOS™ - CLI Reference for FortiOS 5.0
system global
Variable
internal-switch-mode {hub
| interface | switch}
Description
Set the mode for the internal switch to be one of hub, interface, or switch.
Switch mode combines FortiGate unit interfaces into one switch with one address. Interface mode gives each internal interface its own address.
Default
switch internal-switch-speed
{100full | 100half | 10full
| 10half | auto}
On some FortiGate models you can also select Hub
Mode. Hub mode is similar to switch mode except that in hub mode the interfaces do not learn the
MAC addresses of the devices on the network they are connected to and may also respond quicker to network changes in some circumstances. You should only select Hub Mode if you are having network performance issues when operating with switch mode. The configuration of the FortiGate unit is the same whether in switch mode or hub mode.
Before switching modes, all configuration settings for the interfaces affected by the switch must be set to defaults.
Set the speed of the switch used for the internal interface. Choose one of: auto
100full
100half
10full
10half ip-src-port-range
<start_port>-<end_port> ipsec-hmac-offload
{disable | enable} ipv6-accept-dad {0|1|2} language <language> auto
100 and 10 refer to 100M or 10M bandwidth. Full and half refer to full or half duplex.
Specify the IP source port range used for traffic originating from the FortiGate unit. The valid range for <start_port> and <end_port> is from 1 to
65535 inclusive.
1024-4999
You can use this setting to avoid problems with networks that block some ports, such as FDN ports.
Enable to offload IPsec HMAC processing to hardware or disable to perform IPsec HMAC processing in software.
Configure ipv6 DAD (Duplicate Address Detection) operation: enable
1
0 — Disable DAD
1 — Enable DAD
2 — Enable DAD and disable IPv6 operation if MACbased duplicate link-local address has been found.
Set the web-based manager display language. You can set
<language> to one of english, french, japanese, korean, portuguese, spanish, simch (Simplified Chinese) or trach (Traditional
Chinese). english
Fortinet Technologies Inc.
Page 535 FortiOS™ - CLI Reference for FortiOS 5.0
system global
Variable
lcdpin <pin_number>
Description
lcdprotection
{enable | disable} ldapconntimeout
<ldaptimeout_msec> login-timestamp
{enable | disable} log-user-in-upper
{enable | disable} management-vdom
<domain>
Enable or disable LCD panel PIN protection. This applies only to models with an LCD panel.
LDAP connection timeout in msec
Enable or disable logging of login timestamps.
Log username in uppercase letters.
Enter the name of the management virtual domain.
Management traffic such as FortiGuard traffic originates from the management VDOM.
max-dlpstat-memory
<size>
Enter the memory limit (1 to 15% of system memory) for the DLP stat daemon.
max-report-db-size <size> Set the maximum size in MBytes for the log report database. miglogd-children <int>
Set the number of miglogd process to run. Range 0 to 15.
num-cpus <int> optimize
{antivirus | throughput}
Set the 6 digit PIN administrators must enter to use the LCD panel. This applies only to models with an
LCD panel.
Enter the number of active CPUs.
NOTE: Do not use this command. It is obsolete and can severely affect performance. The command will be removed in a later firmware release.
Default
123456 disable
500 disable disable root
5
1024
0 antivirus optimize-ssl
{enable | disable} phase1-rekey
{enable | disable} policy-auth-concurrent
<limit_int>
Set firmware performance optimization to either antivirus or throughput.
Enable optimization of SSL by using multiple processes. disable
Enable or disable automatic rekeying between IKE peers before the phase 1 keylife expires.
enable
Limit the number of concurrent logins from the same user. Range 1 to 100. 0 means no limit.
0 per-user-bwl
{enable | disable} pre-login-banner
{enable | disable}
For admin accounts use admin-concurrent.
Enable or disable the webfilter per-user black/white list feature.
Enable to display the admin access disclaimer message prior to logon.
disable disable
For more information see
“system replacemsg admin” on page 610 .
proxy-worker-count
<count_int> post-login-banner
{enable | disable}
Set the number of proxy worker processes. Range 1 to 8.
Enable to display the admin access disclaimer message after successful logon.
radius-port <radius_port>
Change the default RADIUS port. The default port for RADIUS traffic is 1812. If your RADIUS server is using port 1645 you can use the CLI to change the default RADIUS port on your FortiGate unit.
4 disable
1812
Fortinet Technologies Inc.
Page 536 FortiOS™ - CLI Reference for FortiOS 5.0
system
Variable Description
refresh <refresh_seconds> Set the Automatic Refresh Interval, in seconds, for the web-based manager System Status Monitor. registration-notification
{disable | enable} remoteauthtimeout
<timeout_sec>
Default
0
Enter 0 for no automatic refresh.
Enable or disable displaying the registration notification on the web-based manager if the
FortiGate unit is not registered.
enable
The number of seconds that the FortiGate unit waits for responses from remote RADIUS, LDAP, or
TACACS+ authentication servers. The range is 0 to
300 seconds, 0 means no timeout.
5 reset-sessionless-tcp
{enable | disable}
To improve security keep the remote authentication timeout at the default value of 5 seconds. However, if a RADIUS request needs to traverse multiple hops or several RADIUS requests are made, the default timeout of 5 seconds may not be long enough to receive a response.
Enabling this option may help resolve issues with a problematic server, but it can make the FortiGate unit more vulnerable to denial of service attacks. In most cases you should leave resetsessionless-tcp disabled. disable
The reset-sessionless-tcp command determines what action the FortiGate unit performs if it receives a TCP packet but cannot find a corresponding session in its session table. This happens most often because the session has timed out.
If you disable reset-sessionless-tcp, the
FortiGate unit silently drops the packet. The packet originator does not know that the session has expired and might re-transmit the packet several times before attempting to start a new session. This is normal network operation.
If you enable reset-sessionless-tcp, the
FortiGate unit sends a RESET packet to the packet originator. The packet originator ends the current session, but it can try to establish a new session.
restart-time <hh:mm>
This is available in NAT/Route mode only.
Enter daily restart time in hh:mm format (hours and minutes).
No default.
revision-backup-on-logout
{enable | disable} revision-image-autobackup {enable | disable}
This is available only when daily-restart is enabled.
Enable or disable back up of the latest configuration revision when the administrator logs out of the CLI or web-based manager.
disable
Enable or disable back up of the latest configuration revision when firmware is upgraded.
disable
global
Fortinet Technologies Inc.
Page 537 FortiOS™ - CLI Reference for FortiOS 5.0
system global
Variable
send-pmtu-icmp
{enable | disable}
Description
scanunit-count <count_int> Tune the number of scanunits. The range and default depend on the number of CPUs. Only available on
FortiGate units with multiple CPUs. Recommended for advanced users.
Select enable to send a path maximum transmission unit (PMTU) - ICMP destination unreachable packet.
Enable if you need to support PTMUD protocol on your network to reduce fragmentation of packets.
Default
Depends on model.
enable service-expire-notification
{disable | enable} show-backplane-intf
{enable | disable} sql-logging
{enable | disable}
Disabling this command will likely result PMTUD packets being blocked by the unit.
Enable or disable displaying a notification on the web-based manager 30 days before the FortiGate unit support contract expires.
enable
Select enable to show FortiGate-5000 backplane interfaces as port9 and port10. Once these backplanes are visible they can be treated as regular physical interfaces.
disable disable
Enable for SQL logging. This option is present only on models that have hard disks rather than SSDs.
Report generation on these models can be slow.
Enable or disable SP load balancing on models
3950B, 3951B, or 3140B. disable sp-load-balance
{enable | disable} sslvpn-cipher-hardwareacceleration
{enable | disable} sslvpn-kxp-hardwareacceleration
{enable | disable} sslvpn-pkce2-hardwareacceleration
{enable | disable} sslvpn-max-worker-count
<count_int>
Not available if npu-cascade-cluster is enabled in
Enable or disable SSLVPN hardware acceleration.
Enable or disable SSLVPN KXP hardware acceleration.
Enable or disable SSLVPN PKCE2 hardware acceleration.
Set the maximum number of SSL VPN processes.
The actual maximum is the number of CPUs or this value, whichever is smaller.
sslvpn-personal-bookmarkmgmt {enable | disable}
Enable or disable management of SSLVPN user personal bookmarks in the web-based manager.
Depends on model.
Depends on model.
Depends on model.
Depends on number of
CPUs
Enabled on rack-mount units. sslvpn-worker-count
<count_int> strict-dirty-session-check
{enable | disable}
Set the number of processes used to optimize SSL inspection. The actual maximum is the number of
CPUs minus one or this value, whichever is smaller.
Enable to check the session against the original policy when revalidating. This can prevent dropping of redirected sessions when web-filtering and authentication are enabled together.
Depends on number of
CPUs disable
Fortinet Technologies Inc.
Page 538 FortiOS™ - CLI Reference for FortiOS 5.0
system global
Variable
strong-crypto
{enable | disable}
Description
Enable to use strong encryption and only allow strong ciphers (AES, 3DES) and digest (SHA1) for
HTTPS/SSH admin access.
When strong encryption is enabled, HTTPS is supported by the following web browsers: Netscape
7.2, Netscape 8.0, Firefox, and Microsoft Internet
Explorer 7.0 (beta).
Default
disable switch-controller
{enable | disable} switch-controller-reservednetwork <ipv4mask> syncinterval
<ntpsync_minutes> tcp-halfclose-timer
<seconds> tcp-halfopen-timer
<seconds> tcp-option
{enable | disable} tcp-timewait-timer
<seconds_int>
Note that Microsoft Internet Explorer 5.0 and 6.0 are not supported in strong encryption.
Enable switch controller feature. This is available on models that support the switch controller.
disable
Enable reserved network subnet for controlled switches. This is available when the switch controller is enabled.
169.254.254.0
255.255.254.0
0
Enter how often, in minutes, the FortiGate unit should synchronize its time with the Network Time
Protocol (NTP) server. The syncinterval number can be from 1 to 1440 minutes. Setting to 0 disables time synchronization.
120
Enter how many seconds the FortiGate unit should wait to close a session after one peer has sent a FIN packet but the other has not responded. The valid range is from 1 to 86400 seconds.
10
Enter how many seconds the FortiGate unit should wait to close a session after one peer has sent an open session packet but the other has not responded. The valid range is from 1 to 86400 seconds.
enable
Enable SACK, timestamp and MSS TCP options.
For normal operation tcp-option should be enabled. Disable for performance testing or in rare cases where it impairs performance.
1
Set the length of the TCP TIME-WAIT state in seconds. As described in RFC 793 , the “TIME-WAIT state represents waiting for enough time to pass to be sure the remote TCP received the acknowledgment of its connection termination request”. timezone
<timezone_number>
Reducing the time of the TIME-WAIT state means the FortiGate unit can close terminated sessions faster which means more new sessions can be opened before the session limit is reached.
The valid range is 0 to 300 seconds. A value of 0 sets the TCP TIME-WAIT to 0 seconds
The number corresponding to your time zone from
00 to 72. Press
? to list time zones and their numbers. Choose the time zone for the FortiGate unit from the list and enter the correct number.
00
Fortinet Technologies Inc.
Page 539 FortiOS™ - CLI Reference for FortiOS 5.0
system global
Variable
tos-based-priority
{low | medium | high}
Description
Select the default system-wide level of priority for
Type of Service (TOS). TOS determines the priority of traffic for scheduling. Typically this is set on a per service type level. For more information, see
“system tos-based-priority” on page 695 .
Default
high
The value of this field is the default setting for when
TOS is not configured on a per service level.
tp-mc-skip-policy
{enable | disable} two-factor-email-expiry
<seconds_int>
Enable to allow skipping of the policy check, and to enable multicast through.
Set the timeout period for email-based two-factor authentication. Range 30 to 300 seconds.
two-factor-sms-expiry
<seconds_int>
Set the timeout period for sms-based two-factor authentication. Range 30 to 300 seconds.
udp-idle-timer <seconds>
Enter the number of seconds before an idle UDP connection times out. The valid range is from 1 to
86400 seconds.
disable
60
60
180 usb-wan-auth-type {none
| pap | chap} usb-wan-extra-init
<init_str>
Select authentication protocol (PAP or CHAP) or no authentication.
Enter initialization string for modem (127 characters maximum).
none null usb-wan-passwd <str>
Enter the authentication password for PDP-IP calls.
null usb-wan-username <str>
Enter the authentication username for PDP-IP calls.
null use-usb-wan
{enable | disable} user-server-cert
<cert_name>
Enable use of wireless 4G LTE USB modem on USB interface.
Select the certificate to use for https user authentication.
disable
See definition under
Description.
Default setting is
Fortinet_Factory, if available, otherwise self-sign.
vdom-admin
{enable | disable} vip-arp-range
{unlimited | restricted}
Enable to configure multiple virtual domains.
vip-arp-range controls the number of ARP packets the FortiGate unit sends for a VIP range. disable restricted
If restricted, the FortiGate unit sends ARP packets for only the first 8192 addresses in a VIP range. virtual-server-count
<integer>
If unlimited, the FortiGate unit sends ARP packets for every address in the VIP range.
Enter the number of virtual server processes to create. The maximum is the number of CPU cores.
Thisis not available on single-core CPUs.
Enable or disable hardware acceleration.
1 enable virtual-server-hardwareacceleration
{enable | disable} wan {enable | disable} wifi-certificate
<cert-name>
On models FWF-20C-ADSL and FGT-20C-ADSL enables one of the switch port interfaces to act as a
WAN port.
disable
Select the certificate to use for WiFi authentication.
No default.
Fortinet Technologies Inc.
Page 540 FortiOS™ - CLI Reference for FortiOS 5.0
system
Variable Description Default
wifi-ca-certificate
<ca_cert-name> wimax-4g-usb
{enable | disable} wireless-controller
{enable | disable} wireless-controller-port
<port_int>
Select the CA certificate that verifies the WiFi certificate.
No default.
Enable to allow access to a WIMAX 4G USB device.
disable
Enable or disable the wireless (WiFi) daemon.
Select the port used for the control channel in wireless controller mode ( wireless-mode is ac).
The range is 1024 through 49150. The data channel port is the control channel port number plus one.
wireless-mode {ac | client} Set the wireless mode (for FortiWiFi units): enable
5246 ac ac—Wireless controller with local wireless client—Wireless client
global
Fortinet Technologies Inc.
Page 541 FortiOS™ - CLI Reference for FortiOS 5.0
system
gre-tunnel
gre-tunnel
Use this command to configure the tunnel for a GRE interface. A new interface of type “tunnel” with the same name is created automatically as the local end of the tunnel. This command is available only in NAT/Route mode.
To complete the configuration of a GRE tunnel, you need to:
• configure a firewall policy to pass traffic from the local private network to the tunnel interface
• configure a static route to the private network at the remote end of the tunnel using the GRE tunnel “device”
• optionally, define the IP addresses for each end of the tunnel to enable dynamic routing through the tunnel or to enable pinging of each end of the tunnel for testing
Syntax
config system gre-tunnel
edit <tunnel_name> set interface <interface_name> set local-gw <localgw_IP>
end
Variable Description
edit <tunnel_name>
Enter a name for the tunnel.
interface <interface_name> Enter the physical, VLAN, or IPsec VPN interface that functions as the local end of the tunnel.
local-gw <localgw_IP>
Enter the IP address of the local gateway.
remote-gw <remotegw_IP> Enter the IP address of the remote gateway.
Default
No default.
Fortinet Technologies Inc.
Page 542 FortiOS™ - CLI Reference for FortiOS 5.0
system
ha
Use this command to enable and configure FortiGate high availability (HA) and virtual clustering.
You cannot enable HA mode if one of the FortiGate unit interfaces uses DHCP or PPPoE to acquire an IP address. If DHCP or PPPoE is configured, the config ha mode keyword is not available.
In HA mode, most settings are automatically synchronized among cluster units. The following settings are not synchronized:
• override
• priority (including the secondary-vcluster priority)
• ha-mgt-interface-gateway
• cpu-threshold, memory-threshold, http-proxy-threshold, ftp-proxy-threshold, imap-proxy-threshold, nntp-proxy-threshold, pop3-proxy-threshold, smtp-proxy-threshold
• The ha-priority setting of the config router gwdetect command
• The config system interface settings of the FortiGate interface that becomes an HA reserved management interface
• The co nfig system global hostname setting
Syntax
config system ha set
set
arps-interval <interval_integer>
set
authentication {enable | disable}
set
cpu-threshold <weight_int> <low_int> <high_int>
set
set
ftp-proxy-threshold <weight_int> <low_int> <high_int>
set
gratuitous-arps {enable | disable}
set
set
set
set
ha-mgmt-status {enable | disable}
set
ha-mgmt-interface <interface_name>
set
ha-mgmt-interface-gateway <gateway_interface>
set
ha-uptime-diff-margin <diff_int>
set
hb-interval <interval_integer>
set
hb-lost-threshold <threshold_integer>
set
hbdev <interface_name> <priority_integer> [<interface_name>
set
set
helo-holddown <holddown_integer>
set
http-proxy-threshold <weight_int> <low_int> <high_int>
set
imap-proxy-threshold <weight_int> <low_int> <high_int>
set
set
link-failed-signal {enable | disable}
set
load-balance-all {enable | disable}
set
load-balance-udp {enable | disable}
Fortinet Technologies Inc.
Page 543 FortiOS™ - CLI Reference for FortiOS 5.0
ha
system
Fortinet Technologies Inc.
set
memory-threshold <weight_int> <low_int> <high_int>
set
minimum-worker-threshold <threshold_int>
set
set
set
nntp-proxy-threshold <weight_int> <low_int> <high_int>
set
set
set
pingserver-failover-threshold <threshold_integer>
set
pingserver-flip-timeout <timeout_integer>
set
pingserver-monitor-interface <interface_names>
set
pop3-proxy-threshold <weight_int> <low_int> <high_int>
set
set
set
set
set
schedule {hub | ip | ipport | leastconnection | none | random
| round-robin | weight-round-robin}
set
session-pickup {enable | disable}
set
session-pickup-connectionless {enable | disable}
set
session-pickup-delay {enable | disable}
set
session-pickup-expectation {enable | disable}
set
session-pickup-nat {enable | disable}
set
session-sync-daemon-number <process_id_int>
set
session-sync-dev <interface_name> [<interface_name>]...
set
slave-switch-standby {enable | disable}
set
smtp-proxy-threshold <weight_int> <low_int> <high_int>
set
standalone-config-sync {enable | disable}
set
sync-config {enable | disable}
set
uninterruptible-upgrade {enable | disable}
set
update-all-session-timer {enable | disable}
set
weight <priority_integer> <weight_integer>
set
set
end
set override {enable | disable}
set priority <priority_integer>
end config frup-settings
set active-interface <interface_name> set backup-interface <interface_name>
end
set active-switch-port <port_number>
end
ha
Page 544 FortiOS™ - CLI Reference for FortiOS 5.0
system
Variable
arps <arp_integer> arps-interval
<interval_integer>
Description
Set the number of times that the primary unit sends gratuitous ARP packets. Gratuitous ARP packets are sent when a cluster unit becomes a primary unit (this can occur when the cluster is starting up or after a failover).
Default
5
The range is 1 to 60.
Set the number of seconds to wait between sending gratuitous ARP packets. When a cluster unit becomes a primary unit (this occurs when the cluster is starting up or after a failover) the primary unit sends gratuitous ARP packets immediately to inform connected network equipment of the IP address and
MAC address of the primary unit.
8 authentication
{enable | disable} cpu-threshold <weight_int>
<low_int> <high_int>
The range is 1 to 20 seconds.
Enable/disable HA heartbeat message authentication using SHA1.
disable
5 0 0
Configure dynamic weighted load balancing for CPU usage. When enabled fewer sessions will be load balanced to the cluster unit when the CPU usage reaches the high watermark
<high_int>.
This is available when mode is a-a and schedule is weight-round-robin. Default low and high watermarks of 0 disable the feature.
ftp-proxy-threshold
<weight_int> <low_int>
<high_int>
This setting is not synchronized by HA.
encryption {enable | disable} Enable/disable HA heartbeat message encryption using AES-128 for encryption and SHA1 for authentication.
Configure dynamic weighted load balancing for FTP proxy sessions processed by a cluster unit. When enabled fewer sessions will be load balanced to the cluster unit when the high watermark
<high_int> is reached.
disable
5 0 0
This is available when mode is a-a and schedule is weight-round-robin. Default low and high watermarks of 0 disable the feature.
gratuitous-arps
{enable | disable} group-id <id_integer> group-name <name_str>
This setting is not synchronized by HA.
Enable or disable gratuitous ARP packets from new master unit. These ARP packets are not needed if link-failed-signal is enabled.
The HA group ID. The group ID range is from 0 to
255. All members of the HA cluster must have the same group ID. Changing the Group ID changes the cluster virtual MAC address.
enable
0
The HA group name. All cluster members must have the same group name. The maximum length of the group name is 32 characters.
FGT-HA
Fortinet Technologies Inc.
Page 545 FortiOS™ - CLI Reference for FortiOS 5.0
ha
system
Variable
ha-eth-type <type_int> ha-mgmt-status
{enable | disable} ha-mgmt-interface
<interface_name> ha-mgmt-interface-gateway
<gateway_interface> ha-uptime-diff-margin
<diff_int> hb-interval
<interval_integer> hb-lost-threshold
<threshold_integer> hbdev <interface_name>
<priority_integer>
[<interface_name>
<priority_integer>]...
hc-eth-type <type_int>
Description
Set the Ethertype used by HA heartbeat packets for
NAT/Route mode clusters.
<type_int> is a 4-digit number.
Default
8890
Enable or disable the HA reserved management interface feature. disable
Configure the FortiGate interface to be the reserved
HA management interface. You can configure the IP address and other settings for this interface using the config system interface command. When you enable the reserved management interface feature the configuration of the reserved interface is not synchronized by HA.
No default.
Configure the default route for the reserved HA management interface.
0.0.0.0
This setting is not synchronized by HA.
Change the cluster age difference margin (grace period). This margin is the age difference ignored by the cluster when selecting a primary unit based on age. Normally the default value of 300 seconds (5 minutes) should not be changed. However, for demo purposes you can use this option to lower the difference margin.
300
2
The heartbeat interval is the time between sending heartbeat packets. The heartbeat interval range is 1 to 20 (100*milliseconds). So an hb-interval of 2 means a heartbeat packet is sent every 200 milliseconds.
6
The lost heartbeat threshold is the number of consecutive heartbeat packets that are not received from another cluster unit before assuming that the cluster unit has failed. The range is 1 to 60 packets.
Select the FortiGate interfaces to be heartbeat interfaces and set the heartbeat priority for each interface. The heartbeat interface with the highest priority processes all heartbeat traffic. If two or more heartbeat interfaces have the same priority, the heartbeat interface that with the lowest hash map order value processes all heartbeat traffic.
Depends on the
FortiGate model.
By default two interfaces are configured to be heartbeat interfaces and the priority for both these interfaces is set to 50. The heartbeat interface priority range is 0 to 512.
You can select up to 8 heartbeat interfaces. This limit only applies to FortiGate units with more than 8 physical interfaces.
Set the Ethertype used by HA heartbeat packets for
Transparent mode clusters.
<type_int> is a 4-digit number.
8891
ha
Fortinet Technologies Inc.
Page 546 FortiOS™ - CLI Reference for FortiOS 5.0
system
Variable
helo-holddown
<holddown_integer> http-proxy-threshold
<weight_int> <low_int>
<high_int> imap-proxy-threshold
<weight_int> <low_int>
<high_int> l2ep-eth-type <type_int> link-failed-signal
{enable | disable} load-balance-all
{enable | disable} load-balance-udp
{enable | disable} memory-threshold
<weight_int> <low_int>
<high_int>
Description
The hello state hold-down time, which is the number of seconds that a cluster unit waits before changing from hello state to work state.
Default
20
The range is 5 to 300 seconds.
Configure dynamic weighted load balancing for
HTTP proxy sessions processed by a cluster unit.
When enabled fewer sessions will be load balanced to the cluster unit when the high watermark
<high_int> is reached.
This is available when mode is a-a and schedule is weight-round-robin. Default low and high watermarks of 0 disable the feature.
5 0 0
This setting is not synchronized by HA.
Configure dynamic weighted load balancing for IMAP proxy sessions processed by a cluster unit. When enabled fewer sessions will be load balanced to the cluster unit when the high watermark
<high_int> is reached.
5 0 0
This is available when mode is a-a and schedule is weight-round-robin. Default low and high watermarks of 0 disable the feature.
This setting is not synchronized by HA.
Set the Ethertype used by HA telnet sessions between cluster units over the HA link.
<type_int> is a 4-digit number.
8893 disable
Enable or disable shutting down all interfaces (except for heartbeat device interfaces) of a cluster unit with a failed monitored interface for one second after a failover occurs. Enable this option if the switch the cluster is connected to does not update its MAC forwarding tables after a failover caused by a link failure. disable
Select the traffic that is load balanced by activeactive HA. Enable to load balance TCP sessions and sessions for firewall policies that include UTM options. Disable to load balance only sessions for firewall policies that include UTM options.
Available if mode is a-a.
Load balance UTM traffic between FS-5203B and
FG-5001B.
disable
Configure dynamic weighted load balancing for memory usage. When enabled fewer sessions will be load balanced to the cluster unit when the memory usage reaches the high watermark
<high_int>.
5 0 0
This is available when mode is a-a and schedule is weight-round-robin. Default low and high watermarks of 0 disable the feature.
This setting is not synchronized by HA.
Fortinet Technologies Inc.
Page 547 FortiOS™ - CLI Reference for FortiOS 5.0
ha
system
Variable
minimum-worker-threshold
<threshold_int>
Description
Used only in content-cluster inter-chassis mode. In inter-chassis mode HA takes the number of worker
(non-5203B) blades in a chassis when electing an HA master. Blades in a chassis that has less than
"minimum-worker-threshold" worker blades available will be ranked lower than blades in a chassis that meets or exceeds "minimum-worker-threshold".
Default
1
The default value of 1 effectively disables the threshold. The maximum value is 11.
mode {a-a | a-p | standalone} Set the HA mode.
Enter a-p to create an Active-Passive cluster.
Enter a-a to create an Active-Active cluster.
Enter standalone to disable HA.
All members of an HA cluster must be set to the same HA mode.
standalone
Not available if a FortiGate interface mode is set to dhcp or pppoe.
monitor <interface_names>
Enable or disable port monitoring for link failure. Port monitoring (also called interface monitoring) monitors
FortiGate interfaces to verify that the monitored interfaces are functioning properly and connected to their networks.
No default.
nntp-proxy-threshold
<weight_int> <low_int>
<high_int>
Enter the names of the interfaces to monitor. Use a space to separate each interface name. If you want to remove an interface from the list or add an interface to the list you must retype the list with the names changed as required.
You can monitor physical interfaces, redundant interfaces, and 802.3ad aggregated interfaces but not VLAN subinterfaces, IPSec VPN interfaces, or switch interfaces.
You can monitor up to 64 interfaces. This limit only applies to FortiGate units with more than 16 physical interfaces. In a multiple VDOM configuration you can monitor up to 64 interfaces per virtual cluster.
Configure dynamic weighted load balancing for
NNTP proxy sessions processed by a cluster unit.
When enabled fewer sessions will be load balanced to the cluster unit when the high watermark
<high_int> is reached.
This is available when mode is a-a and schedule is weight-round-robin. Default low and high watermarks of 0 disable the feature.
5 0 0
This setting is not synchronized by HA.
ha
Fortinet Technologies Inc.
Page 548 FortiOS™ - CLI Reference for FortiOS 5.0
system
Variable Description
override {enable | disable}
Enable or disable forcing the cluster to renegotiate and select a new primary unit every time a cluster unit leaves or joins a cluster, changes status within a cluster, or every time the HA configuration of a cluster unit changes.
Default
disable
Automatically changes to enable when you enable virtual cluster 2.
This setting is not synchronized by HA.
password <password_str>
Enter a password for the HA cluster. The password must be the same for all FortiGate units in the cluster.
The maximum password length is 15 characters.
pingserver-failover-threshold
<threshold_integer>
Set the HA remote IP monitoring failover threshold.
The failover threshold range is 0 to 50. Setting the failover threshold to 0 means that if any ping server added to the HA remote IP monitoring configuration fails an HA failover will occur.
No default.
0
Set the priority for each remote IP monitoring ping server using the ha-priority field of the command
“router gwdetect” on page 369 .
pingserver-flip-timeout
<timeout_integer>
Set the HA remote IP monitoring flip timeout in minutes. If HA remote IP monitoring fails on all cluster units because none of the cluster units can connect to the monitored IP addresses, the flip timeout stops a failover from occurring until the timer runs out. The range is 6 to 2147483647 minutes.
pingserver-monitor-interface
<interface_names>
Enable HA remote IP monitoring by specifying the
FortiGate unit interfaces that will be used to monitor remote IP addresses. You can configure remote IP monitoring for all types of interfaces including physical interfaces, VLAN interfaces, redundant interfaces and aggregate interfaces.
60 pop3-proxy-threshold
<weight_int> <low_int>
<high_int>
Use a space to separate each interface name. If you want to remove an interface from the list or add an interface to the list you must retype the list with the names changed as required.
Configure dynamic weighted load balancing for
POP3 proxy sessions processed by a cluster unit.
When enabled fewer sessions will be load balanced to the cluster unit when the high watermark
<high_int> is reached.
This is available when mode is a-a and schedule is weight-round-robin. Default low and high watermarks of 0 disable the feature.
5 0 0
This setting is not synchronized by HA.
ha
Fortinet Technologies Inc.
Page 549 FortiOS™ - CLI Reference for FortiOS 5.0
system
Variable Description
priority <priority_integer>
Change the device priority of the cluster unit. Each cluster unit can have a different device priority (the device priority is not synchronized among cluster members). During HA negotiation, the cluster unit with the highest device priority becomes the primary unit. The device priority range is 0 to 255.
Default
128 route-ttl <ttl_integer>
This setting is not synchronized by HA.
route-hold <hold_integer>
The minimum time between primary unit updates to the routing tables of subordinate units in a cluster.
The route hold range is 0 to 3600 seconds.
The time to live for routes in a cluster unit routing table.
The time to live range is 5 to 3600 seconds.
10
10
The time to live controls how long routes remain active in a cluster unit routing table after the cluster unit becomes a primary unit.
route-wait <wait_integer>
The time the primary unit waits after receiving a routing table update before attempting to update the subordinate units in the cluster.
0 schedule {hub | ip | ipport
| leastconnection | none
| random | round-robin
| weight-round-robin}
The route-wait range is 0 to 3600 seconds.
Active-active load balancing schedule.
hub load balancing if the cluster interfaces are connected to hubs. Traffic is distributed to cluster units based on the Source IP and Destination IP of the packet.
• ip — load balancing according to IP address.
• ipport — load balancing according to IP address and port.
• leastconnection — least connection load balancing.
• none — no load balancing. Use none when the cluster interfaces are connected to load balancing switches.
• random — random load balancing.
• round-robin — round robin load balancing. If the cluster units are connected using switches, use round-robin to distribute traffic to the next available cluster unit.
• weight-round-robin — weighted round robin load balancing. Similar to round robin, but you can assign weighted values to each of the units in a cluster.
round-robin
ha
Fortinet Technologies Inc.
Page 550 FortiOS™ - CLI Reference for FortiOS 5.0
system
Variable
session-pickup
{enable | disable} session-pickupconnectionless
{enable | disable} session-pickup-delay
{enable | disable} session-pickup-expectation
{enable | disable} session-pickup-nat
{enable | disable} session-sync-daemonnumber <process_id_int> session-sync-dev
<interface_name>
[<interface_name>]...
slave-switch-standby
{enable | disable}
Description
Enable or disable session pickup. Enable session-pickup so that if the primary unit fails, all sessions are picked up by the new primary unit.
Default
disable
If you enable session pickup the subordinate units maintain session tables that match the primary unit session table. If the primary unit fails, the new primary unit can maintain all active communication sessions.
If you do not enable session pickup the subordinate units do not maintain session tables. If the primary unit fails all sessions are interrupted and must be restarted when the new primary unit is operating.
Enable or disable session synchronization for connectionless (UDP and ICMP) sessions when mode is set to a-a or a-p. When mode is standalone, FGSP cluster session pickup applies to TCP session synchronization only. This is available if session-pickup is enabled.
Enable to synchronize sessions only if they remain active for more than 30 seconds. This option improves performance when session-pickup is enabled by reducing the number of sessions that are synchronized. disable disable disable
Enable or disable session synchronization for expectation sessions in an FGSP cluster. This is available if session-pickup is enabled and mode is standalone.
Enable or disable session synchronization for NAT sessions in an FGSP cluster. This is available if session-pickup is enabled This is available if session-pickup is enabled and mode is standalone..
Set the number of processes used by the HA session sync daemon. Increase the number of processes to handle session packets sent from the kernel efficiently when the session rate is high. Intended for
ELBC clusters, this feature only works for clusters with two members. Range 1 to 15.
disable
1
Select FortiGate interfaces to be used for session synchronization between cluster units instead of using the heartbeat interface. You can select up to 8 session synchronization interfaces. Session synchronization packets are load balanced among these interfaces.
No default.
Enable to force slave FS-5203B into standby mode even though its weight is non-zero. disable
ha
Fortinet Technologies Inc.
Page 551 FortiOS™ - CLI Reference for FortiOS 5.0
system
Variable
smtp-proxy-threshold
<weight_int> <low_int>
<high_int> standalone-config-sync
{enable | disable} sync-config
{enable | disable} uninterruptible-upgrade
{enable | disable} update-all-session-timer
{enable | disable}
Description
Configure dynamic weighted load balancing for
SMTP proxy sessions processed by a cluster unit.
When enabled fewer sessions will be load balanced to the cluster unit when the high watermark
<high_int> is reached.
This is available when mode is a-a and schedule is weight-round-robin. Default low and high watermarks of 0 disable the feature.
Default
5 0 0
This setting is not synchronized by HA.
Synchronize the configuration of the FortiGate units in an FGSP cluster. This is available if sessionpickup is enabled and mode is standalone.
Enable or disable automatic synchronization of primary unit configuration changes to all cluster units.
Enable or disable upgrading the cluster without interrupting cluster traffic processing. disable enable enable
If uninterruptible-upgrade is enabled, traffic processing is not interrupted during a normal firmware upgrade. This process can take some time and may reduce the capacity of the cluster for a short time.
If uninterruptible-upgrade is disabled, traffic processing is interrupted during a normal firmware upgrade (similar to upgrading the firmware operating on a standalone FortiGate unit).
Enable or disable updating all session timers after a failover.
disable
ha
Fortinet Technologies Inc.
Page 552 FortiOS™ - CLI Reference for FortiOS 5.0
system
Variable
weight <priority_integer>
<weight_integer> vdom <vdom_names>
Description
The weighted round robin load balancing weight to assign to each cluster unit in an active-active cluster.
When you set schedule to weight-round-robin you can use the weight field to set the weight of each cluster unit. The weight is set according to the priority of the unit in the cluster. A FortiGate HA cluster can contain up to 4 FortiGate units so you can set up to 4 weights.
Default
The default weight means that the 4 possible units in the cluster all have the same weight of 40. The cluster units are numbered 0 to 3.
priority_integer is a number from 0 to 3 that identifies the priority of the cluster unit.
weight-integer is a number between 0 and 255 that is the weight assigned to the cluster units according to their priority in the cluster. Increase the weight to increase the number of connections processed by the cluster unit with that priority.
You enter the weight for each unit separately. For example, if you have a cluster of 4 FortiGate units you can set the weights for each unit as follows: set weight 0 5 set weight 1 10 set weight 2 15 set weight 3 20
Add virtual domains to virtual cluster 1 or virtual cluster 2. Virtual cluster 2 is also called the secondary virtual cluster.
In the config system ha shell, use set vdom to add virtual domains to virtual cluster 1. Adding a virtual domain to virtual cluster 1 removes that virtual domain from virtual cluster 2.
All virtual domains are added to virtual cluster 1.
In the config secondary-vcluster shell, use set vdom to add virtual domains to virtual cluster 2.
Adding a virtual domain to virtual cluster 2 removes it from virtual cluster 1.
You can use vdom to add virtual domains to a virtual cluster in any combination. You can add virtual domains one at a time or you can add multiple virtual domains at a time. For example, entering set vdom domain_1 followed by set vdom domain_2 has the same result as entering set vdom domain_1 domain_2.
ha
Fortinet Technologies Inc.
Page 553 FortiOS™ - CLI Reference for FortiOS 5.0
system
Variable Description
vcluster2 {disable | enable}
Enable or disable virtual cluster 2.
When multiple VDOMs are enabled, virtual cluster 2 is enabled by default. When virtual cluster 2 is enabled you can use config secondaryvcluster to configure virtual cluster 2.
Disable virtual cluster 2 to move all virtual domains from virtual cluster 2 back to virtual cluster 1.
Default
disable enable when multiple
VDOMs are enabled
Enabling virtual cluster 2 enables override for virtual cluster 1 and virtual cluster 2.
config secondary-vcluster
Configure virtual cluster 2. You must enable vcluster2. Then you can use config secondary-vcluster to set monitor, override, priority, and vdom for virtual cluster 2. priority setting is not synchronized by HA.
Same defaults as virtual cluster 1 except that the default value for override is enable.
config frup-settings fields
These fields configure the Fortinet Redundant UTM Protocol (FRUP).
active-interface
<interface_name> backup-interface
<interface_name> active-switch-port
<port_number>
Select active interface.
Select backup interface.
Enter active switch port.
No default.
No default.
No default.
ha
Fortinet Technologies Inc.
Page 554 FortiOS™ - CLI Reference for FortiOS 5.0
system
interface
interface
Use this command to edit the configuration of a FortiGate physical interface, VLAN subinterface, IEEE 802.3ad aggregate interface, redundant interface, or IPSec tunnel interface.
In the following table, VLAN subinterface can be substituted for interface in most places except that you can only configure VLAN subinterfaces with static IP addresses. Use the edit command to add a VLAN subinterface.
VLAN communication over the backplane interfaces is available for FortiGate-5000 modules installed in a FortiGate-5020 chassis. The FortiSwitch-5003 does not support VLAN-tagged packets so VLAN communication is not available over the FortiGate-5050 and FortiGate-5140 chassis backplanes.
Some fields are specific to aggregate interfaces. These appear at the end of the list of commands under
“variables for aggregate and redundant interfaces (some FortiGate models)” on page 578 .
Some FortiGate models have multiple interfaces that are grouped as a switch named “internal”.
This is switch mode and it is the default. As an alternative, you can select interface mode to use each interface independently. For more information, see internal-switch-mode in
.
Using the one-arm intrusion detection system (IDS), you can now configure a FortiGate unit to operate as an IDS appliance by sniffing packets for attacks without actually receiving and otherwise processing the packets. For more information, see the
ips-sniffer-mode {enable | disable} field.
An interface’s IPv6 address can be included in a Multi Listener Discovery (MLD) report. By default the FortiGate unit includes no addresses in the MLD report. For more information, see
the ip6-send-adv {enable | disable} field.
Syntax
Entering a name string for the edit field that is not the name of a physical interface adds a
VLAN subinterface.
config system interface
Fortinet Technologies Inc.
Page 555 FortiOS™ - CLI Reference for FortiOS 5.0
system
Fortinet Technologies Inc.
interface
set lacp-ha-slave {enable | disable} set lacp-mode {active | passive | static}
set macaddr <mac_address> set mediatype {serdes-sfp | sgmii-sfp}
set member <if_name1> <if_name2> ...
set outbandwidth <bandwidth_integer>
Page 556 FortiOS™ - CLI Reference for FortiOS 5.0
system
Fortinet Technologies Inc.
interface
set stpforward-mode {rpl-all-ext-id | rpl-bridge-ext-id
Page 557 FortiOS™ - CLI Reference for FortiOS 5.0
system
config ipv6 set
set
dhcp6-relay-server {enable | disable}
set
dhcp6-relay-ip {ip1_ipv6 ... ipn_ipv6}
set
set
ip6-allowaccess <access_types>
set
ip6-default-life <ipv6_life_seconds>
set
ip6-hop-limit <ipv6_hops_limit>
set
set
ip6-manage-flag {disable | enable}
set
ip6-max-interval <adverts_max_seconds>
set
ip6-min-interval <adverts_min_seconds>
set
ip6-mode {static | dhcp6 | pppoe}
set
ip6-other-flag {enable | disable}
set
ip6-reachable-time <reachable_msecs>
set
ip6-retrans-time <retrans_msecs>
set
ip6-send-adv {enable | disable}
config ip6-prefix-list
set
autonomous-flag {enable | disable}
set
onlink-flag {enable | disable}
set
set
end
interface
Fortinet Technologies Inc.
Page 558 FortiOS™ - CLI Reference for FortiOS 5.0
system
Fortinet Technologies Inc.
interface
end config ip6-extra-address edit
end end config l2tp-client-settings set
auth-type {auto | chap | mschapv1 | mschapv2 | pap}
set
set
set
set
set
set
set
set
set
end config secondaryip
set
end set
end config vrrp edit
set
set
set
set
set
set
set
end config wifi-mac_list edit <entry_number> set
end config wifi-networks edit
set
end set
set
set
wifi-security {wpa-personal | wep128 | wep64 | open}
set
Page 559 FortiOS™ - CLI Reference for FortiOS 5.0
system interface
A VLAN cannot have the same name as a zone or a virtual domain.
Variable
allowaccess
<access_types>
Description
Enter the types of management access permitted on this interface or secondary IP address. Separate types with spaces. Use the append or clear commands
(instead of set) to add or remove an option from the list.
Default
Varies for each interface.
Valid types are: auto-ipsec — required for IPsec auto-configuration capwap — required for interfaces that carry CAPWAP control traffic. Interfaces dedicated for FortiAP unit use have this option enabled automatically.
fgfm — FortiManager management access http — enable HTTP admin access https — enable HTTPS admin access ping — allow ping response. Useful for testing.
probe-response — allow access by config system server-probe command radius-acct — RADIUS Accounting server access snmp — SNMP management access ssh — enable admin access via SSH telnet — enable admin access via Telnet alias <name_string>
Enter an alias name for the interface. Once configured, the alias will be displayed with the interface name to make it easier to distinguish. The alias can be a maximum of 25 characters.
arpforward
{enable | disable} atm-protocol
{ipoa | none}
This option is only available when interface type is physical.
Enable or disable forwarding of ARP packets on this interface.
ARP forwarding is required for DHCP relay and MS
Windows Client browsing.
Enable IPoA protocol. This is available on ADSL interfaces that support IPoA.
enable none
Fortinet Technologies Inc.
Page 560 FortiOS™ - CLI Reference for FortiOS 5.0
system
Variable
auth-type
<ppp_auth_method> bfd {enable | disable | global} bfd-desired-min-tx
<interval_msec> bfd-detect-mult
<multiplier> bfd-required-min-rx
<interval_msec> broadcast-forward
{enable | disable} defaultgw
{enable | disable} dedicated-to
{management | none} description <text>
Description
Select the PPP authentication method for this interface. Choose one of:
auto — select authentication method automatically
chap — CHAP
mschapv1 — Microsoft CHAP v1
mschapv2 — Microsoft CHAP v2
pap — PAP
Default
auto
This is available only when mode is pppoe, and type of interface is physical.
The status of Bidirectional Forwarding Detection (bfd) on this interface: global
enable — enable BFD and ignore global BFD configuration.
disable — disable BFD on this interface.
global — use the BFD configuration in system settings for the virtual domain to which this interface belongs.
The BFD-related fields below are available only if
bfd is enabled.
Enter the minimum desired interval for the BFD transmit interval. Valid range is from 1 to 100 000 msec.
50
This is available only if
bfd is enable.
Select the BFD detection multiplier.
This is available only if
bfd is enable.
Enter the minimum required interface for the BFD receive interval. Valid range is from 1 to 100 000 msec.
This is available only if
bfd is enable.
Select to enable automatic forwarding of broadcast packets.
3
50 disable
Use with caution. Enabling this option may make the
FortiGate unit vulnerable to broadcast-based DoS attacks such as ping floods.
Enable to get the gateway IP address from the DHCP or PPPoE server.
disable
This is valid only when the mode is one of DHCP or
PPPoE.
Select whether this port is dedicated to unit management or not. This is available on “mgmt” ports where mode is static.
Optionally, enter up to 63 characters to describe this interface.
none
No default.
interface
Fortinet Technologies Inc.
Page 561 FortiOS™ - CLI Reference for FortiOS 5.0
system
Variable
device-access-list
<list_name> device-identification
{enable | disable} device-netscan
{enable | disable}
Description
Enter the device access list to use. The device access
list is configured in user device-access-list . This field
is available when device-identification is enabled.
Enable to attempt to discover OS and device information for source hosts.
Enable to include detected devices in network vulnerability scans. This is available if device-identification is enabled.
Enable to attempt to determine user name for source hosts.
Default
No default.
disable disable enable device-useridentification
{enable | disable} dhcp-client-identifier
<client_name_str>
Override the default DHCP client identifier used by this interface.The DHCP client identifier is used by
DHCP to identify individual DHCP clients (in this case individual FortiGate interfaces). dhcp-relay-ip
<dhcp_relay1_ipv4>
{...
<dhcp_relay8_ipv4>}
By default the DHCP client identifier for each
FortiGate interface is created based on the FortiGate model name and the interface MAC address. In some cases you may want to specify your own DHCP client identifier using this command.
This is available if mode is set to dhcp.
Set DHCP relay IP addresses. You can specify up to eight DHCP relay servers for DHCP coverage of subnets.
No default.
Generally, clients respond to the first offer they receive. The relay agent broadcasts back the
DHCPREQUEST and ACKNOWLEDGE messages so that other DHCP servers do not reserve the addresses they offered. dhcp-relay-service
{enable | disable} dhcp-relay-type {ipsec
| regular} disc-retry-timeout
<pppoe_retry_seconds
>
Do not set dhcp-relay-ip to 0.0.0.0.
Enable to provide DHCP relay service on this interface. The DHCP type relayed depends on the setting of dhcp-relay-type. disable
There must be no other DHCP server of the same type
(regular or ipsec) configured on this interface.
Set dhcp_type to ipsec or regular depending on type of firewall traffic.
Set the initial PPPoE discovery timeout in seconds.
This is the time to wait before retrying to start a
PPPoE discovery. Set to 0 to disable this feature.
regular
1
This field is only available in NAT/Route mode when mode is set to pppoe.
interface
Fortinet Technologies Inc.
Page 562 FortiOS™ - CLI Reference for FortiOS 5.0
system
Variable
distance
<admin_distance>
Description
Configure the administrative distance for routes learned through PPPoE or DHCP. Use the administrative distance to specify the relative priorities of different routes to the same destination. A lower administrative distance indicates a more preferred route. Distance can be an integer from 1-255. For more information, see
Default
1 dns-server-override
{enable | disable}
This variable is only available in NAT/Route mode when mode is set to dhcp or pppoe.
Disable to prevent this interface from using DNS server addresses it acquires via DHCP or PPPoe.
enable
This variable is only displayed if mode is set to dhcp or pppoe.
drop-fragment
{enable | disable} drop-overlappedfragment
{enable | disable}
Enable to drop fragmented packets log them as invalid.
Enable or disable dropping overlapped packet fragments. edit <interface_name> Edit an existing interface or create a new VLAN interface.
edit <ipv6_prefix>
Enter the IPv6 prefix you want to configure. For settings, see the
edit <ipv6_prefix> variables section
of this table.
edit <secondary_ip_id> Enter an integer identifier, e.g., 1, for the secondary ip address that you want to configure. elbc-default-gw
<ipv4_addr>
Use to add a default gateway to hidden front panel ports in ELBC mode. disable disable
None.
None.
None.
explicit-ftp-proxy
{enable | disable} explicit-web-proxy
{enable | disable} external {enable | disable) fail-detect
{enable | disable} fail-detect-option
{link-down | detectserver}
When in ELBC mode the front panel ports are placed in a secret hidden VDOM. This prevents the user from adding routes to that interface. Using the elbcdefault-gw attribute present on front panel ports the user can add a default gateway to these interfaces.
Enable explicit FTP proxy on this interface. For more
information, see “explicit” on page 252
.
Enable explicit Web proxy on this interface. For more
information, see “explicit” on page 877
.
Enable to indicate that an interface is an external interface connected to an external network. This option is used for SIP NAT when the config VoIP profile SIP contact-fixup option is disabled.
Enable interface failure detection.
disable disable disable disable
Select whether the FortiGate unit detects interface failure by port detection ( link-down) or ping server
( detectserver). detectserver is only available in
NAT mode.
link-down
interface
Fortinet Technologies Inc.
Page 563 FortiOS™ - CLI Reference for FortiOS 5.0
system interface
Variable
fail-alert-method
{link-down
| link-failed-signal} fail-alert-interfaces
{port1 port2 ...} forward-domain
<collision_group_num ber>
Description
Select the signal that the FortiGate unit uses to signal the link failure: Link Down or Link Failed.
Default
link-down
Select the interfaces to which failure detection applies.
Specify the collision domain to which this interface belongs. Layer 2 broadcasts are limited to the same group. By default, all interfaces are in group 0.
Collision domains prevent the forwarding of ARP packets to all VLANs on an interface. Without collision domains, duplicate MAC addresses on VLANs may cause ARP packets to be duplicated. Duplicate ARP packets can cause some switches to reset.
0 fp-anomaly [...]
This command is only available in Transparent mode.
Enable NP2 hardware fast path anomaly checking on an interface and specify whether to drop or allow
(pass) different types of anomalies.
No options specified
(disabled)
When no options are specified, anomaly checking performed by the network processor is disabled. If pass options are specified, packets may still be rejected by other anomaly checks, including policyrequired IPS performed using the FortiGate unit main processing resources.
Log messages are generated when packets are dropped due to options in this setting.
The fp-anomaly option is available for NP2-enabled interfaces.
gi-gk {enable | disable} Enable FortiOS Carrier Gi Gatekeeper to enable the Gi firewall on this interface as part of the anti-overbilling configuration. icmp-redirect
{enable | disable}
Disable to stop ICMP redirect from sending from this interface.
disable enable ident-accept
{enable | disable} idle-timeout
<pppoe_timeout_secon ds>
ICMP redirect messages are sent by a router to notify the original sender of packets that there is a better route available.
Enable or disable passing ident packets (TCP port
113) to the firewall policy. If set to disable, the
FortiGate unit sends a TCP reset packet in response to an ident packet.
Disconnect if the PPPoE connection is idle for the specified number of seconds. Set to zero to disable this feature.
disable
0
This is available when mode is set to pppoe.
Fortinet Technologies Inc.
Page 564 FortiOS™ - CLI Reference for FortiOS 5.0
system interface
Variable
inbandwidth
<bandwidth_integer>
Description
Enter the Kbit/sec limit for incoming traffic for this interface.
Use this command to configure inbound traffic shaping for an interface. Inbound traffic shaping limits the bandwidth accepted by the interface. Limiting inbound traffic takes precedence over traffic shaping applied by firewall policies.
You can set inbound traffic shaping for any FortiGate unit interface and it can be active for more than one
FortiGate unit interface at a time. Setting
<bandwidth_integer> to 0 (the default) means unlimited bandwidth or no traffic shaping.
Default
0
This does not affect traffic offloaded to NP2, NP4 and
SP3 processors.
interface <port_name> Enter the physical or VAP interface this virtual interface is linked to.
None.
ip
<interface_ipv4mask> ipmac {enable | disable} ips-sniffer-mode
{enable | disable}
This is available only when adding virtual interfaces such as VLANs and VPNs.
Enter the interface IP address and netmask.
This is not available if mode is set to dhcp or pppoe.
You can set the IP and netmask, but it will not display.
Varies for each interface.
This is only available in NAT/Route mode.
The IP address cannot be on the same subnet as any other FortiGate unit interface.
Enable or disable IP/MAC binding for the specified interface. For information about configuring IP/MAC
binding settings, see “ipmacbinding setting” on page 139 and
“ipmacbinding table” on page 140 .
disable
Enable to configure this interface to operate as a onearmed sniffer as part of configuring a FortiGate unit to operate as an IDS appliance by sniffing packets for attacks without actually receiving and otherwise processing the packets. Once the interface is enabled for sniffing you cannot use the interface for other traffic. You must add sniffer policies for the interface to actually sniff packets.
disable
For more information on one-armed IPS, see
“firewall sniff-interface-policy” on page 214 and
“firewall sniffinterface-policy6” on page 217 .
Fortinet Technologies Inc.
Page 565 FortiOS™ - CLI Reference for FortiOS 5.0
system
Variable
ipunnumbered
<unnumbered_ipv4> l2forward
{enable | disable} l2tp-client
{enable | disable} lcp-echo-interval
<lcp_interval_seconds
> lcp-max-echo-fails
<missed_echoes> listen-forticlientconnection
{enable | disable}
Description
Enable IP unnumbered mode for PPPoE. Specify the
IP address to be borrowed by the interface. This IP address can be the same as the IP address of another interface or can be any IP address.
Default
No default.
This is only available when mode is pppoe.
The Unnumbered IP may be used for PPPoE interfaces for which no unique local address is provided. If you have been assigned a block of IP addresses by your ISP for example, you can add any of these IP addresses to the Unnumbered IP.
Enable to allow layer-2 forwarding for this interface. disable
If there are layer-2 protocols such as IPX, PPTP or
L2TP in use on your network, you need to configure your FortiGate unit interfaces to pass these protocols without blocking.
Enabling l2forward may cause packets to repeatedly loop through the network, much like a broadcast storm. In this case either disable l2forward, or enable
Spanning Tree Protocol (STP) on your network’s switches and routers.
For more information, see
FortiGate VLANs and
VDOMs
.
Enable or disable this interface as a Layer 2 Tunneling
Protocol (L2TP) client. disable
Enabling makes
config l2tp-client-settings visible.
You may need to enable l2forward on this interface.
This is available only on FortiGate 50 series, 60 series, and 100A.
The interface can not be part of an aggregate interface, and the FortiGate unit can not be in
Transparent mode, or HA mode. If l2tp-client is enabled on an interface, the FortiGate unit will not enter HA mode until the L2TP client is disabled.
Set the interval in seconds between PPPoE Link
Control Protocol (LCP) echo requests.
This is available only when mode is pppoe.
Set the maximum number of missed LCP echoes before the PPPoE link is disconnected.
5
3
This is only available when mode is pppoe.
Enable listening for FortiClient endpoints connecting.
This is required for endpoint compliance on endpoints that are connected to the interface through a router. disable listen-forticlient-connection must be configured on the internal interface and on the IPsec tunnel interface if connection is via VPN.
interface
Fortinet Technologies Inc.
Page 566 FortiOS™ - CLI Reference for FortiOS 5.0
system
Variable
macaddr
<mac_address> mediatype {serdessfp | sgmii-sfp} mode
<interface_mode>
interface
Description
Override the factory set MAC address of this interface by specifying a new MAC address. Use the form xx: xx:xx:xx:xx:xx.
Default
Factory set.
This is only used for physical interfaces.
Some FortiGate SFP interfaces can operate in SerDes
(Serializer/Deserializer) or SGMII (Serial Gigabit Media
Independent Interface) mode. The mode that the interface operates in depends on the type of SFP transceiver installed. Use this field to switch the interface between these two modes. serdes-sfp
Set mediatype to:
serdes-sfp if you have installed a SerDes transceiver.
In SerDes mode an SFP interface can only operate at
1000 Mbps.
sgmii-sfp if you have installed an SGMII transceiver.
In SGMII mode the interface can operate at 10, 100, or 1000 Mbps.
This field is available for some FortiGate SFP interfaces. For example, all FortiGate-ASM-FB4 interfaces and interfaces port3 to port18 of the
FortiGate-3016B support both SerDes and SGMII mode.
Configure the connection mode for the interface as one of:
static — configure a static IP address for the interface.
dhcp — configure the interface to receive its IP address from an external DHCP server.
pppoe — configure the interface to receive its IP address from an external PPPoE server. This is available only in NAT/Route mode.
eoa — Ethernet over ATM
pppoa — IP over ATM (also known as bridged mode).
static
This variable is only available in NAT/Route mode.
Fortinet Technologies Inc.
Page 567 FortiOS™ - CLI Reference for FortiOS 5.0
system
Variable
mtu <mtu_bytes> mtu-override
{enable | disable} netbios-forward
{disable | enable} nontp-web-proxy
{disable | enable}
Description
Set a custom maximum transmission unit (MTU) size in bytes. Ideally set mtu to the size of the smallest
MTU of all the networks between this FortiGate unit and the packet destination.
<mtu_bytes> valid ranges are:
• 68 to 1 500 bytes in static mode
• 576 to 1 500 bytes in dhcp mode
• 576 to 1 492 bytes in pppoe mode
• up to 9 000 bytes for NP2-accelerated interfaces
• over 1 500 bytes on high end FortiGate models on some interfaces.
Default
1 500
If you enter an MTU that is not supported, an error message informs you of the valid range for this interface.
In Transparent mode, if you change the MTU of an interface, you must change the MTU of all interfaces to match the new MTU.
If you configure an MTU size larger than 1 500 on your
FortiGate unit, all other network equipment on the route to the destination must also support that frame size.
You can set the MTU of a physical interface, a VLAN interface, and some tunnel interfaces (not IPsec). All virtual interfaces inherit the MTU of the parent physical interface.
The variable mtu is only available when mtuoverride is enabled.
Select enable to use custom MTU size instead of default (1 500). This is available only for physical interfaces and some tunnel interfaces (not IPsec).
disable
Some models support MTU sizes larger than the standard 1 500 bytes.
Enable to forward Network Basic Input/Output
System (NetBIOS) broadcasts to a Windows Internet
Name Service (WINS) server. Use
to set the WINS server IP address.
disable
This variable is only available in NAT/Route mode.
Enable to turn on web cache support for this interface, such as accepting HTTP proxies and DNS requests. Web caching accelerates web applications and web servers by reducing bandwidth usage, server load, and perceived latency. For more information, see
“web-proxy explicit” on page 877 .
disable
This variable is only available when this interface is in
NAT/Route mode.
interface
Fortinet Technologies Inc.
Page 568 FortiOS™ - CLI Reference for FortiOS 5.0
system
Variable
outbandwidth
<bandwidth_integer>
Description
Enter the Kbit/sec limit for outgoing (egress) traffic for this interface.
Default
0
Use this command to configure outbound traffic shaping for an interface. Outbound traffic shaping limits the bandwidth accepted by the interface.
Limiting outbound traffic takes precedence over traffic shaping applied by firewall policies.
You can set outbound traffic shaping for any FortiGate interface and it can be active for more than one
FortiGate interface at a time.
Setting
<bandwidth_integer> to 0 (the default) means unlimited bandwidth or no traffic shaping. padt-retry-timeout
<padt_retry_seconds>
This does not affect traffic offloaded to NP2, NP4 and
SP3 processors.
Initial PPPoE Active Discovery Terminate (PADT) timeout in seconds. Use this timeout to shut down the
PPPoE session if it is idle for this number of seconds.
PADT must be supported by your ISP.
1
This is available in NAT/Route mode when mode is pppoe.
password
<pppoe_password>
Enter the password to connect to the PPPoE server.
This is available in NAT/Route mode when mode is pppoe.
pbx-user-portal {enable
| disable}
Enable PBX user portal on the interface.
This command is available only on FortiGate Voice units.
phone-auto-provision
{enable | disable}
Enable SIP phone auto-provisioning on the interface.
This command is available only on FortiGate Voice units.
poe {disable | enable}
Enable or disable PoE (Power over Ethernet). This option is only available on models with PoE feature.
polling-interval
<interval_int>
Set the amount of time in seconds that the sFlow agent waits between sending collected data to the sFlow collector. The range is 1 to 255 seconds.
No default.
disable disable disable
20 pppoe-unnumberednegotiate
{disable | enable}
A higher polling-interval means less data is sent across the network but also means that the sFlow collector’s picture of the network may be out of date.
Disable to resolve problems when mode is set to
PPPoE, and ipunnumbered is set. The default configuration may not work in some regions, such as
Japan.
enable
This is only available when mode is pppoe and ipunnumbered is set.
interface
Fortinet Technologies Inc.
Page 569 FortiOS™ - CLI Reference for FortiOS 5.0
system
Variable
pptp-client
{disable | enable}
Description
Enable to configure and use a point-to-point tunneling protocol (PPTP) client.
Default
disable
You may need to enable l2forward on this interface.
This command is not available when in HA mode. If the pptp-client is enabled on an interface, the
FortiGate unit will not enter HA mode until that pptpclient is disabled.
Enter the name of the PPTP user. No default.
pptp-user
<pptp_username> pptp-password
<pptp_userpassword> pptp-server-ip
<pptp_serverid> pptp-auth-type
<pptp_authtype> pptp-timeout
<pptp_idletimeout>
Enter the password for the PPTP user.
Enter the IP address for the PPTP server.
Enter the authentication type for the PPTP user.
No default.
No default.
No default.
priority
<learned_priority> remote-ip <ipv4>
Enter the idle timeout in minutes. Use this timeout to shut down the PPTP user session if it is idle for this number of seconds. 0 for disabled.
Enter the priority of routes using this interface.
No default.
0
For more information on priority, see “router static” on page 446 .
This is only available when mode is pppoe or dhcp.
Enter an IP address for the remote end of a tunnel interface.
No default.
If you want to use dynamic routing with the tunnel, or be able to ping the tunnel interface, you must specify an address for the remote end of the tunnel in remote-ip and an address for this end of the tunnel in ip.
replacemsg-overridegroup {group-name} sample-direction {both
| rx | tx}
This is only available if type is tunnel.
Enter the replacement message override group name.
This is for captive portal messages when securitymode is captive-portal.
Configure the sFlow agent to sample traffic received by the interface ( rx) or sent from the interface (tx) or both.
No default.
both
interface
Fortinet Technologies Inc.
Page 570 FortiOS™ - CLI Reference for FortiOS 5.0
system
Variable Description
sample-rate <rate_int> Set the sample rate for the sFlow agent added to this interface. The sample rate defines the average number of packets to wait between samples. For example, the default sample-rate of 2000 samples
1 of every 2000 packets. The sample-rate range is
10 to 99999 packets between samples.
Default
2000 secondary-IP
{enable | disable}
The lower the sample-rate the higher the number of packets sampled. Sampling more packets increases the accuracy of the sampling data but also increases the CPU and network bandwidth required to support sFlow. The default sample-rate of 2000 provides high enough accuracy in most cases.
You can increase the sample-rate to reduce accuracy. You can also reduce the sample-rate to increase accuracy.
Enable to add a secondary IP address to the interface.
This option must be enabled before configuring a secondary IP address. disable security-groups
[group1 [group2 ... groupn]]} security-mode {none
| captive-portal
| 802.1X} sflow-sampler
{disable | enable}
When disabled, the web-based manager interface displays only the option to enable secondary IP.
Optionally, enter the groups that are allowed access to this interface. This is available when securitymode is captive-portal.
Set security mode for this interface:
Null none none
captive-portal — allow only authenticated members of security-groups access through this interface.
802.1X — available only on FGT60C, FWF60C,
FWF60CM, FGT80C, FGT80CM, FWF80CM,
FWF81C, FGT110C, and FGT111C.
Add an sFlow agent to an interface. You can also configure the sFlow agent’s sample-rate, polling-interval, and sample-direction. You can add sFlow agents to any FortiGate interface, including physical interfaces, VLAN interfaces, and aggregate interfaces.
disable
After adding the sFlow agent you can configure the sFlow
For more information about sFlow see “system sflow” on page 678 .
snmp-index <id_int>
Optionally, specify the index number of this interface for SNMP purposes. null
interface
Fortinet Technologies Inc.
Page 571 FortiOS™ - CLI Reference for FortiOS 5.0
system
Variable
speed
<interface_speed> spillover-threshold
<threshold_int> status {down | up} stpforward
{enable | disable}
Description
The interface speed:
auto — the default speed. The interface uses autonegotiation to determine the connection speed.
Change the speed only if the interface is connected to a device that does not support auto-negotiation.
Default
auto
10full — 10 Mbps, full duplex
10half — 10 Mbps, half duplex
100full — 100 Mbps, full duplex
100half — 100 Mbps, half duplex
1000full — 1000 Mbps, full duplex
1000half — 1000 Mbps, half duplex
Speed options vary for different models and interfaces. Enter a space and a “?” after the speed field to display a list of speeds available for your model and interface.
You cannot change the speed for switch interfaces.
Note: XG2 interfaces on models 3140B and 3950B cannot be configured for 1000Mbps.
Set the spillover-threshold to limit the amount of bandwidth processed by the Interface. The range is
0-16 776 000 Kbps.
0
Set the spillover-threshold for an interface if the ECMP route failover and load balance method, configured by the v4-ecmp-mode field of the config system settings command is set to usage-based.
The FortiGate unit sends all ECMP-routed sessions to the lowest numbered interface until the bandwidth being processed by this interface reaches its spillover threshold. The FortiGate unit then spills additional sessions over to the next lowest numbered interface.
Start or stop the interface. If the interface is stopped, it does not accept or send packets.
up
If you stop a physical interface, associated virtual interfaces such as VLAN interfaces will also stop.
Enable to forward Spanning Tree Protocol (STP) packets through this interface. STP maps the network to provide the least-cost-path from point to point while blocking all other ports for that path. This prevents any loops which would flood the network.
(down for
VLANs) disable
If your network uses layer-2 protocols, and has looping issues STP will stop this. For more information, see
FortiGate VLANs and VDOMs
.
interface
Fortinet Technologies Inc.
Page 572 FortiOS™ - CLI Reference for FortiOS 5.0
system interface
Variable
stpforward-mode
{rpl-all-ext-id
| rpl-bridge-ext-id
| rpl-nothing}
Description
Choose the STP forwarding mode;
rpl-all-ext-id Replace all extension IDs (root, bridge).
rpl-bridge-ext-id Replace bridge extension ID only.
rpl-nothing Replace nothing.
subst {enable | disable} Enable to use a substitute destination MAC address for this address.
Default
rpl-all-ext-id disable substitute-dst-mac
<destination_mac_addr es> tcp-mss
<max_send_bytes> trust-ip-1 <ipmask> trust-ip-2 <ipmask> trust-ip-3 <ipmask> type {aggregate | hardswitch | hdlc | loopback | physical | redundant | tunnel | vap-switch | vdomlink | vlan | wireless}
This feature may be used with virtual interfaces to prevent network loops.
Enter the substitute destination MAC address to use when subst is enabled. Use the xx:xx:xx:xx:xx:xx format.
No default.
Enter the FortiGate unit’s maximum sending size for
TCP packets.
Enter trusted source addresses for this management interface. Packets from other source addresses are dropped. This is available on “mgmt” interfaces where dedicate-to is management.
Enter the type of interface. Note: Some types are read only, and are set automatically by hardware.
aggregate — available only on some FortiGate models. Aggregate links use the 802.3ad standard to group up to 8 interfaces together. For aggregate specific fields, see
“variables for aggregate and redundant interfaces (some FortiGate models)” on page 578 .
No default.
0.0.0.0/24 vlan for newly created interface, physical otherwise.
hard-switch — used when a switch-interface is configured and unit electronics provides switch functionality. The switch-interface type field must be set to switch-hardware. For more information see
“switch-interface” on page 693 .
hdlc — High-level Data Link Control (HDLC) is a bitoriented synchronous data link layer protocol; it operates at Layer-2 of OSI model. It is an interface that supports T1/E1 connections. This type of interface is supported by some AMC cards.
loopback — a virtual interface that is always up. This interface’s status and link status are not affected by external changes. It is primarily used for blackhole routing - dropping all packets that match this route.
This route is advertised to neighbors through dynamic routing protocols as any other static route. loopback interfaces have no dhcp settings, no forwarding, no mode, or dns settings. You can create a loopback interface from the CLI or web-based manager.
Fortinet Technologies Inc.
Page 573 FortiOS™ - CLI Reference for FortiOS 5.0
system interface
Variable
type {aggregate | hardswitch | hdlc | loopback | physical | redundant | tunnel | vap-switch | vdomlink | vlan | wireless}
Description
physical — for reference only. All physical FortiGate interfaces and only these interfaces have type set to physical and the type cannot be changed.
redundant — used to group 2 or more interfaces together for reliability. Only one interface is in use at any given time. If the first interface fails, traffic continues uninterrupted as it switches to the next interface in the group. This is useful in HA configurations. The order interfaces become active in the group is determined by the order you specify using the set member field.
tunnel is for reference only - you cannot create tunnel interfaces using this command. Create GRE tunnels using the
system gre-tunnel command. Create
IPSec tunnels using the vpn ipsec-intf phase1 command.
Default
vlan for newly created interface, physical otherwise.
vap-switch — for a wireless controller virtual access point (VAP). This type of interface is created automatically when you configure a VAP.
vdom-link — an internal point-to-point interface object. This interface object is a link used to join virtual domains. For more information on vdom-links,
vlan — a virtual LAN interface. This is the type of interface created by default on any existing physical interface. VLANs increase the number of network interfaces beyond the physical connections on the unit. VLANs cannot be configured on a switch mode interface in Transparent mode.
username
<pppoe_username>
wireless — applies only to FortiWiFi models.
Enter the user name used to connect to the PPPoE server.
This is only available in NAT/Route mode when mode is set to pppoe.
vdom <vdom_name>
Enter the name of the virtual domain to which this interface belongs.
No default.
root vlanforward
{enable | disable}
When you change this field, the physical interface moves to the specified virtual domain. Virtual IP previously added for this interface are deleted. You should also manually delete any routes that include this interface as they may now be inaccessible.
Enable or disable forwarding of traffic between VLANs on this interface. When disabled, VLAN traffic will be delivered to its own VLAN only.. enable disable (v5.0.10 and later)
Fortinet Technologies Inc.
Page 574 FortiOS™ - CLI Reference for FortiOS 5.0
system
Variable Description
vlanid <id_number>
Enter a VLAN ID that matches the VLAN ID of the packets to be received by this VLAN subinterface.
The VLAN ID can be any number between 1 and 4094, as 0 and 4095 are reserved, but it must match the
VLAN ID added by the IEEE 802.1Q-compliant router on the other end of the connection. Two VLAN subinterfaces added to the same physical interface cannot have the same VLAN ID. However, you can add two or more VLAN subinterfaces with the same
VLAN ID to different physical interfaces, and you can add more multiple VLANs with different VLAN IDs to the same physical interface.
Default
No default.
voip
{enable | disable}
This is available only when editing an interface with a type of
VLAN.
Enable the VoIP SIP protocol for allowing SIP traffic on the interface.
This command is available only on FortiGate Voice units.
vrrp-virtual-mac
{enable | disable}
Enable VRRP virtual MAC addresses for the VRRP routers added to this interface. See RFC 3768 for information about the VRRP virtual MAC addresses.
wccp {enable | disable} Enable to WCCP on an interface. This setting specifies the interface the FortiGate unit sends and receives WCCP packets and redirected traffic.
weight <int>
Set the default weight for static routes on this interface. This applies if a route has no weight configured.
wifi-auto-connect
{enable | disable} wifi-auto-save
{enable | disable} wins-ip
<wins_server_ip>
Enable to have client mode WiFi automatically connect to nearest saved WiFi network.
Enable to have client mode WiFi automatically save the passphrase when it connects to a WiFi network.
Enter the IP address of a WINS server to which to forward NetBIOS broadcasts.
This WINS server address is only used if netbiosforward is enabled.
This variable is only available in NAT/Route mode.
config ipv6 variables
autoconf
{enable | disable}
Enable or disable automatic configuration of the IPv6 address.
When enabled, and ip6-send-adv is disabled, the
FortiGate unit acts as a stateless address autoconfiguration client (SLAAC).
Enable or disable DHCP relay service for IPv6.
dhcp6-relay-server
{enable | disable} dhcp6-relay-ip
{ip1_ipv6 ... ipn_ipv6}
Enter the IP address of one or more IPv6 DHCP relays. This is available if dhcp-relay-server is enabled.
disable disable disable
0 enable disable
No default.
disable disable
No default.
interface
Fortinet Technologies Inc.
Page 575 FortiOS™ - CLI Reference for FortiOS 5.0
system interface
Variable
ip6-address
<if_ipv6mask> ip6-allowaccess
<access_types> ip6-default-life
<ipv6_life_seconds> ip6-hop-limit
<ipv6_hops_limit> ip6-link-mtu
<ipv6_mtu>
Description
The interface IPv6 address and netmask. The format for IPv6 addresses and netmasks is described in RFC
3513.
Default
::/0
This is available in NAT/Route mode only.
Enter the types of management access permitted on this IPv6 interface.
Varies for each interface.
Valid types are: fgfm, http, https, ping, snmp, ssh, and telnet. Separate the types with spaces. If you want to add or remove an option from the list, retype the list as required.
Enter the number, in seconds, to add to the Router
Lifetime field of router advertisements sent from the interface. The valid range is 0 to 9000.
1800
This is available in NAT/Route mode only.
Enter the number to be added to the Cur Hop Limit field in the router advertisements sent out this interface. Entering 0 means no hop limit is specified.
This is available in NAT/Route mode only.
This is available in NAT/Route mode only.
Enter the MTU number to add to the router advertisements options field. Entering 0 means that no MTU options are sent.
0
0 ip6-manage-flag
{disable | enable}
This is available in NAT/Route mode only.
Enable or disable the managed address configuration flag in router advertisements.
disable ip6-max-interval
<adverts_max_seconds
>
This is available in NAT/Route mode only.
Enter the maximum time interval, in seconds, between sending unsolicited multicast router advertisements from the interface. The valid range is 4 to 1800.
600 ip6-min-interval
<adverts_min_seconds
>
This is available in NAT/Route mode only.
Enter the minimum time interval, in seconds, between sending unsolicited multicast router advertisements from the interface. The valid range is 4 to 1800.
198 ip6-mode
{static | dhcp6 | pppoe} ip6-other-flag
{enable | disable}
This is available in NAT/Route mode only.
Select either static, DHCP or PPPoE-assigned address for this interface in IPv6 operation. PPPoE is available only if IPv4 mode is pppoe.
Enable or disable the other stateful configuration flag in router advertisements.
ip6-reachable-time
<reachable_msecs> static disable
This is available in NAT/Route mode only.
Enter the number to be added to the reachable time field in the router advertisements. The valid range is 0 to 3600. Entering 0 means no reachable time is specified.
0
This is available in NAT/Route mode only.
Fortinet Technologies Inc.
Page 576 FortiOS™ - CLI Reference for FortiOS 5.0
system interface
Variable
ip6-retrans-time
<retrans_msecs> ip6-send-adv
{enable | disable}
Description
Enter the number to be added to the Retrans Timer field in the router advertisements. Entering 0 means that the Retrans Timer is not specified.
Default
0
This is available in NAT/Route mode only.
Enable or disable the flag indicating whether or not to send periodic router advertisements and to respond to router solicitations.
disable
When enabled, this interface’s address will be added to all-routers group (
FF02::02) and be included in an
Multi Listener Discovery (MLD) report. If no interfaces on the FortiGate unit have ip6-send-adv enabled, the FortiGate unit will only listen to the all-hosts group
(FF02::01) which is explicitly excluded from MLD reports according to RFC 2710 section 5.
When disabled, and autoconf is enabled, the
FortiGate unit acts as a stateless address autoconfiguration client (SLAAC).
This is available in NAT/Route mode only.
edit <ipv6_prefix> variables autonomous-flag
{enable | disable}
Set the state of the autonomous flag for the IPv6 prefix. onlink-flag
{enable | disable} preferred-life-time
<seconds>
Set the state of the on-link flag ("L-bit") in the IPv6 prefix.
Enter the preferred lifetime, in seconds, for this IPv6 prefix.
disable
604800 valid-life-time
<seconds>
Enter the valid lifetime, in seconds, for this IPv6 prefix.
config ip6-extra-addr
Configure a secondary address for this IPv6 interface.
<prefix_ipv6>
IPv6 address prefix.
2592000 config l2tp-client-settings auth-type {auto | chap | mschapv1 | mschapv2 | pap}
Select the type of authorization used with this client:
auto — automatically choose type of authorization.
chap — use Challenge-Handshake Authentication
Protocol.
auto
mschapv1 — use Microsoft version of CHAP version
1.
mschapv2 — use Microsoft version of CHAP version
2.
pap — use Password Authentication Protocol.
defaultgw
{enable | disable} distance
<admin_distance>
Enable to use the default gateway.
Enter the administration distance of learned routes.
disable
2 mtu <integer>
Enter the Maximum Transmission Unit (MTU) for L2TP.
1460 password <password>
Enter the password for L2TP.
n/a
Fortinet Technologies Inc.
Page 577 FortiOS™ - CLI Reference for FortiOS 5.0
system interface
Variable Description
peer-host <ipv4_addr> Enter the IP address of the L2TP host.
peer-mask <netmask>
Enter the netmask used to connect to L2TP peers connected to this interface.
peer-port <port_num>
Enter the port used to connect to L2TP peers on this interface.
priority <integer>
Enter the priority of routes learned through L2TP. This will be used to resolve any ties in the routing table.
user <string>
Enter the L2TP user name used to connect.
variables for ADSL interface (some FortiGate models) gwaddr <IPv4> mux-type
{llc-encaps | vcencaps}
Enter the IP address of the gateway for this interface.
Enter the MUX type as either encaps.
llc-encaps or vc-
This information is provided by your ISP vci <integer>
Enter the virtual circuit identification VCI number. Valid numbers are from 0 to 255. This number is provided by your ISP.
vpi <integer>
Enter the virtual circuit identification VPI number. Valid numbers
Default
n/a
255.255.255.255
1701
0 n/a
0
35 are from 0 to 65535. This number is provided by your
ISP.
variables for aggregate and redundant interfaces (some FortiGate models)
These variables are available only when type is aggregate or redundant.
algorithm
{L2 | L3 | L4}
Enter the algorithm used to control how frames are distributed across links in an aggregated interface
(also called a Link Aggregation Group (LAG)). The algorithm must match that used by connected switches. Enter one of: lacp-ha-slave
{enable | disable} lacp-mode {active | passive | static}
L4
L2 — use source and destination MAC addresses.
L3 — use source and destination IP addresses, fall back to L2 algorithm if IP information is not available.
L4 — use TCP, UDP or ESP header information.
This option affects how the aggregate interface participates in Link Aggregation Control Protocol
(LACP) negotiation when HA is enabled for the VDOM.
It takes effect only if Active-Passive HA is enabled and lacp-mode is not static. Enter enable to participate in LACP negotiation as a slave or disable to not participate.
Enter one of active, passive, or static.
active — send LACP PDU packets to negotiate link aggregation connections. This is the default.
enable active
passive — respond to LACP PDU packets and negotiate link aggregation connections
static — link aggregation is configured statically
Fortinet Technologies Inc.
Page 578 FortiOS™ - CLI Reference for FortiOS 5.0
system
Variable
lacp-speed
{fast | slow} member
<if_name1> <if_name
2> ...
VRRP fields
<VRID_int> adv-interval
<seconds_int> preempt
{enable | disable}
Description
slow — sends LACP PDU packets every 30 seconds to negotiate link aggregation connections. This is the default.
fast — sends LACP PDU packets every second, as recommended in the IEEE 802.3ad standard.
Default
slow
This is available only when type is aggregate.
Specify a list of physical interfaces that are part of an aggregate or redundant group. To modify a list, enter the complete revised list.
If VDOMs are enabled, then vdom must be set the same for each interface before you enter the member list.
No default.
An interface is available to be part of an aggregate or redundant group only if
• it is a physical interface, not a VLAN interface
• it is not already part of an aggregated or redundant interface
• it is in the same VDOM as the aggregated interface
• it has no defined IP address and is not configured for DHCP or PPPoE
• it has no DHCP server or relay configured on it
• it does not have any VLAN subinterfaces
• it is not referenced in any firewall policy, VIP or multicast policy
• it is not an HA heartbeat device or monitored by
HA
• In a redundant group, failover to the next member interface happens when the active interface fails or is disconnected.
The order you specify the interfaces in the member list is the order they will become active in the redundant group. For example if you enter set member port5 port1, then port5 will be active at the start, and when it fails or is disconnected port1 will become active.
This is only available when type is aggregate or redundant.
Add one or more VRRP virtual routers to a FortiGate interface. For information about VRRP, see RFC 3768 .
VRRP virtual router ID (1 to 255). Identifies the VRRP virtual router.
VRRP advertisement interval (1-255 seconds).
1
Enable or disable VRRP preempt mode. In preempt mode a higher priority backup unit can preempt a lower priority master unit.
enable
interface
Fortinet Technologies Inc.
Page 579 FortiOS™ - CLI Reference for FortiOS 5.0
system
Variable
priority <prio_int>
Description
Priority of this virtual router (1-255). The VRRP virtual router on a network with the highest priority becomes the master.
Default
100 start-time
<seconds_int>
The startup time of this virtual router (1-255 seconds).
The startup time is the maximum time that the backup unit waits between receiving advertisement messages from the master unit.
3 status
{enable | disable} vrdst <ipv4_addr> vrip <ipv4_addr>
Enable or disable this virtual router.
Monitor the route to this destination.
IP address of the virtual router.
enable
0.0.0.0
0.0.0.0
WiFi fields (AP-mode) mac <mac_address>
Enter a MAC address for the MAC filter list. This is used in the config wifi-mac_list subcommand.
No default.
wifi-acl {allow | deny} Select whether MAC filter list allows or denies access. deny wifi-auth
{PSK | radius | usergro up}
Select either Pre-shared Key (PSK) or radius to authenticate users connecting to this interface. This is available only when wifi-security is set to WPA.
PSK
Select usergroup to add a usergroup with the wifiusergroup keyword. This option is only available when wifi-security is set to wpa-enterprise or wpa2enterprise.
Enable if you want FortiWiFi-60 to broadcast its SSID.
disable wifi-broadcast_ssid
{enable | disable} wifi-encrypt
{AES | TKIP}
Select either Advanced Encryption Standard (AES) or
Temporal Key Integrity Protocol (TKIP) for encryption on this WLAN interface.
TKIP wififragment_threshold
<packet_size>
This is available only when wifi-security is set to
WPA.
Set the maximum size of a data packet before it is broken into smaller packets, reducing the chance of packet collisions. If the packet size is larger than the threshold, the FortiWiFi unit will fragment the transmission. If the packet size less than the threshold, the FortiWiFi unit will not fragment the transmission.
2346
Range 800-2346. A setting of 2346 bytes effectively disables this option.
This is available in AP mode only.
wifi-key <hex_key>
Enter a WEP key. The WEP key must be 10 or 26 hexadecimal digits (0-9 a-f). For a 64-bit WEP key, enter 10 hexadecimal digits. For a 128-bit WEP key, enter 26 hexadecimal digits.
wifi-mac-filter
{enable | disable} wifi-security must be set to WEP128 or WEP64.
This is available in AP mode only.
Enable MAC filtering for the wireless interface.
No default.
disable
interface
Fortinet Technologies Inc.
Page 580 FortiOS™ - CLI Reference for FortiOS 5.0
system interface
Variable
wifi-passphrase
<pass_str> wifi-radius-server
<server_name> wifi-rts_threshold
<integer>
Description
Enter shared key for WPA_PSK security.
wifi-security must be set to WPA_PSK.
This is available in AP mode only.
Set RADIUS server name for WPA_RADIUS security.
Default
fortinet
No default.
wifi-security must be set to WPA_RADIUS.
This is available in AP mode only.
The request to send (RTS) threshold is the maximum size, in bytes, of a packet that the FortiWiFi will accept without sending RTS/CTS packets to the sending wireless device. In some cases, larger packets being sent may cause collisions, slowing data transmissions.
2346
The valid range is 256 to 2346. A setting of 2347 bytes effectively disables this option.
wifi-security
<sec_mode>
This is available in AP mode only.
Enter security (encryption) mode:
none — Communication is not encrypted.
wep64 — WEP 64-bit encryption
wep128 — WEP 128-bit encryption
wpa-personal — WPA or WPA2, personal authentication (PSK)
wpa-enterprise — WPA or WPA2, enterprise authentication (802.1x)
wpa2-personal — WPA2 encryption, personal authentication (PSK) wpa-personal
wpa2-enterprise — WPA or WPA2, enterprise authentication (802.1x)
wpa_radius — WPA encryption via RADIUS server.
wifi-ssid <id_str>
This is available in AP mode only.
Change the Service Set ID (SSID) as required.
fortinet
WiFi-Networks field (Client mode)
<network_id>
Enter an integer ID.
wifi-key <key_str>
Enter the pre-shared key for WEP security on this network.
wifi-keyindex
<index_int> wifi-passphrase
<psk_str>
The SSID is the wireless network name that this
FortiWiFi-60A WLAN broadcasts. Users who wish to use the wireless network should configure their computers to connect to the network that broadcasts this network name.
Enter the pre-shared key index for WEP security on this network.
Enter the pre-shared key for WPA-Personal security on this network.
No default.
1
No default.
Fortinet Technologies Inc.
Page 581 FortiOS™ - CLI Reference for FortiOS 5.0
system
Variable
wifi-security
{wpa-personal
| wep128 | wep64
| open} wifi-ssid <ssid_str>
Description
Select the security that this network uses.
Enter the SSID for this network.
interface
Default
wpa-personal fortinet
Fortinet Technologies Inc.
Page 582 FortiOS™ - CLI Reference for FortiOS 5.0
system
ipip-tunnel
Use this command to set up an RFC 1853 IP-to-IP tunnel.
Syntax
config system ipip-tunnel edit
<tunnel_name> set interface <if_name> set local-gw <ip4_addr>
end
Variable Description
<tunnel_name> interface <if_name>
Enter a name for the IP-to-IP tunnel.
Enter the interface to use.
local-gw <ip4_addr>
Enter the local gateway IP address.
remote-gw <ip4_addr>
Enter the remote gateway IP address.
Default
0.0.0.0
0.0.0.0
ipip-tunnel
Fortinet Technologies Inc.
Page 583 FortiOS™ - CLI Reference for FortiOS 5.0
system
ips-urlfilter-dns
Use this command to configure IPS URL filter DNS servers.
Syntax
config system ips-urlfilter-dns edit
<DNS_IP> set status {enable | disable}
next end
Variable Description
<DNS_IP>
Enter the DNS server IP address.
status {enable | disable} Enable or disable use of this server.
Default
enable
ips-urlfilter-dns
Fortinet Technologies Inc.
Page 584 FortiOS™ - CLI Reference for FortiOS 5.0
system
ipv6-neighbor-cache
Use this command to save neighbor cache entries for the VDOM.
Syntax
config system ipv6-neighbor-cache edit <id>
set interface <intf_name> set ipv6 <ipv6_addr>
end
Variable Description
interface <intf_name>
Enter the network interface.
ipv6 <ipv6_addr>
Enter the IPv6 IP address.
mac <mac_addr>
Enter the MAC address.
ipv6-neighbor-cache
Default
nul
::
00:00:00:00:00:00
Fortinet Technologies Inc.
Page 585 FortiOS™ - CLI Reference for FortiOS 5.0
system ipv6-tunnel
ipv6-tunnel
Use this command to tunnel IPv4 traffic over an IPv6 network. The IPv6 interface is configured under config system interface. All subnets between the source and destination addresses must support IPv6.
This command is not available in Transparent mode.
Syntax
config system ipv6-tunnel
edit <tunnel_name> set destination <remote_IPv6_address> set interface <name>
end
set source <local_IPv6_address>
Variable
edit <tunnel_name> destination
<remote_IPv6_address> interface <name> source
<local_IPv6_address>
Description
Enter a name for the IPv6 tunnel.
The destination IPv6 address for this tunnel.
The interface used to send and receive traffic for this tunnel.
The source IPv6 address for this tunnel.
Default
No default.
0.0.0.0
No default.
0.0.0.0
Fortinet Technologies Inc.
Page 586 FortiOS™ - CLI Reference for FortiOS 5.0
system mac-address-table
mac-address-table
Use this command to create a static MAC table. The table can hold up to 200 entries.
This command is available in Transparent mode only.
Syntax
config system mac-address-table
end
set interface <if_name> set reply-substitute <mac-address_hex>
Variable
reply-substitute
<mac-address_hex>
Description
edit <mac-address_hex> Enter the MAC address as six pairs of hexadecimal digits separated by colons, e.g.:
11:22:33:00:ff:aa interface <if_name>
Enter the name of the interface to which this MAC table entry applies.
Optionally, define a substitute MAC address to use in reply. Then define a MAC address table entry for the reply-substitute MAC address, specifying the interface to which it applies.
Default
No default.
No default.
No default.
Fortinet Technologies Inc.
Page 587 FortiOS™ - CLI Reference for FortiOS 5.0
system
modem
modem
Use this command to configure FortiGate models with dedicated modem interfaces or to configure a serial modem interface connected using a serial converter to the USB port.
This command is only available in NAT/Route mode. When Transparent mode is enabled, all modem related pages are hidden in the web-based manager.
Syntax
config system modem set
account-relation {equal | fallback}
set
set
authtype1 {pap chap mschap mschapv2}
set
authtype2 {pap chap mschap mschapv2}
set
authtype3 {pap chap mschap mschapv2}
set
set
set
dial-on-demand {enable | disable}
set
set
extra-init1, extra-init2, extra-init3 <init_str>
set
set
set
set
set
set
modem-dev1, modem-dev2, modem-dev3 {internal | pcmciawireless}
set
set
passwd1, passwd2, passwd3 <password_str>
set
peer_modem1 {actiontec | ascendTNT | generic}
set
peer_modem2 {actiontec | ascendTNT | generic}
set
peer_modem3 {actiontec | ascendTNT | generic}
set
set
set
set
set
ppp-echo-request1 {disable | enable}
set
ppp-echo-request2 {disable | enable}
set
ppp-echo-request3 {enable | disable}
set
priority <integer> {enable | disable}
set
set
set
set
set
end set
Fortinet Technologies Inc.
Page 588 FortiOS™ - CLI Reference for FortiOS 5.0
system modem
Variable
account-relation
{equal | fallback}
Description
Set the account relationship as either
equal or fallback.
equal — Accounts are equal and keep using the first successful account.
Default
equal
fallback — The first account takes priority, fall back to the first account if possible altmode {enable | disable} Enable for installations using PPP in China. authtype1 {pap chap mschap mschapv2}
Enter the authentication methods to use for 3G modems as one of: PAP, CHAP, MS-CHAP, or MS-
CHAPv2.
authtype2 {pap chap mschap mschapv2} authtype3 {pap chap mschap mschapv2} auto-dial
{enable | disable}
Enable to dial the modem automatically if the connection is lost or the FortiGate unit is restarted. enable pap chap mschap mschapv2 disable connect_timeout
<seconds> dial-on-demand
{enable | disable} distance <distance>
This is available only when dial-on-demand is set to disabled, and mode is set to standalone.
Set the connection completion timeout (30 - 255 seconds).
90 disable
Enable to dial the modem when packets are routed to the modem interface. The modem disconnects after the idle-timer period.
This is available only if auto-dial is set to disabled, and mode is set to standalone.
Enter the administrative distance (1-255) to use for the default route that is automatically added when the modem connects and obtains an IP address. A lower distance indicates a more preferred route. For more information, see
“distance <distance>” on page 447 .
1 extra-init1, extra-init2, extra-init3 <init_str> holddown-timer
<seconds> idle-timer <minutes>
This field is useful for configuring redundant routes in which the modem interface acts as a backup to another interface.
Enter up to three extra initialization strings to send to the modem. null
Used only when the modem is configured as a backup for an interface. Set the time (1-60 seconds) that the
FortiGate unit waits before switching from the modem interface to the primary interface, after the primary interface has been restored.
60
This is available only when mode is set to redundant.
Set the number of minutes the modem connection can be idle before it is disconnected.
5
This is available only if
mode is set to standalone.
Fortinet Technologies Inc.
Page 589 FortiOS™ - CLI Reference for FortiOS 5.0
system modem
Variable
interface <name>
Description
Enter an interface name to associate the modem interface with the ethernet interface that you want to either back up (backup configuration) or replace
(standalone configuration).
lockdown-lac <lac_str>
Optionally, allow connection only to the specified location area code (LAC).
mode
{redudant | standalone}
Enter the required mode:
redundant — The modem interface automatically takes over from a selected ethernet interface when that ethernet interface is unavailable.
modem-dev1, modem-dev2, modem-dev3 {internal
| pcmcia-wireless} network-init <init_str>
Default
No default.
null standalone
standalone — The modem interface is the connection from the FortiGate unit to the Internet.
modem-dev1/2/3 refers to one of up to 3 configurable modems on your FortiGate unit. Each device can be either internal or pcmcia-wireless on models that support PCMCIA. The default is internal.
internal
For 3G PCMCIA modems, select the pcmciawireless option.
Get or set current network operator. <init_str> is equivalent to the AT command
AT+COPS=<mode>,[<format>,<oper>[,<AcT>]] where <mode>:
0
0 — automatic selection, other parameters ignored
1 — manual selection, as specified
Enter the password used to access the specified dialup account.
If the modem at phone1 is Actiontec or AscendTNT, select that type, otherwise leave setting as generic.
No default.
generic passwd1, passwd2, passwd3 <password_str> peer_modem1
{actiontec | ascendTNT
| generic} peer_modem2
{actiontec | ascendTNT
| generic} peer_modem3
{actiontec | ascendTNT
| generic} phone1 <phone-number> phone2 <phone-number> phone3 <phone-number> pin-init <init_str>
If the modem at phone2 is Actiontec or AscendTNT, select that type, otherwise leave setting as
If the modem at select that type, otherwise leave setting as generic. phone3 is Actiontec or AscendTNT, generic.
Enter the phone number required to connect to the dialup account. Do not add spaces to the phone number. Make sure to include standard special characters for pauses, country codes, and other functions as required by your modem to connect to your dialup account.
Enter an AT command string to set the PIN.
Use this command only after a reboot or major settings change.
generic generic
No default.
null
Fortinet Technologies Inc.
Page 590 FortiOS™ - CLI Reference for FortiOS 5.0
system modem
Variable
ppp-echo-request1
{disable | enable} ppp-echo-request2
{disable | enable} ppp-echo-request3
{enable | disable}
Description
Disable ppp-echo-request1 if the PPP echo request feature is not supported by your wireless ISP.
This applies to the 1st modem, if connected.
Default
enable
PPP echo request is used to detect low level link down for modems.
Disable ppp-echo-request2 if the PPP echo request feature is not supported by your wireless ISP.
This applies to a 2nd modem, if connected.
enable
PPP echo request is used to detect low level link down for modems.
Disable ppp-echo-request3 if the PPP echo request feature is not supported by your wireless ISP.
This applies to a 3rd modem, if connected.
enable priority <integer>
{enable | disable}
PPP echo request is used to detect low level link down for modems.
Enter the priority of learned routes on this interface.
0
Valid priorities are from 0 to 4294967295. username1 <name_str> username2 <name_str>
For more information on route priorities, see
redial <tries_integer>
Set the maximum number of times (1-10) that the
FortiGate unit dials the ISP to restore an active connection on the modem interface. Select none to allow the modem to redial without a limit.
status {enable | disable}
Enable or disable modem support. This is equivalent to bringing an interface up or down.
Enter the user name used to access the specified dialup account.
username3 <name_str> wireless-port <port_int>
Enter TTY Port for 3G modems. Enter
0 to use default port.
No default.
disable
No default.
0
Fortinet Technologies Inc.
Page 591 FortiOS™ - CLI Reference for FortiOS 5.0
system
monitors
monitors
Use this command to configure top virus, top attack, policy usage and top DLP dashboard widgets.
Syntax
config system monitors edit
<module_id> set widget-type <module_name> set status {close | open}
end
Variable
<module_id> widget-type
<module_name>
Description
Enter the number of this widget. Use 0 to create a new widget instance.
Name of the system dashboard or usage widget to configure:
— DLP archive usage widget
— Log monitor widget.
— Top Policy usage widget
— Top sessions dashboard widget
—Top attacks dashboard widget
—Top viruses dashboard widget status {close | open}
Set whether the widget is open or closed on the dashboard.
<custom_options>
The custom options for the usage and dashboard widgets are listed below.
Dashboard and usage widget variables
dlp-usage
Options:
dlp-protocols {protocols} — enter the names of the protocols to display information for.
Default
sessions log-monitor
refresh-interval <interval_int> — set the time interval for updating the widget display in the range 10 to 240 seconds or 0 to disable.
report-by {dlp-rule | policy | profile | protocol}— organize the information displayed by DLP rule name, firewall policy
ID, profile name, or DLP protocol.
sort-by {bytes | msg-counts}— sort information by the amount of data ( bytes) or the number of session (msgcounts).
top-n <results_int> — set the number of results to display.
The default value displays the top 10 results.
Option:
log-type {app-ctrl | attack | dlp | event | netscan | spam
| traffic | virus | webfilter} — set log type to monitor
Fortinet Technologies Inc.
Page 592 FortiOS™ - CLI Reference for FortiOS 5.0
system
Variable
pol-usage sessions top-attacks top-viruses
monitors
Description
Options:
display-format {chart | table} — display data in a chart or a table.
refresh-interval <interval_int> — set the time interval for updating the widget display in the range 10 to 240 seconds or 0 to disable.
Default
sort-by {bytes | msg-counts} — sort information by the amount of data ( bytes) or the number of session (msgcounts).
top-n <results_int> — set the number of results to display.
The default value displays the top 10 results.
Options:
display-format {chart | table} — display data in a chart or a table.
ip-version — set Internet Protocol version of sessions to display:
IPv4, IPv6, or ipboth.
refresh-interval <interval_int> — set the time interval for updating the widget display in the range 10 to 240 seconds or 0 to disable.
report-by {source | destination | destination-port}
resolve-host {enable | disable} — Resolve host name.
show-auth-user {enable | disable} — Show authenticated user name.
sort-by {bytes | msg-counts} — sort information by the amount of data ( bytes) or the number of session (msgcounts).
top-n <results_int> — set the number of results to display.
The default value displays the top 10 results.
Options:
refresh-interval <interval_int> — set the time interval for updating the widget display in the range 10 to 240 seconds or 0 to disable.
top-n <results_int> — set the number of results to display.
The default value displays the top 10 results.
For the top viruses dashboard widget set the dashboard column and open and closed status and set the following options:
refresh-interval <interval_int> — set the time interval for updating the widget display in the range 10 to 240 seconds or 0 to disable.
top-n <results_int> — set the number of results to display.
The default value displays the top 10 results.
Fortinet Technologies Inc.
Page 593 FortiOS™ - CLI Reference for FortiOS 5.0
system
nat64
Use this command to configure communication between IPv6 hosts and IPv4 servers.
Syntax
config system nat64 set
end set
set
always-synthesize-aaa-record {enable | disable}
Variable
status {enable | disable} nat64-prefix <IPv6_addr> always-synthesize-aaa-record
{enable | disable}
Description
Enable or disable NAT64.
Enter the NAT64 prefix. It must be ::/96.
Enable or disable AAAA record synthesis.
Default
disable
64:ff9b::/96 disable
nat64
Fortinet Technologies Inc.
Page 594 FortiOS™ - CLI Reference for FortiOS 5.0
system network-visibility
network-visibility
Use these commands to configure network visibility settings.
Syntax
config system network-visibility set
destination-hostname-visibility {enable | disable}
set
destination-location {enable | disable}
set
destination-visibility {enable | disable}
set
source-location {enable | disable}
end
Variable Description Default
destination-hostname-visibility
{enable | disable}
Enable or disable log destination hostname visibility enable destination-location
{enable | disable} destination-visibility
{enable | disable}
Enable or disable log destination geolocation visibility
Enable or disable log destination visibility enable enable source-location
{enable | disable}
Enable or disable log source geo location visibility enable
Fortinet Technologies Inc.
Page 595 FortiOS™ - CLI Reference for FortiOS 5.0
system
np6
np6
You can use the following command to configure a wide range of settings for the NP6 processors in your FortiGate unit. You can configure different settings for each NP6 processor.
Syntax
config system np6 edit <np6-processor-name>
config
set
icmp-frag {allow | drop | trap-to-host}
set
icmp-land {allow | drop | trap-to-host}
set
ipv4-land {allow | drop | trap-to-host}
set
ipv4-optlsrr {allow | drop | trap-to-host}
set
ipv4-optrr {allow | drop | trap-to-host}
set
ipv4-optsecurity {allow | drop | trap-to-host}
set
ipv4-optssrr {allow | drop | trap-to-host}
set
ipv4-optstream {allow | drop | trap-to-host}
set
ipv4-opttimestamp {allow | drop | trap-to-host}
set
ipv4-proto-err {allow | drop | trap-to-host}
set
ipv4-unknopt {allow | drop | trap-to-host}
set
tcp-land {allow | drop | trap-to-host}
set
tcp-syn-fin {allow | drop | trap-to-host}
set
tcp-winnuke {allow | drop | trap-to-host}
set
tcp_fin_noack {allow | drop | trap-to-host}
set
tcp_fin_only {allow | drop | trap-to-host}
set
tcp_no_flag {allow | drop | trap-to-host}
set
tcp_syn_data {allow | drop | trap-to-host}
set
udp-land {allow | drop | trap-to-host}
end config
set
ipv6-daddr_err {allow | drop | trap-to-host}
set
ipv6-land {allow | drop | trap-to-host}
set
ipv6-optendpid {allow | drop | trap-to-host}
set
ipv6-opthomeaddr {allow | drop | trap-to-host}
set
ipv6-optinvld {allow | drop | trap-to-host}
set
ipv6-optjumbo {allow | drop | trap-to-host}
set
ipv6-optnsap {allow | drop | trap-to-host}
set
ipv6-optralert {allow | drop | trap-to-host}
set
ipv6-opttunnel {allow | drop | trap-to-host}
set
ipv6-proto-err {allow | drop | trap-to-host}
Fortinet Technologies Inc.
Page 596 FortiOS™ - CLI Reference for FortiOS 5.0
system
end set
ipv6-saddr_err {allow | drop | trap-to-host}
set
ipv6-unknopt {allow | drop | trap-to-host}
Variable
fastpath {disable | enable}
Description
Enable fastpath acceleration to offload sessions to the NP6 processor. You can disable fastpath if you don’t want the NP6 processor to offload sessions.
Default
enable low-latency-mode {disable | enable}
Enable low-latency mode. In low latency mode the integrated switch fabric is bypassed. Low latency mode requires that packet enter and exit using the same NP6 processor. This option is only available for NP6 processors that can operate in low-latency mode.
disable per-session-accounting
{disable | enable} garbage-session-collector
{disable | enable} session-collector-interval
<range> session-timeout-interval
<range> session-timeout-random-range
<range> session-timeout-fixed {disable
| enable}
Record traffic log messages for offloaded sessions.
Enabling this feature reduces performance.
Enable deleting expired or garbage sessions.
Set the expired or garbage session collector time interval in seconds. The range is 1 to 100 seconds.
Set the random timeout for inactive sessions. The range is 0 to 1000 seconds.
Force session timeouts at fixed, instead of random, intervals.
config fp-anomaly-v4 options
fp-anomaly-v4
Configure how the NP6 processor does IPv4 traffic anomaly protection. You can configure the NP6 processor to allow or drop the packets associated with an attack or forward the packets that are associated with the attack to FortiOS (called “trapto-host”). Selecting “trap-to-host” turns off NP6 anomaly protection for that anomaly. If you require anomaly protection you can enable it with a DoS policy. icmp-frag {allow | drop | trap-to-host} icmp-land {allow | drop | trap-to-host} ipv4-land {allow | drop | trap-to-host} ipv4-optlsrr {allow | drop | trap-to-host} ipv4-optrr {allow | drop | trap-to-host} ipv4-optsecurity {allow | drop | trap-to-host} ipv4-optssrr {allow | drop | trap-to-host}
Detects Layer 3 fragmented packets that could be part of a layer 4 ICMP anomalies.
Detects ICMP land anomalies.f
Detects IPv4 land anomalies.
Detects IPv4 with loose source record route option anomalies.
Detects IPv4 with record route option anomalies.
Detects security option anomalies.
Detects IPv4 with strict source record route option anomalies.
disable disable
8
Set the timeout for inactive sessions. The range is 0 to 1000 seconds.
40
8 disable allow trap-to-host trap-to-host trap-to-host trap-to-host trap-to-host trap-to-host
np6
Fortinet Technologies Inc.
Page 597 FortiOS™ - CLI Reference for FortiOS 5.0
system
Variable
ipv4-optstream {allow | drop | trap-to-host} ipv4-opttimestamp {allow | drop | trap-to-host} ipv4-proto-err {allow | drop | trap-to-host} ipv4-unknopt {allow | drop | trap-to-host} tcp-land {allow | drop | trap-to-host} tcp-syn-fin {allow | drop | trap-to-host} tcp-winnuke {allow | drop | trap-to-host} tcp_fin_noack {allow | drop | trap-to-host} tcp_fin_only {allow | drop | trap-to-host} tcp_no_flag {allow | drop | trap-to-host} tcp_syn_data {allow | drop | trap-to-host} udp-land {allow | drop | trap-to-host}
Description
Detects stream option anomalies.
Detects timestamp option anomalies.
Detects invalid layer 4 protocol anomalies.
Detects unknown option anomalies.
Detects TCP land anomalies.
Detects TCP SYN flood SYN/FIN flag set anomalies.
Detects TCP WinNuke anomalies.
Detects TCP SYN flood with FIN flag set without
ACK setting anomalies.
trap-to-host
Detects TCP SYN flood with only FIN flag set anomalies.
trap-to-host
Detects TCP SYN flood with no flag set anomalies.
allow
Detects TCP SYN flood packets with data anomalies.
Detects UDP land anomalies.
config fp-anomaly-v6 options
fp-anomaly-v6
Configure how the NP6 processor does IPv6 traffic anomaly protection. You can configure the NP6 processor to allow or drop the packets associated with an attack or forward the packets that are associated with the attack to FortiOS (called “trapto-host”). Selecting “trap-to-host” turns off NP6 anomaly protection for that anomaly. If you require anomaly protection you can enable it with a DoS policy. ipv6-daddr_err {allow | drop | trap-to-host} ipv6-land {allow | drop | trap-to-host} ipv6-optendpid {allow | drop | trap-to-host} ipv6-opthomeaddr {allow | drop | trap-to-host} ipv6-optinvld {allow | drop | trap-to-host} ipv6-optjumbo {allow | drop | trap-to-host} ipv6-optnsap {allow | drop | trap-to-host}
Detects destination address as unspecified or loopback address anomalies.
Detects IPv6 land anomalies.
Detects end point identification anomalies.
Detects home address option anomalies.
Detects invalid option anomalies.
Detects jumbo options anomalies.
Detects network service access point address option anomalies.
Default
trap-to-host trap-to-host trap-to-host trap-to-host trap-to-host allow trap-to-host allow trap-to-host trap-to-host trap-to-host trap-to-host trap-to-host trap-to-host trap-to-host trap-to-host
np6
Fortinet Technologies Inc.
Page 598 FortiOS™ - CLI Reference for FortiOS 5.0
system
Variable
ipv6-optralert {allow | drop | trap-to-host} ipv6-opttunnel {allow | drop | trap-to-host} ipv6-proto-err {allow | drop | trap-to-host} ipv6-saddr_err {allow | drop | trap-to-host} ipv6-unknopt {allow | drop | trap-to-host}
Description
Detects router alert option anomalies.
Default
trap-to-host
Detects tunnel encapsulation limit option anomalies.
trap-to-host
Detects layer 4 invalid protocol anomalies.
Detects source address as multicast anomalies.
Detects unknown option anomalies.
trap-to-host trap-to-host trap-to-host
np6
Fortinet Technologies Inc.
Page 599 FortiOS™ - CLI Reference for FortiOS 5.0
system
npu
Use this command to configure the Network Processing Unit (NPU) for FortiGate units that support FB4. The NPU can take over encryption processing for its interfaces that would normally be performed by the main FortiGate unit CPU.
If you use the traffic-shaping-mode command, the bidirection option counts twice as much traffic. You need to allow twice the bandwidth as with unidirection.
Syntax
config system npu
end
next
Variable
dec-offload-antireplay
{enable | disable} dedicated-management-cpu
{enable | disable} dedicated-tx-npu
{enable | disable} enc-offload-antireplay
{enable | disable} npu-cascade-cluster
{enable | disable} offload-ipsec-host
{enable | disable}
Description
Enable this option for the system to offload IPSEC packet encryption to FB4 when the ingress port of the tunnel is on FB4.
Default
enable
Enable dedicating CPU #0 to management functions.
This can affect performance. Available on some models.
disable
Enable a special mode in NP4, which handles slow path packets using a dedicated third NP4. This is available on model 3600C only.
disable disable
Enable this option for the system to offload IPSEC packet encryption to FB4 when the egress port of the tunnel is on FB4. disable
Enable cascade cluster mode on models 3950B and
3951B. Not available if sp-load-balance is enabled in
Enable this option for the system to offload packet encryption to FB4 when the egress port of this packet is on FB4.
disable
npu
Fortinet Technologies Inc.
Page 600 FortiOS™ - CLI Reference for FortiOS 5.0
system
ntp
Use this command to configure Network Time Protocol (NTP) servers.
Syntax
config system ntp set
set
set
set
set
server-mode {enable | disable}
set
config ntpserver
set
authentication {enable | disable}
set
set
set
set
server <ipv4_addr>[/<hostname_str>]
end end
Variable
interface <interface_list>
Description
Enter a space-separated list of interfaces on which the NTP server is available. This is available when server-mode is enabled.
ntpsync {enable | disable} server-mode {enable | disable}
Enable of disable FortiGate unit NTP server.
source-ip <ipv4_addr>
Enter the source IP for communications to the NTP server.
syncinterval <interval_int>
Enable to synchronize FortiGate unit’s system time with the ntp server.
Enter the interval in minutes between contacting
NTP server to synchronize time. The range is from 1 to 1440 minutes.
Default
No default.
disable disable
0.0.0.0
0 type {fortiguard | custom}
Only valid when ntpsync is enabled.
Select FortiGuard or custom NTP server.
config ntpserver fields
Configures custom NTP time source.
edit <serverid_int>
Enter the number for this NTP server authentication {enable | disable} Enable or disable MD5 authentication.
key <password_str> key-id <int>
Enter the password for MD5 authentication.
Enter the Key-ID value for MD5 authentication.
ntpv3 {enable | disable} server
<ipv4_addr>[/<hostname_str>]
Use NTPv3 protocol instead of NTPv4.
Enter the IPv4 address and hostname (optional) for this NTP server.
fortiguard disable null
0 disable
ntp
Fortinet Technologies Inc.
Page 601 FortiOS™ - CLI Reference for FortiOS 5.0
system
object-tag
Use this command to configure object tags.
Syntax
config system object-tag
Variable
edit <tag-name>
Description
Enter the object tag name.
Default
No default.
object-tag
Fortinet Technologies Inc.
Page 602 FortiOS™ - CLI Reference for FortiOS 5.0
system password-policy
password-policy
Use this command to configure higher security requirements for administrator passwords and
IPsec VPN pre-shared keys.
Syntax
config system password-policy set
set
apply-to [admin-password ipsec-preshared-key]
set
change-4-characters {enable | disable}
set
set
set
min-lower-case-letter <num_int>
set
min-upper-case-letter <num_int>
end set
min-non-alphanumeric <num_int>
set
set
expire-status {enable | disable}
set
Variable Description
apply-to
[admin-password ipsec-preshared-key] change-4-characters
{enable | disable} expire <days> minimum-length
<chars> min-lower-case-letter
<num_int> min-upper-case-letter
<num_int> min-non-alphanumeric
<num_int>
Select where the policy applies: administrator passwords or IPSec preshared keys.
Enable to require the new password to differ from the old password by at least four characters.
Set time to expiry in days. Enter
0 for no expiry.
Set the minimum length of password in characters.
Range 8 to 32.
Enter the minimum number of required lower case letters in every password.
Enter the minimum number of required upper case letters in every password.
Enter the minimum number of required nonalphanumeric characters in every password.
min-number
<num_int> expire-status
{enable | disable}
Enter the minimum number of number characters required in every password.
Enable to have passwords expire. expire-day <num_int>
Enter the number of days before the current password is expired and the user will be required to change their password.
Default
admin-password disable
0
8
0
0
0
0 enable
90 status
{enable | disable}
This option is available only when expire-status is set to enable.
Enable password policy.
disable
Fortinet Technologies Inc.
Page 603 FortiOS™ - CLI Reference for FortiOS 5.0
system physical-switch
physical-switch
Use this command to configure the Layer 2 functions on FortiGate unit hardware-based switches.
Syntax
config system physical-switch edit
end
set age-enable {enable | disable} set age-val <int>
Variable
<switch_name> age-enable
{enable | disable} age-val <int>
Description
Select the hardware switch ( sw0 for example).
Enable or disable Layer 2 Ageing Timer
Enter the age value.
Default
disable
3 158 067
Fortinet Technologies Inc.
Page 604 FortiOS™ - CLI Reference for FortiOS 5.0
system
port-pair
port-pair
Use this command to define a port pair in Transparent mode. In a port pair, all L2 packets received on one port are forwarded to the other port. It is not possible to define firewall policies into or out of the port-pair, only between the members of the pair. A maximum of 256 port pairs can be defined in any VDOM, 512 globally.
Syntax
config system port-pair
end
set member <portname1> <portname2>
Variable
edit <port-pair_name> member <portname1> <portname2>
Description
Enter a name for the port pair.
Enter the two port names that comprise the pair.
Default
No default.
No default.
Fortinet Technologies Inc.
Page 605 FortiOS™ - CLI Reference for FortiOS 5.0
system
probe-response
Use this command to configure probe responses.
Syntax
config system probe-response set
set
set
end set
Variable
port <port_int>
Description
http-probe {enable | disable}
Enable or disable probe response.
http-probe-value <string>
Enter content of probe response.
mode {http-probe | twamp}
Select either HTTP-probe or Two-Way Active
Measurement Protocol (TWAMP) mode.
Enter to port to respond on.
probe-response
Default
disable
OK http-probe
8008
Fortinet Technologies Inc.
Page 606 FortiOS™ - CLI Reference for FortiOS 5.0
system
proxy-arp
proxy-arp
Use this command to add IP addresses to MAC address translation entries to the proxy ARP table.
Syntax
config system proxy-arp
edit <table_entry> set interface <port> set ip <ipv4_address>
end next
Variable Description
edit <table_entry>
Enter the unique ID of the table entry to add or modify.
interface <port>
Enter the physical port this IP will be associated with.
ip <ipv4_address>
Enter the IP address to associate with this physical port.
Default
No default.
No default.
No default.
Fortinet Technologies Inc.
Page 607 FortiOS™ - CLI Reference for FortiOS 5.0
system
pstn
pstn
Use this command to configure the PSTN interfaces. PSTN interfaces are available on some
FortiGate Voice models.
Syntax
config system pstn
set busy-tone-length <integer> set busy-quiet-length <integer> set codec {alaw | ulaw}
end
Variables Description Default
edit <fxo_name> cid-name <caller_name>
Enter the name of the FXO.
This name is used for caller ID for calls from the
FortiGate Voice unit to the PSTN. It can be any name, such as a company name, that identifies the branch office.
cid-number <caller_name>
Enter the phone number of the PSTN phone line as provided by your phone service provider.
No default
No default
No default status {enable | disable} use-callerid
{enable | disable} cid-signalling {bell | dtmf
| v23 | v23-jp} cid-start {polarity | ring}
Enable the status of the port.
Enable to catch the caller ID.
Enter the caller ID protocol. The protocol v23-jp is the v23 protocol for Japan.
Enter to start transmitting the caller ID.
send-callerid-after <integer> Enter a number for the number of rings after that the caller ID began to transmit. enable enable bell ring
1 hangup-on-polarity-reversal
{enable | disable} hangup-on-zero-voltage
{enable | disable} hangup-on-busy-tone
{enable | disable} busycount <integer>
Enable to have the phone hang up when there is polarity reversal.
Enable to have the phone hang up when there is zero voltage. disable
Enable to have the phone hang up when a busy tone is detected.
Enter a number for the accurate number of busy tones that are detected.
enable enable
4
Fortinet Technologies Inc.
Page 608 FortiOS™ - CLI Reference for FortiOS 5.0
system
Variables Description
busy-tone-length <integer>
Enter a number that determines how logn the busy tone is on in milliseconds.
busy-quiet-length <integer>
Enter a number that determines how long the busy tone is off in milliseconds.
codec {alaw | ulaw}
Enter the Codec preference type based on the country. ring-detect
{ring-cross-threshold
| ring-full-wave
| ring-half-wave
| ring-validate} ring-timeout {128ms | 256ms
| 384ms | 512ms | 640ms
| 768ms | 896ms | 1024ms
| 1152ms | 1280ms | 1408ms
| 1536ms | 1664ms | 1792ms
| 1920ms} ring-threshold {level-1
| level-2 | level-3}
Enter the appropriate ring detection method for your phone system.
Enter the appropriate ring time-out for your phone system.
Enter the appropriate ring threshold for your phone system. The ring-threshold is based on voltage:
Default
500
500 ulaw ringvalidate
640ms level-1 ring-delay-time {256ms
| 512ms | 768ms | 1024ms
| 1280ms | 1536ms | 1792ms} ring-confirm-time {100ms
| 150ms | 200ms | 256ms
| 384ms | 512ms | 640ms
| 1024ms} ring-max-assertion-count
<int> ring-assertion-time <int> tx-gain <int> rx-gain <int>
• level-1: 13.5V to 16.5V
• level-2: 19.35V to 23.65V
• level-3: 40.5V to 49.5V
Enter the appropriate ring delay time for your phone system.
Enter the appropriate ring confirmation time for your phone system.
512ms
512ms
Enter the appropriate ring maximum assertion count for your phone system.
22
Enter the appropriate ring assertion time for your phone system.
25
Enter the gain for the transmitted signal, in dB, from -
15 to 12.
0
Enter the gain for the received signal, in dB, from -15 to 12.
0
pstn
Fortinet Technologies Inc.
Page 609 FortiOS™ - CLI Reference for FortiOS 5.0
system replacemsg admin
replacemsg admin
Use this command to change the administration disclaimer page.
If you enter the following CLI command the FortiGate unit displays the Administration Login disclaimer whenever an administrator logs into the FortiGate unit web-based manager or CLI. config system global set pre-login-banner enable end set post-login-banner enable
The web-based manager administrator login disclaimer contains the text of the Login
Disclaimer replacement message as well as Accept and Decline buttons. The administrator must select accept to login.
These are HTML messages with HTTP headers.
Syntax
config system replacemsg admin admin_disclaimer_text set
end set
set
Variable
buffer <message>
Description
Type a new replacement message to replace the current replacement message. Maximum length
8 192 characters.
Default
Depends on message type.
format <format>
Set the format of the message: html, text, or none. No default.
header <header_type>
Set the format of the message header: 8bit, http, or none.
Depends on message type.
Replacement messages can include replacement message tags. When users receive the replacement message, the replacement message tag is replaced with content relevant to the message. Generally there is not a large call for these tags in disclaimer pages.
Table 2: Replacement message tags
Tag Description
%%AUTH_REDIR_URL%% Link to open a new window. (optional).
%%AUTH_LOGOUT%%
Immediately close the connection policy.
%%KEEPALIVEURL%%
URL the keep alive page connects to that keeps the connection policy alive. Connects every
%%TIMEOUT%% seconds.
%%TIMEOUT%%
Configured number of seconds between connections.
%%KEEPALIVEURL%%
Fortinet Technologies Inc.
Page 610 FortiOS™ - CLI Reference for FortiOS 5.0
system replacemsg alertmail
replacemsg alertmail
The FortiGate unit adds the alert mail replacement messages listed to alert email messages sent to administrators. For more information about alert email, see
“system email-server” on page 514 .
Alert mail replacement messages are text messages.
These are HTML messages with HTTP headers.
Syntax
config system replacemsg alertmail
set
end set
set
Variable
alert_msg_type buffer <message> format <format>
Description
FortiGuard replacement alertmail message type.
See
.
Type a new replacement message to replace the current replacement message. Maximum length
8 192 characters.
Set the format of the message: html text none header <header_type>
Set the format of the message header:
8bit http none
Default
No default.
Depends on message type.
No default.
Depends on message type.
If you enable Send alert email for logs based on severity for alert email, whether or not replacement messages are sent by alert email depends on how you set the alert email Minimum
log level.
Table 3: alertmail message types
Message Type
alertmail-block
Description
Virus detected must be enabled for alert email. Antivirus File Filter must be enabled in an antivirus profile, and it must block a file that matches an entry in a selected file filter list.
alertmail-crit-event
Whenever a critical level event log message is generated, this replacement message is sent unless you configure alert email to enable
Send alert email for logs based on severity and set the Minimum log level to Alert or Emergency.
Fortinet Technologies Inc.
Page 611 FortiOS™ - CLI Reference for FortiOS 5.0
system replacemsg alertmail
Table 3: alertmail message types alertmail-disk-full
Disk usage must be enabled, and disk usage reaches the percent full
amount configured for alert email. For more information, see “system email-server” on page 514 .
alertmail-nids-event Intrusion detected must be enabled for alert email. When an IPS Sensor or a DoS Sensor detects an attack, this replacement message will be sent.
alertmail-virus
Virus detected must be enabled for alert email. Antivirus Virus Scan must be enabled in an antivirus profile and detect a virus.
Replacement messages can include replacement message tags. When users receive the replacement message, the replacement message tag is replaced with content relevant to the message.
Table 4: Replacement message tags
Tag
%%FILE%%
Description
The name of a file that has been removed from a content stream. This could be a file that contained a virus or was blocked by antivirus file blocking.
%%FILE%% can be used in virus and file block messages.
%%VIRUS%%
%%URL%%
The name of a virus that was found in a file by the antivirus system.
%%VIRUS%% can be used in virus messages
The URL of a web page. This can be a web page that is blocked by web filter content or URL blocking.
%%URL%% can also be used in http virus and file block messages to be the URL of the web page from which a user attempted to download a file that is blocked.
%%CRITICAL_EVENT%%
Added to alert email critical event email messages.
%%CRITICAL_EVENT%% is replaced with the critical event message that triggered the alert email.
%%PROTOCOL%%
The protocol (HTTP, FTP, POP3, IMAP, SMTP) in which a virus was detected.
%%PROTOCOL%% is added to alert email virus messages.
%%SOURCE_IP%%
IP address of the email server that sent the email containing the virus.
%%DEST_IP%%
IP address of the user’s computer that attempted to download the message from which the file was removed.
%%EMAIL_FROM%%
The email address of the sender of the message from which the file was removed.
%%EMAIL_TO%%
The email address of the intended receiver of the message from which the file was removed.
%%NIDS_EVENT%%
The IPS attack message. email intrusion messages.
%%NIDS_EVENT%% is added to alert
Fortinet Technologies Inc.
Page 612 FortiOS™ - CLI Reference for FortiOS 5.0
system replacemsg auth
replacemsg auth
The FortiGate unit uses the text of the authentication replacement messages listed in Table 6
for various user authentication HTML pages that are displayed when a user is required to authenticate because a firewall policy includes at least one identity-based policy that requires firewall users to authenticate.
These pages are used for authentication using HTTP and HTTPS. Authentication replacement messages are HTML messages. You cannot customize the firewall authentication messages for
FTP and Telnet.
The authentication login page and the authentication disclaimer include replacement tags and controls not found on other replacement messages.
Users see the authentication login page when they use a VPN or a firewall policy that requires authentication. You can customize this page in the same way as you modify other replacement messages,
Administrators see the authentication disclaimer page when logging into the FortiGate web-based manager or CLI. The disclaimer page makes a statement about usage policy to which the user must agree before the FortiGate unit permits access. You should change only the disclaimer text itself, not the HTML form code.
There are some unique requirements for these replacement messages:
• The login page must be an HTML page containing a form with ACTION="/" and
METHOD="POST"
• The form must contain the following hidden controls:
• <INPUT TYPE="hidden" NAME="%%MAGICID%%" VALUE="%%MAGICVAL%%">
• <INPUT TYPE="hidden" NAME="%%STATEID%%" VALUE="%%STATEVAL%%">
• <INPUT TYPE="hidden" NAME="%%REDIRID%%" VALUE="%%PROTURI%%">
• The form must contain the following visible controls:
• <INPUT TYPE="text" NAME="%%USERNAMEID%%" size=25>
• <INPUT TYPE="password" NAME="%%PASSWORDID%%" size=25>
These are HTML messages with HTTP headers.
Syntax
config system replacemsg auth
set
end set
set
Variable
auth_msg_type buffer <message>
Description
FortiGuard replacement message type. See Table 5 on page 614 .
Default
No default
Type a new replacement message to replace the current replacement message. Maximum length 8 192 characters.
Depends on message type.
Fortinet Technologies Inc.
Page 613 FortiOS™ - CLI Reference for FortiOS 5.0
system replacemsg auth
Variable
format <format>
Description
Set the format of the message: html text none header <header_type>
Set the format of the message header:
8bit http none
Default
No default
Depends on message type.
Table 5: auth message types
Message Type
auth-challenge-page
Description
This HTML page is displayed if firewall users are required to answer a question to complete authentication. The page displays the question and includes a field in which to type the answer. This feature is supported by RADIUS and uses the generic RADIUS challenge-access auth response. Usually, challenge-access responses contain a Reply-
Message attribute that contains a message for the user (for example,
“Please enter new PIN”). This message is displayed on the login challenge page. The user enters a response that is sent back to the
RADIUS server to be verified.
The Login challenge page is most often used with RSA RADIUS server for RSA SecurID authentication. The login challenge appears when the server needs the user to enter a new PIN. You can customize the replacement message to ask the user for a SecurID PIN.
This page uses the %%QUESTION%% tag.
auth-disclaimer[1|2|3]
Prompts user to accept the displayed disclaimer when leaving protected network.
The web-based manager refers to this as User Authentication
Disclaimer, and it is enabled with a firewall policy that also includes at least one identity-based policy. When a firewall user attempts to browse a network through the FortiGate unit using HTTP or HTTPS this disclaimer page is displayed.
The extra pages seamlessly extend the size of the page from 8 192 characters to 16 384 and 24 576 characters respectively.
Fortinet Technologies Inc.
Page 614 FortiOS™ - CLI Reference for FortiOS 5.0
system replacemsg auth
Table 5: auth message types auth-keepalive-page auth-login-failed-page
The HTML page displayed if firewall users enter an incorrect user name and password combination.
This page includes
%%FAILED_MESSAGE%%, %%USERNAMEID%%, and
%%PASSWORDID%% tags. auth-login-page
The authentication HTML page displayed when firewall users who are required to authenticate connect through the FortiGate unit using
HTTP or HTTPS.
Prompts the user for their username and password to login.
This page includes
%%USERNAMEID%% and %%PASSWORDID%% tags. auth-reject-page
The HTML page displayed with firewall authentication keepalive is enabled using the following CLI command: config system global set auth-keepalive enable end
Authentication keepalive keeps authenticated firewall sessions from ending when the authentication timeout ends. In the web-based manager, go to User > Options to set the Authentication Timeout.
This page includes
%%TIMEOUT%%.
The Disclaimer page replacement message does not re-direct the user to a redirect URL or the firewall policy does not include a redirect URL.
When a firewall user selects the button on the disclaimer page to decline access through the FortiGate unit, the Declined disclaimer
page is displayed.
auth-token-login-page
The authentication HTML page displayed when firewall users who are required to use two-factor authentication connect through the
FortiGate unit using HTTP or HTTPS.
Prompts the user for their username, password and two-factor authentication credentials.
This page includes
%%USERNAMEID%%, %%PASSWORDID%%, and
%%TOKENCODE%% tags. auth-token-loginfailed-page
The HTML page displayed if firewall users performing two-factor authentication enter an incorrect credentials.
This page includes
%%USERNAMEID%%, %%PASSWORDID%%, and
%%TOKENCODE%% and %%EXTRAINFO%% tags.
Replacement messages can include replacement message tags. When users receive the replacement message, the replacement message tag is replaced with content relevant to the message.
Table 6: Replacement message tags
Tag Description
%%AUTH_REDIR_URL%%
Link to open a new window. (optional).
%%AUTH_LOGOUT%%
Immediately close the connection policy.
Fortinet Technologies Inc.
Page 615 FortiOS™ - CLI Reference for FortiOS 5.0
system replacemsg auth
Table 6: Replacement message tags
Tag Description
%%EXTRAINFO%%
Provide extra help on two-factor authentication.
%%FAILED_MESSAGE%%
Message displayed on failed login page after user login fails.
%%KEEPALIVEURL%%
URL the keep alive page connects to that keeps the connection policy alive. Connects every
%%TIMEOUT%% seconds.
%%QUESTION%%
The default login and rejected login pages use this text immediately preceding the username and password fields. The default challenge page uses this as the challenge question.
These are treated as two different variables by the server.
If you want to use different text, replace
%%QUESTION%% with the text that you prefer.
%%TIMEOUT%%
Configured number of seconds between connections.
%%KEEPALIVEURL%%
%%TOKENCODE%%
The FortiToken authentication code. Used for two-factor authentication.
%%USERNAMEID%%
Username of the user logging in. This tag is used on the login and failed login pages.
%%PASSWORDID%%
Password of the user logging in. This tag is used on the challenge, login and failed login pages.
Requirements for login page
The authentication login page is linked to FortiGate functionality and you must construct it according to the following guidelines to ensure that it will work.
• The login page must be an HTML page containing a form with ACTION="/" and
METHOD="POST"
• The form must contain the following hidden controls:
• <INPUT TYPE="hidden" NAME="%%MAGICID%%" VALUE="%%MAGICVAL%%">
• <INPUT TYPE="hidden" NAME="%%STATEID%%" VALUE="%%STATEVAL%%">
• <INPUT TYPE="hidden" NAME="%%REDIRID%%" VALUE="%%PROTURI%%">
• The form must contain the following visible controls:
• <INPUT TYPE="text" NAME="%%USERNAMEID%%" size=25>
• <INPUT TYPE="password" NAME="%%PASSWORDID%%" size=25>
Fortinet Technologies Inc.
Page 616 FortiOS™ - CLI Reference for FortiOS 5.0
system replacemsg device-detection-portal
replacemsg device-detection-portal
The device-detection-portal messages report device detection events to the user. Currently only the device detection failure message is supported.
Syntax
config system replacemsg device-detection-portal device-detection-failure
set
end set
set
Variable
device-detection-failure buffer <message> format <format>
Description
The FortiGate unit sends this message if it cannot determine the device type.
Type a new replacement message to replace the current replacement message. Maximum length
8 192 characters.
Set the format of the message:
Default
No default
Depends on message type.
html html header <header_type> text none
Set the format of the message header: http
8bit http none
Fortinet Technologies Inc.
Page 617 FortiOS™ - CLI Reference for FortiOS 5.0
system replacemsg ec
replacemsg ec
The endpoint control (ec) replacement messages format the portal pages that the FortiGate unit sends to non-compliant users who attempt to use a firewall policy in which Endpoint NAC
( endpoint-check) is enabled.
There are two Endpoint NAC portals:
• Endpoint NAC Download Portal — The FortiGate unit sends this page if the Endpoint NAC profile has recommendation-disclaimer disabled. In the web-based manager, this is the Quarantine Hosts to User Portal (Enforce compliance) option. The user can download the
FortiClient Endpoint Security application installer. If you modify this replacement message, be sure to retain the
%%LINK%% tag which provides the download URL for the FortiClient installer.
• Endpoint NAC Recommendation Portal — The FortiGate unit sends this page if the Endpoint
NAC profile has recommendation-disclaimer enabled. In the web-based manager, this is the Notify Hosts to Install FortiClient (Warn only) option. The user can either download the
FortiClient Endpoint Security application installer or select the Continue to link to access their desired destination. If you modify this replacement message, be sure to retain both the
%%LINK%% tag which provides the download URL for the FortiClient installer and the
%%DST_ADDR%% link that contains the URL that the user requested.
Message format is HTML by default.
Syntax
config system replacemsg ec
set
set
set
end config system replacemsg ec
set
set
end set
Variable
endpt-download-portal
Description Default
The Endpoint NAC Download Portal. The FortiGate unit sends this message to non-compliant users if recommendation-disclaimer is disabled in the Endpoint Control profile.
No default
The user can download the FortiClient Endpoint
Security application installer.
endpt-recommendation-portal
The Endpoint NAC Recommendation Portal. The
FortiGate unit sends this message to noncompliant users if recommendationdisclaimer is enabled in the Endpoint Control profile.
The user can either download the FortiClient
Endpoint Security application installer or select the
Continue to link to access their desired destination.
No default
Fortinet Technologies Inc.
Page 618 FortiOS™ - CLI Reference for FortiOS 5.0
system replacemsg ec
Variable
buffer <message> format <format> header <header_type>
Description
Type a new replacement message to replace the current replacement message. Maximum length
8 192 characters.
Default
Depends on message type.
Set the format of the message: html text none
Set the format of the message header:
8bit http none
The endpoint control replacement messages include the following replacement message tags.
When users receive the replacement message, the replacement message tag is replaced with the appropriate content.
Table 7: Replacement message tags
Tag Description
%%LINK%%
The download URL for the FortiClient installer.
%%DST_ADDR%%
The destination URL that the user entered.
This is used in the endpt-recommendation-portal message only.
Fortinet Technologies Inc.
Page 619 FortiOS™ - CLI Reference for FortiOS 5.0
system replacemsg fortiguard-wf
replacemsg fortiguard-wf
Use this command to change the default messages that replace a web pages that FortiGuard web filtering has blocked.
The FortiGate unit sends the FortiGuard Web Filtering replacement messages listed in
web browsers using the HTTP protocol when FortiGuard web filtering blocks a URL, provides details about blocked HTTP 4xx and 5xx errors, and for FortiGuard overrides. FortiGuard Web
Filtering replacement messages are HTTP pages.
If the FortiGate unit supports SSL content scanning and inspection these replacement messages can also replace web pages downloaded using the HTTPS protocol.
By default, these are HTML messages.
Syntax
config system replacemsg fortiguard-wf
set
end set
set
Variable
format <format>
Description
<fortiguard_msg_type> FortiGuard replacement message type. See
buffer <message>
Type a new replacement message to replace the current replacement message. Maximum length 8 192 characters.
Set the format of the message:
Default
No default.
Depends on message type.
No default html text none header <header_type>
Set the format of the message header:
8bit http none
Depends on message type.
Fortinet Technologies Inc.
Page 620 FortiOS™ - CLI Reference for FortiOS 5.0
system replacemsg fortiguard-wf
Table 8: FortiGuard Web Filtering replacement messages
Message name
http-err
Description
ftgd-block
Enable FortiGuard Web Filtering is enabled in a web filter profile for HTTP or
HTTPS, and blocks a web page. The blocked page is replaced with the ftgd-block web page.
ftgd-ovrd
Override selected filtering for a FortiGuard Web Filtering category and
FortiGuard Web Filtering blocks a web page in this category. displays this web page. Using this web page users can authenticate to get access to the page.
Go to UTM > Web Filter > Override to add override rules. For more
information, see “webfilter override” on page 862 .
The
%%OVRD_FORM%% tag provides the form used to initiate an override if
FortiGuard Web Filtering blocks access to a web page. Do not remove this tag from the replacement message.
Provide details for blocked HTTP 4xx and 5xx errors is enabled in a web filter profile for HTTP or HTTPS, and blocks a web page. The blocked page is replaced with the http-err web page.
Fortinet Technologies Inc.
Page 621 FortiOS™ - CLI Reference for FortiOS 5.0
system replacemsg ftp
replacemsg ftp
The FortiGate unit sends the FTP replacement messages to FTP clients when an event occurs such as antivirus blocking a file that contains a virus in an FTP session.
By default, these are text-format messages with no header.
Syntax
config system replacemsg ftp
set
end set
set
Variable
<message-type> buffer <message> format <format>
Description
FTP replacement message type. See
Default
No default.
Type a new replacement message to replace the current replacement message. Maximum length 8 192 characters.
Depends on message type.
Set the format of the message: No default html text none header <header_type> Set the format of the message header:
8bit http none
Depends on message type.
Table 9: FTP replacement messages
Message name Description
explicit-banner
Greeting banner for explicit FTP proxy.
ftp-dl-archive-block
FTP file transfer for DLP archiving was blocked. In DLP archiving, the
DLP engine examines email, FTP, IM, NNTP, and web traffic. When enabled, the FortiGate unit records all occurrences of these traffic types when they are detected by the sensor.
ftp-dl-blocked
Antivirus File Filter enabled for FTP in an antivirus profile blocks a file being downloaded using FTP that matches an entry in the selected file filter list and sends this message to the FTP client. ftp-dl-dlp-ban
In a DLP sensor, a rule with action set to Ban blocks an FTP session and displays this message. This message is displayed whenever the banned user attempts to access until the user is removed from the banned user list.
Fortinet Technologies Inc.
Page 622 FortiOS™ - CLI Reference for FortiOS 5.0
system replacemsg ftp
Replacement messages can include replacement message tags. When users receive the replacement message, the replacement message tag is replaced with content relevant to the message.
Table 10:Replacement message tags
Tag
%%FILE%%
Description
The name of a file that has been removed from a content stream.
This could be a file that contained a virus or was blocked by antivirus file blocking.
%%FILE%% can be used in virus and file block messages.
%%VIRUS%%
The name of a virus that was found in a file by the antivirus system.
%%VIRUS%% can be used in virus messages
%%QUARFILENAME%%
The name of a file that has been removed from a content stream and added to the quarantine. This could be a file that contained a virus or was blocked by antivirus file blocking.
%%QUARFILENAME%% can be used in virus and file block messages. Quarantining is only available on FortiGate units with a local disk.
%%URL%%
The URL of a web page. This can be a web page that is blocked by web filter content or URL blocking.
%%URL%% can also be used in http virus and file block messages to be the URL of the web page from which a user attempted to download a file that is blocked.
%%PROTOCOL%%
The protocol (HTTP, FTP, POP3, IMAP, SMTP) in which a virus was detected.
%%PROTOCOL%% is added to alert email virus messages.
%%SOURCE_IP%%
The IP address from which a virus was received. For email this is the IP address of the email server that sent the email containing the virus. For HTTP this is the IP address of the web page that sent the virus.
%%DEST_IP%%
The IP address of the computer that would have received the blocked file. For email this is the IP address of the user’s computer that attempted to download the message from which the file was removed.
Fortinet Technologies Inc.
Page 623 FortiOS™ - CLI Reference for FortiOS 5.0
system replacemsg http
replacemsg http
Use this command to change default replacement messages added to web pages when the antivirus engine blocks a file in an HTTP session because of a matching file pattern or because a virus is detected; or when web filter blocks a web page.
The FortiGate unit sends the HTTP replacement messages listed to web browsers using the
HTTP protocol when an event occurs such as antivirus blocking a file that contains a virus in an
HTTP session. HTTP replacement messages are HTML pages.
If the FortiGate unit supports SSL content scanning and inspection these replacement messages can also replace web pages downloaded using the HTTPS protocol.
Syntax
config system replacemsg http
set
end set
set
Variable
<message-type> buffer <message>
Description
HTTP replacement message type. See Table 11 .
Type a new replacement message to replace the current replacement message. Maximum length 8 192 characters.
Set the format of the message:
Default
No default.
Depends on message type.
No default format <format> html text none header <header_type> Set the format of the message header:
8bit
Depends on message type.
http none
Table 11:HTTP replacement messages
Message name
bannedword http-archive-block
Description
Web content blocking is enabled in a web filter profile, and blocks a web page being downloaded with an HTTP GET that contains content matching an entry in the selected Web Content Block list. The blocked page is replaced with the bannedword web page.
A transfer contained a blocked DLP archive. In DLP archiving, the DLP engine examines email, FTP, IM, NNTP, and web traffic. When enabled, the FortiGate unit records all occurrences of these traffic types when they are detected by the sensor.
Fortinet Technologies Inc.
Page 624 FortiOS™ - CLI Reference for FortiOS 5.0
system replacemsg http
Table 11:HTTP replacement messages
Message name
http-block
Description
Antivirus File Filter is enabled for HTTP or HTTPS in a web filter profile, and blocks a file being downloaded using an HTTP GET that matches an entry in the selected file filter list. The file is replaced with the httpblock web page that is displayed by the client browser.
The user is not allowed to upload the file.
http-client-archiveblock http-clientbannedword http-client-block http-client-filesize http-contenttypeblock http-dlp-ban http-filesize http-post-block https-invalid-certblock infcache-block url-block
Web content blocking enabled in a web filter profile blocks a web page being uploaded with an HTTP PUT that contains content that matches an entry in the selected Web Content Block list. The client browser displays the http-client-bannedword web page.
Antivirus File Filter is enabled for HTTP or HTTPS in an antivirus profile blocks a file being uploaded by an HTTP POST that matches an entry in the selected file filter list and replaces it with the http-client-block web page that is displayed by the client browser.
Oversized File/Email is set to Block for HTTP or HTTPS and an oversized file that is being uploaded with an HTTP PUT is blocked and replaced with the http-client-filesize web page.
When a specific type of content is not allowed, it is replaced with the http-contenttype-block web page.
In a DLP sensor, a rule with action set to Ban replaces a blocked web page or file with the http-dlp-ban web page.
This web page also replaces any additional web pages or files that the banned user attempts to access until the user is removed from the banned user list.
Antivirus Oversized File/Email is set to Block for HTTP or HTTPS and blocks an oversized file being downloaded using an HTTP GET. The file is replaced with the http-filesize web page that is displayed by the client browser.
HTTP POST Action is set to Block and the FortiGate unit blocks an HTTP
POST and displays the http-post-block web page.
When an invalid security certificate is detected, the https-invalidcert-block page is displayed.
Client comforting is enabled and the FortiGate unit blocks a URL added to the client comforting URL cache. It replaces the blocked URL with the infcache-block web page. For more information about the client comforting URL cache, see
“firewall policy, policy6” on page 167 .
Web URL filtering is enabled and blocks a web page with a URL that matches an entry in the selected URL Filter list. The blocked page is replaced with the url-block web page.
Fortinet Technologies Inc.
Page 625 FortiOS™ - CLI Reference for FortiOS 5.0
system replacemsg http
Replacement messages can include replacement message tags. When users receive the replacement message, the replacement message tag is replaced with content relevant to the message.
Table 12:Replacement message tags
Tag
%%FILE%%
Description
The name of a file that has been removed from a content stream.
This could be a file that contained a virus or was blocked by antivirus file blocking.
%%FILE%% can be used in virus and file block messages.
%%VIRUS%%
The name of a virus that was found in a file by the antivirus system.
%%VIRUS%% can be used in virus messages
%%QUARFILENAME%%
The name of a file that has been removed from a content stream and added to the quarantine. This could be a file that contained a virus or was blocked by antivirus file blocking.
%%QUARFILENAME%% can be used in virus and file block messages. Quarantining is only available on FortiGate units with a local disk.
%%URL%%
The URL of a web page. This can be a web page that is blocked by web filter content or URL blocking.
%%URL%% can also be used in http virus and file block messages to be the URL of the web page from which a user attempted to download a file that is blocked.
%%PROTOCOL%%
The protocol (HTTP, FTP, POP3, IMAP, SMTP) in which a virus was detected.
%%PROTOCOL%% is added to alert email virus messages.
%%SOURCE_IP%%
%%DEST_IP%%
The IP address of the web page from which a virus was received.
The IP address of the computer that would have received the blocked file. For email this is the IP address of the user’s computer that attempted to download the message from which the file was removed.
Fortinet Technologies Inc.
Page 626 FortiOS™ - CLI Reference for FortiOS 5.0
system replacemsg im
replacemsg im
Use this command to change default replacement messages added to instant messaging and peer-to-peer sessions when either file-transfer or voice-chat is blocked.
By default, these are text messages with an 8-bit header.
Syntax
config system replacemsg im
set
end set
set
Variable
<message-type> buffer <message> format <format>
Description
im replacement message type. See
.
Type a new replacement message to replace the current replacement message. Maximum length 8 192 characters.
Set the format of the message: html text
Default
No default.
Depends on message type.
No default none header <header_type> Set the format of the message header:
8bit http none
Depends on message type.
Table 13:Instant messaging (IM) and peer to peer (P2P) message types
Message name
im-dlp
Description
In a DLP sensor, a rule with action set to Block replaces a blocked IM or P2P message with this message.
im-dlp-ban
In a DLP sensor, a rule with action set to Ban replaces a blocked IM or P2P message with this message. This message also replaces any additional messages that the banned user sends until they are removed from the banned user list.
im-file-xfer-block
Antivirus File Filter enabled for IM deletes a file that matches an entry in the selected file filter list and replaces it with this message. im-file-xfer-infected Antivirus Virus Scan enabled for IM deletes an infected file from and replaces the file with this message. im-file-xfer-name
Antivirus File Filter enabled for IM deletes a file with a name that matches an entry in the selected file filter list and replaces it with this message.
Fortinet Technologies Inc.
Page 627 FortiOS™ - CLI Reference for FortiOS 5.0
system replacemsg im
Table 13:Instant messaging (IM) and peer to peer (P2P) message types
Message name
im-file-xfer-size
Description
Antivirus Oversized File/Email set to Block for IM removes an oversized file and replaces the file with this message.
im-long-chat-block im-photo-share-block im-voice-chat-block
In an Application Control list, the block-long-chat CLI field is enabled for AIM, ICQ, MSN, or Yahoo. You enable blocking oversized chat messages from the CLI.
In an Application Control list, the block-photo CLI field is enabled for MSN, or Yahoo. You enable photo blocking from the CLI.
In an Application Control list, the Block Audio option is selected for AIM, ICQ, MSN, or Yahoo!. im-video-chat-block
In an Application Control list, the block-video CLI field is enabled for MSN. You enable video chat blocking from the CLI.
Replacement messages can include replacement message tags. When users receive the replacement message, the replacement message tag is replaced with content relevant to the message.
Table 14:Replacement message tags
Tag
%%FILE%%
Description
The name of a file that has been removed from a content stream.
This could be a file that contained a virus or was blocked by antivirus file blocking.
%%FILE%% can be used in virus and file block messages.
%%VIRUS%%
The name of a virus that was found in a file by the antivirus system.
%%VIRUS%% can be used in virus messages
%%QUARFILENAME%%
The name of a file that has been removed from a content stream and added to the quarantine. This could be a file that contained a virus or was blocked by antivirus file blocking.
%%QUARFILENAME%% can be used in virus and file block messages. Quarantining is only available on FortiGate units with a local disk.
%%PROTOCOL%%
The protocol (HTTP, FTP, POP3, IMAP, SMTP) in which a virus was detected.
%%PROTOCOL%% is added to alert email virus messages.
%%SOURCE_IP%%
The IP address from which a virus was received. For email this is the IP address of the email server that sent the email containing the virus. For HTTP this is the IP address of the web page that sent the virus.
%%DEST_IP%%
The IP address of the computer that would have received the blocked file. For email this is the IP address of the user’s computer that attempted to download the message from which the file was removed.
Fortinet Technologies Inc.
Page 628 FortiOS™ - CLI Reference for FortiOS 5.0
system replacemsg mail
replacemsg mail
Use this command to change default replacement messages added to email messages when the antivirus engine blocks a file either because of a matching file pattern or because a virus is detected; or when spam filter blocks an email.
By default, these are text messages with an 8-bit header.
Syntax
config system replacemsg mail
set
end set
set
Variable
<message-type> buffer <message> format <format>
Description
mail replacement message type. See
.
Type a new replacement message to replace the current replacement message. Maximum length 8 192 characters.
Set the format of the message:
Default
No default.
Depends on message type.
No default html text none header <header_type> Set the format of the message header:
8bit http none
Depends on message type.
Table 15:mail message types
Message name
email-block
Description
The antivirus File Filter is enabled for an email protocol deletes a file that matches an entry in the selected file filter list. The file is blocked and the email is replaced with the email-block message. email-dlp-ban
In a DLP sensor, a rule with action set to Ban replaces a blocked email message with this message. This message also replaces any additional email messages that the banned user sends until they are removed from the banned user list. email-dl-ban-sender
In a DLP sensor, a rule with action set to Ban Sender replaces a blocked email message with this message. The email-dlp-ban message also replaces any additional email messages that the banned user sends until the user is removed from the banned user list.
Fortinet Technologies Inc.
Page 629 FortiOS™ - CLI Reference for FortiOS 5.0
system replacemsg mail
Table 15:mail message types
Message name
email-dlp-subject
The email-dlp-subject message is added to the subject field of all email messages replaced by the DLP sensor Block,
Ban, Ban Sender, Quarantine IP address, and Quarantine
interface actions.
email-filesize
Description
partial
When the antivirus Oversized File/Email is set to Block for an email protocol removes an oversized file from an email message, the file is replaced with the email-filesize message.
Antivirus Pass Fragmented Emails is not enabled so a fragmented email is blocked. The partial message replaces the first fragment of the fragmented email.
smtp-block smtp-filesize
Splice mode is enabled and the antivirus file filter deleted a file from an SMTP email message. The FortiGate unit aborts the
SMTP session and returns a 554 SMTP error message to the sender that includes the smtp-block replacement message.
Splice mode is enabled and antivirus Oversized File/Email is set to Block. When the FortiGate unit blocks an oversize SMTP email message, the FortiGate unit aborts the SMTP session and returns a 554 SMTP error message to the sender that includes the smtpfilesize replacement message.
Replacement messages can include replacement message tags. When users receive the replacement message, the replacement message tag is replaced with content relevant to the message.
Table 16:Replacement message tags
Tag
%%FILE%%
Description
%%VIRUS%%
The name of a virus that was found in a file by the antivirus system.
%%VIRUS%% can be used in virus messages
%%QUARFILENAME%%
The name of a file that has been removed from a content stream and added to the quarantine. This could be a file that contained a virus or was blocked by antivirus file blocking.
%%QUARFILENAME%% can be used in virus and file block messages. Quarantining is only available on FortiGate units with a local disk.
%%PROTOCOL%%
The name of a file that has been removed from a content stream.
This could be a file that contained a virus or was blocked by antivirus file blocking.
%%FILE%% can be used in virus and file block messages.
%%SOURCE_IP%%
The protocol (HTTP, FTP, POP3, IMAP, SMTP) in which a virus was detected.
%%PROTOCOL%% is added to alert email virus messages.
IP address of the email server that sent the email containing the virus.
%%DEST_IP%%
IP address of the user’s computer that attempted to download the message from which the file was removed.
Fortinet Technologies Inc.
Page 630 FortiOS™ - CLI Reference for FortiOS 5.0
system replacemsg mail
Table 16:Replacement message tags
Tag
%%EMAIL_FROM%%
%%EMAIL_TO%%
Description
The email address of the sender of the message from which the file was removed.
The email address of the intended receiver of the message from which the file was removed.
Fortinet Technologies Inc.
Page 631 FortiOS™ - CLI Reference for FortiOS 5.0
system replacemsg mm1
replacemsg mm1
Use this command to change default replacement messages added to messages sent by
FortiOS Carrier on the MM1 network when the antivirus engine blocks a file either because of a matching file pattern or because a virus is detected; or when spam filter blocks an email.
Syntax
config system replacemsg mm1
set
set
set
set
set
set
from-sender {enable | disable}
set
set
set
set
set
end set
set
sender-visibility <sender_vis>
set
set
Variable
<message_type>
Description
MM1 replacement message types, one of: mm1-retr-conf-block mm1-retr-conf-bword mm1-retr-conf-sis-block mm1-retr-conf-virus mm1-send-conf-block mm1-send-conf-bword mm1-send-conf-sis-block mm1-send-conf-virus mm1-send-req-block mm1-send-req-bword mm1-send-req-sis-block mm1-send-req-virus
Default
No default.
Fortinet Technologies Inc.
Page 632 FortiOS™ - CLI Reference for FortiOS 5.0
system replacemsg mm1
add-smil
{enable | disable} charset
<character_set> class <class> format <format> from
<from_address> from-sender
{enable | disable} header
<header_type>
Enable to add SMIL content to the message. SMIL content can include images.
This field is available for the following message types: mm1-send-req-block us-ascii utf-8
The message can be classified as one of: disable mm1-send-req-bword mm1-send-req-sis-block mm1-send-req-virus
Character encoding used for replacement message, one of: utf-8 automatic advertisement automatic informational not-included personal
Set the format of the message, one of: text html none text wml
Not all formats are supported by all message types.
Address the message is from.
null image <string> message
<message_text>
Enable for the notification message to be sent from the recipient. This is to avoid billing problems.
Set the format of the message header, one of:
8bit http none
Enter the name of the image to include in the SMIL message part. Using ‘?’ will show the list of available image names.
This is only available when add-smil is enabled.
Text of the replacement message.
disable http
Depends on message type.
Fortinet Technologies Inc.
Page 633 FortiOS™ - CLI Reference for FortiOS 5.0
system replacemsg mm1
normal priority <priority>
Priority of the message, one of: high rsp-status
<rsp_status> low normal not included
Response status code, one of: err-content-not-accepted err-msg-fmt-corrupt err-msg-not-found err-net-prob err-snd-addr-unresolv err-srv-denied err-unspecified err-unsupp-msg ok
Response text.
rsp-text
<response_text> sender-visibility
<sender_vis>
Sender visibility, one of: hide not-specified show smil-part <string>
Enter the SMIL part of the replacement message. subject
<subject_text>
Subject text string.
err-content-notaccepted
Depends on message type.
not-specified
Depends on message type.
Fortinet Technologies Inc.
Page 634 FortiOS™ - CLI Reference for FortiOS 5.0
system replacemsg mm3
replacemsg mm3
Use this command to change default replacement messages added to messages sent by
FortiOS Carrier on the MM3 network when the antivirus engine blocks a file either because of a matching file pattern or because a virus is detected; or when spam filter blocks an email.
Syntax
config system replacemsg mm3
set
set
set
end set
set
set
set
Variable
<message_type>
Description
MM3 replacement message types, one of: mm3-block mm3-block-notif mm3-bword mm3-bword-notif mm3-sis-block mm3-sis-block-notif
Default
No default.
mm3-sis-block-notif mm3-virus mm3-virus-block charset <character_set> Character encoding used for replacement messages, one of: utf-8 format <format> us-ascii utf-8
Replacement message format flag, one of: html none text text wml from <from_address>
Address the message is from.
header <header_type>
Set the format of the message header, one of:
8bit http none null none
Fortinet Technologies Inc.
Page 635 FortiOS™ - CLI Reference for FortiOS 5.0
system
message
<message_text> priority <priority>
Text of the replacement message.
Priority of the message, one of: high low normal not included subject <subject_text>
Subject text string.
replacemsg mm3
Depends on message type.
normal
Depends on message type.
Fortinet Technologies Inc.
Page 636 FortiOS™ - CLI Reference for FortiOS 5.0
system replacemsg mm4
replacemsg mm4
Use this command to change default replacement messages added to messages sent by
FortiOS Carrier on the MM4 network when the antivirus engine blocks a file either because of a matching file pattern or because a virus is detected; or when spam filter blocks an email.
Syntax
config system replacemsg mm4
set
set
set
set
set
set
from-sender {enable | disable}
set
set
set
set
set
end set
set
Variable Description
<message_type>
MM4 replacement message types, one of: mm4-block mm4-block-notif mm4-bword mm4-bword-notif mm4-sis-block add-smil
{enable | disable} charset
<character_set> mm4-sis-block-notif mm4-virus mm4-virus-block
Enable to add SMIL content to the message. SMIL content can include images.
This field is available for the following message types: mm4-block-notif mm4-bword-notif mm4-sis-block-notif
Character encoding used for replacement messages: us-ascii or utf-8.
Default
No default.
disable utf-8
Fortinet Technologies Inc.
Page 637 FortiOS™ - CLI Reference for FortiOS 5.0
system replacemsg mm4
class <class>
The message can be classified as one of: advertisement automatic informational not-included personal domain
<address_domain>
The from address domain.
format <format>
Replacement message format flag, one of: html none text automatic null text from
<from_address> from-sender
{enable | disable} header
<header_type> image <string> wml
Address the message is from.
Enable for the notification message to be sent from the recipient. This is to avoid billing problems.
Enter the name of the image to include in the SMIL message part. Using ‘?’ will show the list of available image names.
This is only available when add-smil is enabled.
message
<message_text>
Text of the replacement message.
priority <priority> Priority of the message, one of: high null disable
Set the format of the message header: 8bit, http, or none.
none
Depends on message type.
normal rsp-status
<rsp_status> low normal not included
Response status codes, one of: err-content-notaccepted err-content-not-accepted err-msg-fmt-corrupt err-net-prob err-snd-addr-unresolv err-srv-denied err-unspecified err-unsupp-msg ok smil-part <string> Enter the SMIL part of the replacement message. subject
<subject_text>
Subject text string.
Depends on message type.
Fortinet Technologies Inc.
Page 638 FortiOS™ - CLI Reference for FortiOS 5.0
system replacemsg mm7
replacemsg mm7
Use this command to change default replacement messages added to messages sent by
FortiOS Carrier on the MM7 network when the antivirus engine blocks a file either because of a matching file pattern or because a virus is detected; or when spam filter blocks an email.
Syntax
config system replacemsg mm7
set
set
set
set
set
set
set
from-sender {enable | disable}
set
set
set
set
set
set
end set
Variable Description
<mm7message_type> MM7 replacement message types, one of: mm7-block mm7-block-notif mm7-bword mm7-bword-notif mm7-sis-block add-smil
{enable | disable} addr_type
<addr_type> mm7-sis-block-notif mm7-virus mm7-virus-block
Enable to add SMIL content to the message. SMIL content can include images.
This field is available for the following message types: mm7-block-notif mm7-bword-notif mm7-sis-block-notif
From address types, one of: number rfc2882-addr short-code
Default
No default.
disable number
Fortinet Technologies Inc.
Page 639 FortiOS™ - CLI Reference for FortiOS 5.0
system replacemsg mm7
charset
<character_set> class <class>
Character encoding used for replacement messages, one of: us-ascii utf-8
The message can be classified as one of: advertisement automatic utf-8 automatic informational not-included personal
Replacement message format flag, one of: format <format> text image <string> html none text wml from <from_address> Address the message is from.
from-sender
{enable | disable}
Enable for the notification message to be sent from the recipient. This is to avoid billing problems. header <header_type> Set the format of the message header, one of: null disable none
8bit http none
Enter the name of the image to include in the SMIL message part. Using ‘?’ will show the list of available image names.
This is only available when add-smil is enabled.
Text of the replacement message.
message
<message_text> priority <priority>
Depends on message type.
normal
Priority of the message, one of: high low normal not included
Fortinet Technologies Inc.
Page 640 FortiOS™ - CLI Reference for FortiOS 5.0
system
rsp-status
<rsp_status> smil-part <string> subject
<subject_text>
Response status codes, one of: addr-err addr-not-found app-addr-not-supp app-denied app-id-not-found client-err content-refused gen-service-err improper-ident link-id-not-found msg-fmt-corrupt msg-id-not-found msg-rejected multiple-addr-not-supp not-possible oper-restrict partial-success repl-app-id-not-found service-denied service-err service-unavail srv-err success unsupp-oper unsupp-ver validation-err
Enter the SMIL part of the replacement message.
Subject text string.
replacemsg mm7
Depends on message type.
Depends on message type.
Fortinet Technologies Inc.
Page 641 FortiOS™ - CLI Reference for FortiOS 5.0
system replacemsg-group
replacemsg-group
Use this command to define replacement messages for your VDOM, overriding the corresponding global replacement messages.
Syntax
To create a VDOM-specific replacement message: config system replacemsg-group edit default
edit
end set
end set
set
To remove a VDOM-specific replacement message, restoring the global replacement message: config system replacemsg-group edit default
delete
end
Variable
buffer <message>
Description Default
Type a new replacement message to replace the current replacement message. Maximum length
8 192 characters.
Depends on message type.
comment <comment_str>
Optionally, enter a descriptive comment.
format <format>
Set the format of the message:
No default
No default html header <header_type> text none
Set the format of the message header: Depends on message type.
8bit http none
Fortinet Technologies Inc.
Page 642 FortiOS™ - CLI Reference for FortiOS 5.0
system
Variable
<msg_category>
<msg_type>
replacemsg-group
Description Default
The category of replacement message. This corresponds to the field following replacemsg in the global system replacemsg command.
For example, the http category includes the messages defined globally in the system replacemsg http command.
The message type. This corresponds to the final field in the global system replacemsg command. For example, to create a new login message for your SSL VPN, you would set
<msg_category> to sslvpn and <msg_type> to sslvpn-login.
No default
No default
Fortinet Technologies Inc.
Page 643 FortiOS™ - CLI Reference for FortiOS 5.0
system replacemsg-group
replacemsg-group
Replacement messages can be created and applied to specific profile groups. This allows the customization of messages for specific users or user groups.
If a user is not part of a custom replacement message group, their replacement messages come from the ‘default’ group. The ‘default’ group always exists, and cannot be deleted. All additional replacement message groups inherit from the default group. Any messages in custom groups that have not been modified, inherit any changes to those messages in the default group.
The only replacement messages that can not be customized in groups are administration related messages, which in the following categories:
• Alert Mail
• Administration
• Authentication
• IM and P2P
• SSL VPN
Except for mm1, mm3, mm4, mm7 which use the message field, all replacement message types use the buffer field to refer to the body of the message.
Syntax
config system replacemsg-group
edit <groupname_string> set comment <string>
| mm3 | mm4 | mm7 | nntp | spam} edit <msgkey_integer>
set
set
set
end set
set
end
Variable Description
edit <groupname_string>
Create or edit a replacement message group.
Use a groupname of default to configure per-vdom replacement messages. Only valid when VDOMs are enabled.
comment <string>
Enter a descriptive comment for this replacement message group.
Default
Fortinet Technologies Inc.
Page 644 FortiOS™ - CLI Reference for FortiOS 5.0
system replacemsg-group
Variable
group-type {auth
| captive-portal | ec | utm}
Description
Enter the type of replacement message group this is.
auth — for use with authentication pages in firewall policies
captive-portal — for use with captive-portal configurations
ec — for use with endpoint-control profiles
utm — for use with UTM settings in firewall policies default — used to configure per-vdom replacement messages, only available when group name is set to default config {auth | ec
| fortiguard-wf | ftp | http
| mail | mm1 | mm3 | mm4
| mm7 | nntp | spam}
Select a replacement message type to add or edit.
These types or protocols, match with the existing replacemsg commands, and determine which msgtypes are available.
For more information on these replacement message types see: edit <msgkey_integer>
•
“system replacemsg auth” on page 613
•
“system replacemsg ec” on page 618
•
“replacemsg fortiguard-wf” on page 620
•
•
•
•
•
•
•
•
•
Note: mm1,mm3,mm4,and mm7 are FortiOS Carrier only.
Create or edit a message entry in the table. Enter the key of the entry. msg-type <type>
Using ‘?’ will show you the existing message type as well as the msgkey entries in the table.
Select the message type for this message entry. Valid message types vary according to which replacement message table you are editing.
For a list of valid message types for this table, refer to the CLI replacemsg command of the same name.
Default
utm
Fortinet Technologies Inc.
Page 645 FortiOS™ - CLI Reference for FortiOS 5.0
system
Variable
buffer <string> header <header_flag> format <format_flag> message <string>
replacemsg-group
Description
Enter the replacement message for this message type.
Enclose the message in quotes.
Default
This field is used with the following replacement messages: fortiguard-wf ftp http mail nntp spam
Other replacement messages use the message field.
Select the header for this message. Valid types include:
8bit http none
Select the format of this message. Valid formats include: html none text wml (FortiOS Carrier only)
Enter the replacement message for this message type.
Enclose the message in quotes.
This field is used with the following replacement messages: mm1 (FortiOS Carrier only) mm3 (FortiOS Carrier only) mm4 (FortiOS Carrier only) mm7 (FortiOS Carrier only)
Other replacement messages use the
buffer field.
Fortinet Technologies Inc.
Page 646 FortiOS™ - CLI Reference for FortiOS 5.0
system replacemsg-image
replacemsg-image
Use this command to add, edit, or delete images to be used in HTTP replacement messages and for the SMIL parts of FortiOS Carrier replacement messages. Both image-base64 and image-type must be present for a valid entry.
Syntax
config system replacemsg-image
end
set image-base64 <image_data> set image-type <format>
Variable
image-type <format>
Description
edit <image_name>
Enter the name or tag to use for this image image-base64 <image_data>
Enter the image in base64 encoding. You can also use the graphical interface to add images by browsing to their location.
Select the format of the image. Available formats include:
Default
none.
none.
none.
gif jpeg png tiff
Fortinet Technologies Inc.
Page 647 FortiOS™ - CLI Reference for FortiOS 5.0
system replacemsg nac-quar
replacemsg nac-quar
Use this command to change the NAC quarantine pages for data leak (DLP), denial of service
(DoS), IPS, and virus detected.
These are HTML messages with HTTP headers.
Syntax
config system replacemsg nac-quar
set
end set
set
Variable
nac-quar_msg_type buffer <message> format <format>
Description
Replacement message type. See
Type a new replacement message to replace the current replacement message. Maximum length 8 192 characters.
Set the format of the message: html text
Default
No default
Depends on message type.
No default none header <header_type> Set the format of the message header:
8bit http none
Depends on message type.
Table 17:nac-quar message types
Message name Description
nac-quar-dlp Action set to Quarantine IP address or Quarantine Interface in a DLP sensor and the DLP sensor adds a source IP address or a FortiGate interface to the banned user list. The FortiGate unit displays this replacement message as a web page when the blocked user attempts to connect through the
FortiGate unit using HTTP on port 80 or when any user attempts to connect through a FortiGate interface added to the banned user list using HTTP on port 80.
nac-quar-dos For a DoS Sensor the CLI quarantine option set to attacker or interface and the DoS Sensor added to a DoS firewall policy adds a source IP, a destination IP, or FortiGate interface to the banned user list.
The FortiGate unit displays this replacement message as a web page when the blocked user attempts to connect through the FortiGate unit using
HTTP on port 80 or when any user attempts to connect through a FortiGate interface added to the banned user list using HTTP on port 80. This replacement message is not displayed if quarantine is set to both.
Fortinet Technologies Inc.
Page 648 FortiOS™ - CLI Reference for FortiOS 5.0
system replacemsg nac-quar
Table 17:nac-quar message types
Message name Description
nac-quar-ips Quarantine Attackers enabled in an IPS sensor filter or override and the IPS sensor adds a source IP address, a destination IP address, or a FortiGate interface to the banned user list. The FortiGate unit displays this replacement message as a web page when the blocked user attempts to connect through the FortiGate unit using HTTP on port 80 or when any user attempts to connect through a FortiGate interface added to the banned user list using HTTP on port 80. This replacement message is not displayed if method is set to Attacker and Victim IP Address.
nac-quarvirus
Antivirus Quarantine Virus Sender adds a source IP address or FortiGate interface to the banned user list. The FortiGate unit displays this replacement message as a web page when the blocked user attempts to connect through the FortiGate unit using HTTP on port 80 or when any user attempts to connect through a FortiGate interface added to the banned user list using HTTP on port 80.
Fortinet Technologies Inc.
Page 649 FortiOS™ - CLI Reference for FortiOS 5.0
system replacemsg nntp
replacemsg nntp
Use this command to change the net news transfer protocol (NNTP) download pages.
These are HTML messages with HTTP headers.
Syntax
config system replacemsg nntp
set
end set
set
Variable
auth_msg_type buffer <message> format <format>
Description
FortiGuard replacement alertmail message type. See
No default
Type a new replacement message to replace the current replacement message. Maximum length
8 192 characters.
Set the format of the message:
Default
Depends on message type.
No default html text none header <header_type> Set the format of the message header:
8bit http none
Depends on message type.
Table 18:net news transfer protocol (NNTP) message types
Message name Description
nntp-dl-blocked
Antivirus File Filter is enabled for NNTP blocks a file attached to an
NNTP message that matches an entry in the selected file filter list. The
FortiGate unit sends the nntp-dl-blocked message to the FTP client. nntp-dl-filesize Antivirus Oversized File/Email is set to Block for NNTP. The FortiGate unit removes an oversized file from an NNTP message and replaces the file with the nntp-dl-filesize message.
nntp-dlp-ban
In a DLP sensor, a rule with action set to Ban replaces a blocked NNTP message with this message. The nntp-dlp-ban message also replaces any additional NNTP messages that the banned user sends until they are removed from the banned user list. nntp-dlp-subject
The nntp-dlp-subject message is added to the subject field of all
NNTP messages replaced by the DLP sensor Block, Ban, Quarantine IP
address, and Quarantine interface actions.
Fortinet Technologies Inc.
Page 650 FortiOS™ - CLI Reference for FortiOS 5.0
system replacemsg nntp
Replacement messages can include replacement message tags. When users receive the replacement message, the replacement message tag is replaced with content relevant to the message.
Table 19:Replacement message tags
Tag
%%FILE%%
%%QUARFILENAME%%
%%VIRUS%%
Description
The name of a file that has been removed from a content stream. This could be a file that contained a virus or was blocked by antivirus file blocking. The file may have been quarantined if a virus was detected.
%%FILE%% can be used in virus and file block messages.
The name of a file that has been removed from a content stream and added to the quarantine. This could be a file that contained a virus or was blocked by antivirus file blocking.
%%QUARFILENAME%% can be used in virus and file block messages. Quarantining is only available on FortiGate units with a local disk.
The name of a virus that was found in a file by the antivirus system.
%%VIRUS%% can be used in virus messages
Fortinet Technologies Inc.
Page 651 FortiOS™ - CLI Reference for FortiOS 5.0
system replacemsg spam
replacemsg spam
The FortiGate unit adds the Spam replacement messages listed in
responses if the email message is identified as spam and the spam action is discard. If the
FortiGate unit supports SSL content scanning and inspection these replacement messages can also be added to SMTPS server responses.
By default, these are text messages with an 8-bit header.
Syntax
config system replacemsg spam
set
end set
set
Variable
<message-type> buffer <message> format <format>
Description
Spam replacement message type. See html
Default
No default.
Type a new replacement message to replace the current replacement message. Maximum length 8 192 characters.
Depends on message type.
Set the format of the message, one of: text text none header <header_type>
Set the format of the message header, one of:
8bit http none
8bit
Table 20:spam message types
Message name
ipblocklist reversedns smtp-spam-ase
Description
Spam Filtering IP address BWL check enabled for an email protocol identifies an email message as spam and adds this replacement message.
Spam Filtering Return e-mail DNS check enabled for an email protocol identifies an email message as spam and adds this replacement message.
The FortiGuard Antispam Engine (ASE) reports this message as spam.
smtp-spambannedword
Spam Filtering Banned word check enabled for an email protocol identifies an email message as spam and adds this replacement message.
Fortinet Technologies Inc.
Page 652 FortiOS™ - CLI Reference for FortiOS 5.0
system replacemsg spam
Table 20:spam message types
Message name
smtp-spam-dnsbl smtp-spam-emailblack smtp-spam-feip
Description
From the CLI, spamrbl enabled for an email protocol identifies an email message as spam and adds this replacement message.
The spam filter email address blacklist marked an email as spam.
The smtp-spam-emailblack replaces the email.
FortiGuard Antispam IP address checking identifies an email message as spam and adds this replacement message to the server response. smtp-spam-helo smtp-spammimeheader submit
Spam Filtering HELO DNS lookup enabled for SMTP identifies an email message as spam and adds this replacement message.
HELO DNS lookup is not available for SMTPS.
From the CLI, spamhdrcheck enabled for an email protocol identifies an email message as spam and adds this replacement message.
Any Spam Filtering option enabled for an email protocol identifies an email message as spam and adds this replacement message.
Spam Filtering adds this message to all email tagged as spam.
The message describes a button that the recipient of the message can select to submit the email signatures to the FortiGuard
Antispam service if the email was incorrectly tagged as spam (a false positive).
Table 21:Replacement messages can include replacement message tags. When users receive the replacement message, the replacement message tag is replaced with content relevant to the message.
Table 22:Replacement message tags
Tag Description
%%QUARFILENAME%%
The name of a file that has been removed from a content stream and added to the quarantine. This could be a file that contained a virus or was blocked by antivirus file blocking.
%%QUARFILENAME%% can be used in virus and file block messages. Quarantining is only available on FortiGate units with a local disk.
%%SOURCE_IP%%
The IP address from which a virus was received. For email this is the IP address of the email server that sent the email containing the virus. For HTTP this is the IP address of the web page that sent the virus.
%%DEST_IP%%
The IP address of the computer that would have received the blocked file. For email this is the IP address of the user’s computer that attempted to download the message from which the file was removed.
Fortinet Technologies Inc.
Page 653 FortiOS™ - CLI Reference for FortiOS 5.0
system replacemsg spam
Table 22:Replacement message tags
Tag
%%EMAIL_FROM%%
%%EMAIL_TO%%
Description
The email address of the sender of the message from which the file was removed.
The email address of the intended receiver of the message from which the file was removed.
Fortinet Technologies Inc.
Page 654 FortiOS™ - CLI Reference for FortiOS 5.0
system replacemsg sslvpn
replacemsg sslvpn
The SSL VPN login replacement messages are HTML replacement messages.
The sslvpn-logon message formats the FortiGate SSL VPN portal login page.
The sslvpn-limit message formats the web page that appears if a user attempts to log into
SSL VPN more than once.
You can customize these replacement messages according to your organization’s needs. The pages are linked to FortiGate functionality and you must construct them according to the following guidelines to ensure that it will work.
These are HTML messages with HTTP headers.
Syntax
config system replacemsg sslvpn {sslvpn-limit | sslvpn-logon} set
end set
set
Variable
buffer <message> format <format>
Description
Type a new replacement message to replace the current replacement message. Maximum length
8 192 characters.
Set the format of the message:
Default
Depends on message type.
No default html text none header <header_type> Set the format of the message header:
8bit http none
Depends on message type.
Replacement messages can include replacement message tags. When users receive the replacement message, the replacement message tag is replaced with content relevant to the message.
Fortinet Technologies Inc.
Page 655 FortiOS™ - CLI Reference for FortiOS 5.0
system replacemsg traffic-quota
replacemsg traffic-quota
When user traffic through the FortiGate unit is blocked by traffic shaper quota controls, users see the Traffic shaper block message or the Per IP traffic shaper block message when they attempt to connect through the FortiGate unit using HTTP.
This is an HTML message with an HTTP header.
Syntax
config system replacemsg traffic-quota {per-ip-shaper-block | traffic-shaper-block} set
set
end set
Variable
buffer <message> format <format>
Description
Type a new replacement message to replace the current replacement message. Maximum length
8 192 characters.
Set the format of the message:
Default
Depends on message type.
No default html text none header <header_type>
Set the format of the message header:
8bit http none
Depends on message type.
Replacement messages can include replacement message tags. When users receive the replacement message, the replacement message tag is replaced with content relevant to the message.
Requirements for traffic quota pages
The traffic quota HTTP pages should contain the
%%QUOTA_INFO%% tag to display information about the traffic shaping quota setting that is blocking the user.
Fortinet Technologies Inc.
Page 656 FortiOS™ - CLI Reference for FortiOS 5.0
system replacemsg utm
replacemsg utm
When data leaks or viruses are detected, these messages are substituted for the blocked item.
Syntax
config system replacemsg utm <message_type> set
end set
set
Variable
buffer <message> format <format>
Description
Type a new replacement message to replace the current replacement message. Maximum length
8 192 characters.
Set the format of the message: html text none header <header_type> Set the format of the message header:
8bit http none
Default
Depends on message type.
No default
Depends on message type.
Message Type
dlp-text dlp-html virus-html virus-text
Description
An email message is blocked because it appears to contain a data leak.
An HTTP transfer is blocked because it appears to contain a data leak.
A virus was detected in a file being downloaded using an HTTP GET.
A virus was detected in a file attachment. The file was removed.
Table 23:Replacement message tags
Tag
%%FILE%%
%%VIRUS%%
Description
The name of a file that has been removed from a content stream.
This could be a file that contained a virus or was blocked by antivirus file blocking.
%%FILE%% can be used in virus and file block messages.
The name of a virus that was found in a file by the antivirus system.
%%VIRUS%% can be used in virus messages
Fortinet Technologies Inc.
Page 657 FortiOS™ - CLI Reference for FortiOS 5.0
system replacemsg utm
Table 23:Replacement message tags
Tag
%%QUARFILENAME%%
The name of a file that has been removed from a content stream and added to the quarantine. This could be a file that contained a virus or was blocked by antivirus file blocking.
%%QUARFILENAME%% can be used in virus and file block messages. Quarantining is only available on FortiGate units with a local disk.
%%PROTOCOL%%
Description
The protocol (HTTP, FTP, POP3, IMAP, SMTP) in which a virus was detected.
%%PROTOCOL%% is added to alert email virus messages.
Fortinet Technologies Inc.
Page 658 FortiOS™ - CLI Reference for FortiOS 5.0
system replacemsg webproxy
replacemsg webproxy
The web proxy returns messages for user authentication failures and HTTP errors.
Syntax
config system replacemsg webproxy {auth-authorization | authchallenge | auth-login | deny | http-err | user-limit} set
set
set
Variable
buffer <message> format <format>
Description
Type a new replacement message to replace the current replacement message. Maximum length
8 192 characters.
Set the format of the message:
Default
Depends on message type.
html html text none header <header_type>
Set the format of the message header:
8bit http none http
The http-err replacement message requires the following tags:
Table 24:Web proxy http-err replacement message tags
Tag Description
%%HTTP_ERR_CODE%%
The returned HTTP error code, “404” for example.
%%HTTP_ERR_DESC%%
The returned HTTP error message, “Not Found” for example.
%%PROTOCOL%%
%%URL%%
The protocol that applies to the traffic, “http://” for example.
The URL (not including protocol) that caused the error.
Fortinet Technologies Inc.
Page 659 FortiOS™ - CLI Reference for FortiOS 5.0
system resource-limits
resource-limits
Use this command to configure resource limits that will apply to all VDOMs. When you set a global resource limit, you cannot exceed that resource limit in any VDOM. For example, enter the following command to limit all VDOMS to 100 VPN IPSec Phase 1 Tunnels: config global config system resource-limits end end set ipsec-phase1 100
With this global limit set you can only add a maximum of 100 VPN IPSec Phase 1 Tunnels to any
VDOM.
You can also edit the resource limits for individual VDOMs to further limit the number of resources that you can add to individual VDOMs. See
“system vdom-property” on page 698 .
A resource limit of 0 means no limit. No limit means the resource is not being limited by the resource limit configuration. Instead the resource is being limited by other factors. The FortiGate unit limits dynamic resources by the capacity of the FortiGate unit and can vary depending on how busy the system is. Limits for static resources are set by limitations in the FortiGate configuration as documented in the
FortiGate Maximum Values Matrix
document.
The default maximum value for each resource depends on the FortiGate model. Dynamic resources (Sessions, Dial-up Tunnels, and SSL VPN) do not have default maximums so the default maximum for dynamic resources is always 0 (meaning unlimited). Static resources may have a limit set or many be set to 0 meaning they are limited by the resource limit configuration.
If you set the maximum resource usage for a VDOM you cannot reduce the default maximum global limit for all VDOMs below this maximum.
This command is available only when VDOMs are enabled.
Syntax
config global config system resource-limits
Fortinet Technologies Inc.
Page 660 FortiOS™ - CLI Reference for FortiOS 5.0
system resource-limits
end end
set user <max_int> set user-group <max_int>
Variable
custom-service
<max_int>
Enter the maximum number of firewall custom services.
dialup-tunnel <max_int> Enter the maximum number of dialup-tunnels.
firewall-address
<max_int> firewall-addrgrp
<max_int>
Enter the maximum number of firewall addresses.
Enter the maximum number of firewall address groups.
firewall-policy
<max_int> log-disk-quota
<max_int>
Enter the maximum number of firewall policies.
ipsec-phase1 <max_int> Enter the maximum number of IPSec phase1 tunnels.
ipsec-phase2 <max_int> Enter the maximum number of IPSec phase2 tunnels.
Enter the maximum amount of log disk space available in
MBytes for global log messages. The range depends on the amount of hard disk space available.
onetime-schedule
<max_int> proxy <max_int>
Description
Enter the maximum number of onetime schedules.
Enter the maximum number of users that can be using the explicit proxy at one time.
Default
How the number of concurrent explicit proxy users is determined depends on their authentication method:
• For session-based authenticated users, each authenticated user is counted as a single user. Since multiple users can have the same user name, the proxy attempts to identify users according to their authentication membership (based upon whether they were authenticated using RADIUS, LADAP, FSSO, local database etc.). If a user of one session has the same name and membership as a user of another session, the explicit proxy assumes this is one user.
• For IP Based authentication, or no authentication, or if no explicit proxy security policy has been added, the source IP address is used to determine a user. All sessions from a single source address are assumed to be from the same user.
recurring-schedule
<max_int>
Enter the maximum number of recurring schedules.
service-group <max_int> Enter the maximum number of firewall service groups.
session <max_int>
Enter the maximum number of sessions.
sslvpn <max_int> user <max_int>
Enter the maximum number of sessions.
Enter the maximum number of users.
user-group <max_int>
Enter the maximum number of user groups.
Fortinet Technologies Inc.
Page 661 FortiOS™ - CLI Reference for FortiOS 5.0
system server-probe
server-probe
Use this command to configure server probing.
Syntax
config system server-probe edit <id>
end
Variable Description Default
interval <seconds_int> port <port_int>
Enter the period in seconds between probe attempts.
Enter the TCP port for HTTP-Get protocol probe.
60
80 protocol {ping | http-get} Select the protocol to use when probing.
response-value <str>
Enter the expected server response. This is available when protocol is http-get.
retry <tries-Int>
Enter the number of times to retry unsuccessful probe.
ping
No default.
5 server <server_addr>
Enter the server IP address or FQDN to probe.
srcintf <interface_name> Enter the interface to which the server is connected.
status {enable | disable}
Enable or disable probe.
url <url_str>
Enter the URL for HTTP-Get protocol probe.
No default.
No default.
enable
No default.
Fortinet Technologies Inc.
Page 662 FortiOS™ - CLI Reference for FortiOS 5.0
system session-helper
session-helper
dns-tcp dns-udp ftp h245I h245O h323 mgcp mms pmap pptp
FortiGate units use session helpers to process sessions that have special requirements.
Session helpers function like proxies by getting information from the session and performing support functions required by the session. For example:
• The SIP session helper looks inside SIP messages and performs NAT (if required) on the IP addresses in the SIP message and opens pinholes to allow media traffic associated with the
SIP session to pass through the FortiGate unit.
• The FTP session helper can keep track of multiple connections initiated from a single FTP session. The session helper can also permits an FTP server to actively open a connection back to a client program.
• The TNS session helper sniffs the return packet from an initial 1521 SQLNET exchange and then uses the port and session information uncovered in that return TNS redirect packet to add a temporary firewall policy that accepts the new port and IP address supplied as part of the TNS redirect.
The session helper configuration binds a session helper to a TCP or UDP port and protocol.
When a session is accepted by a firewall policy on that port and protocol the FortiGate unit passes the session to the session helper configured with this command. The session is processed by the session helper.
If your FortiGate unit accepts sessions that require a session helper on different ports than those defined by the session-helper configuration, then you can add more entire to the session helper configuration. Its OK to have multiple session helper configurations for a given protocol because only the matching configuration is used.
Use the show system session-helper command to view the current session helper configuration.
FortiGate units include the session helpers listed in
Table 25:FortiGate session helpers
Description Session helper name dcerpc
Distributed computing environment / remote procedure calls protocol
(DCE/RPC).
Domain name service (DNS) using the TCP protocol.
Domain name service (DNS) using the UDP protocol.
File transfer protocol (FTP).
H.245 I call-in protocol.
H.256 O call-out protocol.
H.323 protocol.
Media gateway control protocol (MGCP).
Multimedia message service (MMS) protocol
Port mapper (PMAP) protocol.
Point to point tunneling protocol (PPTP).
Fortinet Technologies Inc.
Page 663 FortiOS™ - CLI Reference for FortiOS 5.0
system session-helper
Table 25:FortiGate session helpers
Description Session helper name ras rsh sip tftp tns
Remote access service (RAS) protocol.
Remote shell protocol (RSH).
Session initiation protocol (SIP).
Trivial file transfer protocol (TFTP).
Oracle transparent network substrate protocol (TNS or SQLNET).
Syntax
config system session-helper edit
<helper-number> set name {dcerpc | dns-tcp | dns-udp | ftp | h245I | H2450
| h323 | mgcp | mms | pmap | pptp | ras | rsh | sip | tftp
end
set port <port_number> set protocol <protocol_number>
Variable
<helper-number>
Description
Enter the number of the session-helper that you want to edit, or enter an unused number or 0 to create a new session-helper.
name {dcerpc | dns-tcp
| dns-udp | ftp | h245I | H2450
| h323 | mgcp | mms | pmap
| pptp | ras | rsh | sip | tftp
| tns} port <port_number>
The name of the session helper to configure.
Enter the port number to use for this protocol.
protocol <protocol_number>
The protocol number for this service, as defined in
RFC 1700 .
Default
No default.
No default.
No default.
No default.
Fortinet Technologies Inc.
Page 664 FortiOS™ - CLI Reference for FortiOS 5.0
system session-sync
session-sync
Use this command to configure TCP session synchronization between two standalone
FortiGate units. You can use this feature with external routers or load balancers configured to distribute or load balance TCP sessions between two peer FortiGate units. If one of the peers fails, session failover occurs and active TCP sessions fail over to the peer that is still operating.
This failover occurs without any loss of data. As well the external routers or load balancers will detect the failover and re-distribute all sessions to the peer that is still operating.
TCP session synchronization between two standalone FortiGate units is also sometimes called standalone session synchronization or session synchronization between non-HA FortiGate units.
You cannot configure standalone session synchronization when HA is enabled.
Syntax
config system session-sync edit
<sync_id> set peerip <peer_ipv4>
set peervd <vd_name> set syncvd <vd_name> config filter
set
dstaddr <dst_ip_ipv4> <dst_mask_ipv4>
set
set
set
set
srcaddr <src_ip_ipv4> <src_mask_ipv4>
set
set
edit
set
end set
end end end
Variable Description
<service_filter_id>
Enter the unique ID for the service filter.
<sync_id>
Enter the unique ID number for the session synchronization configuration to edit. The session synchronization configuration ID can be any number between 1 and 200. The session synchronization configuration IDs of the peers do not have to match.
peerip <peer_ipv4> Enter the IP address of the interface on the peer unit that is used for the session synchronization link.
Default
No default.
0.0.0.0
Fortinet Technologies Inc.
Page 665 FortiOS™ - CLI Reference for FortiOS 5.0
system session-sync
Variable Description
peervd <vd_name>
Enter the name of the virtual domain that contains the session synchronization link interface on the peer unit.
Usually both peers would have the same peervd. Multiple session synchronization configurations can use the same peervd.
syncvd <vd_name> Enter the names of one or more virtual domains so that the sessions processed by these virtual domains are synchronized using this session synchronization configuration.
config customservice config filter
Add a service filter for session sync.
Add a filter to a standalone session synchronization configuration. You can add a filter if you want to only synchronize some TCP sessions. Using a filter you can configure synchronization to only synchronize sessions according to source and destination address, source and destination interface, and predefined firewall TCP service.
You can only add one filter to a standalone session synchronization configuration.
dstaddr
<dst_ip_ipv4>
<dst_mask_ipv4> dstaddr6
<dst_ip_ipv6>
Enter the destination IP address (or range) and netmask of the sessions to synchronize. For IPv4 addresses, use dstaddr. For IPv6 addresses, use dstaddr6.
The default IP address and netmask (
0.0.0.0 / 0.0.0.0 or
::/0) synchronizes sessions for all destination address.
Default
root
0.0.0.0
0.0.0.0
::/0 dstintf
<interface_name>
If you want to specify multiple IP addresses or address ranges you can add multiple standalone session synchronization configurations.
Enter the name of a FortiGate interface (this can be any interface including a VLAN interface, aggregate interface, redundant interface, virtual SSL VPN interface, or inter-
VDOM link interface). Only sessions destined for this interface are synchronized. You can only enter one interface name. If you want to synchronize sessions for multiple interfaces you can add multiple standalone session synchronization configurations. The default dstintf setting synchronizes sessions for all interfaces.
(null)
Enter the destination port range for the service filter.
(null) dst-port-range
<xxx-yyy> service <string>
(null) Enter the name of a FortiGate firewall predefined service.
Only sessions that use this predefined service are synchronized. You can only enter one predefined service name. If you want to synchronize sessions for multiple services you can add multiple standalone session synchronization configurations.
Fortinet Technologies Inc.
Page 666 FortiOS™ - CLI Reference for FortiOS 5.0
system session-sync
Variable
srcaddr
<src_ip_ipv4>
<src_mask_ipv4> srcaddr6
<src_ip_ipv6> srcintf
<interface_name> src-port-range
<xxx-yyy>
Description
Enter the source IP address and netmask of the sessions to synchronize. For IPv4 addresses, use
srcaddr. For IPv6 addresses, use
srcaddr6.
Default
0.0.0.0
0.0.0.0
The default IP address and netmask (
0.0.0.0 / 0.0.0.0 or
::/0) synchronizes sessions for all source address. If you want to specify multiple IP addresses or address ranges you can add multiple standalone session synchronization configurations.
::/0
Enter the name of a FortiGate interface (this can be any interface including a VLAN interface, aggregate interface, redundant interface, virtual SSL VPN interface, or inter-
VDOM link interface). Only sessions from this interface are synchronized. You can only enter one interface name. If you want to synchronize sessions for multiple interfaces you can add multiple standalone session synchronization configurations. The default srcintf setting synchronizes sessions for all interfaces.
(null)
Enter the source port range for the service filter.
(null)
Fortinet Technologies Inc.
Page 667 FortiOS™ - CLI Reference for FortiOS 5.0
system
session-ttl
session-ttl
Use this command to configure port-range based session timeouts by setting the session time to live (ttl) for multiple TCP, UDP, or SCTP port number ranges. The session ttl is the length of time a TCP, UDP, or SCTP session can be idle before being dropped by the FortiGate unit. You can add multiple port number ranges. For each range you can configure the protocol (TCP, UDP, or SCTP) and start and end numbers of the port number range.
Syntax
config system session-ttl set
config port
set
set
set
set
timeout {<timeout_int> | never}
end end
Variable
default <seconds>
<entry_id> end-port
<port_number_int>
Description
Enter the default session timeout in seconds. The valid range is from 300 - 604 800 seconds. This affects only TCP and SCTP sessions that do not have a timeout specified in a defined config port entry.
Enter an entry ID. Range 0-65535. This is just an identifier, and does not assign the port number.
Default
3600
The end port number of the port number range. You must configure both the start-port and end-port. To specify a range, the start-port value must be lower than the end-port value. To specify a single port, the start-port value must be identical to the end-port value. The range is 0 to 65 535.
0 protocol <protocol_int> Enter the protocol number to match the protocol of the sessions for which to configure a session ttl range. The
Internet Protocol Number is found in the IP packet header.
RFC 5237 describes protocol numbers and you can find a list of the assigned protocol numbers here . The range is from 0 to 255.
No default.
0
To enter a port number range you must set protocol to 6 for TCP sessions, to 17 for UDP sessions, or to 132 for
SCTP sessions.
Fortinet Technologies Inc.
Page 668 FortiOS™ - CLI Reference for FortiOS 5.0
system session-ttl
Variable
start-port
<port_number_int> timeout
{<timeout_int> | never}
Description
The start port number of the port number range. You must configure both the start-port and end-port. To specify a range, the start-port value must be lower than the end-port value. To specify a single port, the start-port value must be identical to the end-port value. The range is 0 to 65 535.
Default
0
300
Enter the number of seconds the session can be idle for on this port. The valid range is from 1 - 604800 seconds.
Optionally you can enter never instead of specifying the number of seconds if you want the session to never expire.
Caution: While it is possible to set timeout to never , this is not a secure configuration and should be avoided.
Fortinet Technologies Inc.
Page 669 FortiOS™ - CLI Reference for FortiOS 5.0
system
settings
settings
Use this command to change settings that are per VDOM settings such as the operating mode and default gateway.
When changing the opmode of the VDOM, there are fields that are visible depending on which opmode you are changing to. They are only visible after you set the opmode and before you commit the changes with either ‘end or ‘next’. If you do not set these fields, the opmode change will fail.
Table 26:Fields associated with each opmode
Change from NAT to Transparent mode Change from Transparent to NAT mode
set gateway <gw_ipv4> set manageip <manage_ipv4>
set set
set
system settings differs from system global in that system global fields apply to the entire FortiGate unit, where system settings fields apply only to the current VDOM, or the entire FortiGate unit if VDOMs are not enabled.
Bi-directional Forwarding Detection (BFD) is a protocol used by BGP and OSPF. It is used to quickly locate hardware failures in the network. Routers running BFD communicate with each other, and if a timer runs out on a connection then that router is declared down. BFD then communicates this information to the routing protocol and the routing information is updated.
BFD support was added in FortiOS v3.0 MR4, and can only be configured through the CLI.
When asymmetric routing is enabled, through the use of asymroute field, the FortiGate unit can no longer perform stateful inspection.
Syntax
config system settings set
allow-subnet-overlap {enable | disable}
set
set
set
set
bfd-desired-min-tx <interval_msec>
set
bfd-required-min-rx <interval_msec>
set
set
bfd-dont-enforce-src-port {enable | disable}
set
deny-tcp-with-icmp {enable | disable}
set
set
discovered-device-timeout <days_int>
set
set
firewall-session-dirty {check-all | check-new
set
set
Fortinet Technologies Inc.
Page 670 FortiOS™ - CLI Reference for FortiOS 5.0
system settings
set
gui-default-policy-columns <column_list>
set
set
set
set
set
set
multicast-forward {enable | disable}
set
multicast-skip-policy {enable | disable}
set
multicast-ttl-notchange {enable | disable}
set
set
per-ip-bandwidth {enable | disable}
set
set
ses-denied-traffic {enable | disable}
set
set
sip-nat-trace {enable | disable}
set
set
sip-tcp-port <port1_int> [<port2_int>]>
set
set
set
strict-src-check {enable | disable}
set
utf8-spam-tagging {enable | disable}
set
v4-ecmp-mode {source-ip-based | usage-based | weight-based}
set
vpn-stats-log {ipsec | l2tp | pptp | ssl}
set
end set
wccp-cache-engine {enable | disable}
Variable
allow-subnet-overlap
{enable | disable}
Description
Enable limited support for interface and VLAN subinterface IP address overlap for this VDOM.
Use this command to enable limited support for overlapping IP addresses in an existing network configuration.
Default
disable
Caution: for advanced users only. Use this only for existing network configurations that cannot be changed to eliminate IP address overlapping.
asymroute {enable | disable} Enable to turn on IPv4 asymmetric routing on your FortiGate unit, or this VDOM if you have
VDOMs enabled.
asymroute6
{enable | disable} disable
This feature should only be used as a temporary check to troubleshoot a network. It is not intended to be enabled permanently. When it enabled, many security features of your FortiGate unit are not enabled.
Note: Enabling asymmetric routing disables stateful inspection. Your FortiGate unit can only perform stateless inspection in this state.
Enable to turn on IPv6 asymmetric routing on your FortiGate unit, or this VDOM if you have
VDOMs enabled.
disable
Fortinet Technologies Inc.
Page 671 FortiOS™ - CLI Reference for FortiOS 5.0
system
Variable
bfd {enable | disable} bfd-desired-min-tx
<interval_msec>
Description
Enable to turn on bi-directional forwarding detection (BFD) for this virtual domain, or the whole FortiGate unit. BFD can be used with
OSPF and BGP configurations, and overridden on a per interface basis.
Enter a value from 1 to 100 000 msec as the preferred minimum transmit interval for BFD packets. If possible this will be the minimum used.
Default
disable
50 bfd-required-min-rx
<interval_msec>
This variable is only available when bfd is enabled.
Enter a value from 1 to 100 000 msec as the required minimum receive interval for BFD packets. The FortiGate unit will not transmit BFD packets at a slower rate than this.
50
This variable is only available when bfd is enabled.
bfd-detect-mult <multiplier
Enter a value from 1 to 50 for the BFD detection multiplier.
bfd-dont-enforce-src-port
{enable | disable} deny-tcp-with-icmp
{enable | disable} device <interface_name>
Enable to not enforce the BFD source port.
Enable to deny TCP by sending an ICMP
Communication Prohibited packet. Firewall policies will enable send-deny-packet.
3 disable disable
Enter the interface to use for management access. This is the interface to which ip applies.
No default.
This field is visible only after you change opmode from transparent to nat, before you commit the change.
settings
discovered-device-timeout
<days_int> ecmp-max-paths
<max_entries> email-portal-check-dns
{enable | disable}
Enter the timeout for discovered devices. Range:
1 to 365 days.
28
10
Enter the maximum number of routes allowed to be included in an Equal Cost Multi-Path (ECMP) configuration. Set to 1 to disable ECMP routing.
ECMP routes have the same distance and the same priority, and can be used in load balancing.
Enable to have the email collection portal verify that the domain name part of email address can be resolved using a DNS lookup.
enable
Fortinet Technologies Inc.
Page 672 FortiOS™ - CLI Reference for FortiOS 5.0
system
Variable
firewall-session-dirty
{check-all | check-new
| check-policy-option} gateway <gw_ipv4> gateway6 <gw_ipv6> gui-default-policy-columns
<column_list> ip <address_ipv4>
Description
Select how to manage changes to a firewall policy: check-all — flush all current sessions and reevaluate them check-new — keep existing sessions and apply policy change to new sessions only. This reduces
CPU load and the possibility of packet loss.
Default
check-all check-policy-option — use the option selected in the firewall-session-dirty field of the firewall policy.
See
“firewall policy, policy6” on page 167
.
Enter the default gateway IP address. No default.
This field is visible only after you change opmode from nat to transparent or from transparent to nat, before you commit the change.
Enter the default gateway IPv6 address. No default.
This field is visible only after you change opmode from nat to transparent or from transparent to nat, before you commit the change.
Optionally, override the web-based manager’s default displayed column set for firewall policies.
<column_list> is a space-delimited list containing any of the following column names in the desired order of appearance from left to right:
#, policyid, srcintf, dstintf, srcaddr, dstaddr, schedule, service, action, logtraffic, nat, status, authentication, count, profile, vpntunnel, comments
(null)
Enter the IP address to use after switching to nat mode.
No default.
ip6 <address_ipv6>
This field is visible only after you change opmode from transparent to nat, before you commit the change.
Enter the IPv6 address to use after switching to nat mode.
No default.
This field is visible only after you change opmode from transparent to nat, before you commit the change.
mac-ttl <seconds_int>
Set duration of MAC addresses during transparent mode. Range: 300 to 8 640 000 seconds (100days).
manageip <manage_ipv4>
Set the IP address and netmask of the
Transparent mode management interface. You must set this when you change opmode from nat to transparent.
manageip6 <manage_ipv6>
Set the IPv6 management address prefix for
Transparent mode.
300
No default.
No default.
settings
Fortinet Technologies Inc.
Page 673 FortiOS™ - CLI Reference for FortiOS 5.0
system
Variable
multicast-forward
{enable | disable} multicast-skip-policy
{enable | disable} multicast-ttl-notchange
{enable | disable}
Description
Enable or disable multicast forwarding to forward any multicast IP packets in which the TTL is 2 or higher to all interfaces and VLAN interfaces except the receiving interface. The TTL in the IP header will be reduced by 1.
Default
enable
When multiple VDOMs are configured, this option is available within each VDOM.
Must be disabled when using multicast security policies.
No default.
This field is visible only after you change opmode from nat to transparent, before you commit the change.
Enable to alter multicast forwarding so that it does not decrement the time-to-live (TTL) in the packet header. disable
Disable for normal multicast forwarding behavior.
In multiple VDOM mode, this option is only available within VDOMs. It is not available at the global level.
opmode {nat | transparent}
Enter the required operating mode.
nat
If you change opmode from nat to transparent, you must set manageip and gateway.
If you change opmode from transparent to nat, you must set device, ip, gatewaydevice and gateway.
Enable or disable per-IP bandwidth reporting.
per-ip-bandwidth
{enable | disable} sccp-port <port_number> enable
Enter the port number from 1 to 65535 of the
TCP port to use to monitor Skinny Client Call protocol (SCCP) traffic. SCCP is a Cisco proprietary protocol for VoIP.
ses-denied-traffic
{enable | disable}
Enable or disable including denied traffic in session table.
sip-helper {enable | disable}
Enable or disable the SIP session helper. The SIP session helper will process SIP sessions unless the SIP sessions are accepted by the SIP ALG.
2000 disable enable sip-nat-trace
{enable | disable}
Select enable to record the original IP address of the phone.
sip-ssl-port <port_number>
Enter the port number from 1 to 65535 that the
SIP proxy monitors for SIP traffic.
enable
5061 sip-tcp-port <port1_int>
[<port2_int>]>
Enter of one or two port numbers (range 1 to
65535) that the SIP ALG monitors for SIP TCP sessions.
sip-udp-port <port_number> Enter the port number from 1 to 65535 that the
SIP ALG monitors for SIP UDP sessions.
5060
5060
settings
Fortinet Technologies Inc.
Page 674 FortiOS™ - CLI Reference for FortiOS 5.0
system settings
Variable
status {enable | disable}
Description
Disable or enable this VDOM. Disabled VDOMs keep all their configuration, but the resources of that VDOM are not accessible.
To leave VDOM mode, all disabled VDOMs must be deleted - to leave VDOM mode there can be only the root VDOM configured.
Default
enable strict-src-check
{enable | disable} utf8-spam-tagging
{enable | disable} v4-ecmp-mode
{source-ip-based
| usage-based | weight-based}
Only available when VDOMs are enabled.
Enable to refuse packets from a source IP range if there is a specific route in the routing table for this network (RFC 3704).
disable
Enable converts spam tags to UTF8 for better non-ascii character support.
enable
Set the ECMP route failover and load balance method, which controls how the FortiGate unit assigns a route to a session when multiple equalcost routes to the sessions’s destination are available. You can select: source-ip-based vpn-stats-log {ipsec | l2tp
| pptp | ssl}
source-ip-based — the FortiGate unit load balances sessions among ECMP routes based on the source IP address of the sessions to be load balanced. No other settings can be configured to support source IP load balancing.
weight-based — the FortiGate unit load balances sessions among ECMP routes based on weights added to ECMP routes. More traffic is directed to routes with higher weights. Use the weight field of the config router static command to add weights to static routes. See
usage-based — the FortiGate unit distributes sessions among ECMP routes based on how busy the FortiGate interfaces added to the routes are. After selecting usage-based you use the spillover-threshold field of the config system interface command to add spillover thresholds to interfaces added to ECMP routes.
The FortiGate unit sends all ECMP-routed sessions to the lowest numbered interface until the bandwidth being processed by this interface reaches its spillover threshold. The FortiGate unit then spills additional sessions over to the next lowest numbered interface. See
“system interface” on page 555 .
Enable periodic VPN log statistics for one or more types of VPN.
Fortinet Technologies Inc.
Page 675 FortiOS™ - CLI Reference for FortiOS 5.0
system
Variable
vpn-stats-period
<period_int> wccp-cache-engine
{enable | disable}
Description
Enter the interval in seconds for vpn-statslog to collect statistics.
Configure the FortiGate unit to operate as a
WCCP cache engine. Use the config system wccp command to configure WCCP cache engine settings.
Default
0 disable
settings
Fortinet Technologies Inc.
Page 676 FortiOS™ - CLI Reference for FortiOS 5.0
system
sit-tunnel
sit-tunnel
Use this command to tunnel IPv6 traffic over an IPv4 network. The IPv6 interface is configured under config system interface. The command to do the reverse is
.This command is not available in Transparent mode.
Syntax
config system sit-tunnel
edit <tunnel_name> set destination <tunnel_address> set interface <name>
end
set ip6 <address_ipv6> set source <address_ipv4>
Variable Description
edit <tunnel_name> destination
<tunnel_address> interface <name>
Enter a name for the IPv6 tunnel.
The destination IPv4 address for this tunnel.
The interface used to send and receive traffic for this tunnel.
ip6 <address_ipv6>
The IPv6 address for this tunnel.
source <address_ipv4>
The source IPv4 address for this tunnel.
Default
No default.
0.0.0.0
No default.
No default.
0.0.0.0
Fortinet Technologies Inc.
Page 677 FortiOS™ - CLI Reference for FortiOS 5.0
system
sflow
sflow
Use this command to add or change the IP address and UDP port that FortiGate sFlow agents use to send sFlow datagrams to an sFlow collector.
sFlow is a network monitoring protocol described in http://www.sflow.org
. FortiOS implements sFlow version 5. You can configure one or more FortiGate interfaces as sFlow agents that monitor network traffic and send sFlow datagrams containing information about traffic flow to an sFlow collector. sFlow is normally used to provide an overall traffic flow picture of your network. You would usually operate sFlow agents on switches, routers, and firewall on your network, collect traffic data from all of them and use a collector to show traffic flows and patterns.
Syntax
config system sflow set
end set
set
Variable Description
collector-ip
<collector_ipv4>
The IP address of the sFlow collector that sFlow agents should send sFlow datagrams to.
collector_port <port_int> The UDP port number used for sending sFlow datagrams.
Change this setting only if required by your sFlow collector or you network configuration.
source-ip <ipv4_addr>
Enter the source IP address for the sFlow agent.
Default
0.0.0.0
6343
0.0.0.0
Fortinet Technologies Inc.
Page 678 FortiOS™ - CLI Reference for FortiOS 5.0
system
sms-server
sms-server
Use this command to configure cellphone service provider entries for use with the SMS text message option for two-factor authentication.
One option for two-factor authentication sends a token via SMS text message to a cell phone number when the user or admin attempts to log on to the FortiGate unit. This token must be entered for the user or admin to be authenticated and allowed access.
Syntax
config system sms-server
end
Variable
edit <provider>
Description
Enter the name of a cell phone service provider.
Maximum length allowed is 32 characters.
Default
null
To enter a name that includes spaces enclose the name in quotes.
mail-server <server_name> Enter the address of the mail server that will accept the email and forward the message to the destination cell phone as an SMS text message. null
Fortinet Technologies Inc.
Page 679 FortiOS™ - CLI Reference for FortiOS 5.0
system snmp community
snmp community
Use this command to configure SNMP communities on your FortiGate unit. You add SNMP communities so that SNMP managers can connect to the FortiGate unit to view system information and receive SNMP traps. SNMP traps are triggered when system events happen such as when antivirus checking is bypassed, or when the log disk is almost full.
You can add up to three SNMP communities. Each community can have a different configuration for SNMP queries and traps. Each community can be configured to monitor the
FortiGate unit for a different set of events. You can also the add IP addresses of up to 8 SNMP managers to each community.
Part of configuring an SNMP manager is to list it as a host in a community on the FortiGate unit it will be monitoring. Otherwise the SNMP monitor will not receive any traps from that FortiGate unit, or be able to query it.
Syntax
config system snmp community
edit <index_number> set events <events_list>
config hosts
set
elbc-management {enable | disable}
set
set
host-type {any | query | trap}
set
set
end set
config hosts6
set
set
end set
set
Fortinet Technologies Inc.
Page 680 FortiOS™ - CLI Reference for FortiOS 5.0
system snmp community
end
Variable
edit
<index_number>
Description
Enter the index number of the community in the SNMP communities table. Enter an unused index number to create a new SNMP community.
events <events_list> Enable the events for which the FortiGate unit should send traps to the SNMP managers in this community.
Default
All events enabled.
av-bypass — FortiGate unit has entered bypass mode.
See “ set av-failopen pass” under
av-conserve — System enters conserve mode.
av-fragmented — A fragmented file has been detected.
av-oversize — An oversized file has been detected.
av-oversize-blocked — An oversized file has been blocked.
av-oversize-passed — An oversized file has passed through.
av-pattern — An file matching the AV pattern is detected.
av-virus — A virus is detected.
bgp-backward-transition — BGP FSM from a highnumbered to a low-numbered state.
bgp-established — BGP FSM enters the established state.
cpu-high — CPU usage exceeds threshold. Default is 80%.
Automatic smoothing ensures only prolonged high CPU usage will trigger this trap, not a momentary spike.
ent-conf-change — entity config change (rfc4133)
fan-failure — A cooling fan has failed.
faz-disconnect — A FortiAnalyzer device has disconnected from the FortiGate unit.
fm-conf-change — FortiGate unit is managed by
FortiManager, but the FortiGate administrator has modified the configuration directly.
fm-if-change — FortiManager interface changes.
ha-hb-failure — The HA heartbeat interface has failed.
ha-member-down — The HA cluster member stops.
ha-member-up — The HA cluster members starts.
ha-switch — The primary unit in a HA cluster fails and is replaced with a new HA unit.
intf-ip — The IP address of a FortiGate interface changes.
ips-anomaly — IPS detects an anomaly.
ips-fail-open — IPS network buffer is full.
ips-pkg-update — IPS package has been updated.
ips-signature — IPS detects an attack.
Fortinet Technologies Inc.
Page 681 FortiOS™ - CLI Reference for FortiOS 5.0
system snmp community
Variable Description
load-balance-real-server-down — real server is down.
log-full — Hard drive usage exceeds threshold. Default is
90%.
Default
mem-low — Memory usage exceeds threshold. Default is
80%.
power-supply-failure — Power outage detected on monitored power supply. Available only on some models.
vpn-tun-down — A VPN tunnel stops.
vpn-tun-up — A VPN tunnel starts.
name
<community_name> query-v1-port
<port_number> query-v1-status
{enable | disable} query-v2c-port
<port_number> query-v2c-status
{enable | disable} status
{enable | disable} trap-v1-lport
<port_number> trap-v1-rport
<port_number> trap-v1-status
{enable | disable} trap-v2c-lport
<port_number> trap-v2c-rport
<port_number> trap-v2c-status
{enable | disable}
Enter the name of the SNMP community.
Enter the SNMP v1 query port number used for SNMP manager queries.
Enable or disable SNMP v1 queries for this SNMP community.
Enter the SNMP v2c query port number used for SNMP manager queries.
Enable or disable SNMP v2c queries for this SNMP community.
Enable or disable the SNMP community.
Enter the SNMP v1 local port number used for sending traps to the SNMP managers.
Enter the SNMP v1 remote port number used for sending traps to the SNMP managers.
162
Enable or disable SNMP v1 traps for this SNMP community.
enable
Enter the SNMP v2c local port number used for sending traps to the SNMP managers.
No default.
161
162
Enter the SNMP v2c remote port number used for sending traps to the SNMP managers.
162
Enable or disable SNMP v2c traps for this SNMP community.
enable
hosts, hosts6 variables
edit <host_number> Enter the index number of the host in the table. Enter an unused index number to create a new host.
elbc-management
{enable | disable} ha-direct
{enable | disable} host-type
{any | query | trap}
Enable to allow use of snmp over the base channel and front panel ports in ELBC mode.
Enable direct management of cluster members.
Set permitted actions for this host: query—make queries only enable
161 enable enable
162 disable any trap—receive traps only any—any SMTP action
Fortinet Technologies Inc.
Page 682 FortiOS™ - CLI Reference for FortiOS 5.0
system snmp community
Variable Description
interface <if_name> Enter the name of the FortiGate interface to which the SNMP manager connects.
Default
No default.
ip <address_ipv4>
Enter the IPv4 IP address of the SNMP manager (for hosts). 0.0.0.0
ip6 <address_ipv6> Enter the IPv6 IP address of the SNMP manager (for hosts6). :: source-ip
<address_ipv4/mask
>
Enter the source IPv4 IP address for SNMP traps sent by the
FortiGate unit (for hosts).
0.0.0.0/
0.0.0.0
source-ip6
<address_ipv6>
Enter the source IPv6 IP address for SNMP traps sent by the
FortiGate unit (for hosts6).
::
Fortinet Technologies Inc.
Page 683 FortiOS™ - CLI Reference for FortiOS 5.0
system snmp sysinfo
snmp sysinfo
Use this command to enable the FortiGate SNMP agent and to enter basic system information used by the SNMP agent. Enter information about the FortiGate unit to identify it. When your
SNMP manager receives traps from the FortiGate unit, you will know which unit sent the information. Some SNMP traps indicate high CPU usage, log full, or low memory.
Syntax
config system snmp sysinfo set
set
set
set
set
set
trap-high-cpu-threshold <percentage>
set
trap-log-full-threshold <percentage>
end set
trap-low-memory-threshold <percentage>
Variable
contact-info <info_str>
Description
Add the contact information for the person responsible for this FortiGate unit. The contact information can be up to 35 characters long.
description <description>
Add a name or description of the FortiGate unit. The description can be up to 35 characters long.
engine-id <engine-id_str>
Each SNMP engine maintains a value, snmpEngineID, which uniquely identifies the SNMP engine. This value is included in each message sent to or from the SNMP engine. In FortiOS, the snmpEngineID is composed of two parts:
Default
No default.
No default.
No default.
location <location> status {enable | disable} trap-high-cpu-threshold
<percentage>
• Fortinet prefix 0x8000304404
• the optional engine-id string, 24 characters maximum, defined in this command
Optionally, enter an engine-id value.
Describe the physical location of the FortiGate unit.
The system location description can be up to 35 characters long. Note: XSS vulnerability checking is disabled, so XSS characters such as ‘(‘ and ‘)’ are permitted.
No default.
Enable or disable the FortiGate SNMP agent.
Enter the percentage of CPU used that will trigger the threshold SNMP trap for the high-cpu. disable
80
There is some smoothing of the high CPU trap to ensure the CPU usage is constant rather than a momentary spike. This feature prevents frequent and unnecessary traps.
Fortinet Technologies Inc.
Page 684 FortiOS™ - CLI Reference for FortiOS 5.0
system snmp sysinfo
Variable
trap-log-full-threshold
<percentage> trap-low-memory-threshold
<percentage>
Description
Enter the percentage of disk space used that will trigger the threshold SNMP trap for the log-full.
Default
90
Enter the percentage of memory used that will be the threshold SNMP trap for the low-memory.
80
Fortinet Technologies Inc.
Page 685 FortiOS™ - CLI Reference for FortiOS 5.0
system
snmp user
snmp user
Use this command to configure an SNMP user including which SNMP events the user wants to be notified about, which hosts will be notified, and if queries are enabled which port to listen on for them.
FortiOS implements the user security model of RFC 3414. You can require the user to authenticate with a password and you can use encryption to protect the communication with the user.
Syntax
config system snmp user
edit <username> set auth-proto {md5 | sha} set auth-pwd <password>
set events <event_string> set ha-direct {enable | disable} set notify-hosts <hosts_string>
end
Variable Description
edit <username>
Edit or add selected user.
auth-proto
{md5 | sha}
Select authentication protocol: md5 — use HMAC-MD5-96 authentication protocol.
auth-pwd
<password> sha — use HMAC-SHA-96 authentication protocol.
This is only available if security-level is auth-priv or auth-no-priv.
Enter the user’s password. Maximum 32 characters.
This is only available if security-level is auth-priv or auth-no-priv.
Default
No default.
sha
No default.
Fortinet Technologies Inc.
Page 686 FortiOS™ - CLI Reference for FortiOS 5.0
system snmp user
Variable
events
<event_string>
Description
Select which SNMP notifications to send. Select each event that will generate a notification, and add to string.
Separate multiple events by a space. Available events include:
amc-bypass — an AMC bridge module has switched to bridge (bypass) mode.
av-bypass — AV bypass happens
av-conserve — AV system enters conserve mode
av-fragmented — AV detected fragmented file
av-oversize — AV detected oversized file
av-oversize-blocked — AV oversized files blocked
av-oversize-passed — AV oversized files passed
av-pattern — AV detected file matching pattern
av-virus — AV detected virus
cpu-high — cpu usage too high
ent-conf-change — entity config change (rfc4133)
Default
No default.
fan-failure — A cooling fan has failed.
faz-disconnect — FortiAnalyzer unit disconnected
fm-conf-change — config change (FM trap)
fm-if-change — interface IP change (FM trap)
ha-hb-failure — HA heartbeat interface failure
ha-member-down — HA cluster member down
ha-member-up — HA cluster member up
ha-switch — HA cluster status change
intf-ip — interface IP address changed
ips-anomaly — ips detected an anomaly
ips-pkg-update — ips package updated
ips-signature — ips detected an attack
log-full — available log space is low
mem-low — available memory is low
power-supply-failure — power supply failure
vpn-tun-down — VPN tunnel is down
vpn-tun-up — VPN tunnel is up
Note: On the events field, the unset command clears all options.
Enable direct management of cluster members.
disable ha-direct
{enable | disable} notify-hosts
<hosts_string>
Enter IPv4 IP addresses to send SNMP notifications
(SNMP traps) to when events occur. Separate multiple addresses with a space.
No default.
Fortinet Technologies Inc.
Page 687 FortiOS™ - CLI Reference for FortiOS 5.0
system snmp user
Variable
notify-hosts6
<hosts_string> priv-proto
{aes | des} priv-pwd <key> queries
{enable | disable} query-port
<port_int> security-level
<slevel>
Description
Enter IPv6 IP addresses to send SNMP notifications
(SNMP traps) to when events occur. Separate multiple addresses with a space.
Select privacy (encryption) protocol:
aes — use CFB128-AES-128 symmetric encryption.
des — use CBC-DES symmetric encryption.
Default
No default.
aes
This is available if security-level is auth-priv.
Enter the privacy encryption key. Maximum 32 characters.
This is available if security-level is auth-priv.
Enable or disable SNMP v3 queries for this user. Queries are used to determine the status of SNMP variables.
Set security level to one of:
No default.
enable
Enter the number of the port used for SNMP v3 queries. If multiple versions of SNMP are being supported, each version should listen on a different port.
161 no-auth-no-priv
no-auth-no-priv — no authentication or privacy
auth-no-priv — authentication but no privacy
auth-priv — authentication and privacy
Fortinet Technologies Inc.
Page 688 FortiOS™ - CLI Reference for FortiOS 5.0
system
sp
Use this command to configure offloading traffic to a FortiASIC Security Processing (SP)
Module. Fortinet security processing modules provide multi-gigabit throughput increases for intrusion prevention, firewall, and IP multicast applications. All models are based on the carrierclass Advanced Mezzanine Card™ (AMC) specification.
FortiGate units that support these modules offer a third action. Legitimate connections are allowed while an attack is blocked.
This command is only available on models with one or more AMC slots and a FortiASIC Security
Processing Module installed. When VDOMs are enabled, this is a global command.
Syntax
config system sp set
set
ips-weight {less-fw | balanced | all-ips}
set
fp-disable {all | ips | ipsec | multicast | DoS | none}
set
ipsec-inb-optimization {enable | disable}
set
syn-proxy-client-timer <sec_int>
end set
syn-proxy-server-timer <sec_int>
Default Variable
name <string> ips-weight {less-fw
| balanced | all-ips}
Description
Maximum of 31 characters.
Select the weighting method for IPS sessions. Default is less-fw.
• less-fw
• balanced
• all-ips fp-disable {all | ips
| ipsec | multicast
| DoS | none}
Select one or more types of traffic to exclude from file processing.
Security processing modules can accelerate different security features such as firewall, IPS, multicast, and DoS.
By default the modules will accelerate all those types of traffic, but you can disable acceleration of one or more of those types of traffic with this command. Any one or more types of traffic listed will not be accelerated, and will be handled by the FortiOS system. ipsec-inb-optimization
{enable | disable}
Select to enable inbound IPsec optimization. less-fw none enable
sp
Fortinet Technologies Inc.
Page 689 FortiOS™ - CLI Reference for FortiOS 5.0
system
Variable Description
syn-proxy-client-timer
<sec_int>
Set the number of seconds for the client side timer for the three-way handshake. If the timer expires and the handshake is not complete, the connection is discarded.
Range is 1 to 255. Default is 3.
syn-proxy-servertimer <sec_int>
For the tcp_syn_flood threshold, in addition to Block and
Pass, you can choose to Proxy connect attempts when their volume exceeds the threshold value. When the tcp_syn_flood threshold action is set to Proxy, incomplete
TCP connections are allowed as normal as long as the configured threshold is not exceeded. If the threshold is exceeded, the FortiGate unit will intercept incoming SYN packets with a hardware accelerated SYN proxy to determine whether the connection attempts are legitimate or a SYN flood attack.
Set the number of seconds for the server side timer for the three-way handshake. If the timer expires and the handshake is not complete, the connection is discarded.
Range is 1 to 255. Default is 3.
3
Default
3
sp
Fortinet Technologies Inc.
Page 690 FortiOS™ - CLI Reference for FortiOS 5.0
system
storage
storage
Use this command to add and edit local disk storage settings.
Syntax
config system storage edit
end
set media-type <name> set partition <partition_ref_int>
Variable Description
<storage_name>
The name for this storage.
media-type <name> The type of disk. You cannot configure or change this setting.
partition
<partition_ref_int>
The partition reference number. See
Default
Fortinet Technologies Inc.
Page 691 FortiOS™ - CLI Reference for FortiOS 5.0
system
stp
Use this command to configure Spanning Tree Protocol on an Internal interface switch in switch mode.
Syntax
config system stp set
set
set
set
set
set
set
end set
Variable Description
config-revision <int>
Set the configuration revision. Range 0-65535.
forward-delay <secs_int>
Set forwarding delay. Range 4 to 30.
hello-time <secs_int> max-age <secs_int>
Set hello time. Range 1 to 10.
Set maximum packet age. Range 6 to 40.
max-hops <hops_int>
Set maximum number of hops. Range 1 to 40.
region-name <name_str>
Set region name. status {enable | disable}
Enable or disable STP.
switch-priority <prio_int> Set priority. Permitted values: 0, 4096, 8192, 12288,
16384, 20480, 24576, 28672, 32768, 36864, 40960,
45056, 49152, 53248, 57344, 61440.
Default
0
15
2
20
20 null enable
32768
stp
Fortinet Technologies Inc.
Page 692 FortiOS™ - CLI Reference for FortiOS 5.0
system switch-interface
switch-interface
Use this command to group physical and wifi interfaces into a software switch interface (also called a softswitch, soft-switch or soft switch). A software switch is a virtual switch that is implemented in software instead of hardware. When you add interfaces to a software switch the interfaces all share one IP address and become a single entry on the interface list. As a result, all of the interfaces are on the same subnet and traffic between devices connected to each interface of the software switch cannot be filtered by firewall policies.
Adding a software switch can be used to simplify communication between devices connected to different FortiGate interfaces. For example, using a software switch you can place the
FortiGate interface connected to an internal network on the same subnet as your wireless interfaces. Then devices on the internal network can communicate with devices on the wireless network without any additional configuration on the FortiGate unit.
The physical and WiFi interfaces added to a software switch interface cannot be used in any other configurations. The wifi interfaces can be implemented on the FortiWiFi unit or on remote
FortiWiFi units of FortiAP units controlled by the wireless controller feature. Interfaces in a software switch cannot be monitored by HA or used as heart beat devices.
This command can be used at the Global or VDOM level.
Syntax
config system switch-interface edit
<group_name> set member <iflist> set span {enable | disable} set span-dest-port <portnum>
end
Variable
<group_name>
Description
The name for this software switch.
Cannot be in use by any other interfaces, vlans, or inter-
VDOM links.
member <iflist>
Enter a list of the interfaces that will be part of this software switch. Separate interface names with a space.
span
{enable | disable} span-dest-port
<portnum>
Default
No default.
No default.
Use <tab> to advance through the list of available interfaces.
Enable or disable port spanning. This is available only when type is switch. Port spanning echoes traffic received by the software switch to the span destination port. Port spanning can be used to monitor all traffic passing through the soft switch. You can also configure the span destination port and the span source ports., which are the switch ports for which traffic is echoed.
Enter the span port destination port name. All traffic on the span source ports is echoed to the span destination port.
disable
No default.
Use <tab> to advance through the list of available interfaces.
Available when span is enabled.
Fortinet Technologies Inc.
Page 693 FortiOS™ - CLI Reference for FortiOS 5.0
system switch-interface
Variable
span-direction
{rx | tx | both} span-source-port
<portlist>
Description
Select the direction in which the span port operates:
rx — Copy only received packets from source SPAN ports to the destination SPAN port.
tx — Copy only transmitted packets from source SPAN ports to the destination SPAN port.
both — Copy both transmitted and received packets from source SPAN ports to the destination SPAN port.
Default
both span-direction is available only when span is enabled.
Enter a list of the interfaces that are span source ports.
Separate interface names with a space. Port spanning echoes all traffic on the span source ports to the span destination port.
No default.
type {hub | switch
| hardware-switch} vdom
<vdom_name>
Use <tab> to advance through the list of available interfaces.
Available when span is enabled.
Select the type of switch functionality: switch
hub — duplicates packets to all member ports
switch — normal switch functionality (available in NAT mode only)
Enter the VDOM to which the software switch belongs.
No default.
Fortinet Technologies Inc.
Page 694 FortiOS™ - CLI Reference for FortiOS 5.0
system tos-based-priority
tos-based-priority
Use this command to prioritize your network traffic based on its type-of-service (TOS).
IP datagrams have a TOS byte in the header (as described in RFC 791). Four bits within this field determine the delay, the throughput, the reliability, and cost (as described in RFC 1349) associated with that service. There are 4 other bits that are seldom used or reserved that are not included here. Together these bits are the tos variable of the tos-based-priority command.
The TOS information can be used to manage network traffic and its quality based on the needs of the application or service. TOS application routing (RFC 1583) is supported by OSPF routing.
For more information on TOS in routing, see “policy, policy6” on page 417 .
Syntax
config system tos-based-priority
end
set tos <ip_tos_value> set priority [high | medium | low]
Variable
edit <name> tos <ip_tos_value>
Description
Enter the name of the link object to create
Enter the value of the type of service byte in the IP datagram header: priority
[high | medium | low]
8 -- minimize delay
4 -- maximize throughput
2 -- maximize reliability
1 -- minimize monetary cost
0 -- default service
Select the priority of this type of service as either high, medium, or low priority. These priority levels conform to the firewall traffic shaping priorities.
Default
No default.
0 medium
Fortinet Technologies Inc.
Page 695 FortiOS™ - CLI Reference for FortiOS 5.0
system
vdom-dns
vdom-dns
Use this command to configure DNS servers for a non-management VDOM. This command is only available from a non-management VDOM
DNS settings such as dns-cache-limit and set globally. See
.
Syntax
config system vdom-dns set
set
set
set
set
end set
Variable Description Default
ip6-primary <dns_ipv6> ip6-secondary <dns_ip6> primary <dns_ipv4> secondary <dns_ip4>
Enter the primary IPv6 DNS server IP address.
Enter the secondary IPv6 DNS server IP address.
Enter the primary DNS server IP address.
Enter the secondary DNS IP server address.
::
::
0.0.0.0
0.0.0.0
source-ip <ipv4_addr>
Enter the source IP for communications to DNS server.
0.0.0.0
vdom-dns {disable | enable} Enable configuring DNS servers for the current VDOM. disable
Fortinet Technologies Inc.
Page 696 FortiOS™ - CLI Reference for FortiOS 5.0
system
vdom-link
vdom-link
Use this command to create an internal point-to-point interface object. This object is a link used to join virtual domains. Inter-VDOM links support BGP routing, and DHCP.
Creating the interface object also creates 2 new interface objects by the name of <name>0 and
<name>1. For example if your object was named v_link, the 2 interface objects would be named v_link0 and v_link1. You can then configure these new interfaces as you would any other virtual interface using config system interface.
When using vdom-links in HA, you can only have vdom-links in one vcluster. If you have vclusters defined, you must use the vcluster field to determine which vcluster will be allowed to contain the vdom-links.
A packet can pass through an inter-VDOM link a maximum of three times. This is to prevent a loop. When traffic is encrypted or decrypted it changes the content of the packets and this resets the inter-VDOM counter. However using IPIP or GRE tunnels do not reset the counter.
Syntax
config system vdom-link
edit <name> set type {ppp | ethernet} set vcluster {1|2}
end
Variable
edit <name>
Description
Enter the name of the link object to create. You are limited to 8 characters maximum for the name.
type {ppp | ethernet}
Select type of VDOM link: PPP or Ethernet.
vcluster {1|2}
Select vcluster 1 or 2 as the only vcluster to have inter-
VDOM links.
Default
No default.
ppp
This option is available only when HA and vclusters are configured, and there are VDOMs in both vclusters.
Fortinet Technologies Inc.
Page 697 FortiOS™ - CLI Reference for FortiOS 5.0
system vdom-property
vdom-property
Use this command to enter a description of a VDOM and to configure resource usage for the
VDOM that overrides global limits and specifies guaranteed resource usage for the VDOM.
When configuring resource usage for a VDOM you can set the Maximum and Guaranteed value for each resource.
• The Maximum value limits the amount of the resource that can be used by the VDOM. When you add a VDOM, all maximum resource usage settings are 0 indicating that resource limits for this VDOM are controlled by the global resource limits. You do not have to override the maximum settings unless you need to override global limits to further limit the resources available for the VDOM. You cannot set maximum resource usage higher in a VDOM than the corresponding global resource limit. For each resource you can override the global limit to reduce the amount of each resource available for this VDOM. The maximum must the same as or lower than the global limit. The default value is 0, which means the maximum is the same as the global limit.
Use the command “system resource-limits” on page 660 to set global resource limits.
• The Guaranteed value represents the minimum amount of the resource available for that
VDOM. Setting the guaranteed value makes sure that other VDOMs do not use all of a resource. A guaranteed value of 0 means that an amount of this resource is not guaranteed for this VDOM. You only have to change guaranteed settings if your FortiGate may become low on resources and you want to guarantee that a minimum level is available for this VDOM.
For each resource you can enter the minimum amount of the resource available to this
VDOM regardless of usage by other VDOMs. The default value is 0, which means that an amount of this resource is not guaranteed for this VDOM.
Syntax
config global config system vdom-property
set
custom-service <max_int> [<guaranteed_int>]
set
set
dialup-tunnel <max_int> [<guaranteed_int>]
set
firewall-policy <max_int> [<guaranteed_int>]
set
firewall-profile <max_int> [<guaranteed_int>]
set
firewall-address <max_int> [<guaranteed_int>]
set
firewall-addrgrp <max_int> [<guaranteed_int>]
set
ipsec-phase1 <max_int> [<guaranteed_int>]
set
ipsec-phase2 <max_int> [<guaranteed_int>]
set
set
onetime-schedule <max_int> [<guaranteed_int>]
set
recurring-schedule <max_int> [<guaranteed_int>]
set
service-group <max_int> [<guaranteed_int>]
set
session <max_int> [<guaranteed_int>]
set
user <max_int> [<guaranteed_int>]
set
user-group <max_int> [<guaranteed_int>]
Fortinet Technologies Inc.
Page 698 FortiOS™ - CLI Reference for FortiOS 5.0
system vdom-property
end set
end
Variable
edit <vdom_name> custom-service <max_int>
[<guaranteed_int>] description
<description_str> dialup-tunnel <max_int>
[<guaranteed_int>] firewall-policy <max_int>
[<guaranteed_int>] firewall-profile <max_int>
[<guaranteed_int>] firewall-address <max_int>
[<guaranteed_int>] firewall-addrgrp <max_int>
[<guaranteed_int>]
Select the VDOM to set the limits for.
Enter the maximum and guaranteed number of firewall custom services.
Enter a description of the VDOM. The description can be up to 63 characters long.
Enter the maximum and guaranteed number of dialuptunnels.
Enter the maximum and guaranteed number of firewall policies.
Enter the maximum and guaranteed number of firewall profiles.
Enter the maximum and guaranteed number of firewall addresses.
Enter the maximum and guaranteed number of firewall address groups.
ipsec-phase1 <max_int>
[<guaranteed_int>] ipsec-phase2 <max_int>
[<guaranteed_int>]
Enter the maximum and guaranteed number of IPSec phase1 tunnels.
Enter the maximum and guaranteed number of IPSec phase2 tunnels.
log-disk-quota <max_int>
Enter the maximum amount of log disk space available in MBytes for log messages for this VDOM. The range depends on the amount of hard disk space available.
onetime-schedule
<max_int>
[<guaranteed_int>] recurring-schedule
<max_int>
[<guaranteed_int>] service-group <max_int>
[<guaranteed_int>] session <max_int>
[<guaranteed_int>] user <max_int>
[<guaranteed_int>]
Description
Enter the maximum and guaranteed number of onetime schedules.
Enter the maximum and guaranteed number of recurring schedules.
Enter the maximum and guaranteed number of firewall service groups.
Enter the maximum and guaranteed number of sessions.
Default
0 0
0 0
0 0
0 0
0 0
0 0
0 0
0 0
0 0
0 0
0 0
0 0
0 0
Enter the maximum and guaranteed number of users.
0 0
Fortinet Technologies Inc.
Page 699 FortiOS™ - CLI Reference for FortiOS 5.0
system
Variable
user-group <max_int>
[<guaranteed_int>] web-proxy <max_int>
vdom-property
Description
Enter the maximum and guaranteed number of user groups.
Enter the maximum number of users that can be using the explicit web proxy at one time from this VDOM.
How the number of concurrent explicit proxy users is determined depends on their authentication method:
• For session-based authenticated users, each authenticated user is counted as a single user. Since multiple users can have the same user name, the proxy attempts to identify users according to their authentication membership (based upon whether they were authenticated using RADIUS, LADAP,
FSSO, local database etc.). If a user of one session has the same name and membership as a user of another session, the explicit proxy assumes this is one user.
• For IP Based authentication, or no authentication, or if no web-proxy firewall policy has been added, the source IP address is used to determine a user. All sessions from a single source address are assumed to be from the same user.
Default
0 0
0 0
Fortinet Technologies Inc.
Page 700 FortiOS™ - CLI Reference for FortiOS 5.0
system vdom-radius-server
vdom-radius-server
Use this command to specify the dynamic profile RADIUS server for each VDOM. This command is available only if VDOMs are enabled ( vdom-admin is enabled in config system global).
Syntax
config system vdom-radius-server edit
end
set status {enable | disable} set radius-server-vdom <vdom_name_str>
Variable Description
vdom_name
<name_str>
Enter the VDOM name.
status {enable | disable} Enable or disable this VDOM RADIUS server entry.
radius-server-vdom
<vdom_name_str>
Enter the VDOM of the dynamic profile radius server to use for dynamic profile traffic in the current vdom.
Default
No default.
disable
No default.
Fortinet Technologies Inc.
Page 701 FortiOS™ - CLI Reference for FortiOS 5.0
system vdom-sflow
vdom-sflow
Use this command to add or change the IP address and UDP port that FortiGate sFlow agents operating on interfaces in a non-management VDOM use to send sFlow datagrams to an sFlow collector.
Syntax
config system sit-tunnel set
end set
set
Variable
collector-ip
<collector_ipv4> collector_port
<port_int> vdom-sflow
{enable | disable}
Description
The IP address of the sFlow collector that sFlow agents added to interfaces in this VDOM should send sFlow datagrams to.
The UDP port number used for sending sFlow datagrams.
Change this setting only if required by your sFlow collector or you network configuration.
Enable configuring sFlow settings for the current VDOM.
Default
0.0.0.0
6343 enable
Fortinet Technologies Inc.
Page 702 FortiOS™ - CLI Reference for FortiOS 5.0
system virtual-switch
virtual-switch
Use this command to configure virtual switch interfaces on the FortiGate models that support this feature.
Syntax
config system virtual-switch edit
<vswitch_name> set set physical-switch <switch_name>
config port edit
set
set
set
end end
Variable Description
<vswitch_name> set physical-switch
<switch_name>
Enter a name for the virtual switch.
Enter the hardware switch name, sw0 for example.
config port
<port_name>
Create an entry for each member interface.
Enter the interface name.
duplex {full | half}
Select duplex setting.
speed <interface_speed> Set the interface speed:
auto — the default speed. The interface uses autonegotiation to determine the connection speed. Change the speed only if the interface is connected to a device that does not support auto-negotiation.
Default
No default.
full auto
10full — 10 Mbps, full duplex
10half — 10 Mbps, half duplex
100full — 100 Mbps, full duplex
100half — 100 Mbps, half duplex
1000full — 1000 Mbps, full duplex
1000half — 1000 Mbps, half duplex status {up | down}
Speed options vary for different models and interfaces.
Enter and a set speed ? to display a list of speeds available for your model and interface.
Select up or down status for this member interface.
up
Fortinet Technologies Inc.
Page 703 FortiOS™ - CLI Reference for FortiOS 5.0
system
wccp
wccp
Configure settings for Web Cache Communication Protocol (WCCP).
You can configure a FortiGate unit to operate as a WCCP router or client.
• A FortiGate unit operating as a WCCP router can intercept HTTP and HTTPS sessions and forward them to a web caching engine that caches web pages and returns cached content to the web browser.
• A FortiGate unit operating as a WCCP client can accept and forward WCCP sessions and use firewall policies to apply NAT, UTM, and other FortiGate security features to them. A
FortiGate unit operates as a WCCP client only in NAT/Route mode (and not in Transparent mode)
Enter the following command to configure a FortiGate unit to operate as a WCCP router (this is the default FortiGate WCCP configuration): config system settings set wccp-cache-engine disable end
Enter the following command to configure a FortiGate unit to operate as a WCCP client: config system settings set wccp-cache-engine enable end
When you enter this command an interface named w.<vdom_name> is added to the FortiGate configuration (for example w.root). All WCCP sessions received by a FortiGate unit operating as a WCCP client are considered to be received at this interface and you can enter firewall policies for the WCCP traffic.
Syntax (WCCP router mode)
config system wccp edit
<router4_ipv4>] set authentication {disable | enable} set forward-method {GRE | L2 | any}
set return-method {GRE | L2 | any} set assignment-method {HASH | MASK | any}
end
next
Fortinet Technologies Inc.
Page 704 FortiOS™ - CLI Reference for FortiOS 5.0
system
Syntax (WCCP client mode)
config system wccp edit
end next
Variable
<service-id> router-id
<interface_ipv4> cache-id
<cache_engine_ip4> group-address
<multicast_ipv4>
Description
Valid ID range is from 0 to 255. 0 for HTTP.
An IP address known to all cache engines. This IP address identifies a FortiGate interface IP address to the cache engines. If all cache engines connect to the same
FortiGate interface, then
<interface_ipv4> can be
0.0.0.0, and the FortiGate unit uses the IP address of that interface as the router-id.
Default
1
0.0.0.0
If the cache engines can connect to different FortiGate interfaces, you must set router-id to a single IP address, and this IP address must be added to the configuration of the cache engines that connect to that interface.
The IP address of the cache engine if its IP address is not the same as the IP address of a FortiGate interface. If the
IP address of the cache engine is the same as the IP address of the FortiGate interface on which you have enabled WCCP, the cache-id should be 0.0.0.0.
0.0.0.0
The IP multicast address used by the cache routers.
0.0.0.0 means the FortiGate unit ignores multicast
WCCP traffic. Otherwise, group-address must be from
224.0.0.0 to 239.255.255.255.
0.0.0.0
The IP address and net mask of up to four WCCP routers.
0.0.0.0 0.0.0.0
server-list
<router1_ipv4>
[<router2_ipv4> ...
<router4_ipv4>] router-list
<server_ipv4mask> authentication
{disable | enable} service-type {auto
| dynamic | standard} forward-method
{GRE | L2 | any}
IP addresses of one or more WCCP routers that can communicate with a FortiGate unit operating as a WCCP cache engine. Separate multiple addresses with a space.
Enable or disable using use MD5 authentication for the
WCCP configuration.
Set the WCCP service type used by the cache server.
disable auto
Specifies how the FortiGate unit forwards traffic to cache servers. If forward-method is any the cache server determines the forward method.
GRE
wccp
Fortinet Technologies Inc.
Page 705 FortiOS™ - CLI Reference for FortiOS 5.0
system wccp
Variable
return-method {GRE
| L2 | any} assignment-method
{HASH | MASK | any} assignment-weight
<weight_int> assignment-bucketformat {ciscoimplementation | wccp-v2} password
<password_str>
Description
Specifies how a cache server declines a redirected packet and returns it to the FortiGate unit. If returnmethod is any the cache server determines the return method.
Default
GRE
Specifies which assignment method the FortiGate unit prefers. If assignment-method is any the cache server determines the assignment method.
HASH
Set the assignment weight for the WCCP cache engine.
The range is 0 to 255.
0
Set the assignment bucket format for the WCCP cache engine. ciscoimplementation
The authentication password. Maximum length is 8 characters.
No default.
Fortinet Technologies Inc.
Page 706 FortiOS™ - CLI Reference for FortiOS 5.0
system
zone
zone
Use this command to add or edit zones.
In NAT/Route mode, you can group related interfaces or VLAN subinterfaces into zones.
Grouping interfaces and subinterfaces into zones simplifies policy creation. For example, if you have two interfaces connected to the Internet, you can add both of these interfaces to the same zone. Then you can configure policies for connections to and from this zone, rather than to and from each interface.
In Transparent mode you can group related VLAN subinterfaces into zones and add these zones to virtual domains.
Syntax
config system zone
end
set interface <name_str> set intrazone {allow | deny}
Variable Description
edit <zone_name> interface <name_str>
Enter the name of a new or existing zone.
Add the specified interface to this zone. You cannot add an interface if it belongs to another zone or if firewall policies are defined for it.
intrazone {allow | deny} Allow or deny traffic routing between different interfaces in the same zone.
Default
No default.
deny
Fortinet Technologies Inc.
Page 707 FortiOS™ - CLI Reference for FortiOS 5.0
user
This chapter covers:
• configuration of the FortiGate unit to use external authentication servers, including
Windows Active Directory or other Directory Service servers
• configuration of user accounts and user groups for firewall policy authentication, administrator authentication and some types of VPN authentication
• configuration of peers and peer groups for IPSec VPN authentication and PKI user authentication
This chapter contains the following sections:
Configuring users for authentication
Page 708
user Configuring users for authentication
Configuring users for authentication
This chapter covers two types of user configuration:
• users authenticated by password
• users, sites or computers (peers) authenticated by certificate
Configuring users for password authentication
You need to set up authentication in the following order:
1. If external authentication is needed, configure the required servers.
• See
• See
• See
•
For Directory Service, see “user fsso” on page 718
.
2. Configure local user identities.
For each user, you can choose whether the FortiGate unit or an external authentication server verifies the password.
•
.
3. Create user groups.
Add local users to each user group as appropriate. You can also add an authentication server to a user group. In this case, all users in the server’s database can authenticate to the
FortiGate unit.
•
See “user group” on page 722 .
• For Directory Service, also see
.
Configuring peers for certificate authentication
If your FortiGate unit will host IPSec VPNs that authenticate clients using certificates, you need to prepare for certificate authentication as follows:
1. Import the CA certificates for clients who authenticate with a FortiGate unit VPN using certificates.
• See
“vpn certificate ca” on page 757 .
2. Enter the certificate information for each VPN client (peer).
•
3. Create peer groups, if you have VPNs that authenticate by peer group. Assign the appropriate peers to each peer group.
•
See “user peergrp” on page 734
.
Fortinet Technologies Inc.
Page 709 FortiOS™ - CLI Reference for FortiOS 5.0
user
ban
ban
The FortiGate unit compiles a list of all users, IP addresses, or interfaces that have a quarantine/ban rule applied to them. The Banned User list in the FortiGate web-based interface shows all IP addresses and interfaces blocked by NAC (Network Access Control) quarantine, and all IP addresses, authenticated users, senders and interfaces blocked by DLP (Data Leak
Prevention). All users or IP addresses on the Banned User list are blocked until they are removed from the list, and all sessions to an interface on the list are blocked until the interface is removed from the list. Each banned user configuration can have an expiry time/date to automatically remove it from the Banned User list, or the user must be removed from the list manually by the system administrator.
You cannot configure items in the Banned user list with the CLI, you must use the web-based manager. In the CLI, you can display the list items in the Banned User list using get user ban, and remove items from the list using the following command: config user ban delete banid <ban_int> end
Syntax (view only, cannot be configured)
config user ban edit
| quarantine-src-dst-ip | quarantine-intf | dlp-user
| dlp-ip | dlp-sender | dlp-im} set cause {IPS (Intrusion Protection Sensor) | Antivirus (AV)
set im-type {aim | icq | msn | yahoo}
end
set im-name <im_name> set expires <ban_expiry_date>
end
Variable
banid <ban_int>
Description
Enter the unique ID number of the banned user configuration.
Default
No default.
Fortinet Technologies Inc.
Page 710 FortiOS™ - CLI Reference for FortiOS 5.0
user
Variable
source {dlp-rule
| dlp-compound | IPS
| AV | DoS}
Description
The source of the ban:
• dlp-rule — a DLP rule configured by the system administrator
• dlp-compound — a DLP compound rule configured by the system administrator
•
IPS — FortiGate unit IPS
•
AV — FortiGate unit IPS
•
DoS — DoS sensor
The type of ban:
Default
dlp-rule type {quarantine-src-ip
| quarantine-dst-ip
| quarantine-src-dst-ip
| quarantine-intf
| dlp-user | dlp-ip
| dlp-sender | dlp-im}
• quarantine-src-ip — Complete quarantine based on source IP address
• quarantine-dst-ip — Complete quarantine based on destination IP address
• quarantine-src-dst-ip — Block all traffic from source to destination address
• quarantine-intf — Block all traffic on the banned interface (port quarantine) quarantine-src-ip
• dlp-user — Ban based on user
• dlp-ip — Ban based on IP address of user
• dlp-sender — Ban based on email sender
• dlp-im — Ban based on IM user
FortiGate function that caused ban: cause {IPS (Intrusion
Protection Sensor)
| Antivirus (AV)
| Data Leak Prevention
(DLP)}
• IPS (Intrusion Protection Sensor)
•
Antivirus (AV) — virus detected
• Data Leak Prevention (DLP) src-ip-addr
<src_ip_addr> protocol {smtp | pop3
| imap | http-post
| http-get | ftp-put | ftp-get
| nntp | aim | icq | msn
| ym | smtps | pop3s
| imaps | https-post
| https_get}
The banned source IP address.
The protocol used by the user or IP addresses added to the Banned User list. dst-ip-addr
<dst_ip_addr>
The destination IP address quarantined or banned. This applies to ban types quarantinedst-ip and quarantine-src-dst-ip.
interface
<interface_name>
The interface that was quarantined or banned.
This applies to ban type quarantine-intf. ip-addr <ip_addr>
The banned IP address (ban type dlp-ip).
user <user_name>
The name of the banned user (ban type dlpuser).
sender <sender_name>
The name of the banned sender (ban type dlp-sender).
(null)
0.0.0.0
No default.
null
0.0.0.0
null null
ban
Fortinet Technologies Inc.
Page 711 FortiOS™ - CLI Reference for FortiOS 5.0
user
Variable
im-type {aim | icq | msn | yahoo}
Description
The type of instant messenger that was banned.
This applies to ban type dlp-im:
Default
aim
• aim — AOL instant messenger
• icq — ICQ
• msn — MSN messenger
• yahoo — Yahoo! messenger im-name <im_name> expires
<ban_expiry_date>
The name of the banned instant messenger (ban type dlp-im).
Date and Time when the FortiGate unit will lift the ban. Date and time
<yyyy/mm/dd hh:mm:ss>.
Range from 5 minutes to 365 days or indefinite. If set to indefinite, the ban must be manually removed from the Banned
User list.
created <system_date>
System-generated time that the ban was created by the system administrator. Format
Wed Dec
31 16:00:00 1969.
null indefinite
No default.
ban
Fortinet Technologies Inc.
Page 712 FortiOS™ - CLI Reference for FortiOS 5.0
user
device
device
Use this command to define host devices.
Syntax
config user device edit
| BlackBerry PlayBook | Fortinet Device | Gaming Console
| IP Phone | Linux PC | Mac | Media Streaming
| Other Device | Windows PC | Windows Phone | iPad
end
Variable
<device_alias>
Description
Enter a name for the device. Device, device type and device group names must be unique.
Default
No default.
comment
<comment_str> mac <mac_addr> type { Android Phone
| Android Tablet
| BlackBerry Phone
| BlackBerry PlayBook
| Fortinet Device
| Gaming Console
| IP Phone | Linux PC
| Mac | Media Streaming
| Other Device
| Windows PC
| Windows Phone | iPad
| iPhone} user <username_str>
Optionally, enter a comment up to 32 characters in length.
Enter the MAC address of the device.
Select the device type.
Enter the name of the device’s user.
No default.
00:00:00:00:00:00
Null
Null
Fortinet Technologies Inc.
Page 713 FortiOS™ - CLI Reference for FortiOS 5.0
user device-access-list
device-access-list
Use this command to configure device lists for use on interfaces with device identification enabled.
Syntax
config user device-access-list edit
<devlist_name> set default-action {accept | deny}
config device-list edit <id> set
end set
end
Variable Description
<devlist_name>
Enter a name for this device list.
action {accept | deny}
Select whether to accept or deny this device.
default-action
{accept | deny} device <dev_name>
Select whether to allow or deny unknown devices.
Enter the device name.
Default
accept
No default.
Fortinet Technologies Inc.
Page 714 FortiOS™ - CLI Reference for FortiOS 5.0
user device-category
device-category
Use this command to provide comments for the predefined device types. You cannot create or delete device types.
Syntax
config user device-category edit {android-phone | android-tablet | blackberry-phone
| blackberry-playbook | collected-emails | fortinet-device
| gaming-console | ip-phone | ipad | iphone | linux-pc | mac
| media-streaming | other-network-device | router-nat-device
| windows-pc | windows-phone} end
Variable Description
comment <comment_str> Comment (read-only).
desc <desc_str>
Description (read-only).
Default
No default.
No default.
Fortinet Technologies Inc.
Page 715 FortiOS™ - CLI Reference for FortiOS 5.0
user device-group
device-group
Use this command to define device groups.
Syntax
config user device-group edit
end
set comment <comment_str> set member {device-1 ... device-n}
Variable
<groupname_str>
Description
Enter a name for this device group. Device, device type and device group names must be unique.
comment <comment_str> Optionally, enter a comment up to 32 characters in length.
member {device-1 ... device-n}
Enter the device names that belong to this group.
Default
No default.
No default.
No default.
Fortinet Technologies Inc.
Page 716 FortiOS™ - CLI Reference for FortiOS 5.0
user
fortitoken
fortitoken
This command to register FortiToken devices and FortiToken Mobile “soft token” certificates.
Syntax
config user fortitoken edit
end
Variable
activation-expire <str>
Description
serial-number <sn_str> status {active | lock}
Enter the FortiToken device serial number.
Activate or lock out FortiToken device.
comments <comment_str> license <license_str>
FortiToken Mobile license. You can retrieve this using the command execute fortitoken-mobile import <activation_code> activation-code <code_str> The FortiToken activation code from the FortiToken
Mobile card.
Activation expiry time. Read-only.
Default
No default.
active
No default.
No default.
No default.
Fortinet Technologies Inc.
Page 717 FortiOS™ - CLI Reference for FortiOS 5.0
user
fsso
Use this command to configure the FortiGate unit to receive user group information from a
Directory Service server equipped with the Fortinet Single Sign On Agent (FSSO-Agent). You can specify up to five computers on which a FSSO collector agent is installed. The FortiGate unit uses these collector agents in a redundant configuration. If the first agent fails, the
FortiGate unit attempts to connect to the next agent in the list.
You can add user groups to Directory Service type user groups for authentication in firewall policies.
Syntax
config user fsso
end
Variable
edit <server_name>
Description
Enter a name to identify the Directory Service server. ldap_server
<ldap-server-name> password <password> password2 <password2> password3 <password3> password4 <password4> password5 <password5>
Enter a new name to create a new server definition or enter an existing server name to edit that server definition.
Enter the name of the LDAP server to be used to access the Directory Service.
For each collector agent, enter the password.
Default
No default.
No default.
No default.
fsso
Fortinet Technologies Inc.
Page 718 FortiOS™ - CLI Reference for FortiOS 5.0
user
Variable
port <port_number> port2 <port2_number> port3 <por3_number> port4 <port4_number> port5 <port5_number> server <domain> server2 <domain2> server3 <domain3> server4 <domain4> server5 <domain5> source-ip <ipv4_addr>
Description
For each collector agent, enter the port number used for communication with FortiGate units.
Enter the domain name or IP address for up to five collector agents. Range from 1 to 63 characters.
Default
8000
No default.
Enter the source IP for communications to FSSO server.
0.0.0.0
fsso
Fortinet Technologies Inc.
Page 719 FortiOS™ - CLI Reference for FortiOS 5.0
user fsso-polling
fsso-polling
Use this command to configure polling of servers for Fortinet Single Sign-On.
Syntax - Global
config user fsso-polling edit
end
Syntax - VDOM
config user fsso-polling edit
set port <port_int> set user <uid_str>
config adgrp end edit
end
Variable
<AD_id_int>
Description
Enter an ID number for the Windows Active Directory
(AD) server.
status {enable | disable} server <name> password <pwd_str> authentication
{enable | disable} auth-password <pwd_str>
Enable or disable FSSO polling.
Enter the AD server name or IP address.
Enter the AD server password.
Enable or disable authentication.
Enter the AD server password.
default-domain
<domain_str>
Enter this server’s default domain name.
ldap-server <server_name>
Enter the name of the LDAP server for group and user names.
Default
enable
Null
Null enable
Null
Null
Null listening-port <port_int> logon-history <hours_int>
Enter the server port number. Range 1 the 65 535,
Enter length of logon history. Range 1 to 48 hours.
8000
8 polling-frequency <sec_int> Enter the polling interval. Range 1 to 30 seconds. 10
Fortinet Technologies Inc.
Page 720 FortiOS™ - CLI Reference for FortiOS 5.0
user fsso-polling
Variable
port <port_int> user <uid_str>
Description
Enter the server port number. Range 0 the 65 535.
Enter the user account name for the AD server.
config adgrp fields
adgrp-name <group_name>
Enter a Windows AD group name for which FSSO polling will be conducted.
Default
0
Null
No default.
Fortinet Technologies Inc.
Page 721 FortiOS™ - CLI Reference for FortiOS 5.0
user
group
group
Use this command to add or edit user groups. User groups can include defined peer members.
Syntax
config user group
edit <groupname> set auth-concurrent-override {enable | disable}
set password {auto-generate | email | specify} set sponsor {disabled | mandatory | optional}
end
config guest edit
set
set
set
set
set
set
end set
config match edit
set
set
end set
Variable
edit <groupname> auth-concurrent-override
{enable | disable}
Description
Enter a new name to create a new group or enter an existing group name to edit that group.
Enable to override the policy-auth-concurrent
.
Default
No default.
disable
Fortinet Technologies Inc.
Page 722 FortiOS™ - CLI Reference for FortiOS 5.0
user
Variable
auth-concurrent-value
<limit_int> authtimeout <timeout> company {disabled
| mandatory | optional} email {enable | disable} expire <seconds_int> expire-type {immediately
| first-successful-login} group-type {firewall
| fsso-service | rsso
| guest} http-digest-realm
<realm_str> member <names> mobile-phone
{enable | disable} multiple-guest-add
{enable | disable}
Description Default
Set the number of concurrent logins permitted from the same user. Range 1 to 100. 0 means no limit.
This field is available if auth-concurrent-override is enabled.
0
Enter the value in seconds of an authentication timeout for the user group. Range 1 to 480 minutes. Enter 0 to use the global authentication value. This is available if group-type is firewall or directory-service.
Select the option for the guest’s company name field on the web-based manager Guest
Management form: disabled, mandatory or optional. This is available if group-type is guest.
0 optional
Enable or disable the email address field in the web-based manager Guest Management form.
This is available if group-type is guest.
Enter the number of seconds until the guest account expires. This is available if group-type is guest.
disable
14400
Select when expiry time countdown begins: immediately or after the user’s first successful login. This is available if group-type is guest.
Enter the group type.
<grp_type> determines the type of user: immediately firewall firewall - FortiGate users defined in user local, user ldap or user radius fsso-service - Single Sign On users rsso - RADIUS SSO users guest — guest users
Enter the realm attribute for MD5-digest authentication.
No default.
Enter the names of users, peers, LDAP servers, or
RADIUS servers to add to the user group. Separate names by spaces. To add or remove names from the group you must re-enter the whole list with the additions or deletions required.
No default.
This field is available if group-type is firewall or fsso-service.
Enable or disable the mobile phone number field in the web-based manager Guest Management form.
This is available if group-type is guest.
Enable or disable the multiple guest add option in the web-based manager User Group form. This is available if group-type is guest.
disable disable
group
Fortinet Technologies Inc.
Page 723 FortiOS™ - CLI Reference for FortiOS 5.0
user
Variable
password {auto-generate
| email | specify}
Description
Select the source of the guest password:
Default
auto-generate sponsor {disabled
| mandatory | optional} auto-generate — create a random user ID email — use the guest’s email address specify — enter a user ID string
This is available if group-type is guest.
Select whether the sponsor field on the web-based manager Guest Management form should be disabled, mandatory or optional. This is available if group-type is guest.
Enter the name of the SSL-VPN portal for this group.
optional
No default.
sslvpn-portal
<web_portal_name>
This is available if
group-type is sslvpn.
sso-attribute-value <string> Enter the name of the RADIUS user group this local user group represents.
user-id {auto-generate
| email | specify}
Select the source of the guest user ID: auto-generate — create a random user ID
No default.
email email — use the guest’s email address specify — enter a user ID string user-name
{enable | disable}
config guest fields
This is available if group-type is guest.
Enable or disable guest user name entry. This is available if group-type is guest.
Configure guest users. This is available if grouptype is guest.
<guest_id> company
<company-name_str> email <email-addr_str> expiration
<expire-time_str> mobile-phone
<telnumber_str> name <name_str> password <pwd_str> sponser
<sponsor-name_str>
Enter the guest user ID.
Enter the user’s company name.
Enter the user’s email address.
Enter the account expiration time.
Enter the user’s user’s telephone number.
Enter the user’s name.
Enter the user’s password.
Enter the user’s sponsor.
config match fields
Specify the user group names on the authentication servers that are members of this
FortiGate user group. If no matches are specified, all users on the server can authenticate.
<match_id>
Enter an ID for the entry. group-name <gname_str>
The name of the matching group on the remote authentication server.
disable
No default.
group
Fortinet Technologies Inc.
Page 724 FortiOS™ - CLI Reference for FortiOS 5.0
user
Variable
rsso {enable | disable}
Description
Enable or disable RADIUS single sign-on matching in this user group.
server-name <srvname_str> The name of the remote authentication server.
Default
disable
group
Fortinet Technologies Inc.
Page 725 FortiOS™ - CLI Reference for FortiOS 5.0
user
ldap
ldap
Use this command to add or edit the definition of an LDAP server for user authentication.
To authenticate with the FortiGate unit, the user enters a user name and password. The
FortiGate unit sends this user name and password to the LDAP server. If the LDAP server can authenticate the user, the user is successfully authenticated with the FortiGate unit. If the LDAP server cannot authenticate the user, the connection is refused by the FortiGate unit. The maximum number of remote LDAP servers that can be configured for authentication is 10.
The FortiGate unit supports LDAP protocol functionality defined in RFC2251 for looking up and validating user names and passwords. FortiGate LDAP supports all LDAP servers compliant with LDAP v3.
FortiGate LDAP support does not extend to proprietary functionality, such as notification of password expiration, that is available from some LDAP servers. FortiGate LDAP support does not supply information to the user about why authentication failed.
LDAP user authentication is supported for PPTP, L2TP, IPSec VPN, and firewall authentication.
With PPTP, L2TP, and IPSec VPN, PAP (Packet Authentication Protocol) is supported and CHAP
(Challenge Handshake Authentication Protocol) is not.
Syntax
config user ldap
end
Variable
edit <server_name>
Description
Enter a name to identify the LDAP server.
Enter a new name to create a new server definition or enter an existing server name to edit that server definition.
Default
No default.
Fortinet Technologies Inc.
Page 726 FortiOS™ - CLI Reference for FortiOS 5.0
user
Variable
cnid <id> dn <dname> group-member-check
{user-attr | group-object} group-object-filter
<group_filter>
Description
Enter the common name identifier for the LDAP server.
Default
cn
The common name identifier for most LDAP servers is cn. However some servers use other common name identifiers such as uid. Maximum 20 characters.
Enter the distinguished name used to look up entries on the LDAP server. It reflects the hierarchy of LDAP database object classes above the Common Name
Identifier. The FortiGate unit passes this distinguished name unchanged to the server.
No default.
You must provide a dn value if type is simple.
Maximum 512 characters.
Select the group membership checking method: user attribute or group object.
Enter the name of the filter for group searches. The search for the group on the LDAP server is done with the following default filter configuration:
(&(objectcategory=group)(member=*)) user-attr
For example, to look for the group that will allow dialin ( msNPAllowDialin) set the filter to
(&(uid=%u)(msNPAllowDialin=TRUE)).
This field is available when group-member-check is group-object.
member-attr <attr_name>
An attribute of the group that is used to authenticate users. port <number>
Enter the port number for communication with the
LDAP server.
server <domain>
Enter the LDAP server domain name or IP address.
The host name must comply with RFC1035.
secondary-server <domain> Optionally, enter a second LDAP server name or IP address.
tertiary-server <domain>
Optionally, enter a third LDAP server name or IP address.
source-ip
<source_ipv4addr>
Optionally, enter a source IP address to use for LDAP requests. null
389
No default.
No default.
No default.
0.0.0.0
ldap
Fortinet Technologies Inc.
Page 727 FortiOS™ - CLI Reference for FortiOS 5.0
user
Variable
type <auth_type>
Description
Enter the authentication type for LDAP searches.
One of:
• anonymous — bind using anonymous user search
• regular — bind using username/password and then search
• simple — simple password authentication without search
You can use simple authentication if the user records are all under one dn that you know. If the users are under more than one dn, use the anonymous or regular type, which can search the entire LDAP database for the required user name.
Default
simple username
<ldap_username>
If your LDAP server requires authentication to perform searches, use the regular type and provide values for username and password.
This field is available only if type is regular. For regular authentication, you need a user name and password. See your server administrator for more information.
password <ldap_passwd>
This field is available only if type is regular. For regular authentication, you need a user name and password. See your server administrator for more information.
password-expiry-warning
{disable | enable} password-renewal {disable
| enable} secure <auth_port>
{disable | starttls | ldaps}
Enable or disable password expiry warnings.
Enable or disable online password renewal.
Select the port to be used in authentication.
disable — port 389
No default.
No default.
disable disable disable ca-cert <cert_name> ldaps — port 636 starttls — port 389
This field is available when secure is set to ldaps or
starttls. User authentication will take place via a CA certificate. The CA certificate will be used by the LDAP library to validate the public certificate provided by the LDAP server.
null
ldap
Fortinet Technologies Inc.
Page 728 FortiOS™ - CLI Reference for FortiOS 5.0
user
local
local
Use this command to add local user names and configure user authentication for the FortiGate unit. To add authentication by LDAP or RADIUS server you must first add servers using the config user ldap and config user radius commands.
Syntax
config user local
end
Variable Description
edit <username>
Enter the user name. Enter a new name to create a new user account or enter an existing user name to edit that account.
auth-concurrentoverride
{enable | disable} auth-concurrentvalue <limit_int>
Enable to override the policy-auth-concurrent setting in
Set the number of concurrent logins permitted from the same
IP address. Range 1 to 100. 0 means no limit. This field is available if auth-concurrent-override is enabled.
ldap-server
<servername>
Enter the name of the LDAP server with which the user must authenticate. You can only select an LDAP server that has been added to the list of LDAP servers. See
passwd
<password_str>
This is available when type is set to ldap.
Enter the password with which the user must authenticate.
Passwords at least 6 characters long provide better security than shorter passwords.
Default
disable
0
No default.
No default.
passwd-policy
<policy_name> passwd-time
<time_str>
This is available when type is set to password.
Optionally, select a password policy to apply to this user. Use
user password-policy to create password policies.
null
The time of last password update. (Read only).
No default.
Fortinet Technologies Inc.
Page 729 FortiOS™ - CLI Reference for FortiOS 5.0
user
Variable
radius-server
<servername> sms-customserver
<srv_name> sms-phone
<phone_str> sms-server
{fortiguard
| custom} status
{enable | disable} tacacs+-server
<servername>
Description Default
Enter the name of the RADIUS server with which the user must authenticate. You can only select a RADIUS server that has
been added to the list of RADIUS servers. See “radius” on page 735 .
No default.
This is available when type is set to radius.
Enter the custom server to use for SMS-based two-factor authentication. The server name must be defined first using the config system sms-server command. This field is available when two-factor is sms and sms-server is custom.
Enter the user’s phone number for SMS-based two-factor authentication.
No default.
No default.
Select FortiGuard or custom SMS server for SMS-based twofactor authentication. This field is available when two-factor is sms.
Enter enable to allow the local user to authenticate with the
FortiGate unit.
fortiguard enable
Enter the name of the TACACS+ server with which the user must authenticate. You can only select a TACACS+ server that has been added to the list of TACACS+ servers. See
No default.
This is available when type is set to tacacs+.
two-factor
{disable
| fortitoken | email
| sms}
Enable two-factor authentication through FortiToken, email, or
SMS. type <auth-type> Enter one of the following to specify how this user’s password is verified: disable
No default.
ldap — The LDAP server specified in ldap-server verifies the password.
workstation
<name_str> password — The FortiGate unit verifies the password against the value of passwd.
radius — The RADIUS server specified in radius-server verifies the password.
tacacs+ — The TACACS+ server specified in tacacs+-server verifies the password.
Enter the user’s workstation name if you want to permit the user to authenticate only from a particular workstation. This is available when type is ldap.
null
local
Fortinet Technologies Inc.
Page 730 FortiOS™ - CLI Reference for FortiOS 5.0
user password-policy
password-policy
Use this command to define password policies that set user password expiry and provide expiry warnings.
Syntax
config user password-policy edit
end
set expire-days <days_int> set warn-days <days_int>
Variable
<policy_name> expire-days <days_int> warn-days <days_int>
Description Default
Enter a name for this password policy.
No default.
Set the number of days until expiry. Range 0 to 999.
180
Set number of days prior to expiry to provide expiry warning. Range 0 to 30.
15
Fortinet Technologies Inc.
Page 731 FortiOS™ - CLI Reference for FortiOS 5.0
user
peer
peer
Use this command to add or edit peer (digital certificate holder) information. You use the peers you define here in the config vpn ipsec phase1 command if you specify peertype as peer. Also, you can add these peers to peer groups you define in the config user peergrp command.
For PKI user authentication, you can add or edit peer information and configure use of LDAP server to check access rights for client certificates.
This command refers to certificates imported into the FortiGate unit. You import CA certificates using the vpn certificate ca command. You import local certificates using the vpn certificate local command.
You can configure a peer user with no values in subject or ca. This user behaves like a user account or policy that is disabled.
If you create a PKI user in the CLI with no values in subject or ca, you cannot open the user record in the web-based manager, or you will be prompted to add a value in Subject ( subject) or CA ( ca).
Syntax
config user peer
edit <peer_name> set ca <ca_name> set cn <cn_name>
end
set subject <constraints> set two-factor {enable | disable}
Variable
edit <peer_name> ca <ca_name> cn <cn_name>
Description
Enter the peer name. Enter a new name to create a new peer or enter an existing peer name to edit that peer’s information.
Enter the CA certificate name, as returned by execute vpn certificate ca list.
Enter the peer certificate common name.
Default
No default.
No default.
Fortinet Technologies Inc.
Page 732 FortiOS™ - CLI Reference for FortiOS 5.0
user
Variable
cn-type <type> ldap-mode {password
| principal-name} ldap-password
<ldap_password> ldap-server
<ldap_server> ldap-username
<ldap_user> mandatory-ca-verify
{enable | disable}
Description
Enter the peer certificate common name type:
Default
string
FQDN — Fully-qualified domain name.
email — The user’s email address.
ipv4 — The user’s IP address (IPv4).
ipv6 — The user’s IP address (IPv6).
string — Any other piece of information.
Select mode for LDAP authentication.
password password — use user name and password.
principal-name — use LDAP userPrincipalName attribute.
Enter the login password for the LDAP server used to perform client access rights check for the defined peer.
No default.
Enter the name of one of the LDAP servers defined under
‘config user ldap’ used to perform client access rights check for the defined peer.
null
Enter the login name for the LDAP server used to perform client access rights check for the defined peer.
null disable
If the CA certificate is installed on the FortiGate unit, the peer certificate is checked for validity. The mandatoryca-verify field determines what to do if the CA certificate is not installed: enable — The peer cannot be authenticated.
disable — The peer certificate is automatically considered valid and authentication succeeds.
ocsp-override-server
<ocsp-name> passwd
<password_str>
Enter the OCSP server to use to retrieve certificate. This applies if OCSP is enabled in vpn certificate setting.
Enter the password that this peer uses for two-factor authentication. The is available when two-factor is enabled.
subject <constraints>
Optionally, enter any of the peer certificate name constraints.
two-factor
{enable | disable}
Enable user to authenticate by password in addition to certificate authentication. Specify the password in passwd.
null
No default.
No default.
disable
peer
Fortinet Technologies Inc.
Page 733 FortiOS™ - CLI Reference for FortiOS 5.0
user
peergrp
peergrp
Use this command to add or edit a peer group. Peers are digital certificate holders defined using the config user peer command. You use the peer groups you define here in the config vpn ipsec phase1 command if you specify peertype as peergrp.
For PKI user authentication, you can add or edit peer group member information. User groups that use PKI authentication can also be configured using config user group.
Syntax
config user peergrp
end
Variable
edit <groupname>
Description
Enter a new name to create a new peer group or enter an existing group name to edit that group. member <peer_names>
Enter the names of peers to add to the peer group.
Separate names by spaces. To add or remove names from the group you must re-enter the whole list with the additions or deletions required.
Default
No default.
Fortinet Technologies Inc.
Page 734 FortiOS™ - CLI Reference for FortiOS 5.0
user
radius
radius
Use this command to add or edit the information used for RADIUS authentication.
The default port for RADIUS traffic is 1812. If your RADIUS server is using a different port you can change the default RADIUS port. You may set a different port for each of your RADIUS servers. The maximum number of remote RADIUS servers that can be configured for authentication is 10.
The RADIUS server is now provided with more information to make authentication decisions, based on values in server, use-management-vdom, nas-ip, and the config user group subcommand config match. Attributes include:
•
NAS-IP-Address - RADIUS setting or IP address of FortiGate interface used to talk to
RADIUS server, if not configured
•
NAS-Port - physical interface number of the traffic that triggered the authentication
•
Called-Station-ID - same value as NAS-IP Address but in text format
•
Fortinet-Vdom-Name - name of VDOM of the traffic that triggered the authentication
•
NAS-Identifier - configured hostname in non-HA mode; HA cluster group name in HA mode
•
Acct-Session-ID - unique ID identifying the authentication session
•
Connect-Info - identifies the service for which the authentication is being performed
(web-auth, vpn-ipsec, vpn-pptp, vpn-l2tp, vpn-ssl, admin-login, test)
You may select an alternative authentication method for each server. These include CHAP, PAP,
MS-CHAP, and MS-CHAP-v2.
Syntax
config user radius
set rsso-log-period <log_time> set rsso-radius-response {enable | disable}
Fortinet Technologies Inc.
Page 735 FortiOS™ - CLI Reference for FortiOS 5.0
user radius
end
config accounting-server edit <id_int> set
set
set
end set
Variable
edit <server_name>
Description
Enter a name to identify the RADIUS server.
Default
all-usergroup {enable | disable} auth-type {auto | chap
| ms_chap | ms_chap_v2
| pap} h3c-compatibility
{enable | disable}
Enter a new name to create a new server definition or enter an existing server name to edit that server definition.
Enable to automatically include this RADIUS server in all user groups.
Select the authentication method for this RADIUS server. auto auto uses pap, ms_chap_v2, and chap.
Enable compatibility with the H3C Intelligent
Management Platform (IMC) server. The supplicant requests 802.1X authentication and then sends a second phase security check request to the H3C IMC server. disable disable nas-ip <use_ip> radius-port
<radius_port_num> secret
<server_password>
IP address used as
NAS-IP-Address and
Called-Station-ID attribute in RADIUS access requests. RADIUS setting or IP address of FGT interface used to talk with RADIUS server, if not configured.
No default.
1812
Change the default RADIUS port for this server. The default port for RADIUS traffic is
1812. Range is
0..65535.
Enter the RADIUS server shared secret. The server secret key should be a maximum of 16 characters in length.
No default.
server <domain>
Enter the RADIUS server domain name or IP address.
The host name must comply with RFC1035.
No default.
secondary-secret
<sec_server_password>
Enter the secondary RADIUS server shared secret. The server secret key should be a maximum of 16 characters in length.
No default.
secondary-server
<sec_server_domain> tertiary-secret
<ter_server_password>
Enter the secondary RADIUS server domain name or IP address.
Enter the tertiary RADIUS server shared secret. The server secret key should be a maximum of 16 characters in length.
No default.
No default.
tertiary-server
<ter_domain>
Optionally, enter the secondary RADIUS server domain name or IP address.
No default.
Fortinet Technologies Inc.
Page 736 FortiOS™ - CLI Reference for FortiOS 5.0
user
Variable
use-management-vdom
{enable | disable}
Description
source-ip <ipv4_addr>
Enter the source IP for communications to RADIUS server.
Enable to use the management VDOM to send all
RADIUS requests.
Default
0.0.0.0
disable
Variable Description Default config accounting-server fields
status {enable | disable} Enable or disable accounting server configuration. disable server <domain | IP>
Enter the accouting server domain name or IP address.
No default.
secret
<server_password>
Enter the accouting server shared secret. The server secret key should be a maximum of 16 characters in length.
source-ip <ipv4_addr>
Enter the source IP for communications to the accouting server.
No default.
0.0.0.0
Variable Description Default
RADIUS SSO fields
rsso {enable | disable}
Enable RADIUS SSO to configure a RADIUS SSO agent.
Then, FortiOS accepts connections on the rssoradius-server-port. Other RSSO settings become available. rsso-context-timeout
<timeout_seconds>
When the FortiGate unit receives a RADIUS Start record, the user added to a “user context list” of logged on users. The user is considered logged on until disable
28800
• the FortiGate unit receives a RADIUS Stop record for the user’s end point or
• this timeout period has expired with no communication from the user end point.
This timeout is only required if FortiOS doesn’t receive
RADIUS Stop records. However, even if the accounting system does send RADIUS Stop records, this timeout should be set in case the FortiGate unit misses a Stop record.
The default timeout is 28800 seconds (8 hours). You can keep this timeout relatively high because its not usually a problem to have a long context list, but entries that are no longer used should be removed regularly. If the timeout is too short, user context entries might be removed prematurely.
Set the timeout to 0 if you do not want FortiOS to remove entries from the list except in response to RADIUS Stop messages.
radius
Fortinet Technologies Inc.
Page 737 FortiOS™ - CLI Reference for FortiOS 5.0
user radius
Variable Description
rsso-endpoint-attribute
<RADIUS_attribute>
To extract the user end point identifier from the RADIUS
Start record, this field must be set to the name of the
RADIUS attribute that contains the end point identifier.
You can select the
RADIUS_attribute from the list or enter an attribute name. The
RADIUS_attribute must match one of the RADIUS attributes in the list. The
RADIUS_attribute is case sensitive.
rsso-endpoint-blockattribute
<RADIUS_attribute> rsso-flush-ip-session
{enable | disable}
This field specifies a RADIUS attribute that can be used to block a user. If the attribute value is “Block”, FortiOS blocks all traffic from the user’s IP address.
Enable to flush user IP sessions on RADIUS accounting stop messages.
rsso-log-flags <lflags>
Enter one or more of the following options to configure
FortiOS to write event log messages for RADIUS SSO events. You can enter multiple options. Separate the options with a space.
none — Disable logging of RADIUS SSO events.
accounting-event — Enable to write an event log message when FortiOS does not find the expected information in a RADIUS Record. For example, if a
RADIUS record contains more than the expected number of addresses.
Default
Calling-
Station-Id
Called-
Station-Id disable
All options except none.
accounting-stop-missed — Enable to write an event log message whenever a user context entry timeout expires indicating that FortiOS removed an entry from the user context list without receiving a RADIUS Stop message.
context-missing — Enable to write an event log message whenever a user context creation timeout expires indicating that FortiOS was not able to match a communication session because a matching entry was not found in the user context list.
endpoint-block — Enable to write an event log message whenever a user is blocked because the attribute specified in rsso-endpoint-blockattribute has the value “Block”.
profile-missing — Enable to write an event log message whenever FortiOS cannot find a group name in a RADIUS start message that matches the name of an
RSSO user group in FortiOS.
protocol-error — Enable to write an event log message if RADIUS protocol errors occur. For example, if a RADIUS record contains a RADIUS secret that does not match the one added to the dynamic profile.
radiusd-other — Enable to write event log messages for other events. The event is described in the log message. For example, write a log message if the memory limit for the user context list is reached and the oldest entries in the table have been dropped.
Fortinet Technologies Inc.
Page 738 FortiOS™ - CLI Reference for FortiOS 5.0
user radius
Variable
rsso-log-period
<log_time> rsso-radius-response
{enable | disable} rsso-radius-server-port
<RADIUS_listen_port> rsso-secret
<server_password> rsso-validate-requestsecret {enable | disable} sso-attribute
<RADIUS_attribute> sso-attribute-key
<profile_attribute_key>
Description
The time in seconds to group event log messages for dynamic profile events. For example, if the log message period is 30 seconds, FortiOS Carrier generates groups of event log messages every 30 seconds instead of generating event log messages continuously. And the log messages generated each period contain a count of how many events of that type occurred.
Default
0
If set to 0, FortiOS Carrier generates all event log messages in real time.
Enable if you want FortiOS Carrier to send RADIUS responses after receiving RADIUS Start and Stop records. This setting may be required by your accounting system.
disable
If required, change the UDP port number used by the
RADIUS accounting server for sending RADIUS records.
FortiOS Carrier listens for RADIUS Start and Stop records on this port.
1813
Enter the RADIUS secret used by the RADIUS accounting server.
No default
Enable if you want FortiOS Carrier to verify that the
RADIUS secret matches the RADIUS secret in the
RADIUS Start or End record. You can verify the RADIUS secret to verify that the RADIUS record is valid.
disable
To extract a profile group name from the RADIUS Start record, this field must be set to the name of the RADIUS attribute that contains the profile group name. You can select the
RADIUS_attribute from the list or enter an attribute name. The
RADIUS_attribute must match one of the RADIUS attributes in the list. The
RADIUS_attribute is case sensitive.
Class
Enter a string if the profile attribute contains more data than just the profile group name. The profile key is a text string that always comes directly before the profile group name in the profile attribute. For example, if the profile group name always follows the text string profile, the class attribute could include the string: profile=<profile_name_str>. Where
<profile_name_str> is the name of the profile group.
Maximum 36 characters.
No default.
Fortinet Technologies Inc.
Page 739 FortiOS™ - CLI Reference for FortiOS 5.0
user
setting
setting
Use this command to change per VDOM user settings such as the firewall user authentication time out and protocol support for firewall policy authentication.
user settings differ from system global settings in that system global settings fields apply to the entire FortiGate unit, where user settings fields apply only to the user
VDOM.
Syntax
config user setting set
auth-blackout-time <blackout_time_int>
set
set
auth-http-basic {enable | disable}
set
set
auth-lockout-duration <seconds>
set
set
auth-multi-group {enable | disable}
end set
auth-secure-http {enable | disable}
set
auth-type {ftp | http | https | telnet}
set
auth-timeout <auth_timeout_minutes>
set
auth-timeout-type {idle-timeout | hard-timeout | new-session}
config auth-ports
set
set
type {ftp | http | https | telnet}
end
Variable
auth-blackout-time
<blackout_time_int>
Description
When a firewall authentication attempt fails 5 times within one minute the IP address that is the source of the authentication attempts is denied access for the
<blackout_time_int> period in seconds. The range is 0 to 3600 seconds.
auth-cert <cert_name>
HTTPS server certificate for policy authentication.
Fortinet_Factory, Fortinet_Firmware (if applicable to your FortiGate unit), and self-sign are built-in certificates but others will be listed as you add them.
auth-http-basic
{enable | disable}
Enable or disable support for HTTP basic authentication for identity-based firewall policies.
HTTP basic authentication usually causes a browser to display a pop-up authentication window instead of displaying an authentication web page. Some basic web browsers, for example, web browsers on mobile devices, may only support HTTP basic authentication.
auth-invalid-max <int>
Enter the maximum number of failed authentication attempts to allow before the client is blocked. Range:
1-100.
Default
0 self-sign disable
5
Fortinet Technologies Inc.
Page 740 FortiOS™ - CLI Reference for FortiOS 5.0
user
Variable
auth-lockout-duration
<seconds> auth-lockout-threshold
<int> auth-multi-group
{enable | disable} auth-secure-http
{enable | disable} auth-type {ftp | http
| https | telnet} auth-timeout
<auth_timeout_minutes> auth-timeout-type
{idle-timeout
| hard-timeout
| new-session}
Description
Enter the login lockout period in seconds. The lockout is imposed after too many failed login attempts, set by auth-lockout-threshold.
Enter the number of login attempts that trigger a login lockout. Range 1 to 10.
Default
0
3 enable
This option can be disabled if the Active Directory structure is setup such that users belong to only 1 group for the purpose of firewall authentication. disable
Enable to have http user authentication redirected to secure channel - https.
Set the user authentication protocol support for firewall policy authentication. User controls which protocols should support the authentication challenge.
5
Set the number of minutes before the firewall user authentication timeout requires the user to authenticate again. The maximum authtimeout interval is 1440 minutes (24 hours). To improve security, keep the authentication timeout at the default value of 5 minutes.
Set the type of authentication timeout. idle-timeout idle-timeout — applies only to idle session hard-timeout — applies to all sessions radius-ses-timeout-act
{hard-timeout
| ignore-timeout} new-session — applies only to new sessions
Select how to use RADIUS session timeout: hard-timeout — use RADIUS timeout ignore-timeout — ignore RADIUS timeout config auth-ports variables
<auth-table-entry-id>
Create an entry in the authentication port table if you are using non-standard ports. port <port_int> type {ftp | http | https
| telnet}
Specify the authentication port. Range 1 to 65535.
Specify the protocol to which port applies.
hard-timeout
1024 http
setting
Fortinet Technologies Inc.
Page 741 FortiOS™ - CLI Reference for FortiOS 5.0
user
tacacs+
tacacs+
Use this command to add or edit the information used for TACACS+ authentication.
Terminal Access Controller Access-Control System (TACACS+) is a remote authentication protocol used to communicate with an authentication server. TACACS+ allows a client to accept a user name and password and send a query to a TACACS+ authentication server. The server host determines whether to accept or deny the request and sends a response back that allows or denies network access to the user.
The default port for a TACACS+ server is 49. The maximum number of remote TACACS+ servers that can be configured for authentication is 10.
You may select an alternative authentication method for each server. These include CHAP, PAP,
MS-CHAP, and ASCII.
Syntax
config user tacacs+
end
set key <server_key> set port <tacacs+_port_num> set server <domain> set source-ip <ipv4_addr>
Variable Description
edit <server_name>
Enter a name to identify the TACACS+ server.
Default
Enter a new name to create a new server definition or enter an existing server name to edit that server definition. authen-type {ascii | auto | chap | ms_chap | pap}
Select the authentication method for this TACACS+ server. authorization
{enable | disable} key <server_key> auto uses pap, ms_chap_v, and chap, in that order.
Enable or disable TACACS+ authorization.
Enter the key to access the server. The maximum number is 16.
port
<tacacs+_port_num> server <domain>
Change the default TACACS+ port for this server. The default port for TACACS+ traffic is
49. Range is
0..65535.
Enter the TACACS+ server domain name or IP address.
The host name must comply with RFC1035.
source-ip <ipv4_addr> Enter the source IP for communications to TACACS+ server.
auto disable
49
No default.
0.0.0.0
•
Fortinet Technologies Inc.
Page 742 FortiOS™ - CLI Reference for FortiOS 5.0
voip
Use VoIP commands to configure VoIP profiles for firewall policies.
This chapter describes the following command:
Page 743
voip
profile
profile
Use this command to add VoIP profiles for SIP, SIMPLE, and SCCP. To apply the SIP ALG, you add a VoIP profile to a firewall policy that accepts SIP sessions. All SIP sessions accepted by the firewall policy will be processed by the SIP ALG using the settings in the VoIP profile. The
VoIP profile contains settings that are applied to SIP, Session Initiation Protocol for Instant
Messaging and Presence Leveraging Extensions (SIMPLE) and Skinny Call Control Protocol
(SCCP) sessions. You configure SIP and SCCP settings separately. SIP settings also apply to
SIMPLE sessions.
Syntax
config voip profile
edit <profile_name> set comment <comment_str> set extended-utm-log {enable | disable} config sip
set
set
set
open-register-pinhole {enable | disable}
set
open-contact-pinhole {enable | disable}
set
open-record-route-pinhole {enable | disable}
set
open-via-pinhole {enable | disable}
set
strict-register {enable | disable}
set
register-rate <rate_sec_policy_int>
set
invite-rate <rate_sec_policy_int>
set
set
set
block-long-lines {enable | disable}
set
block-unknown {enable | disable}
set
call-keepalive <keepalive_time>
set
set
set
block-cancel {enable | disable}
set
set
block-invite {enable | disable}
set
block-message {enable | disable}
set
block-notify {enable | disable}
set
block-options {enable | disable}
set
block-prack {enable | disable}
set
block-publish {enable | disable}
set
block-refer {enable | disable}
set
block-register {enable | disable}
set
block-subscribe {enable | disable}
set
block-update {enable | disable}
set
reg-diff-port {enable | disable}
set
rfc2543-branch {enable | disable}
set
log-violations {enable | disable}
set
log-call-summary {enable | disable}
set
Fortinet Technologies Inc.
Page 744 FortiOS™ - CLI Reference for FortiOS 5.0
voip
Fortinet Technologies Inc.
profile
set
subscribe-rate <rate_sec_policy_int>
set
message-rate <rate_sec_policy_int>
set
notify-rate <rate_sec_policy_int>
set
refer-rate <rate_sec_policy_int>
set
update-rate <rate_sec_policy_int>
set
options-rate <rate_sec_policy_int>
set
ack-rate <rate_sec_policy_int>
set
prack-rate <rate_sec_policy_int>
set
info-rate <rate_sec_policy_int>
set
publish-rate <rate_sec_policy_int>
set
bye-rate <rate_sec_policy_int>
set
cancel-rate <rate_sec_policy_int>
set
preserve-override {enable | disable}
set
no-sdp-fixup {enable | disable}
set
contact-fixup {enable | disable}
set
max-idle-dialogs <dialogs_perpolicy_int>
set
block-geo-red-options {enable | disable}
set
hosted-nat-traversal {enable | disable}
set
hnt-restrict-source-ip {enable | disable}
set
max-body-length <size_bytes_int>
set
unknown-header {discard | pass | respond}
set
malformed-request-line {discard | pass | respond}
set
malformed-header-via {discard | pass | respond}
set
malformed-header-from {discard | pass | respond}
set
malformed-header-to {discard | pass | respond}
set
malformed-header-call-id {discard | pass | respond}
set
malformed-header-cseq {discard | pass | respond}
set
malformed-header-rack {discard | pass | respond}
set
malformed-header-rseq {discard | pass | respond}
set
malformed-header-contact {discard | pass | respond}
set
malformed-header-record-route {discard | pass | respond}
set
malformed-header-route {discard | pass | respond}
set
malformed-header-expires {discard | pass | respond}
set
malformed-header-content-type {discard | pass | respond}
set
malformed-header-content-length {discard | pass | respond}
set
malformed-header-max-forwards {discard | pass | respond}
set
malformed-header-allow {discard | pass | respond}
set
malformed-header-p-asserted-identity {discard | pass | respond}
set
malformed-header-sdp-v {discard | pass | respond}
set
malformed-header-sdp-o {discard | pass | respond}
set
malformed-header-sdp-s {discard | pass | respond}
set
malformed-header-sdp-i {discard | pass | respond}
set
malformed-header-sdp-c {discard | pass | respond}
set
malformed-header-sdp-b {discard | pass | respond}
set
malformed-header-sdp-z {discard | pass | respond}
set
malformed-header-sdp-k {discard | pass | respond}
set
malformed-header-sdp-a {discard | pass | respond}
Page 745 FortiOS™ - CLI Reference for FortiOS 5.0
voip profile
set
malformed-header-sdp-t {discard | pass | respond}
set
malformed-header-sdp-r {discard | pass | respond}
set
malformed-header-sdp-m {discard | pass | respond}
set
set
provisional-invite-expiry-time <time_int>
set
set
ssl-algorithm {high | medium | low)
set
set
set
ssl-client-certificate <cert_name>
set
ssl-client-renegotiation {allow | deny | secure}
set
ssl-min-version {ssl-3.0 | tls-1.0 | tls-1.1}
set
ssl-max-version {ssl-3.0 | tls-1.0 | tls-1.1}
set
ssl-pfs {require | allow | deny}
set
ssl-send-empty-frags {enable | disable}
set
ssl-server-certificate <cert_name>
end end
set
set
block-mcast {enable | disable}
set
verify-header {enable | disable}
set
log-call-summary {disable | enable}
set
log-violations {disable | enable}
set
end
Variable
edit <profile_name> extended-utm-log
{enable | disable}
Description
Enter the name of a VoIP profile comment <comment_str>
Optionally enter a description of up to 63 characters of the VoIP profile.
Enable or disable detailed UTM log messages.
Default
disable
config sip
Configure VoIP profile settings for SIP and SIMPLE.
Variable
status {enable | disable} rtp {enable | disable} open-register-pinhole
{enable | disable} open-contact-pinhole
{enable | disable} open-record-route-pinhole
{enable | disable}
Description
Enable or disable SIP for this VoIP profile.
Enable or disable opening pinholes for RTP traffic to traverse FortiGate unit.
Enable or disable opening a pinhole for the port number specified in SIP REGISTER message Contact header line.
Enable or disable opening a pinhole for the port number specified in a Contact header line in any SIP message except a SIP REGISTER message.
Open firewall pinhole for Record-Route port.
Default
enable enable enable enable enable
Fortinet Technologies Inc.
Page 746 FortiOS™ - CLI Reference for FortiOS 5.0
voip profile
Variable
open-via-pinhole
{enable | disable} strict-register
{enable | disable}
Description
Open firewall pinhole for Via port.
Default
disable
Controls how pinholes are opened to allow traffic from a
SIP server to pass through the FortiGate unit. If enabled the SIP ALG opens a pinhole that only accepts sessions from a single IP address (the address of the SIP server).
disable
This option should be disabled if the SIP proxy server and SIP registrar are different entities with different IP addresses.
register-rate
<rate_sec_policy_int> invite-rate
<rate_sec_policy_int> max-dialogs <max_int>
Set a rate limit (per second, per policy) for SIP REGISTER requests. Set to 0 to disable rate limiting.
Set a rate limit (per second, per policy) for SIP INVITE requests. Set to 0 to disable rate limiting.
0
0
Maximum number of concurrent calls (or dialogs) per policy. Set to 0 to not limit dialogs.
0 max-line-length
<length_int>
Maximum SIP header line length. The range is 78-4096 characters. If a SIP message contains a line that exceeds the maximum line length a log message is recorded. If block-long-lines is enabled the message is blocked and the FortiGate unit returns a SIP 413 Request entity too large SIP response message.
998 block-long-lines
{enable | disable}
Enable or disable blocking SIP request messages with a header or body line that exceeds the max-linelength.
Block unrecognized SIP request messages. enable block-unknown
{enable | disable} call-keepalive
<keepalive_time>
Continue tracking calls with no RTP sessions for this many minutes. Terminate the call if the time limit is exceeded. Range is 1 and 10,080 seconds. Set to 0 to disable. Call keep alive should be used with caution because enabling this feature results in extra FortiGate
CPU overhead and can cause delay/jitter for the VoIP call. Also, the FortiGate unit terminates the call without sending SIP messages to end the call. And if the SIP endpoints send SIP messages to terminate the call they will be blocked by the FortiGate unit if they are sent after the FortiGate unit terminates the call.
enable
0 block-ack {enable | disable} Enable or disable blocking SIP ACK request messages. disable block-bye {enable | disable} Enable or disable blocking SIP BYE request messages. disable block-cancel
{enable | disable} block-info
{enable | disable}
Enable or disable blocking SIP CANCEL request messages.
Enable or disable blocking SIP INFO request messages. disable disable
Enable or disable blocking SIP INVITE request messages. disable block-invite
{enable | disable} block-message
{enable | disable} block-notify
{enable | disable}
Enable or disable blocking SIP MESSAGE request messages.
Enable or disable blocking SIP NOTIFY request messages. disable disable
Fortinet Technologies Inc.
Page 747 FortiOS™ - CLI Reference for FortiOS 5.0
voip profile
Variable
block-options
{enable | disable} block-prack
{enable | disable} block-publish
{enable | disable} block-refer
{enable | disable} block-register
{enable | disable} block-subscribe
{enable | disable} block-update
{enable | disable} reg-diff-port
{enable | disable} rfc2543-branch
{enable | disable}
Description
Enable or disable blocking SIP OPTIONS request messages.
Enable or disable blocking SIP PRACK request messages.
Enable or disable blocking SIP PUBLISH request messages.
Enable or disable blocking SIP REFER request messages.
Enable or disable blocking SIP REGISTER request messages.
Enable or disable blocking SIP SUBSCRIBE request messages.
Enable or disable blocking SIP UPDATE request messages.
Enable or disable opening a pinhole for the port number included in the Via SIP message header line.
Enable to support RFC 2543-complaint SIP calls involving branch commands that are missing or that are valid for RFC 2543 but invalid for RFC 3261. RFC 3261 is the most recent SIP RFC. RFC 3261 obsoletes RFC
2543. This option also allows FortiGate units to support
SIP calls that include Via headers that are missing the branch parameter.
log-violations
{enable | disable}
Enable or disable writing a logging message when a SIP option in a VoIP profile detects a violation in a SIP message.
log-call-summary
{enable | disable}
Enable or disable summary content archiving of SIP calls.
nat-trace {enable | disable}
Enable or disable preserving the original source IP address of the SIP message in the i= line of the SDP profile. This option enables NAT with IP address conservation (also called SIP NAT tracing), which changes the contents of SIP messages by adding the source IP address of the originator of the message into the SDP i= line of the SIP message. The SDP i= line is used for free-form text. However, if your SIP server can retrieve information from the SDP i= line, it can be useful for keeping a record of the source IP address of the originator of a SIP message when operating in a NAT environment. You can use this feature for billing purposes by extracting the IP address of the originator of the message.
subscribe-rate
<rate_sec_policy_int>
Limit the number of SIP SUBSCRIBE messages per second per policy that the FortiGate unit accepts. Set to
0 to disable rate limiting.
message-rate
<rate_sec_policy_int>
Limit the number of SIP MESSAGE messages per second per policy that the FortiGate unit accepts. Set to
0 to disable rate limiting.
Default
disable disable disable disable disable disable disable disable disable disable enable enable
0
0
Fortinet Technologies Inc.
Page 748 FortiOS™ - CLI Reference for FortiOS 5.0
voip
Variable
notify-rate
<rate_sec_policy_int> refer-rate
<rate_sec_policy_int> update-rate
<rate_sec_policy_int> options-rate
<rate_sec_policy_int> ack-rate
<rate_sec_policy_int> prack-rate
<rate_sec_policy_int> info-rate
<rate_sec_policy_int> publish-rate
<rate_sec_policy_int> bye-rate
<rate_sec_policy_int> cancel-rate
<rate_sec_policy_int> preserve-override
{enable | disable} no-sdp-fixup
{enable | disable} contact-fixup
{enable | disable}
profile
Description
Limit the number of SIP NOTIFY messages per second per policy that the FortiGate unit accepts. Set to 0 to disable rate limiting.
Limit the number of SIP REFER messages per second per policy that the FortiGate unit accepts. Set to 0 to disable rate limiting.
0
Limit the number of SIP UPDATE messages per second per policy that the FortiGate unit accepts. Set to 0 to disable rate limiting.
0
Limit the number of SIP OPTIONS messages per second per policy that the FortiGate unit accepts. Set to 0 to disable rate limiting.
0
0
Limit the number of SIP ACK messages per second per policy that the FortiGate unit accepts. Set to 0 to disable rate limiting.
0
Limit the number of SIP PRACK messages per second per policy that the FortiGate unit accepts. Set to 0 to disable rate limiting.
0
Limit the number of SIP INFO messages per second per policy that the FortiGate unit accepts. Set to 0 to disable rate limiting.
Default
0
0
Limit the number of SIP PUBLISH messages per second per policy that the FortiGate unit accepts. Set to 0 to disable rate limiting.
0
Limit the number of SIP BYE messages per second per policy that the FortiGate unit accepts. Set to 0 to disable rate limiting.
0
Limit the number of SIP CANCEL messages per second per policy that the FortiGate unit accepts. Set to 0 to disable rate limiting.
disable
Enable or disable adding the original o= line of a SIP message to the end of the i= line or replace the i= line in the original message with a new i= line. This command is used for SIP IP address conservation.
disable
Enable or disable not performing NAT on addresses in the SDP lines of the SIP message body. This option is disabled by default and the FortiGate unit performs NAT on addresses in SDP lines. Enable this option if you don’t want the FortiGate unit to perform NAT on the addresses in SDP lines.
enable
Enable or disable performing NAT on the IP addresses and port numbers in the headers in SIP CONTACT messages even if they don’t match the session’s IP address and port numbers.
Fortinet Technologies Inc.
Page 749 FortiOS™ - CLI Reference for FortiOS 5.0
voip profile
Variable
max-idle-dialogs
<dialogs_perpolicy_int> block-geo-red-options
{enable | disable} hosted-nat-traversal
{enable | disable} hnt-restrict-source-ip
{enable | disable} max-body-length
<size_bytes_int> unknown-header {discard | pass | respond} malformed-request-line
{discard | pass | respond} malformed-header-via
{discard | pass | respond} malformed-header-from
{discard | pass | respond}
Description
Specify the maximum number of established but idle dialogs to retain (per policy). Set to 0 to disable.
Default
0
Idle dialogs would usually be dialogs that have been interrupted because of errors or problems or as the result of a SIP attack that opens a large number of SIP dialogs without closing them. This command provides a way to remove these dialogs from the dialog table and recover memory and resources being used by these open and idle dialogs.
Block OPTIONS requests, but OPTIONS requests still notify for redundancy.
disable
Enable or disable support for hosted NAT Traversal
(HNT). HNT has different requirements for address translation.
disable
Restrict RTP source IP to be the same as SIP source IP when HNT is enabled.
disable
Specify the maximum size of a SIP message body in bytes that will be processed by the SIP ALG. Larger messages are discarded. Set to 0 for no limit. This option checks the value in the SIP Content-Length header line to determine body length. The Content-Length can be larger than the actual size of a SIP message if the SIP message content is split over more than one packet. SIP messages are of variable size and the message size can change with the addition of Via and Record-Route headers.
0 pass
Configure deep SIP message inspection to discard, pass without changing, or discard and send a SIP response message for a SIP message with an unknown header line. Even if set to pass the SIP ALG writes a log message if an unknown header is found and logviolations is enabled.
Configure deep SIP message inspection to discard, pass without changing, or discard and send a SIP response message for a SIP message a with a malformed requestline (the first line in a SIP request message). Even if set to pass the SIP ALG writes a log message if an unknown header is found and log-violations is enabled.
Configure deep SIP message inspection to discard, pass without changing, or discard and send a SIP response message for a SIP message a with a malformed Via header line. Even if set to pass the SIP ALG writes a log message if an unknown header is found and logviolations is enabled.
Configure deep SIP message inspection to discard, pass without changing, or discard and send a SIP response message for a SIP message a with a malformed From header line. Even if set to pass the SIP ALG writes a log message if an unknown header is found and logviolations is enabled.
pass pass pass
Fortinet Technologies Inc.
Page 750 FortiOS™ - CLI Reference for FortiOS 5.0
voip profile
Variable
malformed-header-to
{discard | pass | respond} malformed-header-call-id
{discard | pass | respond} malformed-header-cseq
{discard | pass | respond} malformed-header-rack
{discard | pass | respond} malformed-header-rseq
{discard | pass | respond} malformed-header-contact
{discard | pass | respond} malformed-header-recordroute {discard | pass | respond} malformed-header-route
{discard | pass | respond}
Description
Configure deep SIP message inspection to discard, pass without changing, or discard and send a SIP response message for a SIP message a with a malformed To header line. Even if set to pass the SIP ALG writes a log message if an unknown header is found and logviolations is enabled.
Configure deep SIP message inspection to discard, pass without changing, or discard and send a SIP response message for a SIP message a with a malformed Call ID header line. Even if set to pass the SIP ALG writes a log message if an unknown header is found and logviolations is enabled.
Configure deep SIP message inspection to discard, pass without changing, or discard and send a SIP response message for a SIP message a with a malformed CSeq header line. Even if set to pass the SIP ALG writes a log message if an unknown header is found and logviolations is enabled.
Configure deep SIP message inspection to discard, pass without changing, or discard and send a SIP response message for a SIP message a with a malformed Rack header line. Even if set to pass the SIP ALG writes a log message if an unknown header is found and logviolations is enabled.
Configure deep SIP message inspection to discard, pass without changing, or discard and send a SIP response message for a SIP message a with a malformed RSeq header line. Even if set to pass the SIP ALG writes a log message if an unknown header is found and logviolations is enabled.
Configure deep SIP message inspection to discard, pass without changing, or discard and send a SIP response message for a SIP message a with a malformed Contact header line. Even if set to pass the SIP ALG writes a log message if an unknown header is found and logviolations is enabled.
Configure deep SIP message inspection to discard, pass without changing, or discard and send a SIP response message for a SIP message a with a malformed Record-
Route header line. Even if set to pass the SIP ALG writes a log message if an unknown header is found and logviolations is enabled.
Configure deep SIP message inspection to discard, pass without changing, or discard and send a SIP response message for a SIP message a with a malformed Route header line. Even if set to pass the SIP ALG writes a log message if an unknown header is found and logviolations is enabled.
Default
pass pass pass pass pass pass pass pass
Fortinet Technologies Inc.
Page 751 FortiOS™ - CLI Reference for FortiOS 5.0
voip profile
Variable
malformed-header-expires
{discard | pass | respond} malformed-header-contenttype {discard | pass | respond} malformed-header-contentlength {discard | pass | respond} malformed-header-maxforwards {discard | pass | respond} malformed-header-allow
{discard | pass | respond} malformed-header-passerted-identity {discard | pass | respond} malformed-header-sdp-v
{discard | pass | respond} malformed-header-sdp-o
{discard | pass | respond}
Description
Configure deep SIP message inspection to discard, pass without changing, or discard and send a SIP response message for a SIP message a with a malformed Expires header line. Even if set to pass the SIP ALG writes a log message if an unknown header is found and logviolations is enabled.
Configure deep SIP message inspection to discard, pass without changing, or discard and send a SIP response message for a SIP message a with a malformed Content-
Type header line. Even if set to pass the SIP ALG writes a log message if an unknown header is found and logviolations is enabled.
Configure deep SIP message inspection to discard, pass without changing, or discard and send a SIP response message for a SIP message a with a malformed Content-
Length header line. Even if set to pass the SIP ALG writes a log message if an unknown header is found and log-violations is enabled.
Configure deep SIP message inspection to discard, pass without changing, or discard and send a SIP response message for a SIP message a with a malformed Maxforwards header line. Even if set to pass the SIP ALG writes a log message if an unknown header is found and log-violations is enabled.
Configure deep SIP message inspection to discard, pass without changing, or discard and send a SIP response message for a SIP message a with a malformed Allow header line. Even if set to pass the SIP ALG writes a log message if an unknown header is found and logviolations is enabled.
Configure deep SIP message inspection to discard, pass without changing, or discard and send a SIP response message for a SIP message a with a malformed P-
Asserted-Identity header line. Even if set to pass the SIP
ALG writes a log message if an unknown header is found and log-violations is enabled.
Configure deep SIP message inspection to discard, pass without changing, or discard and send a SIP response message for a SIP message a with a malformed v= body line. Even if set to pass the SIP ALG writes a log message if an unknown header is found and logviolations is enabled.
Configure deep SIP message inspection to discard, pass without changing, or discard and send a SIP response message for a SIP message a with a malformed o= body line. Even if set to pass the SIP ALG writes a log message if an unknown header is found and logviolations is enabled.
Default
pass pass pass pass pass pass pass pass
Fortinet Technologies Inc.
Page 752 FortiOS™ - CLI Reference for FortiOS 5.0
voip profile
Variable
malformed-header-sdp-s
{discard | pass | respond} malformed-header-sdp-i
{discard | pass | respond} malformed-header-sdp-c
{discard | pass | respond} malformed-header-sdp-b
{discard | pass | respond} malformed-header-sdp-z
{discard | pass | respond} malformed-header-sdp-k
{discard | pass | respond} malformed-header-sdp-a
{discard | pass | respond} malformed-header-sdp-t
{discard | pass | respond}
Description
Configure deep SIP message inspection to discard, pass without changing, or discard and send a SIP response message for a SIP message a with a malformed s= body line. Even if set to pass the SIP ALG writes a log message if an unknown header is found and logviolations is enabled.
Configure deep SIP message inspection to discard, pass without changing, or discard and send a SIP response message for a SIP message a with a malformed i= body line. Even if set to pass the SIP ALG writes a log message if an unknown header is found and logviolations is enabled.
Configure deep SIP message inspection to discard, pass without changing, or discard and send a SIP response message for a SIP message a with a malformed c= body line. Even if set to pass the SIP ALG writes a log message if an unknown header is found and logviolations is enabled.
Configure deep SIP message inspection to discard, pass without changing, or discard and send a SIP response message for a SIP message a with a malformed b= body line. Even if set to pass the SIP ALG writes a log message if an unknown header is found and logviolations is enabled.
Configure deep SIP message inspection to discard, pass without changing, or discard and send a SIP response message for a SIP message a with a malformed z= body line. Even if set to pass the SIP ALG writes a log message if an unknown header is found and logviolations is enabled.
Configure deep SIP message inspection to discard, pass without changing, or discard and send a SIP response message for a SIP message a with a malformed k= body line. Even if set to pass the SIP ALG writes a log message if an unknown header is found and logviolations is enabled.
Configure deep SIP message inspection to discard, pass without changing, or discard and send a SIP response message for a SIP message a with a malformed a= body line. Even if set to pass the SIP ALG writes a log message if an unknown header is found and logviolations is enabled.
Configure deep SIP message inspection to discard, pass without changing, or discard and send a SIP response message for a SIP message a with a malformed t= body line. Even if set to pass the SIP ALG writes a log message if an unknown header is found and logviolations is enabled.
Default
pass pass pass pass pass pass pass pass
Fortinet Technologies Inc.
Page 753 FortiOS™ - CLI Reference for FortiOS 5.0
voip profile
Variable
malformed-header-sdp-r
{discard | pass | respond} malformed-header-sdp-m
{discard | pass | respond} ips-rtp {enable | disable} provisional-invite-expirytime <time_int> ssl-mode {off | full} ssl-algorithm {high
| medium | low) ssl-auth-client
<peer_group> ssl-auth-server
<peer_group> ssl-client-certificate
<cert_name> ssl-client-renegotiation
{allow | deny | secure}
Description
Configure deep SIP message inspection to discard, pass without changing, or discard and send a SIP response message for a SIP message a with a malformed r= body line. Even if set to pass the SIP ALG writes a log message if an unknown header is found and logviolations is enabled.
Configure deep SIP message inspection to discard, pass without changing, or discard and send a SIP response message for a SIP message a with a malformed m= body line. Even if set to pass the SIP ALG writes a log message if an unknown header is found and logviolations is enabled.
Enable to have RTP traffic inherit the IPS setting from the
SIP firewall policy. Disable if IPS slows down RTP traffic, which might occur if there is a high volume of RTP traffic.
Also if the traffic is using NP accelerated interfaces, enabling IPS means that the RTP traffic cannot be accelerated by NP interface acceleration.
Select SSL mode:
Default
pass pass enable
The expiry time in seconds to wait for provisional INVITE requests. The range is 10-3600 seconds.
210 off full — client-to-FortiGate and FortiGate-to-client off — no SSL
Select SSL algorithm strength: high
high — AES or 3DES
medium — AES, 3DES, RC4, or DES
low — AES, 3DES, or RC4
Require a client certificate and authenticate it with the peer or peergrp.
Authenticate the server certificate with the peer or peergrp.
Select the certificate to use for client authentication.
null null null
Select the client renegotiation policy:
allow — allow SSL client to renegotiate allow
deny — reject any attempt to renegotiate
secure — reject any renegotiation attempt that does not offer a RFC 5746 Secure Regotiation Indication
Select the minimum SSL/TLS version to accept.
ssl-3.0
ssl-min-version {ssl-3.0
| tls-1.0 | tls-1.1} ssl-max-version {ssl-3.0
| tls-1.0 | tls-1.1} ssl-pfs {require | allow
| deny}
Select the maximum SSL/TLS version to accept.
Set policy for Perfect Forward Secrecy (PFS). tls-1.1
allow
Fortinet Technologies Inc.
Page 754 FortiOS™ - CLI Reference for FortiOS 5.0
voip profile
Variable
ssl-send-empty-frags
{enable | disable} ssl-server-certificate
<cert_name>
Description
Enable sending empty fragments to avoid attack on CBC
IV (SSL 3.0 & TLS 1.0 only).
Default
enable
Select the certificate to use for server authentication.
null
config sccp
Configure VoIP profile settings for SCCP.
Variable
status {disable | enable} block-mcast
{enable | disable} verify-header
{enable | disable} log-call-summary {disable | enable} log-violations {disable | enable} max-calls <calls_int>
Description
Enable or disable SCCP.
Default
enable
Enable or disable blocking multicast RTP connections.
disable
Enable or disable verifying SCCP header content.
Enable or disable summary content archiving of SCCP calls.
disable enable
Enable or disable writing a logging message when a SIP option in a VoIP profile detects a violation in a SIP message.
disable
Enter the maximum number of calls per minute per
SCCP client. The range is 1 to 65535. Set to 0 to disable limiting the number of calls.
0
Fortinet Technologies Inc.
Page 755 FortiOS™ - CLI Reference for FortiOS 5.0
vpn
Use vpn commands to configure options related to virtual private networking through the
FortiGate unit, including:
• IPSec operating parameters
• a local address range for PPTP or L2TP clients
• SSL VPN configuration settings
This chapter contains the following sections:
ssl web virtual-desktop-app-list
Page 756
vpn certificate ca
certificate ca
Use this command to install Certificate Authority (CA) root certificates.
When a CA processes your Certificate Signing Request (CSR), it sends you the CA certificate, the signed local certificate and the Certificate Revocation List (CRL).
The process for obtaining and installing certificates is as follows:
1. Use the execute vpn certificate local command to generate a CSR.
2. Send the CSR to a CA.
The CA sends you the CA certificate, the signed local certificate and the CRL.
3. Use the vpn certificate local command to install the signed local certificate.
4. Use the vpn certificate ca command to install the CA certificate.
5. Use the vpn certificate crl command to install the CRL.
Depending on your terminal software, you can copy the certificate and paste it into the command.
The CA certificate can update automatically from a Simple Certificate Enrollment Protocol
(SCEP) server.
Syntax
config vpn certificate ca
end
To view all of the information about the certificate, use the get command: get vpn certificate ca <ca_name>
Variable
edit <ca_name> ca <cert>
Description
Enter a name for the CA certificate.
Enter or retrieve the CA certificate in PEM format.
Fields relevant to SCEP auto-update
auto-update-days
<days_int>
Enter how many days before expiry the FortiGate unit requests an updated CA certificate. Enter
0 for no autoupdate.
auto-update-dayswarning <days_int>
Enter how many days before CA certificate expiry the
FortiGate generates a warning message. Enter 0 for no warning.
scep-url <URL_str>
Enter the URL of the SCEP server.
source-ip <ip4_addr> Enter an address to verify request is send from expected
IP. source-ip can be set after local Certificate is generated.
0
0
Default
No default.
No default.
No default.
No default.
Fortinet Technologies Inc.
Page 757 FortiOS™ - CLI Reference for FortiOS 5.0
vpn certificate crl
certificate crl
Use this command to install a Certificate Revocation List (CRL).
When a CA processes your Certificate Signing Request (CSR), it sends you the CA certificate, the signed local certificate and the Certificate Revocation List (CRL).
The process for obtaining and installing certificates is as follows:
1. Use the execute vpn certificate local command to generate a CSR.
2. Send the CSR to a CA.
The CA sends you the CA certificate, the signed local certificate and the CRL.
3. Use the vpn certificate local command to install the signed local certificate.
4. Use the vpn certificate ca command to install the CA certificate.
5. Use the vpn certificate crl command to install the CRL.
Depending on your terminal software, you can copy the certificate and paste it into the command.
The CRL can update automatically from a Simple Certificate Enrollment Protocol (SCEP) server.
Syntax
config vpn certificate crl
end
set update-vdom <update_vdom> set http-url <http_url> set update-interval <seconds>
Variable Description
edit <crl_name> crl <crl_PEM> ldap-server
<ldap_server_name> ldap-username
<ldap_username>
Enter a name for the Certificate Revocation List (CRL).
Enter the CRL in PEM format.
Name of the LDAP server defined in config user ldap table for
CRL auto-update.
LDAP login name.
ldap-password
<ldap_password> scep-cert
<scep_certificate>
LDAP login password.
Local certificate used for SCEP communication for CRL autoupdate.
scep-url <scep_url>
URL of the SCEP server used for automatic CRL certificate updates. The URL must begin with http:// or https://.
source-ip <ip4_addr> Enter an address to verify request is send from expected IP. source-ip can be set after local Certificate is generated.
Default
Fortinet-
Firmware
No default.
Fortinet Technologies Inc.
Page 758 FortiOS™ - CLI Reference for FortiOS 5.0
vpn certificate crl
Variable Description
update-vdom
<update_vdom>
VDOM used to communicate with remote SCEP server for
CRL auto-update.
http-url <http_url>
URL of an http server used for automatic CRL certificate updates. The URL must begin with http:// or https://.
update-interval
<seconds>
Enter how frequently, in seconds, the FortiGate unit checks for an updated CRL. Enter
0 to update the CRL only when it expires. This option is available when you add a scep-url.
Default
root
Fortinet Technologies Inc.
Page 759 FortiOS™ - CLI Reference for FortiOS 5.0
vpn certificate local
certificate local
Use this command to install local certificates.
When a CA processes your Certificate Signing Request (CSR), it sends you the CA certificate, the signed local certificate and the Certificate Revocation List (CRL).
The process for obtaining and installing certificates is as follows:
1. Use the execute vpn certificate local command to generate a CSR.
2. Send the CSR to a CA.
The CA sends you the CA certificate, the signed local certificate and the CRL.
3. Use the vpn certificate local command to install the signed local certificate.
4. Use the vpn certificate ca command to install the CA certificate.
5. Use the vpn certificate crl command to install the CRL.
Depending on your terminal software, you can copy the certificate and paste it into the command.
The local certificate can update automatically from a Simple Certificate Enrollment Protocol
(SCEP) server.
Syntax
config vpn certificate local
end
To view all of the information about the certificate, use the get command: get vpn certificate local [cert_name]
Variable Description Default
edit <cert_name> certificate <cert_PEM>
Enter the local certificate name.
Enter the signed local certificate in PEM format.
No default.
No default.
comments <comment_text> Enter any relevant information about the certificate.
No default.
You should not modify the following variables if you generated the CSR on this unit.
csr <csr_PEM> password <pwd> private-key <prkey> source-ip <ip4_addr>
The CSR in PEM format.
The password in PEM format.
The private key in PEM format.
No default.
No default.
No default.
No default.
Enter an address to verify request is send from expected IP. source-ip can be set after local
Certificate is generated.
Fortinet Technologies Inc.
Page 760 FortiOS™ - CLI Reference for FortiOS 5.0
vpn certificate local
Variable Description Default
Fields relevant to SCEP auto-update
scep-url <URL_str> scep-password
<password_str> auto-regenerate-days
<days_int>
Enter the URL of the SCEP server.
Enter the password for the SCEP server.
Enter how many days before expiry the FortiGate unit requests an updated local certificate. Enter
0 for no auto-update.
auto-regenerate-dayswarning <days_int>
Enter how many days before local certificate expiry the FortiGate generates a warning message. Enter 0 for no warning.
No default.
No default.
0
0
Fortinet Technologies Inc.
Page 761 FortiOS™ - CLI Reference for FortiOS 5.0
vpn certificate ocsp-server
certificate ocsp-server
Use this command to specify the revocation server for an OCSP (Online Certificate Status
Protocol) server certificate. You can also specify the action to take if the server is not available.
Syntax
config vpn certificate ocsp-server edit
<ocsp_name> set cert <cert_name> set secondary-cert <cert2_name>
end
To view all of the information about the certificate, use the get command: get vpn certificate ocsp [cert_name]
Variable
<ocsp_name> cert <cert_name>
Description
Enter a name for this OSCP server entry.
Enter the OCSP server public certificate (one of the remote certificates).
secondary-cert
<cert2_name> secondary-url
<ocsp2_url>
Enter the secondary OCSP server public certificate (one of the remote certificates).
Enter the URL of the secondary OCSP server.
source-ip <ip4_addr>
Enter an address to verify request is send from expected IP. source-ip can be set after local Certificate is generated.
url <ocsp_url>
Enter the URL of the OCSP server.
unavail-action
<unavailable_action>
Action taken on client certification when the OCSP server is unreachable. revoke or ignore. Default is revoke.
Fortinet Technologies Inc.
Page 762 FortiOS™ - CLI Reference for FortiOS 5.0
vpn certificate remote
certificate remote
Use this command to install remote certificates. The remote certificates are public certificates without a private key. They are used as OCSP (Online Certificate Status Protocol) server certificates.
Syntax
config vpn certificate remote edit
end
set remote <remote_cert_detail>
To view all of the information about the certificate, use the get command: get vpn certificate remote [cert_name]
Variable Description
cert <cert_name>
Enter the name of the public certificate.
remote <remote_cert_detail> Details/description of the remote certificate.
Fortinet Technologies Inc.
Page 763 FortiOS™ - CLI Reference for FortiOS 5.0
vpn certificate setting
certificate setting
Use this command to enable obtaining certificates by OSCP.
Syntax
config vpn certificate setting set
check-ca-cert {enable | disable}
end set
ocsp-status {enable | disable}
set
oscp-default-server <ocsp_name>
Variable Description
check-ca-cert
{enable | disable}
Enable to check certificate and fail the authentication if the CA certificate is not found.
ocsp-status {enable | disable} Enable or disable obtaining certificates by OCSP oscp-default-server
<ocsp_name>
Enter the OSCP server to use by default. This is one of the servers defined in
Default
enable disable null
Fortinet Technologies Inc.
Page 764 FortiOS™ - CLI Reference for FortiOS 5.0
vpn ipsec concentrator
ipsec concentrator
Use this command to add IPSec policy-based VPN tunnels to a VPN concentrator. The VPN concentrator collects hub-and-spoke tunnels into a group.
The concentrator allows VPN traffic to pass from one tunnel to the other through the FortiGate unit. The FortiGate unit functions as a concentrator, or hub, in a hub-and-spoke network.
VPN concentrators are not available in Transparent mode.
Syntax
config vpn ipsec concentrator edit <concentrator_name> end
set member <member_name> [member_name] [member_name] set src-check {enable | disable}
The member field is required.
Variable
edit
<concentrator_name> member
<member_name>
[member_name]
[member_name] src-check
{enable | disable}
Description
Enter a name for the concentrator.
Enter the names of up to three VPN tunnels to add to the concentrator. Separate the tunnel names with spaces.
Default
No default.
No default.
Members can be tunnels defined in vpn ipsec phase1 or vpn ipsec manual-key.
To add or remove tunnels from the concentrator you must re-enter the whole list with the required additions or deletions.
Enable to check the source address of the phase2 selector when locating the best matching phase2 in a concentrator. The default is to check only the destination selector.
disable
Fortinet Technologies Inc.
Page 765 FortiOS™ - CLI Reference for FortiOS 5.0
vpn ipsec forticlient
ipsec forticlient
Use this command to configure automatic VPN configuration for FortiClient Host Security application users.
The FortiClient users who will use automatic configuration must be members of a user group.
The config vpn ipsec forticlient command creates a “realm” that associates the user group with the phase 2 VPN configuration. You can create multiple realms to associate different user groups with different phase 2 configurations.
The user group identifies the user name and password settings that the dialup client’s credentials must match in order for authentication to be successful. The phase 2 tunnel definition and its associated firewall encryption policy provides the configuration parameters to download to the FortiClient Host Security application.
Syntax
Set or unset VPN policy distribution parameters.
config vpn ipsec forticlient
edit <realm_name> set phase2name <tunnel_name> set status {enable | disable}
end
set usergroupname <group_name>
Variable
edit <realm_name>
Description
Enter a name for the FortiClient realm. This is also referred to as the policy name.
phase2name
<tunnel_name>
Enter the name of the phase 2 tunnel configuration that you defined as part of the dialup-client configuration.
status {enable | disable} Enable or disable IPSec VPN policy distribution.
usergroupname
<group_name>
Enter the name of the user group that you created for dialup clients. This group must already exist.
Default
No default.
Null enable
Null
Fortinet Technologies Inc.
Page 766 FortiOS™ - CLI Reference for FortiOS 5.0
vpn ipsec manualkey
ipsec manualkey
Use this command to configure manual keys for IPSec tunnel-mode VPN tunnels. You configure a manual key tunnel to create an IPSec tunnel-mode VPN tunnel between the FortiGate unit and a remote IPSec VPN client or gateway that is also using manual key.
A manual key VPN tunnel consists of a name for the tunnel, the IP address of the VPN gateway or client at the opposite end of the tunnel, and the encryption and authentication algorithms to use for the tunnel. Because the keys are created when you configure the tunnel, no negotiation is required for the VPN tunnel to start. However, the VPN gateway or client that connects to this tunnel must use the same encryption and authentication algorithms and must have the same encryption and authentication keys.
Syntax
config vpn ipsec manualkey
edit <tunnel_name> set authentication <authentication_algorithm>
set authkey <authentication_key> set encryption <method>
set enckey <encryption_key> set interface <interface_name> set localspi <local_spi_number>
end
The authentication, encryption, interface, remote-gw, localspi, and remotespi fields are required. All other fields are optional.
Variable
edit <tunnel_name> authentication
<authentication_algorithm>
Description
Enter a name for the tunnel.
Enter one of the following authentication algorithms:
• md5
• null
• sha1
• sha256
• sha384
• sha512
Make sure you use the same algorithm at both ends of the tunnel.
Note: encryption and authentication cannot both be null.
Default
No default.
null
Fortinet Technologies Inc.
Page 767 FortiOS™ - CLI Reference for FortiOS 5.0
vpn
Variable
authkey
<authentication_key> encryption <method>
ipsec manualkey
Description
This field is available when authentication is set to md5, sha1, or sha256.
Default
-
Enter the key in 16-digit (8-byte) segments separated by hyphens. For example (MD5):
(No default.)
0102030405060708-090a0b0c0d0e0f10
For a SHA1 key, the final segment is only 8 digits
(4 bytes).
• If authentication is md5, enter a 32-digit (16byte) hexadecimal number.
• If authentication is sha1, enter a 40-digit (20byte) hexadecimal number.
• If authentication is sha256, enter a 64-digit
(32-byte) hexadecimal number.
Digits can be
0 to 9, and a to f.
Use the same authentication key at both ends of the tunnel.
Enter one of the following encryption algorithms: null
• 3des
• aes128
• aes192
• aes256
• aria128
• aria192
• aria256
• des
• seed
• null
The ARIA and seed algorithms are not available on some models.
Make sure you use the same algorithm at both ends of the tunnel.
Note: encryption and authentication cannot both be null.
Fortinet Technologies Inc.
Page 768 FortiOS™ - CLI Reference for FortiOS 5.0
vpn ipsec manualkey
Variable Description
enckey <encryption_key>
This field is available when encryption is set to
3des, aes128, aes192, aes256, or des. Enter the associated encryption key:
Default
-
(No default.)
• If encryption is des, enter a 16 digit (8 byte) hexadecimal number.
• If encryption is 3des, enter a 48 digit (24 byte) hexadecimal number.
• If encryption is aes128, enter a 32 digit (16 byte) hexadecimal number.
• If encryption is aes192, enter a 48 digit (24 byte) hexadecimal number.
• If encryption is aes256, enter a 64 digit (32 byte) hexadecimal number.
Digits can be
0 to 9, and a to f.
For all of the above, separate each 16 digit (8 byte) hexadecimal segment with a hyphen.
Use the same encryption key at both ends of the tunnel. interface <interface_name>
Enter the name of the physical, aggregate, or VLAN interface to which the IPSec tunnel will be bound.
The FortiGate unit obtains the IP address of the interface from system interface settings (see
).
Null.
You cannot change interface if a firewall policy references this VPN.
local-gw <address_ipv4>
Optionally, specify a secondary IP address of the interface selected in interface to use for the local end of the VPN tunnel. If you do not specify an IP address here, the FortiGate unit obtains the IP address of the interface from the system interface
settings (see “interface” on page 555 ).
localspi
<local_spi_number>
Local Security Parameter Index. Enter a hexadecimal number of up to eight digits (digits can be 0 to 9, a to f) in the range 0x100 to FFFFFFF. This number must be added to the Remote SPI at the opposite end of the tunnel.
npu-offload
{enable | disable}
Enable or disable offload of VPN session to NPU.
remote-gw <address_ipv4>
The IP address of the remote gateway external interface.
remotespi
<remote_spi_number>
Remote Security Parameter Index. Enter a hexadecimal number of up to eight digits in the range
0x100 to FFFFFFF. This number must be added to the Local SPI at the opposite end of the tunnel.
0.0.0.0
0x100 enable
0.0.0.0
0x100
Fortinet Technologies Inc.
Page 769 FortiOS™ - CLI Reference for FortiOS 5.0
vpn ipsec manualkey-interface
ipsec manualkey-interface
Use this command to configure manual keys for a route-based (interface mode) IPSec VPN tunnel. When you create a route-based tunnel, the FortiGate unit creates a virtual IPSec interface automatically. The interface can be modified afterward using the system network interface CLI command. This command is available only in NAT/Route mode.
Syntax
config vpn ipsec manualkey-interface
edit <tunnel_name> set auth-alg <authentication_algorithm>
set auth-key <authentication_key> set enc-alg <method>
set interface <interface_name>
end
set remote-spi <remote_spi_number>
The auth-alg, enc-alg, interface, remote-gw, local-spi, and remote-spi fields are required. All other fields are optional.
Default
No default.
null
Variable
edit <tunnel_name> auth-alg
<authentication_algorithm>
Description
Enter a name for the tunnel.
Enter one of the following authentication algorithms:
• md5
• null
• sha1
• sha256
• sha384
• sha512
Make sure you use the same algorithm at both ends of the tunnel.
Note: enc-alg and auth-alg cannot both be null.
Fortinet Technologies Inc.
Page 770 FortiOS™ - CLI Reference for FortiOS 5.0
vpn
Variable
auth-key
<authentication_key> enc-alg <method>
ipsec manualkey-interface
Description
This field is available when auth-alg is set to md5, sha1 or sha256.
Default
-
Enter the key in 16-digit (8-byte) segments separated by hyphens. For example (MD5):
(No default.)
0102030405060708-090a0b0c0d0e0f10
For a SHA1 key, the final segment is only 8 digits
(4 bytes).
• If auth-alg is md5, enter a 32-digit (16-byte) hexadecimal number.
• If auth-alg is sha1, enter a 40-digit (20-byte) hexadecimal number.
• If auth-alg is sha256, enter a 64-digit (32-byte) hexadecimal number.
Digits can be
0 to 9, and a to f.
Use the same authentication key at both ends of the tunnel.
Enter one of the following encryption algorithms: null
• 3des
• aes128
• aes192
• aes256
• des
• aria128
• aria192
• aria256
• seed
• null
The ARIA algorithm is not available on some models.
Make sure you use the same algorithm at both ends of the tunnel.
Note: enc-alg and auth-alg cannot both be null.
Fortinet Technologies Inc.
Page 771 FortiOS™ - CLI Reference for FortiOS 5.0
vpn ipsec manualkey-interface
Variable Description
enc-key <encryption_key>
This field is available when enc-alg is set to 3des, aes128, aes192, aes256, or des. Enter the associated encryption key:
• If enc-alg is des, enter a 16 digit (8 byte) hexadecimal number.
• If enc-alg is 3des, enter a 48 digit (24 byte) hexadecimal number.
• If enc-alg is aes128, enter a 32 digit (16 byte) hexadecimal number.
• If enc-alg is aes192, enter a 48 digit (24 byte) hexadecimal number.
• If enc-alg is aes256, enter a 64 digit (32 byte) hexadecimal number.
Digits can be
0 to 9, and a to f.
For all of the above, separate each 16 digit (8 byte) hexadecimal segment with a hyphen.
Default
-
(No default.)
Use the same encryption key at both ends of the tunnel. interface <interface_name> Enter the name of the physical, aggregate, or VLAN interface to which the IPSec tunnel will be bound. The
FortiGate unit obtains the IP address of the interface
from system interface settings (see “interface” on page 555
).
ip-version <4 | 6>
Enter
4 for IPv4 encapsulation or 6 for IPv6 encapsulation.
local-gw <address_ipv4> local-gw6 <address_ipv6>
By default, the FortiGate unit determines the local gateway IP address from the interface setting.
Optionally, you can specify a secondary IP address configured on the same interface.
Null.
4
0.0.0.0
for IPv4
:: for IPv6 local-spi
<local_spi_number> local-gw6 is available when ip-version is 6. local-gw is available when ip-version is 4.
Local Security Parameter Index. Enter a hexadecimal number of up to eight digits (digits can be 0 to 9, a to f) in the range 0x100 to FFFFFFF. This number must be added to the Remote SPI at the opposite end of the tunnel.
0x100
Enable or disable offload of VPN session to NPU.
enable npu-offload
{enable | disable} remote-gw <address_ipv4> remote-gw6
<address_ipv6>
The IP address of the remote gateway external interface.
0.0.0.0 for IPv4 remote-spi
<remote_spi_number> remote-gw6 is available when ip-version is 6. remote-gw is available when ip-version is 4.
Remote Security Parameter Index. Enter a hexadecimal number of up to eight digits in the range
0x100 to FFFFFFF. This number must be added to the
Local SPI at the opposite end of the tunnel.
:: for IPv6
0x100
Fortinet Technologies Inc.
Page 772 FortiOS™ - CLI Reference for FortiOS 5.0
vpn ipsec phase1
ipsec phase1
Use this command to add or edit IPSec tunnel-mode phase 1 configurations. When you add a tunnel-mode phase 1 configuration, you define how the FortiGate unit and a remote VPN peer
(gateway or client) authenticate themselves to each other as part of establishing an IPSec VPN tunnel.
The phase 1 configuration specifies the name of a remote VPN peer, the nature of the connection (static IP, dialup, or dynamic DNS), the encryption and authentication keys for the phase 1 proposal, and the authentication method (preshared key or certificate). For authentication to be successful, the FortiGate unit and the remote VPN peer must be configured with compatible phase 1 settings.
You can change all settings except the type setting after you define the configuration: if the address type of a remote peer changes, you must delete the original phase 1 configuration and define a new one. As a general rule, create only one phase 1 configuration per remote VPN peer.
Syntax
config vpn ipsec phase1 edit <gateway_name>
set localid <local_id> set localid-type {auto | fqdn | user-fqdn | keyid | address
set priority <prio> set proposal <encryption_combination>
Fortinet Technologies Inc.
Page 773 FortiOS™ - CLI Reference for FortiOS 5.0
vpn ipsec phase1
end
A proposal value is required. In NAT/Route mode, you must specify interface. A remote-gw value may be required depending on the value of the type attribute. You must also enter a preshared key or a certificate name depending on the value of authmethod. All other fields are optional.
Variable
edit <gateway_name> add-gw-route
{enable | disable} authmethod
<authentication_method> authpasswd <password> authusr <user_name>
Description Default
Enter a name (maximum 35 characters) for this gateway. If type is dynamic, the maximum name length is further reduced depending on the number of dialup tunnels that can be established: by 2 for up to 9 tunnels, by 3 for up to 99 tunnels, 4 for up to 999 tunnels, and so on.
No default.
disable
Enable to automatically add a route to the remote gateway specified in remote-gw.
Note: This command is deprecated.
Use the
dynamic-gateway {enable | disable}
field in config
Specify the authentication method: psk
• Enter psk to authenticate using a pre-shared key.
Use psksecret to enter the pre-shared key.
• Enter rsa-signature to authenticate using a digital certificate. Use set rsa-certificate to enter the name of the digital certificate.
You must configure certificates before selecting rsa-signature here. For more information, see
“execute vpn certificate local” on page 1006 and
“vpn certificate ca” on page 757 .
This field is available when xauthtype is set to client.
No default.
Enter the XAuth client password for the FortiGate unit.
This field is available when xauthtype is set to client.
Null
Enter the XAuth client user name for the FortiGate unit.
Fortinet Technologies Inc.
Page 774 FortiOS™ - CLI Reference for FortiOS 5.0
vpn ipsec phase1
Variable Description
authusrgrp <group_name>
This field is available when xauthtype is set to auto, pap, or chap.
Default
Null autoconfig {client | gateway
| disable} auto-negotiate
{enable | disable} dhgrp {1 2 5 14} distance <int> dpd {disable | enable} dpd-retrycount
<retry_integer>
When the FortiGate unit is configured as an XAuth server, enter the user group to authenticate remote
VPN peers. The user group can contain local users,
LDAP servers, and RADIUS servers. The user group must be added to the FortiGate configuration before the group name can be cross-referenced. For more information, see
“user local” on page 729 , and
Select VPN auto configuration mode: VPN gateway,
VPN client, or auto configuration disabled.
disable
Enable to keep trying to negotiate an IKE SA even if the link is down. The primary use of this feature is in cases where there are multiple redundant tunnels and you prefer the primary connection if it can be established. enable
5
Type
1, 2, 5 and/or 14 to select one or more Diffie-
Hellman groups from DH group 1, 2, 5 and 14 respectively. At least one of the DH group settings on the remote peer or client must be identical to one of the selections on the FortiGate unit.
1
Configure the administrative distance for routes added when a dialup IPSec connection is established. Using administrative distance you can specify the relative priorities of different routes to the same destination. A lower administrative distance indicates a more preferred route. Distance can be an integer from
“distance <distance>” on page 447
.
enable
Enable or disable DPD (Dead Peer Detection). DPD detects the status of the connection between VPN peers. Enabling DPD facilitates cleaning up dead connections and establishing new VPN tunnels. DPD is not supported by all vendors and is not used unless
DPD is supported and enabled by both VPN peers.
This field is available when dpd is set to enable.
3
The DPD retry count when dpd is set to enable. Set the number of times that the local VPN peer sends a
DPD probe before it considers the link to be dead and tears down the security association (SA). The dpdretrycount range is 0 to 10.
To avoid false negatives due to congestion or other transient failures, set the retry count to a sufficiently high value for your network.
Fortinet Technologies Inc.
Page 775 FortiOS™ - CLI Reference for FortiOS 5.0
vpn ipsec phase1
Variable
dpd-retryinterval <seconds>
[<milliseconds>]
Description
This field is available when dpd is set to enable.
The DPD (Dead Peer Detection) retry interval is the time that the local VPN peer waits between sending
DPD probes.
Set the time in seconds plus, optionally, milliseconds.
For example, for 2.5 seconds enter 2 500. The range is
1 to 60 seconds, 0 to 999 milliseconds.
Default
5
When the tunnel is starting, or if it has failed, a retry interval of 5 seconds is used if dpd-retryinterval is less than 5 seconds.
forticlient-enforcement
{enable | disable} fragmentation
{enable | disable} ike-version {1 | 2}
Enable to allow only FortiClient users to connect.
Enable intra-IKE fragmentation support on retransmission of fragmented packets.
Select whether to use IKEv1 or IKEv2 (RFC 4306).
interface <interface_name> Enter the name of the physical, aggregate, or VLAN interface to which the IPSec tunnel will be bound. The
FortiGate unit obtains the IP address of the interface from system interface settings (see
) unless you specify a different IP address
using the local-gw <address_ipv4> attribute.
disable enable
1
Null keepalive <seconds>
You cannot change interface if a firewall policy references this VPN.
This field is available when nattraversal is set to enable.
10
Set the NAT traversal keepalive frequency. This number specifies (in seconds) how frequently empty
UDP packets are sent through the NAT device to make sure that the NAT mapping does not change until P1 and P2 security associations expire. The keepalive frequency can be from 10 to 900 seconds.
keylife <seconds>
Set the keylife time. The keylife is the amount of time
(in seconds) before the phase 1 encryption key expires. When the key expires, a new key is generated without interrupting service. The range is 120 to
172,800 seconds.
local-gw <address_ipv4>
Optionally, specify a secondary IP address of the interface selected in interface to use for the local end of the VPN tunnel. If you do not specify an IP address here, the FortiGate unit obtains the IP address of the interface from the system interface settings (see
28800
0.0.0.0
Fortinet Technologies Inc.
Page 776 FortiOS™ - CLI Reference for FortiOS 5.0
vpn ipsec phase1
Variable
localid <local_id>
Description Default
Enter a local ID if the FortiGate unit is functioning as a
VPN client and will use the local ID for authentication purposes.
Null
If you want to dedicate a tunnel to a FortiGate dialup client, you must assign a unique identifier (local ID) to the FortiGate client.
localid-type {auto | fqdn
| user-fqdn | keyid | address
| asn1dn}
Whenever you configure a unique identifier (local ID) on a FortiGate dialup client, you must enable aggressive mode on the FortiGate dialup server and also specify the identifier as a peer ID on the FortiGate dialup server.
Select the type of localid: auto auto — select type automatically fqdn — Fully Qualified Domain Name user-fqdn — Use User Fully Qualified Domain Name keyid — Use Key Identifier ID address — Use IP address ID asn1dn — Use ASN.1 Distinguished Name ID mode {aggressive | main}
Enter aggressive or main (ID Protection) mode.
Both modes establish a secure channel. main nattraversal
{enable | disable} negotiate-timeout
<seconds_int>
In main mode, identifying information is hidden. Main mode is typically used when both VPN peers have static IP addresses.
In aggressive mode, identifying information is exchanged in the clear.
When the remote VPN peer or client has a dynamic IP address, or the remote VPN peer or client will be authenticated using an identifier (local ID), you must select Aggressive mode if there is more than one dialup phase 1 configuration for the interface IP address.
Enable NAT traversal if you expect the IPSec VPN traffic to go through a gateway that performs NAT. If no NAT device is detected, enabling NAT traversal has no effect. Both ends of the VPN must have the same
NAT traversal setting. If you enable NAT traversal you can set the keepalive frequency.
Enter how long in seconds the FortiGate unit will wait for the IKE SA to be negotiated. Range: 1 to 300 seconds. enable
30
Fortinet Technologies Inc.
Page 777 FortiOS™ - CLI Reference for FortiOS 5.0
vpn ipsec phase1
Variable
peer
<CA_certificate_name> peerid <peer_id> peergrp
<certificate_group_name> peertype
<authentication_method>
Description
This field is available when authmethod is set to rsa-signature and peertype is set to peer.
Default
Null
Enter the name of the peer (CA) certificate that will be used to authenticate remote VPN clients or peers. Use the command config user peer to add peer certificates. Peer certificates must be added to the
FortiGate configuration before they can be crossreferenced. For more information, see
.
This field is available when peertype is set to one.
Null
Enter the peer ID that will be used to authenticate remote clients or peers by peer ID.
This field is available when type is set to dynamic, authmethod is set to rsa-signature, and peertype is set to peergrp.
Null
Enter the name of the peer certificate group that will be used to authenticate remote clients or peers. You must create the peer certificate group before the group name can be cross-referenced. For more information, see
.
The following attributes are available under the following conditions: any
• one is available when mode is set to aggressive or when authmethod is set to rsa-signature.
• dialup is available when type is set to dynamic and authmethod is set to psk.
• peer is available when authmethod is set to rsa-signature.
• peergrp is available when type is set to dynamic and authmethod is set to rsasignature.
Enter the method for authenticating remote clients or peers when they connect to the FortiGate unit:
• Type any to accept any remote client or peer (peer
IDs are not used for authentication purposes). The mode attribute can be set to aggressive or main.
You can use this option with RSA Signature authentication. But, for highest security, you should configure a PKI user/group for the peer and set
Peer Options to Accept this peer certificate only.
• Type one to authenticate either a remote peer or client that has a dynamic IP address and connects using a unique identifier over a dedicated tunnel, or more than one dialup client that connects through the same tunnel using the same (shared) identifier.
Use the peerid field to set the peer ID. If more than one dialup client will be connecting using the same (shared) identifier, set mode to aggressive.
Fortinet Technologies Inc.
Page 778 FortiOS™ - CLI Reference for FortiOS 5.0
vpn ipsec phase1
Variable
priority <prio> proposal
<encryption_combination>
Description
• Type dialup to authenticate dialup VPN clients that use unique identifiers and preshared keys (or unique preshared keys only) to connect to the VPN through the same VPN tunnel. In this case, you must create a dialup user group for authentication purposes. Use the usrgrp field to set the user group name. If the dialup clients use unique identifiers and preshared keys, set mode to aggressive. If the dialup clients use preshared keys only, set mode to main.
• Type peer to authenticate one (or more) certificate holders based on a particular (or shared) certificate. Use the peer field to enter the certificate name. Set mode to aggressive if the remote peer or client has a dynamic IP address.
• Type peergrp to authenticate certificate holders that use unique certificates. In this case, you must create a group of certificate holders for authentication purposes. Use the peergrp field to set the certificate group name. The mode attribute can be set to aggressive or main. Set mode to aggressive if the remote peer or client has a dynamic IP address.
Default
0
This value is used to be break ties in selection of dialup routes. In the case that both routes have the same priority, the egress index for the routes will be used to determine the selected route.
Set
<prio> to a value between 0 and 4 294 967 295.
Select a minimum of one and a maximum of three encryption-message digest combinations for the phase 1 proposal (for example,
3des-md5). The remote peer must be configured to use at least one of the proposals that you define. Use a space to separate the combinations.
aes128-sha1
3des-sha1
You can choose any of the following abbreviated symmetric key encryption algorithms:
• des — Digital Encryption Standard, a 64-bit block algorithm that uses a 56-bit key.
•
3des — Triple-DES, in which plain text is encrypted three times by three keys.
• aes128 — A 128-bit block algorithm that uses a
128-bit key.
• aes192 — A 128-bit block algorithm that uses a
192-bit key.
• aes256 — A 128-bit block algorithm that uses a
256-bit key.
Fortinet Technologies Inc.
Page 779 FortiOS™ - CLI Reference for FortiOS 5.0
vpn ipsec phase1
Variable
rsa-certificate
<server_certificate>
Description
• aria128 — A 128-bit Korean block algorithm that uses a 128-bit key.
Default
• aria192 — A 128-bit Korean block algorithm that uses a 192-bit key.
• aria256 — A 128-bit Korean block algorithm that uses a 256-bit key.
• seed — A 128-bit Korean block algorithm that uses a 128-bit key.
The ARIA and seed algorithms are not available on some models.
You can select any of the following message digests to check the authenticity of messages during an encrypted session:
• md5 — Message Digest 5, the hash algorithm developed by RSA Data Security.
• sha1 — Secure Hash Algorithm 1, which produces a 160-bit message digest.
• sha256 — Secure Hash Algorithm 2, which produces a 256-bit message digest.
• sha384 — Secure Hash Algorithm 2, which produces a 384-bit message digest.
• sha512 — Secure Hash Algorithm 2, which produces a 512-bit message digest.
psksecret <preshared_key>
This field is available when authmethod is set to psk.
*
Enter the pre-shared key. The pre-shared key must be the same on the remote VPN gateway or client and should only be known by network administrators. The key must consist of at least 6 printable characters. For optimum protection against currently known attacks, the key should consist of a minimum of 16 randomly chosen alphanumeric characters.
remote-gw <address_ipv4> This field is available when type is set to static.
(No default.)
0.0.0.0
remotegw-ddns
<domain_name>
Enter the static IP address of the remote VPN peer.
This field is available when type is set to ddns.
Enter the identifier of the remote peer (for example, a fully qualified domain name).
Null.
Use this setting when the remote peer has a static domain name and a dynamic IP address (the IP address is obtained dynamically from an ISP and the remote peer subscribes to a dynamic DNS service).
This field is available when authmethod is set to rsa-signature.
Enter the name of the signed personal certificate for the FortiGate unit. You must install the server certificate before you enter the server certificate name. For more information, see
“vpn certificate local” on page 1006
.
Null.
Fortinet Technologies Inc.
Page 780 FortiOS™ - CLI Reference for FortiOS 5.0
vpn ipsec phase1
Variable
type <remote_gw_type>
Description
Enter the connection type of the remote gateway:
Default
static usrgrp <group_name>
• If the remote VPN peer has a static IP address, type static. Use the remotegw field to enter the
IP address.
• If the remote VPN peer has a dynamically assigned
IP address (DHCP or PPPoE), type dynamic.
• If the remote VPN peer has a dynamically assigned
IP address and subscribes to a dynamic DNS service, type ddns. Use the remotegw-ddns field to enter the domain name of the remote VPN peer.
This field is available when type is set to dynamic, authmethod is set to psk, and peertype is set to dialup.
Null.
Enter the name of the group of dialup VPN clients to authenticate. The user group must be added to the
FortiGate configuration before it can be cross-
referenced here. For more information, see “user group” on page 722 ,
,
“user local” on page 729 , and
.
xauthtype <XAuth_type>
Optionally configure XAuth (eXtended Authentication): disable xauthexpire {on-disconnect
| on-rekey}
• Type disable to disable XAuth.
• Type client to configure the FortiGate unit to act as an XAuth client. Use the authuser field to add the XAuth user name and password.
• Type auto, pap, or chap to configure the
FortiGate unit as an XAuth server. These options are available only when type is dynamic. Use the authusrgrp field to specify the user group containing members that will be authenticated using XAuth.
Choose when the authentication with XAUTH expires: ondisconnect
• on-disconnect — when the tunnel closes
• on-rekey — when the phase 1 encryption key expires
Fortinet Technologies Inc.
Page 781 FortiOS™ - CLI Reference for FortiOS 5.0
vpn ipsec phase1-interface
ipsec phase1-interface
Use this command to define a phase 1 definition for a route-based (interface mode) IPSec VPN tunnel that generates authentication and encryption keys automatically. A new interface of type
“tunnel” with the same name is created automatically as the local end of the tunnel.
Optionally, you can create a route-based phase 1 definition to act as a backup for another
IPSec interface. See the monitor <phase1> field.
To complete the configuration of an IPSec tunnel, you need to:
• configure phase 2 settings (see
“ipsec phase2-interface” on page 803 )
• configure a firewall policy to pass traffic from the local private network to the tunnel interface
• configure a static route via the IPSec interface to the private network at the remote end of the tunnel
• optionally, define the IP addresses for each end of the tunnel to enable dynamic routing through the tunnel or to enable pinging of each end of the tunnel for testing
Syntax
config vpn ipsec phase1-interface edit <gateway_name>
set interface <interface_name> set ip-version <4 | 6> set ipv4-dns-server1 set ipv6-dns-server1
Fortinet Technologies Inc.
Page 782 FortiOS™ - CLI Reference for FortiOS 5.0
vpn
Fortinet Technologies Inc.
set priority <prio> set proposal <encryption_combination>
set usrgrp <group_name> set xauthtype <XAuth_type> set xauthexpire {on-disconnect | on-rekey}
ipsec phase1-interface
Page 783 FortiOS™ - CLI Reference for FortiOS 5.0
vpn ipsec phase1-interface
end config ipv4-exclude-range edit <entry_id> set
set
end config ipv6-exclude-range edit <entry_id> set
end set
You must specify values for proposal and interface. A remote-gw value may be required depending on the value of the type attribute. You must also enter a preshared key or a certificate name depending on the value of authmethod. All other fields are optional.
Variable
edit <gateway_name> add-gw-route
{enable | disable} add-route
{enable | disable}
Description Default
Enter a name (maximum 15 characters) for the remote gateway. If type is dynamic, the maximum name length is further reduced depending on the number of dialup tunnels that can be established: by 2 for up to 9 tunnels, by 3 for up to 99 tunnels, 4 for up to 999 tunnels, and so on
No default.
disable
Enable to automatically add a route to the remote gateway specified in remote-gw.
Note: This command is deprecated.
Use the
Enable to add a route to the client’s peer destination selector. Disable if you use dynamic routing over the tunnel.
enable
This is available only when mode-cfg is enabled.
assign-ip {enable | disable} For a client, enable to request an IP address from the server. For a server, enable to assign an IP address to a dialup client. This is available if mode-cfg (IKE Configuration Method) is enabled.
enable
Fortinet Technologies Inc.
Page 784 FortiOS™ - CLI Reference for FortiOS 5.0
vpn ipsec phase1-interface
Variable
assign-ip-from
{range | usrgrp} authmethod
<authentication_method>
Description
Select source of IP address assigned to an IKE
Configuration Method client.
range — Assign an IP address from the range defined in ipv4-start-ip and ipv4-end-ip
( ipv6-start-ip and ipv4-end-ip for IPv6 clients).
Default
range usrgrp — Assign the address defined in the
RADIUS Framed-IP-Address for the user. This is available when the VPN is configured to authenticate clients with XAuth. xauthtype must be auto, pap, or chap. This is available only if ike-version is 1.
This is available if
mode-cfg (IKE Configuration
Method) is enabled.
assign-ip-type {ip | subnet} Select the type of IP address assigned to an IKE
Configuration Method client: ip ip — assign a single IP address to the client, as configured in assign-ip-from. subnet — assign an IP address to each end of the
VPN tunnel, as configured in assign-ip-from.
This type of IP address assignment facilitates the use of dynamic routing through the tunnel.
This is available if
mode-cfg (IKE Configuration
Method) is enabled.
Specify the authentication method:
• Enter psk to authenticate using a pre-shared key. Use psksecret to enter the pre-shared key.
• Enter rsa-signature to authenticate using a digital certificate. Use set rsa-certificate to enter the name of the digital certificate.
psk
You must configure certificates before selecting rsa-signature here. For more information, see
“execute vpn certificate local” on page 1006
and
“vpn certificate ca” on page 757 .
authpasswd <password>
This field is available when xauthtype is set to client.
No default.
authusr <user_name>
Enter the XAuth client password for the FortiGate unit.
This field is available when xauthtype is set to client.
Enter the XAuth client user name for the FortiGate unit.
Null
Fortinet Technologies Inc.
Page 785 FortiOS™ - CLI Reference for FortiOS 5.0
vpn ipsec phase1-interface
Variable Description
authusrgrp <group_name> This field is available when xauthtype is set to auto, pap, or chap.
auto-negotiate
{enable | disable} banner <string> client-auto-negotiate
{enable | disable} client-keep-alive
{enable | disable} default-gw <gw_ip>
Default
Null
When the FortiGate unit is configured as an XAuth server, enter the user group to authenticate remote
VPN peers. The user group can contain local users, LDAP servers, and RADIUS servers. The user group must be added to the FortiGate configuration before the group name can be crossreferenced. For more information, see
“user local” on page 729 , and
.
Enable to keep trying to negotiate an IKE SA even if the link is down. The primary use of this feature is in cases where there are multiple redundant tunnels and you prefer the primary connection if it can be established. enable
Specify a message to send to IKE Configuration
Method clients. Some clients display this message to users. This is available if
mode-cfg (IKE
Configuration Method) is enabled.
Null
Enable or disable allowing the client to bring up the tunnel when there is no traffic. This is available when type is dynamic and mode-cfg is enabled.
disable disable
Enable or disable allowing the client to keep the tunnel up when there is no traffic. This is available when type is dynamic and mode-cfg is enabled.
0.0.0.0
If the IPSec interface has a different default route than other traffic, enter the next hop router IP address. Be sure to set default-gw-priority to a higher priority (lower value) than the general default route.
default-gw-priority <int>
If you set default-gw, set the priority to a lower value (higher priority) than the general default route.
dhgrp {1 2 5 14}
This is available when type is dynamic. The route it creates is not visible in the routing table.
Type
1, 2, 5, and/or 14 to select one or more
Diffie-Hellman groups from DH group 1, 2, 5, and
14 respectively. At least one of the DH group settings on the remote peer or client must be identical to one of the selections on the FortiGate unit.
distance <int>
Configure the administrative distance for routes added when a dialup IPSec connection is established. Using administrative distance you can specify the relative priorities of different routes to the same destination. A lower administrative distance indicates a more preferred route.
Distance can be an integer from 1-255. See also
“distance <distance>” on page 447 .
0
5
1
Fortinet Technologies Inc.
Page 786 FortiOS™ - CLI Reference for FortiOS 5.0
vpn ipsec phase1-interface
Variable Description
dns-mode {auto | manual} Set DNS behavior when mode-cfg is enabled.
domain <string> dpd {enable | disable} dpd-retrycount
<retry_integer>
Default
manual
auto — assign DNS servers in the following order:
1 servers assigned to interface by DHCP
2 per-VDOM assigned DNS servers
3 global DNS server
manual — use DNS servers specified in ipv4dns-server1, ipv4-dns-server2, etc.
Specify a domain name to send to IKE
Configuration Method clients. This is available if mode-cfg (IKE Configuration Method) is enabled.
Null
Enable or disable DPD (Dead Peer Detection). DPD detects the status of the connection between VPN peers. Enabling DPD facilitates cleaning up dead connections and establishing new VPN tunnels.
DPD is not supported by all vendors and is not used unless DPD is supported and enabled by both VPN peers.
This field is available when dpd is set to enable.
enable
3
The DPD retry count when dpd is set to enable.
Set the number of times that the local VPN peer sends a DPD probe before it considers the link to be dead and tears down the security association
(SA). The dpd-retrycount range is 0 to 10.
To avoid false negatives due to congestion or other transient failures, set the retry count to a sufficiently high value for your network.
This field is available when dpd is set to enable.
5 dpd-retryinterval
<seconds> [<milliseconds]
The DPD (Dead Peer Detection) retry interval is the time that the local VPN peer waits between sending DPD probes.
Set the time in seconds plus, optionally, milliseconds. For example, for 2.5 seconds enter 2
500. The range is 1 to 60 seconds, 0 to 999 milliseconds.
When the tunnel is starting, or if it has failed, a retry interval of 5 seconds is used if dpdretryinterval is less than 5 seconds.
Enable to allow only FortiClient users to connect.
disable forticlient-enforcement
{enable | disable} fragmentation
{enable | disable} ike-version {1 | 2} include-local-lan
{enable | disable}
Enable intra-IKE fragmentation support on retransmission of fragmented packets.
This is available when type is dynamic and mode-config is enabled.
enable
Select whether to use IKEv1 or IKEv2 (RFC 4306).
1
Allow Unity clients to access their local LAN even if they are using split tunneling. disable
Fortinet Technologies Inc.
Page 787 FortiOS™ - CLI Reference for FortiOS 5.0
vpn ipsec phase1-interface
Variable
interface
<interface_name> ip-version <4 | 6> ipv4-dns-server1 ipv6-dns-server1 ipv4-dns-server2 ipv6-dns-server2 ipv4-dns-server3 ipv6-dns-server3 ipv4-end-ip <ip4addr> ipv6-end-ip <ip6addr>
Description Default
Enter the name of the physical, aggregate, or
VLAN interface to which the IPSec tunnel will be bound. The FortiGate unit obtains the IP address of the interface from system interface settings (see
“interface” on page 555 ) unless you specify a
different IP address using the
Null
Enter 4 for IPv4 encapsulation or 6 for IPv6 encapsulation.
4
Enter DNS server addresses to provide to IKE
Configuration Method clients. If the value is
0.0.0.0, no DNS server address is provided.
0.0.0.0
::
Either the IPv4 or IPv6 version of these fields is available, depending on mode-cfg-ip-version.
ipv4-wins-server1 ipv4-wins-server2 ipv6-prefix <ip6prefix>
Set end of IP address range to assign to IKE
Configuration Method clients. This is available when mode-cfg is enabled, type is dynamic, and assign-ip-from is range.
No default.
Either the IPv4 or IPv6 version of this field is available, depending on mode-cfg-ip-version. ipv4-netmask <ip4mask>
Set the netmask value to pass to IKE Configuration
Method clients.
ipv4-split-include
<address_name>
Select the address or address group that the client can reach through the VPN. This information is sent to the client as part of IKE Configuration
Method.
No default.
Null.
ipv4-start-ip <ip4addr> ipv6-start-ip <ip6addr>
This is available only if mode-cfg is set to enable.
Set start of IP address range to assign to IKE
Configuration Method clients. This is available when mode-cfg is enabled, type is dynamic, and assign-ip-from is range.
No default.
Either the IPv4 or IPv6 version of this field is available, depending on mode-cfg-ip-version.
Enter WINS server addresses to provide to IKE
Configuration Method clients. If the value is
0.0.0.0, no WINS server address is provided.
0.0.0.0
0
Specify the size, in bits, of the network portion of the subnet address for IPv6 IKE Configuration
Method clients. Range is 0 to 128.
This is available when mode-cfg-ip-version is
6 and assign-ip-type is subnet.
Fortinet Technologies Inc.
Page 788 FortiOS™ - CLI Reference for FortiOS 5.0
vpn ipsec phase1-interface
Variable
keepalive <seconds> keylife <seconds> local-gw <address_ipv4> local-gw6 <address_ipv6> localid <local_id>
Description
This field is available when nattraversal is set to enable.
Set the NAT traversal keepalive frequency. This number specifies (in seconds) how frequently empty UDP packets are sent through the NAT device to make sure that the NAT mapping does not change until P1 and P2 security associations expire. The keepalive frequency can be from 0 to
900 seconds.
Set the keylife time. The keylife is the amount of time (in seconds) before the phase 1 encryption key expires. When the key expires, a new key is generated without interrupting service. The range is 120 to 172,800 seconds.
Optionally, specify a secondary IP address of the interface selected in interface to use for the local end of the VPN tunnel. local-gw6 is available when ip-version is 6. local-gw is available when ip-version is 4.
If you do not specify an IP address here, the
FortiGate unit obtains the IP address of the interface from system interface settings (see
Enter a local ID if the FortiGate unit is functioning as a VPN client and will use the local ID for authentication purposes.
If you want to dedicate a tunnel to a FortiGate dialup client, you must assign a unique identifier
(local ID) to the FortiGate client.
localid-type {auto | fqdn
| user-fqdn | keyid
| address | asn1dn}
Whenever you configure a unique identifier (local
ID) on a FortiGate dialup client, you must enable aggressive mode on the FortiGate dialup server and also specify the identifier as a peer ID on the
FortiGate dialup server.
Select the type of localid: auto — select type automatically fqdn — Fully Qualified Domain Name user-fqdn — Use User Fully Qualified Domain
Name keyid — Use Key Identifier ID address — Use IP address ID asn1dn — Use ASN.1 Distinguished Name ID
Default
5
28800
0.0.0.0 for
IPv4
:: for IPv6
Null auto
Fortinet Technologies Inc.
Page 789 FortiOS™ - CLI Reference for FortiOS 5.0
vpn ipsec phase1-interface
Variable Description
mode {aggressive | main}
Enter aggressive or main (ID Protection) mode.
Both modes establish a secure channel.
Default
main
In main mode, identifying information is hidden.
Main mode is typically used when both VPN peers have static IP addresses. mode-cfg
{enable | disable}
In aggressive mode, identifying information is exchanged in the clear. Aggressive mode is typically used when a remote peer or dialup client has a dynamic IP address. You must enable aggressive mode when the remote FortiGate unit has a dynamic IP address, or the remote VPN peer or client will be authenticated using an identifier
(local ID).
This is available if ike-version is 1.
Enable IKE Configuration Method so that compatible clients can configure themselves with settings that the FortiGate unit provides. disable
This is available if type is dynamic. mode-cfg-ip-version {4|6} Select whether an IKE Configuration Method client receives an IPv4 or IPv6 IP address. This is available if mode-cfg and assign-ip are enabled.
monitor <phase1>
Optionally, this IPSec interface can act as a backup for another (primary) IPSec interface. Enter the name of the primary interface.
4
Null.
monitor-hold-down-delay
<seconds_int> nattraversal
{enable | disable} negotiate-timeout
<seconds_int> npu-offload
{enable | disable}
The backup interface is used only while the primary interface is out of service. dpd must be enabled.
A primary interface can have only one backup interface and cannot act as a backup for another interface.
Enter the number of seconds to delay returning traffic to the primary interface from backup after the primary interface becomes stable again.
Range: 0 to 31 536 000 seconds.
0
Enable NAT traversal if you expect the IPSec VPN traffic to go through a gateway that performs NAT.
If no NAT device is detected, enabling NAT traversal has no effect. Both ends of the VPN must have the same NAT traversal setting. If you enable
NAT traversal you can set the keepalive frequency.
enable
Enter how long in seconds the FortiGate unit will wait for the IKE SA to be negotiated. Range: 1 to
300 seconds.
30
Enable or disable offload of VPN session to NPU.
enable
Fortinet Technologies Inc.
Page 790 FortiOS™ - CLI Reference for FortiOS 5.0
vpn ipsec phase1-interface
Variable
peer
<CA_certificate_name> peerid <peer_id> peergrp
<certificate_group_name> peertype
<authentication_method>
Description
This field is available when authmethod is set to rsa-signature and peertype is set to peer.
Default
Null
Enter the name of the peer (CA) certificate that will be used to authenticate remote VPN clients or peers. Use the command config user peer to add peer certificates. Peer certificates must be added to the FortiGate configuration before they can be cross-referenced. For more information,
.
This field is available when peertype is set to one.
Null
Enter the peer ID that will be used to authenticate remote clients or peers by peer ID.
This field is available when type is set to dynamic, authmethod is set to rsasignature, and peertype is set to peergrp.
Null
Enter the name of the peer certificate group that will be used to authenticate remote clients or peers. You must create the peer certificate group before the group name can be cross-referenced.
For more information, see “user peergrp” on page 734
.
The following attributes are available under the following conditions: any
• dialup is available when type is set to dynamic and authmethod is set to psk.
• peer is available when authmethod is set to rsa-signature.
• peergrp is available when type is set to dynamic and authmethod is set to rsasignature.
Enter the method for authenticating remote clients or peers when they connect to the FortiGate unit:
• Type any to accept any remote client or peer
(peer IDs are not used for authentication purposes). The mode attribute can be set to aggressive or main.
You can use this option with RSA Signature authentication. But, for highest security, you should configure a PKI user/group for the peer and set Peer Options to Accept this peer certificate only.
Fortinet Technologies Inc.
Page 791 FortiOS™ - CLI Reference for FortiOS 5.0
vpn ipsec phase1-interface
Variable
priority <prio>
Description
• Type one to authenticate either a remote peer or client that has a dynamic IP address and connects using a unique identifier over a dedicated tunnel, or more than one dialup client that connects through the same tunnel using the same (shared) identifier. Use the peerid field to set the peer ID. If more than one dialup client will be connecting using the same
(shared) identifier, set mode to aggressive.
• Type dialup to authenticate dialup VPN clients that use unique identifiers and preshared keys
(or unique preshared keys only) to connect to the VPN through the same VPN tunnel. In this case, you must create a dialup user group for authentication purposes. Use the usrgrp field to set the user group name. If the dialup clients use unique identifiers and preshared keys, set mode to aggressive. If the dialup clients use preshared keys only, set mode to main.
• Type peer to authenticate one (or more) certificate holders based on a particular (or shared) certificate. Use the peer field to enter the certificate name. Set mode to aggressive if the remote peer or client has a dynamic IP address.
Default
• Type peergrp to authenticate certificate holders that use unique certificates. In this case, you must create a group of certificate holders for authentication purposes. Use the peergrp field to set the certificate group name. The mode attribute can be set to aggressive or main. Set mode to aggressive if the remote peer or client has a dynamic IP address.
This value is used to be break ties in selection of dialup routes. In the case that both routes have the same priority, the egress index for the routes will be used to determine the selected route.
0
Set
<prio> to a value between 0 and 4 294 967
295. proposal
<encryption_combination>
Select a minimum of one and a maximum of three encryption-message digest combinations for the phase 1 proposal (for example,
3des-md5). The remote peer must be configured to use at least one of the proposals that you define. Use a space to separate the combinations.
aes128-sha1
3des-sha1
Fortinet Technologies Inc.
Page 792 FortiOS™ - CLI Reference for FortiOS 5.0
vpn ipsec phase1-interface
Variable Description
You can choose any of the following abbreviated symmetric key encryption algorithms:
• des — Digital Encryption Standard, a 64-bit block algorithm that uses a 56-bit key.
•
3des — Triple-DES, in which plain text is encrypted three times by three keys.
• aes128 — A 128-bit block algorithm that uses a 128-bit key.
• aes192 — A 128-bit block algorithm that uses a 192-bit key.
• aes256 — A 128-bit block algorithm that uses a 256-bit key.
• aria128 — A 128-bit Korean block algorithm that uses a 128-bit key.
• aria192 — A 128-bit Korean block algorithm that uses a 192-bit key.
• aria256 — A 128-bit Korean block algorithm that uses a 256-bit key.
• seed — A 128-bit Korean block algorithm that uses a 128-bit key.
Default
The ARIA and seed algorithms are not available on some models.
You can select any of the following message digests to check the authenticity of messages during an encrypted session:
• md5 — Message Digest 5, the hash algorithm developed by RSA Data Security.
• sha1— Secure Hash Algorithm 1, which produces a 160-bit message digest.
• sha256 — Secure Hash Algorithm 2, which produces a 256-bit message digest.
• sha384 — Secure Hash Algorithm 2, which produces a 384-bit message digest.
• sha512 — Secure Hash Algorithm 2, which produces a 512-bit message digest.
psksecret <preshared_key> This field is available when authmethod is set to psk.
Enter the pre-shared key. The pre-shared key must be the same on the remote VPN gateway or client and should only be known by network administrators. The key must consist of at least 6 printable characters. For optimum protection against currently known attacks, the key should consist of a minimum of 16 randomly chosen alphanumeric characters.
*
(No default.)
Fortinet Technologies Inc.
Page 793 FortiOS™ - CLI Reference for FortiOS 5.0
vpn ipsec phase1-interface
Variable
remote-gw
<address_ipv4> remote-gw6
<address_ipv6> remotegw-ddns
<domain_name>
Description
This field is available when type is set to static.
Enter the static IP address of the remote VPN peer.
Default
0.0.0.0 for IPv4
:: for IPv6 remote-gw6 is available when ip-version is 6. remote-gw is available when ip-version is 4.
This field is available when type is set to ddns and ip-version is set to 4.
Null
Enter the identifier of the remote peer (for example, a fully qualified domain name).
rsa-certificate
<server_certificate>
Use this setting when the remote peer has a static domain name and a dynamic IP address (the IP address is obtained dynamically from an ISP and the remote peer subscribes to a dynamic DNS service).
This field is available when authmethod is set to rsa-signature.
Null
Enter the name of the signed personal certificate for the FortiGate unit. You must install the server certificate before you enter the server certificate name. For more information, see
“vpn certificate local” on page 1006 .
save-password
{enable | disable} send-cert-chain
{enable | disable}
Enable or disable client saving Xauth user name and password.
Enable or disable sending of the certificate chain, rather than a single certificate.
split-include-service
<service_group_name>
Select the service types that the client can reach through the VPN. This information is sent to the client as part of IKE Configuration Method when mode-cfg is enabled.
type <remote_gw_type>
Enter the connection type of the remote gateway: disable enable
Null static unity-support
{enable | disable}
• If the remote VPN peer has a static IP address, type static. Use the remotegw field to enter the IP address.
• If the remote VPN peer has a dynamically assigned IP address (DHCP or PPPoE), type dynamic.
• If the remote VPN peer has a dynamically assigned IP address and subscribes to a dynamic DNS service, type ddns. Use the remotegw-ddns field to enter the domain name of the remote VPN peer. This option is not available if ip-version is 6.
Enable support for Cisco Unity IKE Configuration
Method extensions in either a server or a client.
This is available for IKEv1 only.
enable
Fortinet Technologies Inc.
Page 794 FortiOS™ - CLI Reference for FortiOS 5.0
vpn ipsec phase1-interface
Variable
usrgrp <group_name>
Description
This field is available when type is set to dynamic, authmethod is set to psk, and peertype is set to dialup.
Default
Null
Enter the name of the group of dialup VPN clients to authenticate. The user group must be added to the FortiGate configuration before it can be crossreferenced here. For more information, see
“user local” on page 729 , and
.
xauthtype <XAuth_type>
Optionally configure XAuth (eXtended
Authentication): disable
• Type disable to disable XAuth.
• Type client to configure the FortiGate unit to act as an XAuth client. Use the authuser field to add the XAuth user name and password.
• Type auto, pap, or chap to configure the
FortiGate unit as an XAuth server. These options are available only when type is dynamic. Use the authusrgrp field to specify the user group containing members that will be authenticated using XAuth.
Choose when the authentication with XAUTH expires: on-disconnect xauthexpire
{on-disconnect | on-rekey}
• on-disconnect — when the tunnel closes
• on-rekey — when the phase 1 encryption key expires
config ipv4-exclude-range and config ipv6-exclude-range Variables
This subcommand is available only when mode-cfg is enabled.
start-ip <ipaddr>
Enter the start of the exclude range.
end-ip <ipaddr>
Enter the end of the exclude range.
No default.
No default.
Fortinet Technologies Inc.
Page 795 FortiOS™ - CLI Reference for FortiOS 5.0
vpn ipsec phase2
ipsec phase2
Use this command to add or edit an IPSec tunnel-mode phase 2 configuration. The FortiGate unit uses the tunnel-mode phase 2 configuration to create and maintain an IPSec VPN tunnel with a remote VPN peer (the VPN gateway or client).
The phase 2 configuration consists of a name for the VPN tunnel, the name of an existing phase 1 configuration, the proposal settings (encryption and authentication algorithms) and DH group used for phase 2. For phase 2 to be successful, the FortiGate unit and the remote VPN peer must be configured with compatible proposal settings.
Syntax
config vpn ipsec phase2 edit <tunnel_name>
set protocol <protocol_integer> set replay {enable | disable}
end
set use-natip {enable | disable}
Fortinet Technologies Inc.
Page 796 FortiOS™ - CLI Reference for FortiOS 5.0
vpn ipsec phase2
The phase1name field is required. All other fields are optional.
Variable
auto-negotiate
{enable | disable}
Description
edit <tunnel_name>
Enter a name for the tunnel.
add-route
{enable | disable}
Enable only if you are running a dynamic routing protocol
(RIP, OSPF, or BGP) and want the routes to be propagated to routing peers.
Enable to negotiate the phase 2 security association (SA) automatically, even if there is no traffic. This repeats every five seconds until it succeeds.
Default
No default.
disable disable dhcp-ipsec
{enable | disable}
You can use this option on a dialup peer to ensure that the tunnel is available for peers at the server end to initiate traffic to the dialup peer. Otherwise, the tunnel does not exist until the dialup peer initiates traffic.
This field is available when phase1name names a dialup gateway configuration.
disable
Enable dhcp-ipsec if the FortiGate unit acts as a dialup server and FortiGate DHCP relay will be used to assign VIP addresses to FortiClient dialup clients. The DHCP relay parameters must be configured separately.
If you configure the DHCP server to assign IP addresses based on RADIUS user group attributes, you must also set the peertype to dialup and specify the usrgrp in
For information about how to configure a DHCP server on a
FortiGate interface, see
“system dhcp server” on page 501
.
For information about FortiGate DHCP relay, see
“system interface” on page 555 .
If the FortiGate unit acts as a dialup server and you manually assigned FortiClient dialup clients VIP addresses that match the network behind the dialup server, select
Enable to cause the FortiGate unit to act as a proxy for the dialup clients.
dhgrp {1 | 2 | 5 | 14}
Type
1, 2, 5, or 14 to select the Diffie-Hellman group to propose for Phase 2 of the IPSec VPN connection. Both
VPN peers must use the same DH Group.
5
Fortinet Technologies Inc.
Page 797 FortiOS™ - CLI Reference for FortiOS 5.0
vpn ipsec phase2
Variable Description
dst-addr-type <type> Enter the type of destination address that corresponds to the recipient(s) or network behind the remote VPN peer or
FortiGate dialup client: dst-end-ip
<address_ipv4> dst-name
<address_name> dst-port
<dest_port_number> dst-start-ip
<address_ipv4> dst-subnet
<address_ipv4mask> encapsulation
{tunnel-mode
| transport-mode} keepalive
{enable | disable}
Default
subnet
• To specify the IP address of a server or host, type ip.
Enter the IP address using the dst-start-ip field.
• To specify a range of IP addresses, type range. Enter the starting and ending addresses using the dststart-ip, and dst-end-ip fields.
• To specify a network address, type subnet. Enter the network address using the dst-subnet field.
• To specify a firewall address or address group, type name. Enter the address or address group name using the dst-name field. You must also select the name option for src-addr-type.
You should not use this option if ike-version is 1.
IKEv1 does not support the use of multiple addresses in selectors. Instead, use the default 0.0.0.0/0 subnet selector and rely on the firewall policy to limit destination addresses.
This field is available when dst-addr-type is set to range. This field is not available if phase1name names a configuration that enables mode-cfg.
0.0.0.0
Enter the highest destination IP address in the range of IP addresses.
This field is available when dst-addr-type is set to name.
Enter the name of a firewall address or address group.
No default.
Enter the port number that the remote VPN peer or
FortiGate dialup client uses to transport traffic related to the specified service (see protocol). The range is 1 to 65535.
To specify all ports, type
0.
This field is available when dst-addr-type is set to range.
0
0.0.0.0
Enter the lowest destination IP address in the range of IP addresses.
Enter the IP address and network mask that identifies the private network behind the remote VPN peer or FortiGate dialup client.
Select encapsulation:
0.0.0.0
0.0.0.0
tunnel-mode
tunnel-mode — Encrypt both payload data and headers.
transport-mode — Encrypt only the payload data. This is used when combining IPsec with another encapsulation, such as L2TP.
Enable to automatically negotiate a new phase 2 security association (SA) before the current SA expires, keeping the tunnel up. Otherwise, a new SA is negotiated only if there is traffic.
disable
Fortinet Technologies Inc.
Page 798 FortiOS™ - CLI Reference for FortiOS 5.0
vpn ipsec phase2
Variable
keylife-type
<keylife_type>
Description
Set when the phase 2 key expires. When the key expires, a new key is generated without interrupting service.
Default
seconds keylifekbs
<kb_integer>
• To make the key expire after a period of time has expired and after an amount of data is transmitted, type both.
• To make the key expire after an amount of data is transmitted, type kbs. Use the keylifekbs field to set the amount of data that is transmitted.
• To make the key expire after a number of seconds elapses, type seconds. Use the keylifeseconds field to set the amount of time that elapses.
This field is available when keylife-type is set to kbs or both.
5120 keylifeseconds
<seconds>
Set the number of Kbits of data to transmit before the phase 2 key expires. The range is 5120 to 4 294 967 295
Kbits.
This field is available when keylife-type is set to seconds or both.
1800
Set the number of seconds to elapse before the phase 2 key expires. seconds can be 120 to 172800 seconds.
l2tp {enable | disable} Enable L2TP traffic through this VPN. This is available if encapsulation is transport-mode and the phase 1 type is dynamic.
pfs {enable | disable} Optionally, enable or disable perfect forward secrecy (PFS).
PFS ensures that each key created during Phase 2 is unrelated to keys created during Phase 1 or to other keys created during Phase 2. PFS may cause minor delays during key generation.
phase1name
<gateway_name>
Enter a phase 1 gateway configuration name. You must add the phase 1 gateway definition to the FortiGate configuration before it can be cross-referenced.
disable enable
Null proposal
<encrypt_digest>
Enter a minimum of one and a maximum of three encryption-message digest combinations (for example,
3des-md5). The remote peer must be configured to use at least one of the proposals that you define. Use a space to separate the combinations.
aes128-sha1
3des-sha1
You can enter any encryption-message digest combination except null-null.
Fortinet Technologies Inc.
Page 799 FortiOS™ - CLI Reference for FortiOS 5.0
vpn ipsec phase2
Variable
protocol
<protocol_integer> replay
{enable | disable}
Description
Here is an explanation of the abbreviated encryption algorithms:
• null— Do not use an encryption algorithm.
• des — Digital Encryption Standard, a 64-bit block algorithm that uses a 56-bit key.
•
3des — Triple-DES, in which plain text is encrypted three times by three keys.
• aes128 — A 128-bit block algorithm that uses a 128-bit key.
• aes192 — A 128-bit block algorithm that uses a 192-bit key.
• aes256 — A 128-bit block algorithm that uses a 256-bit key.
• aria128 — A 128-bit Korean block algorithm that uses a 128-bit key.
• aria192 — A 128-bit Korean block algorithm that uses a 192-bit key.
• aria256 — A 128-bit Korean block algorithm that uses a 256-bit key.
• seed — A 128-bit Korean block algorithm that uses a
128-bit key.
Default
The ARIA and seed algorithms are not available on some models.
You can enter any of the following message digests to check the authenticity of messages during an encrypted session:
• null — Do not use a message digest.
• md5 — Message Digest 5, the hash algorithm developed by RSA Data Security.
• sha1— Secure Hash Algorithm 1, which produces a
160-bit message digest.
• sha256 — Secure Hash Algorithm 2, which produces a
256-bit message digest.
This field is available when selector is set to specify.
0
Enter the IP protocol number for the service. The range is
1 to
255. To specify all services, type 0.
Optionally, enable or disable replay detection. Replay attacks occur when an unauthorized party intercepts a series of IPSec packets and replays them back into the tunnel. Enable replay detection to check the sequence number of every IPSec packet to see if it has been received before. If packets arrive out of sequence, the FortiGate units discards them.
enable
You can configure the FortiGate unit to send an alert email
when it detects a replay packet. See “alertemail” on page 55 .
Fortinet Technologies Inc.
Page 800 FortiOS™ - CLI Reference for FortiOS 5.0
vpn ipsec phase2
Variable
route-overlap
{overlap_option} selector-match
<match_type> single-source
{enable | disable} src-addr-type
<ip_source_name> src-end-ip
<address_ipv4>
Description
Specify how FortiGate unit handles multiple dialup users with the same IP source address. Set overlap_option to one of the following:
Default
use-new allow — allow overlapping routes use-new — delete the old route and add the new route use-old — use the old route and do not add the new route
The peer’s IPSec selectors are compared to FortiGate phase 2 selectors, which are any of src-start-ip / src-end-ip, src-subnet, dst-subnet, dst-startip / dst-end-ip. The match_type value can be one of: exact — peer’s selector must match exactly subset — peer’s selector can be a subset of this selector auto — use exact or subset match as needed (default)
Note: This field is configured automatically when upgrading a FortiOS version 2.80 VPN to version 3.0. You should not set this field when configuring a new VPN.
auto
This field does not apply to IKEv2 connections.
Enable if src-addr-type is name and hosts on the internal network will initiate communication sessions with remote dialup clients.
If the FortiGate unit is a dialup server, enter the type of source address that corresponds to the local sender(s) or network behind the FortiGate dialup server:
• To specify the IP address of a server or host, type ip.
Enter the IP address using the src-start-ip field.
• To specify a range of IP addresses, type range. Enter the starting and ending addresses using the srcstart-ip and src-end-ip fields.
• To specify a network address, type subnet. Enter the network address using the src-subnet field.
• To specify a firewall address or address group, type name. Enter the address or address group name using the src-name field. You must also select the name option for dst-addr-type.
You should not use this option if ike-version is 1.
IKEv1 does not support the use of multiple addresses in selectors. Instead, use the default 0.0.0.0/0 subnet selector and rely on the firewall policy to limit source addresses.
disable subnet
If the FortiGate unit is a dialup client, src-addr-type must refer to the server(s), host(s), or private network behind the FortiGate dialup client.
This field is available when src-addr-type is set to range.
Enter the highest source IP address in the range of IP addresses.
0.0.0.0
Fortinet Technologies Inc.
Page 801 FortiOS™ - CLI Reference for FortiOS 5.0
vpn ipsec phase2
Variable
src-name
<address_name> src-port
<src_port_number> src-start-ip
<address_ipv4> src-subnet
<address_ipv4mask> use-natip
{enable | disable}
Description
This field is available when src-addr-type is set to name.
Enter the name of a firewall address or address group.
Default
No default.
If the FortiGate unit is a dialup server, enter the port number that the FortiGate dialup server uses to transport traffic related to the specified service (see protocol). If the
FortiGate unit is a dialup client, enter the port number that the FortiGate dialup client uses to transport traffic related to the specified service. The src-port range is 1 to 65535.
To specify all ports, type
0.
This field is available when src-addr-type is set to range.
0
0.0.0.0
Enter the lowest source IP address in the range of IP addresses.
If the FortiGate unit is a dialup server, enter the IP address and network mask that identifies the private network behind the FortiGate dialup server. If the FortiGate unit is a dialup client, enter the IP address and network mask that identifies the private network behind the FortiGate dialup client.
0.0.0.0
0.0.0.0
enable
By default, when outbound NAT is used, the FortiGate unit public interface IP address is the source selector. If you disable use-natip, the source selector is as specified in src-start-ip / src-end-ip or src-subnet.
Note: This field is configured automatically when upgrading a FortiOS version 2.80 VPN to version 3.0. You should not set this field when configuring a new VPN.
Fortinet Technologies Inc.
Page 802 FortiOS™ - CLI Reference for FortiOS 5.0
vpn ipsec phase2-interface
ipsec phase2-interface
Use this command to add a phase 2 configuration for a route-based (interface mode) IPSec tunnel or edit an existing interface-mode phase 2 configuration. This command is available only in NAT/Route mode.
Syntax
config vpn ipsec phase2-interface edit <tunnel_name>
set auto-negotiate {enable | disable} set dhcp-ipsec {enable | disable} set dhgrp {1 | 2 | 5 | 14}
set proposal <encrypt_digest> set protocol <protocol_integer>
set src-addr-type <ip_source_name> set src-end-ip <address_ipv4> set src-end-ip6 <address_ipv6>
set src-name <address_name> set src-port <src_port_number>
end
Fortinet Technologies Inc.
Page 803 FortiOS™ - CLI Reference for FortiOS 5.0
vpn ipsec phase2-interface
The phase1name field is required. All other fields are optional.
Variable Description
edit <tunnel_name>
Enter a name for the phase 2 tunnel configuration.
auto-negotiate
{enable | disable}
Enable to negotiate the phase 2 security association
(SA) automatically, even if there is no traffic. This repeats every five seconds until it succeeds.
dhcp-ipsec
{enable | disable}
Default
No default.
disable
You can use this option on a dialup peer to ensure that the tunnel is available for peers at the server end to initiate traffic to the dialup peer. Otherwise, the tunnel does not exist until the dialup peer initiates traffic.
This field is available when phase1name names a dialup gateway configuration.
disable
This field is not available if phase1name names a configuration that enables mode-cfg.
Enable dhcp-ipsec if the FortiGate unit acts as a dialup server and FortiGate DHCP relay will be used to assign VIP addresses to FortiClient dialup clients. The
DHCP relay parameters must be configured separately.
If you configure the DHCP server to assign IP addresses based on RADIUS user group attributes, you must also set the peertype to dialup and specify the
.
For information about how to configure a DHCP server
on a FortiGate interface, see “system dhcp server” on page 501
. For information about FortiGate DHCP relay, see
“system interface” on page 555 .
If the FortiGate unit acts as a dialup server and you manually assigned FortiClient dialup clients VIP addresses that match the network behind the dialup server, select Enable to cause the FortiGate unit to act as a proxy for the dialup clients.
dhgrp {1 | 2 | 5 | 14}
Type
1, 2, 5, or 14 to select the Diffie-Hellman group to propose for Phase 2 of the IPSec VPN connection.
Both VPN peers must use the same DH Group.
5
Fortinet Technologies Inc.
Page 804 FortiOS™ - CLI Reference for FortiOS 5.0
vpn ipsec phase2-interface
Variable Description
dst-addr-type <type> Enter the type of destination address that corresponds to the recipient(s) or network behind the remote VPN peer or FortiGate dialup client:
Default
subnet dst-end-ip
<address_ipv4> dst-end-ip6
<address_ipv6> dst-name
<address_name>
• To specify the IPv4 IP address of a server or host, type ip. Enter the IP address using the dst-start-ip field.
• To specify the IPv6 IP address of a server or host, type ip6. Enter the IP address using the dst-start-ip6 field.
• To specify a range of IPv4 IP addresses, type range. Enter the starting and ending addresses using the dst-start-ip and dst-end-ip fields.
• To specify a range of IPv6 IP addresses, type range6. Enter the starting and ending addresses using the dst-start-ip6 and dst-end-ip6 fields.
• To specify an IPv4 network address, type subnet.
Enter the network address using the dst-subnet field.
• To specify an IPv6 network address, type subnet6. Enter the network address using the dst-subnet field.
• To specify an address defined in a firewall address or address group, type name. Enter the address name using the dst-name field. You must also select the name option for src-addr-type. This is available only for IPv4 addresses.
You should not use this option if ike-version is
1. IKEv1 does not support the use of multiple addresses in selectors. Instead, use the default
0.0.0.0/0 subnet selector and rely on the firewall policy to limit destination addresses.
This field is not available if phase1name names a configuration that enables mode-cfg.
This field is available when dst-addr-type is set to range. This field is not available if phase1name names a configuration that enables mode-cfg.
0.0.0.0
Enter the highest destination IP address in the range of
IP addresses.
This field is available when dst-addr-type is set to range6. This field is not available if phase1name names a configuration that enables mode-cfg.
::
Enter the highest destination IP address in the range of
IP addresses.
This field is available when dst-addr-type is set to name. This field is not available if phase1name names a configuration that enables mode-cfg.
No default.
Enter the firewall address or address group name.
Fortinet Technologies Inc.
Page 805 FortiOS™ - CLI Reference for FortiOS 5.0
vpn ipsec phase2-interface
Variable
dst-port
<dest_port_number> dst-start-ip
<address_ipv4> dst-start-ip6
<address_ipv6> dst-subnet
<address_ipv4mask> dst-subnet6
<address_ipv6mask> encapsulation
{tunnel-mode
| transport-mode} keepalive
{enable | disable}
Description
Enter the port number that the remote VPN peer or
FortiGate dialup client uses to transport traffic related to the specified service (see protocol). The range is
1 to 65535. To specify all ports, type 0.
This field is not available if phase1name names a configuration that enables mode-cfg.
This field is available when dst-addr-type is set to range. This field is not available if phase1name names a configuration that enables mode-cfg.
Default
0
0.0.0.0
Enter the lowest destination IP address in the range of
IP addresses.
This field is available when dst-addr-type is set to range6. This field is not available if phase1name names a configuration that enables mode-cfg.
::
Enter the lowest destination IP address in the range of
IP addresses.
Enter the IPv4 IP address and network mask that identifies the private network behind the remote VPN peer or FortiGate dialup client.
0.0.0.0
0.0.0.0
This field is not available if phase1name names a configuration that enables mode-cfg.
Enter the IPv6 IP address and network mask that identifies the private network behind the remote VPN peer or FortiGate dialup client.
::/0
This field is not available if phase1name names a configuration that enables mode-cfg.
Select encapsulation: tunnel-mode — Encrypt both payload data and headers.
tunnel-mode transport-mode — Encrypt only the payload data.
This is used when combining IPsec with another encapsulation, such as GRE.
Enable to automatically negotiate a new phase 2 security association (SA) before the current SA expires, keeping the tunnel up. Otherwise, a new SA is negotiated only if there is traffic.
disable
Fortinet Technologies Inc.
Page 806 FortiOS™ - CLI Reference for FortiOS 5.0
vpn ipsec phase2-interface
Variable
keylife-type
<keylife_type>
Description
Set when the phase 2 key expires. When the key expires, a new key is generated without interrupting service.
Default
seconds keylifekbs
<kb_integer>
• To make the key expire after a period of time has expired and after an amount of data is transmitted, type both.
• To make the key expire after an amount of data is transmitted, type kbs. Use the keylifekbs field to set the amount of data that is transmitted.
• To make the key expire after a number of seconds elapses, type seconds. Use the keylifeseconds field to set the amount of time that elapses.
This field is available when keylife-type is set to kbs or both.
5120 keylifeseconds
<seconds>
Set the number of KBits of data to transmit before the phase 2 key expires. The range is 5120 to
4 294 967 295 KBits.
This field is available when keylife-type is set to seconds or both.
1800
Set the number of seconds to elapse before the phase
2 key expires. seconds can be 120 to 172800 seconds.
l2tp
{enable | disable}
Enable L2TP traffic through this VPN. This is available if encapsulation is transport-mode and the phase 1 type is dynamic.
pfs {enable | disable} Optionally, enable or disable perfect forward secrecy
(PFS). PFS ensures that each key created during
Phase 2 is unrelated to keys created during Phase 1 or to other keys created during Phase 2. PFS may cause minor delays during key generation.
phase1name
<gateway_name>
Enter a phase 1 gateway configuration name. You must add the phase 1 gateway definition to the
FortiGate configuration before it can be crossreferenced.
disable enable
Null.
Fortinet Technologies Inc.
Page 807 FortiOS™ - CLI Reference for FortiOS 5.0
vpn ipsec phase2-interface
Variable
proposal
<encrypt_digest> protocol
<protocol_integer>
Description
Enter a minimum of one and a maximum of three encryption-message digest combinations (for example,
3des-md5). The remote peer must be configured to use at least one of the proposals that you define. Use a space to separate the combinations.
Default
aes128-sha1
3des-sha1
You can enter any encryption-message digest combination except null-null.
Here is an explanation of the abbreviated encryption algorithms:
• null — Do not use an encryption algorithm.
• des — Digital Encryption Standard, a 64-bit block algorithm that uses a 56-bit key.
•
3des — Triple-DES, which encrypts data three times by three keys.
• aes128 — A 128-bit block algorithm that uses a
128-bit key.
• aes192—- A 128-bit block algorithm that uses a
192-bit key.
• aes256 — A 128-bit block algorithm that uses a
256-bit key.
• aria128 — A 128-bit Korean block algorithm that uses a 128-bit key.
• aria192 — A 128-bit Korean block algorithm that uses a 192-bit key.
• aria256 — A 128-bit Korean block algorithm that uses a 256-bit key.
• seed — A 128-bit Korean block algorithm that uses a 128-bit key.
The ARIA and seed algorithms are not available on some models.
You can enter any of the following message digests to check the authenticity of messages during an encrypted session:
• null — Do not use a message digest.
• md5 — Message Digest 5, the hash algorithm developed by RSA Data Security.
• sha1 — Secure Hash Algorithm 1, which produces a 160-bit message digest.
• sha256 — Secure Hash Algorithm 2, which produces a 256-bit message digest.
This field is available when selector is set to specify.
0
Enter the IP protocol number for the service. The range is
1 to 255. To specify all services, type 0.
Fortinet Technologies Inc.
Page 808 FortiOS™ - CLI Reference for FortiOS 5.0
vpn
Variable
replay {disable | enable} route-overlap
{overlap_option} single-source
{disable | enable}
ipsec phase2-interface
Description
Optionally, enable or disable replay detection. Replay attacks occur when an unauthorized party intercepts a series of IPSec packets and replays them back into the tunnel. Enable replay detection to check the sequence number of every IPSec packet to see if it has been received before. If packets arrive out of sequence, the
FortiGate units discards them.
Default
enable
You can configure the FortiGate unit to send an alert email when it detects a replay packet. See
Specify how FortiGate unit handles multiple dialup users with the same IP source address. Set overlap_option to one of the following: use-new
• allow — allow overlapping routes
• use-new — delete the old route and add the new route
• use-old — use the old route and do not add the new route
Enable or disable all FortiClient dialup clients to connect using the same phase 2 tunnel definition. disable
Fortinet Technologies Inc.
Page 809 FortiOS™ - CLI Reference for FortiOS 5.0
vpn ipsec phase2-interface
Variable
src-addr-type
<ip_source_name> src-end-ip
<address_ipv4> src-end-ip6
<address_ipv6>
Description
If the FortiGate unit is a dialup server, enter the type of source address that corresponds to the local sender(s) or network behind the FortiGate dialup server:
Default
subnet
• To specify the IPv4 IP address of a server or host, type ip. Enter the IP address using the srcstart-ip field.
• To specify the IPv6 IP address of a server or host, type ip6. Enter the IP address using the srcstart-ip6 field.
• To specify a range of IPv4 IP addresses, type range. Enter the starting and ending addresses using the src-start-ip and src-end-ip fields.
• To specify a range of IPv6 IP addresses, type range6. Enter the starting and ending addresses using the src-start-ip6 and src-end-ip6 fields.
• To specify an IPv4 network address, type subnet.
Enter the network address using the src-subnet field.
• To specify an IPv6 network address, type subnet6. Enter the network address using the src-subnet6 field.
• To specify an address defined in a firewall address or address group, type name. Enter the address name using the src-name field. You must also select the name option for dst-addr-type. This is available only for IPv4 addresses.
You should not use this option if ike-version is
1. IKEv1 does not support the use of multiple addresses in selectors. Instead, use the default
0.0.0.0/0 subnet selector and rely on the firewall policy to limit source addresses.
If the FortiGate unit is a dialup client, src-addr-type must refer to the server(s), host(s), or private network behind the FortiGate dialup client.
This field is not available if phase1name names a configuration that enables mode-cfg.
This field is available when src-addr-type is set to range. This field is not available if phase1name names a configuration that enables mode-cfg.
Enter the highest source IP address in the range of IP addresses.
This field is available when src-addr-type is set to range6. This field is not available if phase1name names a configuration that enables mode-cfg.
Enter the highest source IP address in the range of IP addresses.
0.0.0.0
::
Fortinet Technologies Inc.
Page 810 FortiOS™ - CLI Reference for FortiOS 5.0
vpn ipsec phase2-interface
Variable
src-name
<address_name> src-port
<src_port_number> src-start-ip
<address_ipv4> src-start-ip6
<address_ipv6> src-subnet
<address_ipv4mask> src-subnet6
<address_ipv6mask>
Description
This field is available when src-addr-type is set to name. This field is not available if phase1name names a configuration that enables mode-cfg.
Default
Enter the firewall address or address group name.
If the FortiGate unit is a dialup server, enter the port number that the FortiGate dialup server uses to transport traffic related to the specified service (see protocol). If the FortiGate unit is a dialup client, enter the port number that the FortiGate dialup client uses to transport traffic related to the specified service. The src-port range is 1 to 65535. To specify all ports, type
0.
0
This field is not available if phase1name names a configuration that enables mode-cfg.
This field is available when src-addr-type is set to range. This field is not available if phase1name names a configuration that enables mode-cfg.
0.0.0.0
Enter the lowest source IP address in the range of IP addresses.
This field is available when src-addr-type is set to range6. This field is not available if phase1name names a configuration that enables mode-cfg.
::
Enter the lowest source IP address in the range of IP addresses.
If the FortiGate unit is a dialup server, enter the IPv4 IP address and network mask that identifies the private network behind the FortiGate dialup server. If the
FortiGate unit is a dialup client, enter the IP address and network mask that identifies the private network behind the FortiGate dialup client.
0.0.0.0
0.0.0.0
This field is not available if phase1name names a configuration that enables mode-cfg.
If the FortiGate unit is a dialup server, enter the IPv6 IP address and network mask that identifies the private network behind the FortiGate dialup server. If the
FortiGate unit is a dialup client, enter the IP address and network mask that identifies the private network behind the FortiGate dialup client.
::/0
This field is not available if phase1name names a configuration that enables mode-cfg.
Fortinet Technologies Inc.
Page 811 FortiOS™ - CLI Reference for FortiOS 5.0
vpn
l2tp
l2tp
Use this command to enable L2TP and specify a local address range to reserve for remote L2TP clients. When a remote L2TP client connects to the internal network through a L2TP VPN, the client is assigned an IP address from the specified range.
L2TP clients must authenticate with the FortiGate unit when a L2TP session starts. To support
L2TP authentication on the FortiGate unit, you must define the L2TP users who need access and then add them to a user group. For more information, see
,
, and
You need to define a firewall policy to control services inside the L2TP tunnel. For more information, see
“firewall” on page 99 . When you define the firewall policy:
• Create an “external -> internal” policy.
• Set the source address to match the L2TP address range.
• Set the destination address to reflect the private address range of the internal network behind the local FortiGate unit.
• Set the policy service(s) to match the type(s) of traffic that L2TP users may generate.
• Set the policy action to accept.
• Enable NAT if required.
FortiGate units support L2TP with Microsoft Point-to-Point Encryption (MPPE) encryption only.
Later implementations of Microsoft L2TP for Windows use IPSec and require certificates for authentication and encryption. If you want to use Microsoft L2TP with IPSec to connect to a
FortiGate unit, the IPSec and certificate elements must be disabled on the remote client. For more information, see the
Disabling Microsoft L2TP for IPSec
article in the Fortinet Knowledge
Center.
Syntax
config vpn l2tp set
set
set
end set
You can configure L2TP VPNs on FortiGate units that run in NAT/Route mode. The commands are available in NAT/Route mode only. When you configure an L2TP address range for the first time, you must enter a starting IP address, an ending IP address, and a user group.
Variable
eip <address_ipv4> sip <address_ipv4>
Description
The ending IP address of the L2TP address range.
The starting IP address of the L2TP address range.
Default
0.0.0.0
0.0.0.0
Fortinet Technologies Inc.
Page 812 FortiOS™ - CLI Reference for FortiOS 5.0
vpn
Variable Description
status {enable | disable}
Enable or disable L2TP VPN.
usrgrp <group_name>
This field is available when status is set to enable.
Enter the name of the user group for authenticating L2TP clients. The user group must be added to the FortiGate configuration before it can be specified here. For more information, see
, and
Default
disable
Null
l2tp
Fortinet Technologies Inc.
Page 813 FortiOS™ - CLI Reference for FortiOS 5.0
vpn
pptp
pptp
Use this command to enable PPTP and specify a local address range to reserve for remote
PPTP clients. When a remote PPTP client connects to the internal network through a PPTP
VPN, the client is assigned an IP address from the specified range or from the server defined in the PPTP user group.
PPTP clients must authenticate with the FortiGate unit when a PPTP session starts. To support
PPTP authentication on the FortiGate unit, you must define the PPTP users who need access and then add them to a user group. For more information, see
,
,
You need to define a firewall policy to control services inside the PPTP tunnel. For more information, see
“firewall” on page 99 . When you define the firewall policy:
• Create an “external -> internal” policy.
• Set the source address to match the PPTP address range.
• Set the destination address to reflect the private address range of the internal network behind the local FortiGate unit.
• Set the policy service(s) to match the type(s) of traffic that PPTP users may generate.
• Set the policy action to accept.
• Enable NAT if required.
When you intend to use the FortiGate unit as a PPTP gateway, you can select a PPTP client IP from a local address range or use the server defined in the PPTP user group. You select which method to use for IP address retrieval and, in the case of the user group server, provide the IP address and the user group.
The FortiGate unit retrieves the
Framed-IP-Address (the actual IP address of the client) from the RADIUS accounting start/stop message when ip-mode is set to usrgrp.
Syntax
config vpn pptp set
set
set
set
set
end set
You can configure PPTP VPNs on FortiGate units that run in NAT/Route mode. The commands are available in NAT/Route mode only. When you configure a PPTP address range for the first time, you must enter a starting IP address, an ending IP address, and a user group.
Fortinet Technologies Inc.
Page 814 FortiOS™ - CLI Reference for FortiOS 5.0
vpn pptp
Variable Description
eip <address_ipv4>
The ending address of the PPTP address range.
ip-mode {range | usrgrp}
Select one of: range — Assign user IP addresses from the IP address range of configured by sip and eip.
usrgrp — Retrieve the IP address from the user group used to authenticate the user. Select the user group in usrgrp.
local-ip <address_localip> Enter the IP address to be used for the peer’s remote IP on the PPTP client side.
sip <address_ipv4>
The starting address of the PPTP IP address range. status {enable | disable}
Enable or disable PPTP VPN.
usrgrp <group_name>
This field is available when ip-mode is set to usrgrp.
0.0.0.0
0.0.0.0
disable
Null
Enter the name of the user group for authenticating PPTP clients. The user group must be added to the FortiGate configuration before it can be specified here. For more information, see
,
,
, “user peer” on page 732 , and
Default
0.0.0.0
range
Fortinet Technologies Inc.
Page 815 FortiOS™ - CLI Reference for FortiOS 5.0
vpn ssl settings
ssl settings
Use this command to configure basic SSL VPN settings including interface idle-timeout values and SSL encryption preferences. If required, you can also enable the use of digital certificates for authenticating remote clients.
You can optionally specify the IP address of any Domain Name Service (DNS) server and/or
Windows Internet Name Service (WINS) server that resides on the private network behind the
FortiGate unit. The DNS and/or WINS server will find the IP addresses of other computers whenever a connected SSL VPN user sends an email message or browses the Internet.
You can configure SSL VPNs on FortiGate units that run in NAT/Route mode. The commands are available in NAT/Route mode only.
Syntax
config vpn ssl settings set
set
allow-ssl-big-buffer {enable | disable}
set
allow-ssl-client-renegotiation {enable | disable}
set
allow-ssl-insert-empty-fragment {enable | disable}
set
set
auto-tunnel-policy {enable | disable}
set
auto-tunnel-static-route {enable | disable}
set
deflate-compression-level <int>
set
set
set
set
set
force-two-factor-auth {enable | disable}
set
force-utf8-login {enable | disable}
set
http-compression {enable | disable}
set
http-only-cookie {enable | disable}
set
set
set
port-precedence {enable | disable}
set
reqclientcert {enable | disable}
set
route-source-interface {enable | disable}
set
set
set
set
sslvpn-enable {enable | disable}
set
set
set
set
tunnel-ip-pools <pool1_name ...pooln_name>
set
url-obscuration {enable | disable}
set
end set
Fortinet Technologies Inc.
Page 816 FortiOS™ - CLI Reference for FortiOS 5.0
vpn ssl settings
When you configure the timeout settings, if you set the authentication timeout
( auth-timeout) to 0, then the remote client does not have to re-authenticate again unless they log out of the system. In order to fully take advantage of this setting, the value for idle-timeout has to be set to 0 also, so the client does not timeout if the maximum idle time is reached. If the idle-timeout is not set to the infinite value, the system will log out if it reaches the limit set, regardless of the auth-timeout setting.
Set the sslvpn-enable attribute to enable to view all possible settings. The tunnel-ip-pools field is required for tunnel-mode access only. All other fields are optional.
Variable
algorithm
<cipher_suite>
Description
This field is available when sslvpn-enable is set to enable.
Default
default
Enter one of the following options to determine the level of SSL encryption to use. The web browser on the remote client must be capable of matching the level that you specify:
• To use any cipher suite, type low.
• To use a 128-bit or greater cipher suite, type default.
• To use a cipher suite that is greater than 128 bits, type high.
The default setting (disable) reduces memory use by
16kbytes per connection. disable
Enable or disable renegotiation if tunnel goes down. SSL renegotiation feature could be used for DOS attack.
disable allow-ssl-big-buffer
{enable | disable} allow-ssl-clientrenegotiation
{enable | disable} allow-ssl-insert-emptyfragment
{enable | disable} auth-timeout
<auth_seconds>
Internet Explorer 6 and earlier might not work well with the default setting (enable). The setting can be changed, but reduces security.
This field is available when enable.
sslvpn-enable is set to enable
28800 auto-tunnel-policy
{enable | disable} auto-tunnel-static-route
{enable | disable} deflate-compressionlevel <int>
Enter the period of time (in seconds) to control how long an authenticated connection will remain connected.
When this time expires, the system forces the remote client to authenticate again. Range is 10 to 259,200 seconds (3 days). Use the value of 0 to indicate no timeout.
If enabled, when you add an SSL VPN portal with tunnel mode enabled, FortiOS automatically adds an SSL VPN tunnel policy so that you don’t have to add one manually.
enable
If enabled, when you add an SSL VPN portal with tunnel mode enabled, FortiOS automatically adds static routes for the networks that can be accessed through the SSL
VPN tunnel so that you don’t have to add them manually.
enable
Set the compression level. Range is 1 (least compression) to 9 (most compression). Higher compression reduces the volume of data but requires more processing time. This field is available when http-compression is enabled.
6
Fortinet Technologies Inc.
Page 817 FortiOS™ - CLI Reference for FortiOS 5.0
vpn ssl settings
Variable
deflate-min-data-size
<int> dns-server1
<address_ipv4> dns-server2
<address_ipv4> dns-suffix
<domain_str> force-two-factor-auth
{enable | disable}
Description
Set the minimum amount of data that will trigger compression. Smaller amounts are not compressed.
Range is 200 to 65 535 bytes. This field is available when http-compression is enabled.
Enter the IP address of the primary DNS server that SSL
VPN clients will be able to access after a connection has been established. If required, you can specify a secondary DNS server through the dns-server2 attribute.
Default
300
0.0.0.0
Enter the IP address of a secondary DNS server if required.
0.0.0.0
Enter the DNS suffix. Maximum length 253 characters.
null force-utf8-login
{enable | disable} http-compression
{enable | disable} http-only-cookie
{enable | disable} idle-timeout
<idle_seconds> port <port_int> port-precedence
{enable | disable} reqclientcert
{enable | disable}
Enable to require PKI (peer) users to authenticate by password in addition to certificate authentication. If this is enabled, only PKI users with two-factor authentication enabled will be able to log on to the SSL VPN.
disable disable
Enable to use UTF-8 encoding for the login page. This might be necessary when using LDAP to authenticate users.
disable
Enable use of compression between the FortiGate unit and the client web browser. You can adjust the fields deflate-compression-level and deflate-min-data-size to tune performance.
Disable only if a web site is having trouble with the tunnel mode Java Applet. enable
This field is available when enable.
sslvpn-enable is set to
300
Enter the period of time (in seconds) to control how long the connection can remain idle before the system forces the remote user to log in again. The range is from 10 to
259 200 seconds. Use the value of 0 to indicate no timeout.
Enter the SSL VPN access port. Range 1 - 65 535.
10443
The port is usable only when sslvpn-enable is set to enable.
When vdoms are enabled, this setting is per VDOM.
Enable to give SSLVPN higher priority than HTTPS if both are enabled on the same port.
This field is available when sslvpn-enable is set to enable.
enable disable
Disable or enable the use of group certificates for authenticating remote clients. The SSLVPN daemon will require a client certificate for all SSL VPN users regardless of policy.
Fortinet Technologies Inc.
Page 818 FortiOS™ - CLI Reference for FortiOS 5.0
vpn ssl settings
Variable
route-source-interface
{enable | disable}
Description
This field is available when sslvpn-enable is set to enable.
Default
disable servercert
<server_cert_name>
Enable to allow the SSL VPN connection to bypass routing and bind to the incoming interface.
This field is available when enable.
sslvpn-enable is set to self-sign
Enter the name of the signed server certificate that the
FortiGate unit will use to identify itself during the SSL handshake with a web browser when the web browser connects to the login page. The server certificate must already be loaded into the FortiGate configuration. If you do not specify a server certificate, the FortiGate unit offers its factory installed (self-signed) certificate from
Fortinet to remote clients when they connect. sslv2 {enable | disable} This field is available when sslvpn-enable is set to enable.
disable
Disable or enable SSL version 2 encryption.
sslv3 {enable | disable} This field is available when sslvpn-enable is set to enable.
Disable or enable SSL version 3 encryption.
Disable or enable remote-client access.
sslvpn-enable
{enable | disable} tlsv1-0
{enable | disable} tlsv1-1
{enable | disable} tlsv1-2
{enable | disable} tunnel-ip-pools
<pool1_name
...pooln_name> url-obscuration
{enable | disable}
Enable or disable TLS 1.0 cryptographic protocol.
Enable or disable TLS 1.1 cryptographic protocol.
Enable or disable TLS 1.2 cryptographic protocol.
Enter the firewall addresses that represent the ranges of
IP addresses reserved for remote clients.
This field is available when sslvpn-enable is set to enable.
This field is available when sslvpn-enable is set to enable.
wins-server1
<address_ipv4> wins-server2
<address_ipv4> enable disable enable enable enable
No default.
disable
Enable to encrypt the host name of the url in the display
(web address) of the browser for web mode only. This is a requirement for ICSA ssl vpn certification. Also, if enabled, bookmark details are not visible (field is blank.).
Enter the IP address of the primary WINS server that SSL
VPN clients will be able to access after a connection has been established. If required, you can specify a secondary WINS server through the wins-server2 attribute.
0.0.0.0
Enter the IP address of a secondary WINS server if required.
0.0.0.0
Fortinet Technologies Inc.
Page 819 FortiOS™ - CLI Reference for FortiOS 5.0
vpn ssl web host-check-software
ssl web host-check-software
Use this command to define security software for selection in the host-check-policy field of the vpn ssl web portal command.
Syntax
config vpn ssl web host-check-software edit
<software_name> set guid <guid> set type {av | fw}} set version <version_str>
config check-item-list edit
<id_int> set action {deny | require}
end end
Variable
<software_name>
Description
Enter a name to identify the software. The name does not need to match the actual application name.
set guid <guid>
Enter the globally unique identifier (GUID) for the host check application. The GUID is usually in the form xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxx, where each x is a hexadecimal digit. Windows uses GUIDs to identify applications in the Windows Registry.
set type {av | fw}}
Select the software type: antivirus ( av) or firewall (fw). If the software does both, create two entries, one where type is av and one where type is fw.
set version <version_str>
Enter the software version.
check-item-list variables
<id_int>
Enter an ID number for this entry.
set action {deny | require} Select one of
Default
No default.
av
No default.
require require — If the item is found, the client meets the check item condition.
set md5s <md5_str> deny — If the item is found, the client is considered to not meet the check item condition. Use this option if it is necessary to prevent use of a particular security product.
If type is file or process, enter one or more known
MD5 signatures for the application executable file.You can use a third-party utility to calculate MD5 signatures or hashes for any file. You can enter multiple signatures to match multiple versions of the application.
Fortinet Technologies Inc.
Page 820 FortiOS™ - CLI Reference for FortiOS 5.0
vpn ssl web host-check-software
Variable
set target
{file | process | registry}
Description
Enter information as follows:
If type is file, enter the full path to the file.
If type is process, enter the application’s executable file name.
Default
No default.
set type
{file | process | registry}
If type is registry, enter the registry item.
Select how to check for the application:
• file — Look for a file. This could be the application’s executable file or any other file that would confirm the presence of the application. Set target to the full path to the file. Where applicable, you can use environment variables enclosed in percent (%) marks. For example,
%ProgramFiles%\Fortinet\FortiClient\Fo rtiClient.exe.
• process — Look for the application as a running process. Set target to the application’s executable file name.
• registry — Search for a Windows Registry entry.
Set target to the registry item, for example
HKLM\SOFTWARE\Fortinet\FortiClient\Mis c.
set version <version-str>
Enter the version of the application.
file
No default.
Fortinet Technologies Inc.
Page 821 FortiOS™ - CLI Reference for FortiOS 5.0
vpn ssl web portal
ssl web portal
The SSL VPN Service portal allows you to access network resources through a secure channel using a web browser. FortiGate administrators can configure log in privileges for system users and which network resources are available to the users, such as HTTP/HTTPS, telnet, FTP,
SMB/CIFS, VNC, RDP and SSH.
The portal configuration determines what the system user sees when they log in to the
FortiGate. Both the system administrator and the system user have the ability to customize the
SSL VPN portal.
There are three pre-defined default web portal configurations available:
• full-access: Includes all widgets available to the user - Session Information, Connection Tool,
Bookmarks, and Tunnel Mode.
• tunnel-access: Includes Session Information and Tunnel Mode widgets.
• web-access: Includes Session Information and Bookmarks widgets.
These pre-defined portal configurations can be edited, including their names.
Syntax
config vpn ssl web portal edit <portal_name>
Fortinet Technologies Inc.
Page 822 FortiOS™ - CLI Reference for FortiOS 5.0
vpn
Fortinet Technologies Inc.
ssl web portal
config mac-addr-check-rule
set
set
end config os-check-list {windows-2000 | windows-vista | windows-xp
| windows-7 | windows-8} set
action {allow | check-up-to-date | deny}
set
latest-patch-level {disable | 0 - 255}
set
end config widget edit
set
set
set
auto-connect {enable | disable}
set
set
set
set
set
allow-apps <service_type_access>
set
exclusive-routing {enable | disable}
set
set
ip-pools {<pool1_name> .. <pooln_name>}
set
set
set
set
set
set
save-password {enable | disable}
set
split-tunneling {enable | disable}
set
split-tunneling-routing-address <address_name>
set
set
config bookmarks edit
set
set
set
set
set
set
set
full-screen-mode {enable | disable}
set
set
set
set
set
set
Page 823 FortiOS™ - CLI Reference for FortiOS 5.0
vpn ssl web portal
end end set
set
show-status-window {enable | disable}
set
set
sso-credential {sslvpn-login | alternative)
end end set
set
end
Variable
edit <portal_name_str>
Description
Enter a name for the portal.
Default
No default.
allow-access
<allow_access> allow-user-bookmark
{enable | disable} auto-prompt-mobile-userdownload
{enable | disable} cache-cleaner
{enable | disable} heading <str_heading>
Three pre-defined web portal configurations exist: full-access, tunnel-access, and webaccess.
Enter a list of the applications allowed in this portal.
Separate entries with spaces. Application names are:
No default.
• citrix for Citrix web server interface
• ftp for FTP services.
• ping for pinging hosts.
• portforward for port forwarding.
• rdp for Windows Terminal services.
• rdpnative for remote desktop access with native client.
• smb for SMB/CIFS (Windows file share) services.
• ssh for SSH services.
• telnet for telnet services.
• vnc for VNC services.
• web for HTTP and/or HTTPS services.
Allow web portal users to create their own bookmarks.
Enable to prompt mobile users to download
FortiClient Endpoint Security. enable enable
Enable the FortiGate unit to remove residual information from the remote client computer just before the SSL VPN session ends. This is done with a downloaded ActiveX control or disable
Enter the caption that appears at the top of the web portal home page.
null
Fortinet Technologies Inc.
Page 824 FortiOS™ - CLI Reference for FortiOS 5.0
vpn ssl web portal
Variable
host-check {av | av-fw
| custom | fw | none}
Description
Select the type of host checking to perform on endpoints: av — Check for antivirus software recognized by the Windows Security Center.
av-fw — Check for both antivirus and firewall software recognized by the Windows Security
Center.
Default
none custom — Check for the software defined in host-check-policy.
fw — Check for firewall software recognized by the
Windows Security Center.
none — Do not perform host checking.
host-check-interval
<seconds>
Enter how often to recheck the host. Range is every
120 seconds to 259 200 seconds. Enter 0 to not recheck the host during the session. This is not available if host-check is none.
host-check-policy
<hcpolicy_name>
Select the specific host check software to look for.
These applications are defined in the vpn ssl web host-check-software command. This field is
available when host-check is custom.
limit-user-logins
{enable | disable} mac-addr-action
{allow | deny
Enable to allow each user one SSL VPN session at a time.
Set action for MAC address check: allow or deny connection.
mac-addr-check
{enable | disable}
Enable or disable MAC address host check.
os-check {enable | disable} Enable the FortiGate unit to determine what action to take depending on what operating system the client has.
page-layout
<double-column
| single-column> redir-url <redir_url>
0 null disable allow disable disable
Select the number of columns in the portal display.
single-column null Enter the URL of the web page which will enable the
FortiGate unit to display a second HTML page in a popup window when the web portal home page is displayed. The web server for this URL must reside on the private network behind the FortiGate unit.
skip-check-forunsupported-browser
{enable | disable} skip-check-forunsupported-os
{enable | disable} theme {blue | gray
| orange} virtual-desktop
{enable | disable}
Skip the host check if the browser doesn’t support it. This field is available if host checking is enabled.
Skip the host check if the client operating system doesn’t support it. This field is available if host checking is enabled.
Select the portal display theme (color).
Enable the SSL VPN virtual desktop client application. If set to enable on the client, attempts to connect via SSL VPN are refused.
enable enable blue disable
Fortinet Technologies Inc.
Page 825 FortiOS™ - CLI Reference for FortiOS 5.0
vpn ssl web portal
Variable
virtual-desktop-app-list
<applist_name> virtual-desktop-clipboardshare {enable | disable} virtual-desktop-desktopswitch {enable | disable} virtual-desktop-logoutwhen-browser-close
{enable | disable} virtual-desktop-networkshare-access
{enable | disable} virtual-desktop-printing
{enable | disable} virtual-desktop-removablemedia-access
{enable | disable}
Description Default
Enter the name of the application list to apply to the virtual desktop. See
vpn ssl web virtual-desktopapp-list
.
Null
Enable or disable sharing of the clipboard with the regular desktop.
disable
Enable or disable switching between virtual and regular desktop.
Enable or disable automatic logout from virtual desktop when browser is closed.
Enable or disable network share access from the virtual desktop.
Enable or disable printing from the virtual desktop.
Enable or disable accessing removable media such as USB drives from the virtual desktop.
config mac-addr-check-rule variables
edit <rule_name> Enter a name for this MAC check rule.
mac-addr-list <mac_list> Enter client MAC addresses.
mac-addr-mask <int> Set the size of the netmask in bits. Range 1-48.
config os-check-list variables
disable disable disable disable disable
No default.
48
Available when set os-check is set to check-up-to-date.
action {allow | check-up-to-date | deny}
Specify how to perform the patch level check.
• allow - any level is permitted
• check-up-to-date - some patch levels are permitted, make selections for latest-patchlevel and tolerance
• deny - do not permit access for any version of this OS allow latest-patch-level
{disable | 0 - 255}
Specify the latest allowed patch level.
Available when action is set to enable.
tolerance {tolerance_num} Specify the lowest allowable patch level tolerance.
Equals latest-patch-level minus tolerance and above.
Win2000:
4
WinXP:
2
0
Available when action is check-up-to-date.
Widget variables
id <widget_id> name <name_str>
No default.
null type <widget_type> auto-connect
{enable | disable}
Enter the unique ID number of the widget.
Enter the name for the widget. Maximum 36 characters.
Enter the type of widget: bookmark, forticlient-download, history, info, tool or tunnel.
Enable or disable FortiClient automatic connection to this portal.
bookmark disable
Fortinet Technologies Inc.
Page 826 FortiOS™ - CLI Reference for FortiOS 5.0
vpn ssl web portal
Variable Description
column <column_number> Enter the number of columns in the widget display: one or two.
Default
one
This is available if page-layout is doublecolumn.
collapse {enable | disable} Enable the widget to expand in the web portal view.
Allows user to make changes to the widget view/configuration.
dns-server1 <ip4_addr> dns-server2 <ip4_addr>
Specify primary and secondary DNS servers. This is available if type is tunnel.
allow-apps
<service_type_access>
If type is bookmark, select the types of bookmarks the user can create.
disable
0.0.0.0
0.0.0.0
No default.
If type is tool, select the types of services that the user can access with this widget.
exclusive-routing
{enable | disable}
Separate entries with spaces.
• citrix for Citrix web server interface
• ftp for FTP services
• ping for pinging hosts (tool only)
• portforward for port forwarding
• rdp for Windows Terminal services
• rdpnative for remote desktop access with native client
• smb for SMB/CIFS (Windows file share) services
• ssh for SSH services
• telnet for telnet services
• vnc for VNC services
• web for HTTP and/or HTTPS services
Enable to force traffic between the client and the client’s local network to pass through the SSL VPN tunnel. This can enhance security. disable
By default, an SSL VPN with split-tunneling disabled does not affect traffic between the client and the client’s local network, even though all other traffic is routed through the SSL VPN tunnel.
exclusive-routing is available only when split-tunneling is disabled. ip-mode {range | usrgrp}
Select the mode by which the IP address is assigned to the user: range ip-pools {<pool1_name> ..
<pooln_name>}
Available only if tunnel-status is enabled.
Enter the names of the IP pools (firewall addresses) that represent IP address ranges reserved for tunnel-mode SSL VPN clients. This is available only if tunnel-status is enabled.
Fortinet Technologies Inc.
Page 827 FortiOS™ - CLI Reference for FortiOS 5.0
vpn ssl web portal
Variable
ipv6-dns-server1
<ip6_addr> ipv6-dns-server2
<ip6_addr> ipv6-wins-server1
<ip6_addr> ipv6-wins-server2
<ip6_addr> keep-alive
{enable | disable} save-password
{enable | disable} split-tunneling
{enable | disable} split-tunneling-routingaddress <address_name> wins-server1 <ip4_addr> wins-server2 <ip4_addr>
Description
Specify primary and secondary IPv6 DNS servers.
This is available if type is tunnel.
Specify primary and secondary IPv6 WINS servers.
This is available if type is tunnel.
Default
::
::
::
::
Enable or disable keepalive (automatic reconnect) for FortiClient connections to this portal.
Enable or disable FortiClient saving of user password.
disable
Enable split tunneling. Split tunneling ensures that only the traffic for the private network is sent to the
SSL VPN gateway. Internet traffic is sent through the usual unencrypted route. Available only if tunnel-status is enabled.
Enter the firewall addresses for the destinations that clients will reach through the SSL VPN. The client’s split-tunneling configuration will ensure that the tunnel is used for these destinations only.
disable
No default.
This is available when split-tunneling is enabled.
Specify primary and secondary WINS servers. This is available if type is tunnel.
0.0.0.0
0.0.0.0
Fortinet Technologies Inc.
Page 828 FortiOS™ - CLI Reference for FortiOS 5.0
vpn ssl web portal
Variable
Bookmarks variables
Description Default
Note: config bookmarks is available only when widget type is bookmark.
<bookmark_name>
Enter the unique name of the bookmark. Maximum
36 characters.
additional-params
<param_str>
Enter additional parameters the application requires.
null apptype <service_type>
Available when apptype is citrix, portforward, rdp, or rdpnative.
Enter the identifier of the service to associate with the bookmark: web url <target_ip> host <host_name> folder <folder_name>
• Type citrix for Citrix web server interface.
• Type ftp for FTP services.
• Type portforward for port forwarding.
• Type rdp for Windows Terminal services.
• Type rdpnative for remote desktop access with native client.
• Type smb for SMB/CIFS (Windows file share) services.
• Type ssh for SSH services.
• Type telnet for telnet services.
• Type vnc for VNC services.
• Type web for HTTP and/or HTTPS services.
Enter the URL of the web page, if apptype is web or citrix.
Enter the host name, if apptype is telnet or rdp. Maximum 36 characters.
Enter the remote folder name, if apptype is smb or ftp.
No default.
No default.
No default.
The folder name must include the server name,
//172.20.120.103/myfolder, for example.
description
<description_txt>
Enter a description of the bookmark. Maximum 129 characters.
full-screen-mode
{enable | disable}
Enable or disable full-screen mode. Available when apptype is rdp or rdpnative.
keyboard-layout
<locale_str>
Enter the keyboard layout for the RDP session.
Available when apptype is rdp.
listening-port <port_int>
Enter the listening port number.
null disable en-us null logon-user
<user-name_str> logon-password
<password_str> remote-port <port_int>
Available when apptype is portforward.
Enter the logon credentials for the RDP bookmark.
Available when apptype is rdp.
Enter the remote port number.
Available when apptype is portforward.
null null
Fortinet Technologies Inc.
Page 829 FortiOS™ - CLI Reference for FortiOS 5.0
vpn ssl web portal
Variable
screen-height <h_int> screen-width <w_int> show-status-window
{enable | disable} sso {disable | auto}
Description
Enter screen height in pixels. Available when apptype is rdp or rdpnative.
Enter screen width in pixels. Available when apptype is rdp or rdpnative.
Enable or disable the status window.
Available when apptype is portforward.
A Single Sign-On (SSO) bookmark automatically enters the login credentials for the bookmark destination. Select one of:
Default
768
1024 disable disable
disable — This is not an SSO bookmark.
auto — SSO bookmark, configure sso-credential.
sso-credential
{sslvpn-login | alternative)
Select whether the bookmark enters the user’s SSL
VPN credentials or alternative credentials defined in sso-username and sso-password. sso-password <pwd_str>
Enter alternative password. Available when sso-credential is alternative.
sso-username <name_str>
Enter alternative username. Available when sso-credential is alternative.
sslvpn-login
No default.
No default.
Fortinet Technologies Inc.
Page 830 FortiOS™ - CLI Reference for FortiOS 5.0
vpn ssl web realm
ssl web realm
Use this command to configure SSL VPN realms.
Syntax
config vpn ssl web realm
edit <url-path> set login-page <content_str> set max-concurrent-user <int>
end end
set virtual-host <hostname_str>
Variable
edit <url-path>
Description
Enter the URL path to access the SSL-VPN login page. Do not include “http://”.
Default
No default.
login-page <content_str> Enter replacement HTML for SSL-VPN login page. No default.
max-concurrent-user
<int>
Enter the maximum number of concurrent users allowed. Range 0-65 535. 0 means unlimited.
0 virtual-host
<hostname_str>
Enter the virtual host name for this realm. Optional.
Maximum length 255 characters.
No default.
Fortinet Technologies Inc.
Page 831 FortiOS™ - CLI Reference for FortiOS 5.0
vpn ssl web user
ssl web user
Use this command to configure SSL VPN users and their bookmarks.
Syntax
config vpn ssl web user edit
config widget edit <widget_id> config bookmarks edit <bookmark_name> set
set
set
set
sso-credential {sslvpn-login | alternative)
set
set
set
config form-data
set
end set
end
Variable
<user_name> apptype
<service_type> description
<description_txt>
Description
Enter a name for the user.
Enter the identifier of the service to associate with the bookmark:
Default
web
• Type citrix for Citrix web server interface.
• Type ftp for FTP services.
• Type portforward for port forwarding.
• Type rdp for Windows Terminal services.
• Type rdpnative for remote desktop access with native client.
• Type smb for SMB/CIFS (Windows file share) services.
• Type ssh for SSH services.
• Type telnet for telnet services.
• Type vnc for VNC services.
• Type web for HTTP and/or HTTPS services.
Enter a description of the bookmark. Maximum 129 characters.
null
Fortinet Technologies Inc.
Page 832 FortiOS™ - CLI Reference for FortiOS 5.0
vpn ssl web user
Variable Description
sso {disable | auto} A Single Sign-On (SSO) bookmark automatically enters the login credentials for the bookmark destination. Select one of:
Default
disable
disable — This is not an SSO bookmark.
auto — SSO bookmark, configure sso-credential.
static — SSO bookmark with form data.
sso-credential
{sslvpn-login
| alternative) sso-password
<pwd_str> sso-username
<name_str> url <url_str>
Select whether the bookmark enters the user’s SSL VPN credentials or alternative credentials defined in sso-username and sso-password.
Enter alternative password. Available when sso-credential is alternative.
Enter alternative username. Available when sso-credential is alternative.
Enter the URL for this bookmark.
config form-data variables
These fields are available when sso is static.
edit <id_int>
Enter an identifier.
name
<fieldname_str>
Enter a required login page field name, “User Name” for example.
value <value_str>
Enter the value to enter in the field identified by name.
If you are an administrator configuring a bookmark for users: sslvpn-login
No default.
No default.
No default.
No default.
No default.
Enter
%username% to represent the user’s SSL VPN user name.
Enter
%passwd% to represent the user’s SSL VPN password.
Fortinet Technologies Inc.
Page 833 FortiOS™ - CLI Reference for FortiOS 5.0
vpn ssl web virtual-desktop-app-list
ssl web virtual-desktop-app-list
Use this command to create a list of either allowed or blocked applications which you then select when you configure the virtual desktop.
Syntax
config vpn ssl web virtual-desktop-app-list edit
<applist_name> set set action {allow | block}
config apps end edit
end end
Variable
<applist_name> set action
{allow | block}
Description
Enter a name for the application control list.
Set the action for this application control list:
Default
allow allow — Allow the applications on this list and block all others.
block — Block the applications on this list and allow all others
<app_name>
Enter the name of the application to be added to the application control list. This can be any name and does not have to match the official name of the application. set md5s <md5_str> Enter one or more known MD5 signatures (space-separated) for the application executable file.You can use a third-party utility to calculate MD5 signatures or hashes for any file. You can enter multiple signatures to match multiple versions of the application.
No default.
Fortinet Technologies Inc.
Page 834 FortiOS™ - CLI Reference for FortiOS 5.0
wanopt
Use these commands to configure FortiGate WAN optimization.
Page 835
wanopt
auth-group
auth-group
Use this command to configure WAN optimization authentication groups. Add authentication groups to support authentication and secure tunneling between WAN optimization peers.
Syntax
config wanopt auth-group
end
Variable Description
edit <auth_group_name> Enter a name for the authentication group.
auth-method {cert | psk} Specify the authentication method for the authentication group. Enter cert to authenticate using a certificate. Enter psk to authenticate using a preshared key.
cert <certificate_name>
If auth-method is set to cert, select the local certificate to be used by the peers in this authentication group. The certificate must be a local certificate added to the FortiGate unit using the config vpn certificate local
command. For more information, see “vpn certificate local” on page 760 .
peer <peer_host_id> peer-accept
{any | defined | one}
If peer-method is set to one select the name of one peer to add to this authentication group. The peer must have been added to the FortiGate unit using the config wanopt peer command.
Specify whether the authentication group can be used for any peer, only the defined peers that have been added to the FortiGate unit configuration, or just one peer. If you specify one use the peer field to add the name of the peer to the authentication group.
psk <preshared_key>
If auth-method is set to psk enter a preshared key to be used for the authentication group.
Default
cert any
Fortinet Technologies Inc.
Page 836 FortiOS™ - CLI Reference for FortiOS 5.0
wanopt
peer
peer
Add WAN optimization peers to a FortiGate unit to identify the FortiGate units that the local
FortiGate unit can form WAN optimization tunnels with. A peer consists of a peer name, which is the local host ID of the remote FortiGate unit and an IP address, which is the IP address of the interface that the remote FortiGate unit uses to connect to the local FortiGate unit.
Use the command config wanopt settings to add the local host ID to a FortiGate unit.
Syntax
config wanopt peer
end
Variable Description
edit <peer_name> Add the local host ID of the remote FortiGate unit. When the remote FortiGate unit connects to the local FortiGate unit to start a WAN optimization tunnel, the WAN optimization setup request include the remote FortiGate unit local host ID. If the local host ID in the setup request matches a peer added to the local FortiGate unit, then the local FortiGate unit can accept
WAN optimization tunnel setup requests from the remote
FortiGate unit.
ip <peer_ip_ipv4> Enter the IP address of the interface that the remote FortiGate unit uses to connect to the local FortiGate unit. Usually this would be the IP address of the interface connected to the
WAN.
Default
0.0.0.0
Fortinet Technologies Inc.
Page 837 FortiOS™ - CLI Reference for FortiOS 5.0
wanopt
profile
profile
WAN optimization uses profiles to select traffic to be optimized. But, before WAN optimization can accept traffic, the traffic must be accepted by a FortiGate firewall policy. All sessions accepted by a firewall policy that also match a WAN optimization profile are processed by WAN optimization.
To configure WAN optimization you add WAN optimization profiles to the FortiGate units at each end of the tunnel. Firewall policies use the specified WAN optimization profile to determine how to optimize the traffic over the WAN.
The FortiGate unit applies firewall policies to packets before WAN optimization profiles. A WAN optimization profile is applied to a packet only after the packet is accepted by a firewall policy.
Syntax
config wanopt profile
edit <name_str> set auth-group <auth_group_name>
set transparent {enable | disable}
config {cifs | ftp | http | mapi | tcp} set
byte-caching {enable | disable}
set
byte-caching-opt {mem-only | mem-disk}
set
log-traffic {enable | disable}
set
set
prefer-chunking {fix | dynamic}
set
secure-tunnel {enable | disable}
set
set
set
tunnel-non-http {enable | disable}
set
tunnel-sharing {express-shared | private | shared}
set
unknown-http-version {best-effort | reject | tunnel}
end
Variable Description
edit <name_str>
Enter a name for this profile.
auth-group <auth_group_name> Select an authentication group to be used by this profile. Select an authentication group if you want the client and server FortiGate units that use this profile to authenticate with each other before starting a WAN optimization tunnel.
Default
You must add the same authentication group to the client and server FortiGate units. The authentication group should have the same name of both FortiGate units and use the same preshared key or the same certificate.
You can add an authentication group to profiles with auto-detect set to off or active. An authentication group is required if you enable secure-tunnel for the profile.
Fortinet Technologies Inc.
Page 838 FortiOS™ - CLI Reference for FortiOS 5.0
wanopt profile
Variable
transparent {enable | disable}
Description
Enable or disable transparent mode for this profile.
Default
enable
If you enable transparent mode, WAN optimization keeps the original source address of the packets, so servers appear to receive traffic directly from clients. Routing on the server network should be able to route traffic with client IP addresses to the
FortiGate unit.
If you do not select transparent mode, the source address of the packets received by servers is changed to the address of the FortiGate unit interface. So servers appear to receive packets from the FortiGate unit. Routing on the server network is simpler in this case because client addresses are not involved, but the server sees all traffic as coming from the FortiGate unit and not from individual clients.
config {cifs | ftp | http | mapi | tcp} fields
byte-caching {enable | disable}
Enable or disable WAN optimization byte caching for the traffic accepted by this profile. Byte caching is a WAN optimization technique that reduces the amount of data that has to be transmitted across a WAN by caching file data to serve it later as required. Byte caching is available for all protocols.
byte-caching-opt
{mem-only | mem-disk}
Select whether byte-caching optimization uses only memory or both memory and disk. This is available for TCP only. log-traffic {enable | disable} port <port_int>[-<port-int>]
Enable of disable traffic logging.
Enter a single port number or port number range for the profile. Only packets whose destination port number matches this port number or port number range will be accepted by and subject to this profile.
prefer-chunking {fix | dynamic} Select dynamic or fixed data chunking. Dynamic data chunking helps to detect persistent data chunks in a changed file or in an embedded unknown protocol.
For TCP, disable
For all others, enable mem-only enable
0
Depends on protocol.
prefer-chunking is not available for TCP and MAPI.
For TCP, if byte-caching-opt is mem-disk, chunking algorithm will be dynamic. For MAPI, only dynamic is used. For other protocols, fix is the default.
Fortinet Technologies Inc.
Page 839 FortiOS™ - CLI Reference for FortiOS 5.0
wanopt
Variable Description
secure-tunnel {enable | disable}
Enable or disable using AES-128bit-CBC SSL to encrypt and secure the traffic in the WAN optimization tunnel. The FortiGate units use
FortiASIC acceleration to accelerate SSL decryption and encryption of the secure tunnel.
The secure tunnel uses the same TCP port as a non-secure tunnel (TCP port 7810). ssl {enable | disable} status {enable | disable} tunnel-non-http
{enable | disable}
Default
disable
You can configure securetunnel if autodetect is set to active or off. If you enable secure-tunnel you must also add an authgroup to the profile.
Enable or disable applying SSL offloading for
HTTPS traffic. You use SSL offloading to offload
SSL encryption and decryption from one or more
HTTP servers. If you enable ssl, you should configure the profile to accept SSL-encrypted traffic, usually by configuring the profile to accept
HTTPS traffic by setting port to 443.
If you enable SSL you must also use the config wanopt ssl-server command to add an SSL server for each HTTP server that you wan to offload SSL encryption/decryption for. See
“wanopt ssl-server” on page 843
.
disable
You can configure ssl if auto-detect is set to active or off.
Enable or disable the profile.
Configure how to process non-HTTP traffic when a profile configured to accept and optimize HTTP traffic accepts a non-HTTP session. This can occur if an application sends non-HTTP traffic using an HTTP destination port.
enable disable
Select disable to drop or tear down non-HTTP sessions accepted by the profile.
Select enable to pass non-HTTP sessions through the tunnel without applying protocol optimization, byte-caching, or web caching. TCP protocol optimization is applied to non-HTTP sessions.
You can configure tunnel-non-http if proto is set to http and auto-detect is set to active or off.
profile
Fortinet Technologies Inc.
Page 840 FortiOS™ - CLI Reference for FortiOS 5.0
wanopt
Variable
tunnel-sharing {express-shared
| private | shared} unknown-http-version
{best-effort | reject | tunnel}
Description
Select the tunnel sharing mode for this profile:
Select express-shared for profiles that accept interactive protocols such as Telnet.
Select private for profiles that accept aggressive protocols such as HTTP and FTP so that these aggressive protocols do not share tunnels with less-aggressive protocols.
Select shared for profiles that accept nonaggressive and non-interactive protocols.
Default
private
You can configure tunnel sharing if proto is set to http and auto-detect is set to off.
Unknown HTTP sessions are HTTP sessions that don’t comply with HTTP 0.9, 1.0, or 1.1. Configure unknown-http-version to specify how a profile handles HTTP traffic that does not comply with HTTP 0.9, 1.0, or 1.1.
tunnel
Select best-effort to assume all HTTP sessions accepted by the profile comply with
HTTP 0.9, 1.0, or 1.1. If a session uses a different
HTTP version, WAN optimization may not parse it correctly. As a result the FortiGate unit may stop forwarding the session and the connection may be lost.
Select reject to reject or tear down HTTP sessions that do not use HTTP 0.9, 1.0, or 1.1.
Select tunnel to pass HTTP traffic that does not use HTTP 0.9, 1.0, or 1.1 without applying HTTP protocol optimization, byte-caching, or web caching. TCP protocol optimization is applied to this HTTP traffic.
You can configure unknown-http-version if proto is set to http and auto-detect is set to active or off.
profile
Fortinet Technologies Inc.
Page 841 FortiOS™ - CLI Reference for FortiOS 5.0
wanopt
settings
settings
Use this command to add or change the FortiGate WAN optimization local host ID and to enable traffic logging for WAN optimization and WAN optimization web caching sessions. The local host ID identifies the FortiGate unit to other FortiGate units for WAN optimization. All WAN optimization tunnel startup requests to other FortiGate units include the local host id. The
FortiGate unit can only perform WAN optimization with other FortiGate units that have this local host id in their peer list.
Syntax
config wanopt settings set
end set
log-traffic {cifs ftp http mapi tcp}
set
tunnel-ssl-algorithm {high | medium | low}
Variable
host-id <host-id-name_str> log-traffic {cifs ftp http mapi tcp}
Description
Enter the local host ID.
Enable WAN optimization and WAN optimization web caching traffic logging for each type of WAN optimization session.
Valid types are: cifs ftp http mapi tcp.
Separate each type with a space. tunnel-ssl-algorithm
{high | medium | low}
Default
default-id
To add or remove an option from the list, retype the complete list as required.
Select the relative strength of encryption accepted for SSL tunnel negotiation. high high encryption allows AES and 3DES.
medium encryption allows AES, 3DES, and RC4.
low encryption allows AES, 3DES, RC4, and DES.
Fortinet Technologies Inc.
Page 842 FortiOS™ - CLI Reference for FortiOS 5.0
wanopt
ssl-server
ssl-server
Use this command to add one or more SSL servers to support WAN optimization SSL offloading. You enable WAN optimization SSL offloading by enabling the ssl field in a WAN optimization rule. WAN optimization supports SSL encryption/decryption offloading for HTTP servers.
SSL offloading uses the FortiGate unit to encrypt and decrypt SSL sessions.The FortiGate unit intercepts HTTPS traffic from clients and decrypts it before sending it as clear text to the HTTP server. The clear text response from the HTTP server is encrypted by the FortiGate unit and returned to the client. The result should be a performance improvement because SSL encryption is offloaded from the server to the FortiGate unit FortiASIC SSL encryption/decryption engine.
You must add one WAN optimization SSL server configuration to the FortiGate unit for each
HTTP server that you are configuring SSL offloading for. This SSL server configuration must also include the HTTP server CA. You load this certificated into the FortiGate unit as a local certificate using the config vpn certification local command and then add the certificate to the SSL server configuration using the ssl-cert field. The certificate key size must be 1024 or 2048 bits. 4096-bit keys are not supported.
You can configure one WAN optimization rule to offload SSL encryption/decryption for multiple
HTTP servers. To do this, the WAN optimization rule source and destination addresses must be configured so that the rule accepts packets destined for all of the HTTP servers that you want offloading for. Then you must add one SSL server configuration for each of the HTTP servers.
Syntax
config wanopt ssl-server
edit <ssl-server-name> set add-header-x-forwarded-proto {enable | disable}
end
set ssl-send-empty-frags {disable | enable} set url-rewrite {enable | disable}
Variable
edit <ssl-server-name>
Description
Enter a name for the SSL server. It can be any name and this name is not used by other FortiGate configurations.
add-header-x-forwarded-proto
{enable | disable}
Optionally add X-Forwarded-Proto header. This is available when ssl-mode is half.
Default
enable
Fortinet Technologies Inc.
Page 843 FortiOS™ - CLI Reference for FortiOS 5.0
wanopt ssl-server
Variable
ip <ssl_server_ip_ipv4> port <port_int> ssl-mode {full | half}
Description
Enter an IP address for the SSL server. This IP address should be the same as the IP address of the HTTP server that this SSL server will be offloading for. When a session is accepted by a
WAN optimization rule with SSL offloading enabled, the destination IP address of the session is matched with this IP address to select the SSL server configuration to use.
Default
0.0.0.0
Enter a port number to be used by the SSL server.
Usually this would be port 443 for an HTTPS server.
When a session is accepted by a WAN optimization rule with SSL offloading enabled, the destination port of the session is matched with this port to select the SSL server configuration to use.
Configure the SSL server to operate in full mode or half mode. Half mode offloads SSL from the backend server to the server-side FortiGate unit.
0 full
Set the permitted encryption algorithms for SSL sessions according to encryption strength: high ssl-algorithm
{low | medium | high} low — AES, 3DES, RC4, DES medium — AES, 3DES, RC4 high — AES, 3DES ssl-cert <certificate_name>
Select the certificate to be used for this SSL server.
The certificate should be the HTTP server CA used by the HTTP server that this SSL server configuration will be offloading for.
The certificate must be a local certificate added to the FortiGate unit using the config vpn certificate local command. For more
information, see “vpn certificate local” on page 760
.
ssl-client-renegotiation
{allow | deny | secure} ssl-dh-bits {1024 | 1536
| 2048 | 768} ssl-min-version {ssl-3.0
| tls-1.0} ssl-max-version {ssl-3.0
| tls-1.0}
The certificate key size must be 1024 or 2048 bits.
4096-bit keys are not supported.
Select whether client renegotiation is allowed. allow
The deny option aborts any SSL connection that attempts to renegotiate.
The secure option rejects any SSL connection that does not offer an RFC 5746 Secure Renegotiation
Indication.
Select the size of the Diffie-Hellman prime used in
DHE_RSA negotiation. Larger primes may cause a performance reduction but are more secure.
1024
Select the lowest or oldest SSL/TLS version to offer when negotiating. You can set the minimum version to SSL 3.0 or TLS 1.0. TLS 1.0 is more secure that
SSL 3.0.
ssl-3.0
tls-1.0
Select the highest or newest SSL/TLS version to offer when negotiating. You can set the maximum version to SSL 3.0 or TLS 1.0. TLS 1.0 is more secure that SSL 3.0.
Fortinet Technologies Inc.
Page 844 FortiOS™ - CLI Reference for FortiOS 5.0
wanopt ssl-server
Variable
ssl-send-empty-frags {disable
| enable}
Description
Enable or disable sending empty fragments before sending the actual payload. Sending empty fragments is a technique used to avoid cipher-block chaining (CBC) plaintext attacks if the initiation vector (IV) is known. Also called the CBC IV. Some
SSL implementations are not compatible with sending empty fragments. Change ssl-sendempty-frags to disable if required by your SSL implementation.
url-rewrite {enable | disable}
Enable to rewrite Location header of HTTP redirection response(3XX response). This is available when ssl-mode is half.
Default
enable disable
Fortinet Technologies Inc.
Page 845 FortiOS™ - CLI Reference for FortiOS 5.0
wanopt
storage
storage
Use this command to change the size of WAN optimization storages. A storage defines the maximum size of the byte caching or web caching database added to the storage.
Syntax
config wanopt storage
end
set size <partition_size_int> set webcache-storage-percentage <int>
Variable
edit <storage_name_str> size <partition_size_int>
Description
Enter the name of a storage configured using the config system storage command. All
FortiGate units with hard disks include a default storage name such as
Internal or ASM.
Enter the size of the partition in Mbytes. The default depends on the partition size.
webcache-storage-percentage <int>
Enter the portion, in percent, of the storage that is used for web cache. Remainder is used for wanopt.
Default
50
Fortinet Technologies Inc.
Page 846 FortiOS™ - CLI Reference for FortiOS 5.0
wanopt
webcache
webcache
Use this command to change how the WAN optimization web cache operates. In most cases the default settings are acceptable. However you may want to change these settings to improve performance or optimize the cache for your configuration.
Syntax
config wanopt webcache set
always-revalidate {enable | disable}
set
always-revalidate {enable | disable}
set
cache-cookie {enable | disable}
set
cache-expired {enable | disable}
set
set
set
ignore-conditional {enable | disable}
set
ignore-ie-reload {enable | disable}
set
set
set
end set
set
set
set
Variable
always-revalidate
{enable | disable} cache-cookie
{enable | disable} cache-expired
{enable | disable} default-ttl
<expiry_time> fresh-factor
<fresh_percent>
Description
Enable to always to revalidate the requested cached object with content on the server before serving it to the client.
Enable caching of cookies. Typically a HTTP response with a cookie contains data for a specific user, so cookie caching is best not done.
disable disable
Applies only to type-1 objects. When this setting is enabled, type-1 objects that are already expired at the time of acquisition are cached (if all other conditions make the object cachable). When this setting is disabled, already expired type-1 objects become non-cachable at the time of acquisition.
Default
enable
1440
The default expiry time for objects that do not have an expiry time set by the web server. The default expiry time is 1440 minutes (24 hours).
100
Set the fresh factor as a percentage. The default is 100, and the range is 1 to 100. For cached objects that don’t have an expiry time, the web cache periodically checks the server to see if the object has expired. The higher the fresh factor the less often the checks occur.
Fortinet Technologies Inc.
Page 847 FortiOS™ - CLI Reference for FortiOS 5.0
wanopt webcache
Variable
ignore-conditional
{enable | disable} ignore-ie-reload
{enable | disable} ignore-ims
{enable | disable} ignore-pnc
{enable | disable}
Description
Enable or disable controlling the behavior of cache-control header values. HTTP 1.1 provides additional controls to the client over the behavior of caches concerning the staleness of the object. Depending on various Cache-Control headers, the FortiGate unit can be forced to consult the OCS before serving the object from the cache. For more information about the behavior of cache-control header values, see RFC
2616 .
Default
disable
Some versions of Internet Explorer issue Accept / header instead of Pragma nocache header when you select Refresh.
When an Accept header has only the / value, the FortiGate unit treats it as a PNC header if it is a type-N object. enable
When this option is enabled, the FortiGate unit ignores the
PNC interpretation of the Accept: / header.
Be default, the time specified by the if-modified-since (IMS) header in the client's conditional request is greater than the last modified time of the object in the cache, it is a strong indication that the copy in the cache is stale. If so, HTTP does a conditional GET to the Overlay Caching Scheme
(OCS), based on the last modified time of the cached object.
Enable ignore-ims to override this behavior.
Typically, if a client sends an HTTP GET request with a pragma no-cache (PNC) or cache-control nocache header, a cache must consult the OCS before serving the content. This means that the FortiGate unit always re-fetches the entire object from the OCS, even if the cached copy of the object is fresh. disable disable
Because of this, PNC requests can degrade performance and increase server-side bandwidth utilization. However, if ignore-pmc is enabled, then the PNC header from the client request is ignored. The FortiGate unit treats the request as if the PNC header is not present at all.
max-object-size
<object_size>
Set the maximum object size to cache. The default size is
512000 kbytes (512 Mbytes). This object size determines the maximum object size to store in the web cache. All objects retrieved that are larger than the maximum size are delivered to the client but are not stored in the web cache. Range: 1 to
2 147 483 kBytes.
max-ttl <expiry_time> The maximum amount of time an object can stay in the web cache without checking to see if it has expired on the server.
The default is 7200 minutes (120 hours or 5 days). min-ttl <expiry_time> The minimum amount of time an object can stay in the web cache before checking to see if it has expired on the server.
The default is 5 minutes.
512000
7200
5
Fortinet Technologies Inc.
Page 848 FortiOS™ - CLI Reference for FortiOS 5.0
wanopt
Variable
neg-resp-time
<response_time> reval-pnc
{enable | disable}
webcache
Description
Set how long in minutes to cache negative responses. The default is 0, meaning negative responses are not cached.
The content server might send a client error code (4xx HTTP response) or a server error code (5xx HTTP response) as a response to some requests. If the web cache is configured to cache these negative responses, it returns that response in subsequent requests for that page or image for the specified number of minutes.
Default
0
The pragma-no-cache (PNC) header in a client's request can affect the efficiency of the FortiGate unit from a bandwidth gain perspective. If you do not want to completely ignore
PNC in client requests (which you can do by using the ignore
PNC option configuration), you can lower the impact of the
PNC by enabling reval-pnc. When the reval-pnc is enabled, a client's non-conditional PNC-GET request results in a conditional GET request sent to the OCS if the object is already in the cache. This gives the OCS a chance to return the 304 Not Modified response, consuming less server-side bandwidth, because it has not been forced to return full content even though the contents have not actually changed.
By default, the revalidate PNC configuration is disabled and is not affected by changes in the top-level profile. When the
Substitute Get for PNC configuration is enabled, the revalidate PNC configuration has no effect.
disable
Most download managers make byte-range requests with a
PNC header. To serve such requests from the cache, the reval-pnc option should be enabled along with byte-range support.
Fortinet Technologies Inc.
Page 849 FortiOS™ - CLI Reference for FortiOS 5.0
webfilter
Use webfilter commands to add banned words to the banned word list, filter URLs, and configure FortiGuard-Web category filtering.
This chapter contains the following sections:
Page 850
webfilter
content
content
Control web content by blocking or exempting words, phrases, or patterns.
For each pattern you can select Block or Exempt. Block, blocks access to a web page that matches with the pattern. Exempt allows access to the web page even if other entries in the list that would block access to the page.
For a page, each time a block match is found values assigned to the pattern are totalled. If a user-defined threshold value is exceeded, the web page is blocked.
Use this command to add or edit and configure options for the Web content filter list. Patterns words can be one word or a text string up to 80 characters long. The maximum number of patterns in the list is 5000.
When a single word is entered, the FortiGate unit checks Web pages for that word. Add phrases by enclosing the phrase in ‘single quotes’. When a phrase is entered, the FortiGate unit checks
Web pages for any word in the phrase. Add exact phrases by enclosing the phrases in
“quotation marks”. If the phrase is enclosed in quotation marks, the FortiGate checks Web pages for the exact phrase.
Create patterns using wildcards or Perl regular expressions.
Perl regular expression patterns are case sensitive for Web Content Filtering. To make a word or phrase case insensitive, use the regular expression
/i. For example, /bad language/i blocks all instances of bad language regardless of case. Wildcard patterns are not case sensitive.
Syntax
config webfilter content
edit <entry_number> set name <list_str> set comment <comment_str>
config entries
set
set
lang {cyrillic | french | japanese | korean | simch
| spanish | thai | trach | western}
set
pattern-type {regexp | wildcard}
set
end set
end
Variable
edit
<entry_number> name <list_str> comment
<comment_str>
Description
A unique number to identify the banned word list.
The name of the banned word list.
The comment attached to the banned word list.
Default
Fortinet Technologies Inc.
Page 851 FortiOS™ - CLI Reference for FortiOS 5.0
webfilter content
Variable Description
edit <content_str>
Enter the content to match.
Default
Note: multibyte characters (such as those used in Chinese,
Japanese, or Korean) should be entered as character codes
(e.g., &0026032;&0032862;) to ensure that the banned word is readable in the logs.
Select one of: block action
{block | exempt} block If the pattern matches, the Score is added to the total for the web page. The page is blocked if the total score of the web page exceeds the web content block threshold defined in the web filter profile.
Exempt If the pattern matches, the web page will not be blocked even if there are matching Block entries.
lang {cyrillic
| french | japanese
| korean | simch
| spanish | thai
| trach | western} pattern-type
{regexp
| wildcard}
Enter the language character set used for the content. Choose from Cyrillic, French, Japanese, Korean, Simplified Chinese,
Spanish, Thai, Traditional Chinese, or Western.
Set the pattern type for the content. Choose from regexp or wildcard.Create patterns for banned words using Perl regular expressions or wildcards.
score <score_int>
A numerical weighting applied to the content. The score values of all the matching words appearing on a web page are added, and if the total is greater than the webwordthreshold value set in the web filter profile, the page is processed according to whether the bannedword option is set with the http command in the web filter profile. The score for banned content is counted once even if it appears multiple times on the web page.
status
{enable | disable}
Enable or disable the content entry. western wildcard
10 disable
Fortinet Technologies Inc.
Page 852 FortiOS™ - CLI Reference for FortiOS 5.0
webfilter content-header
content-header
Use this example to filter web content according to the MIME content header. You can use this feature to broadly block content by type. But it is also useful to exempt audio and video streaming files from antivirus scanning. Scanning these file types can be problematic.
The content header list is available in the CLI only.
Syntax
config webfilter content-header
edit <entry_number> set name <list_name> set comment <comment_str>
end config entries
end set
action {allow | block | exempt}
set
category <fortiguard_category>
Variable Description
edit <entry_number>
A unique number to identify the content header list.
name <list_name> comment
<comment_str> edit <regex>
The name of the content header list.
The comment attached to the content header list.
Enter a regular expression to match the content header. For example,
.*image.* matches image content types.
action {allow | block
| exempt}
Select one of: allow — permit matching content.
Default
block category
<fortiguard_category> block — if the pattern matches, the content is blocked.
exempt — if the pattern matches, the content is exempted from antivirus scanning.
Enter the FortiGuard category (or categories) to match. To view a list of categories, enter
set category ?
Fortinet Technologies Inc.
Page 853 FortiOS™ - CLI Reference for FortiOS 5.0
webfilter fortiguard
fortiguard
Use this command to enable Web filtering by specific categories using FortiGuard-Web URL filtering.
Syntax
config webfilter fortiguard set
cache-mem-percent <percent_int>
set
set
cache-prefix-match {enable | disable}
set
close-ports {enable | disable}
set
set
set
ovrd-auth-https {enable | disable}
end set
ovrd-auth-port-http <port_int>
set
ovrd-auth-port-https <port_int>
set
reports-status {enable | disable}
set
request-packet-size-limit <bytes_int>
Variable
Description
cache-mem-percent
<percent_int>
Change the maximum percentage of memory the cache will use in db-ver mode. Enter a value from
1 to 15 percent.
cache-mode {ttl | db-ver} Change the cache entry expiration mode. Choices are ttl or db-ver.
Default
2 ttl
Using ttl, cache entries are deleted after a number of seconds determined by the cache-ttl setting, or until newer cache entries force the removal of older ones.
cache-prefix-match
{enable | disable}
When set to db-ver, cache entries are kept until the FortiGuard database changes, or until newer cache entries force the removal of older ones.
Enable and disable prefix matching. enable
If enabled the FortiGate unit attempts to match a packet against the rules in a prefix list starting at the top of the list.
close-ports
{enable | disable} ovrd-auth-cert <str> ovrd-auth-hostname
<str> ovrd-auth-https
{enable | disable} ovrd-auth-port-http
<port_int>
For information on prefix lists see
“prefix-list, prefix-list6” on page 421 .
Enable to close ports used for HTTP/HTTPS authentication and disable user overrides.
disable
Enter a certificate name to use for FortiGuard Web
Filter HTTPS override authentication.
Fortinet_Firmware
Enter a host name to use for FortiGuard Web Filter
HTTPS override authentication.
No default.
Enable to use HTTPS for override authentication.
enable
The port to use for FortiGuard Web Filter HTTP override authentication.
8008
Fortinet Technologies Inc.
Page 854 FortiOS™ - CLI Reference for FortiOS 5.0
webfilter
Variable
ovrd-auth-port-https
<port_int> reports-status
{enable | disable}
Description
The port to use for FortiGuard Web filtering HTTPS override authentication.
Enable or disable FortiGuard Web Filter reports.
request-packet-size-limit
<bytes_int>
This feature is available only on FortiGate units with an internal hard disk.
In some cases, FortiGuard request packets may be dropped due to IP fragmentation. You can set the maximum packet size. Range 576 to 10 000 bytes. Use 0 for the default size, 1100 bytes.
Default
8010 disable
0
fortiguard
Fortinet Technologies Inc.
Page 855 FortiOS™ - CLI Reference for FortiOS 5.0
webfilter ftgd-local-cat
ftgd-local-cat
Use this command to add local categories to the global URL category list. The categories defined here appear in the global URL category list when configuring a web filter profile. Users can rate URLs based on the local categories.
Syntax
config webfilter ftgd-local-cat edit
end
Variable
<local_cat_str> id <id_int>
Description
The description of the local category.
The local category unique ID number.
Default
140
Fortinet Technologies Inc.
Page 856 FortiOS™ - CLI Reference for FortiOS 5.0
webfilter ftgd-local-rating
ftgd-local-rating
Use this command to rate URLs using local categories.
Users can create user-defined categories then specify the URLs that belong to the category.
This allows users to block groups of web sites on a per profile basis. The ratings are included in the global URL list with associated categories and compared in the same way the URL block list is processed.
The user can also specify whether the local rating is used in conjunction with the FortiGuard rating or is used as an override.
Syntax
config webfilter ftgd-local-rating edit
end
set rating [[<category_int>] [group_str]...] set status {enable | disable}
Variable
<url_str> rating [[<category_int>]
[group_str]...]
Description
The URL being rated.
Set categories and/or groups. To remove items from the rating, use the unset command.
Enter ‘?’ to print a list of category and group codes with descriptions.
status {enable | disable} Enable or disable the local rating.
Default
enable
Fortinet Technologies Inc.
Page 857 FortiOS™ - CLI Reference for FortiOS 5.0
webfilter ftgd-warning
ftgd-warning
Use this command to view FortiGuard-Web filter warnings.
When a user attempts to access a web site within a category that is configured with the warning action, the user will received a warning which they have to acknowledge before continuing. You can view all active warnings with the get webfilter override command.
Although the full selection of set commands are offered, you cannot change any of the override entries. The FortiGate unit will return an error when you enter next or end.
Syntax
config webfilter override edit
end get webfilter override
Variable
<override_int> expires
<yyyy/mm/dd hh:mm:ss>
Description
The unique ID number of the override.
The date and time the override expires.
For example, the command to configure an expiry time of 6:45 p.m. on May 22, 2009 would be formatted this way: set expires 2010/05/22 18:45:00 initiator <user_name>
The user who initiated the override rule. This field is get-only.
ip <ipv4>
When the scope is ip, enter the IP address for which the override rule applies.
ip6 <ipv6>
When the scope is ip6, enter the IP address for which the override rule applies.
new-profile <profile_str>
Specify the new web-filter profile to apply the override.
old-profile <profile_str>
Specify the web-filter profile for which the override applies.
scope {user | user-group
| ip | ip6}
The scope of the override rule.
Default
15 minutes after the override is created.
0.0.0.0
:: null null user
Fortinet Technologies Inc.
Page 858 FortiOS™ - CLI Reference for FortiOS 5.0
webfilter ftgd-warning
Variable
status {enable | disable} user <user_str> user-group
<user_group_str>
Description
Enable or disable the override rule.
When the scope is user, the user for which the override rule applies.
When the scope is user-group, enter the user group for which the override rule applies.
Default
disable
Fortinet Technologies Inc.
Page 859 FortiOS™ - CLI Reference for FortiOS 5.0
webfilter ips-urlfilter-cache-setting
ips-urlfilter-cache-setting
Use this command to configure the global DNS settings for flow-based URL filtering in conjunction with a border gateway. See also the
webfilter ips-urlfilter-cache-setting
command.
Syntax
config webfilter ips-urlfilter-cache-setting set
dns-retry-interval <seconds_int>
end set
Variable
dns-retry-interval
<seconds_int> extended-ttl
<seconds_int>
Description
Set the DNS retry interval. Refresh DNS faster than TTL to capture multiple IPs for hosts. Range 0 to 2 147 483. 0 means use DNS server’s TTL value.
Extend the TTL beyond that of the DNS server. Range 0 to
2 147 483.
0
Default
0
Fortinet Technologies Inc.
Page 860 FortiOS™ - CLI Reference for FortiOS 5.0
webfilter ips-urlfilter-setting
ips-urlfilter-setting
Use this command to set up url filtering (flow-based) in conjunction with a border gateway router.
Syntax
config webfilter ips-urlfilter-setting set
end set
set
Variable
device
<intf_name> distance
<dist_int> gateway
<ip_addr>
Description
Select the interface that connects to the border router.
Set the administrative distance. Range 1 to 255.
Enter the IP address of the border router.
Default
No default.
1
0.0.0.0
Fortinet Technologies Inc.
Page 861 FortiOS™ - CLI Reference for FortiOS 5.0
webfilter
override
override
Use this command to configure FortiGuard-Web filter administrative overrides.
The administrative overrides are backed up with the main configuration and managed by the
FortiManager system. The administrative overrides are not cleaned up when they expire and you can reuse these override entries by extending their expiry dates.
Syntax
config webfilter override get webfilter override
edit
end
set user-group <user_group_str>
Variable
<override_int> expires
<yyyy/mm/dd hh:mm:ss>
Description
The unique ID number of the override.
The date and time the override expires.
For example, the command to configure an expiry time of 6:45 p.m. on May 22, 2015 would be formatted this way: set expires 2015/05/22 18:45:00
Default
15 minutes after the override is created.
initiator <user_name>
The user who initiated the override rule. This field is getonly.
ip <ipv4>
When the scope is ip, enter the IP address for which the override rule applies.
0.0.0.0
ip6 <ipv6>
When the scope is ip6, enter the IP address for which the override rule applies.
:: new-profile <profile_str> Specify the new web-filter profile to apply the override. null old-profile <profile_str>
Specify the web-filter profile for which the override applies.
scope {user | user-group | ip | ip6}
The scope of the override rule.
status {enable | disable}
Enable or disable the override rule.
user <user_str>
When the scope is rule applies.
user, the user for which the override user-group
<user_group_str>
When the scope is user-group, enter the user group for which the override rule applies.
null user disable
Fortinet Technologies Inc.
Page 862 FortiOS™ - CLI Reference for FortiOS 5.0
webfilter override-user
override-user
Use this command to configure FortiGuard-Web filter user overrides.
When a user attempts to access a blocked site, if override is enabled, a link appears on the block page directing the user to an authentication form. The user must provide a correct user name and password or the web site remains blocked. Authentication is based on user groups and can be performed for local, RADIUS, and LDAP users.
Administrators can only view and delete the user overrides entries.
Syntax
config webfilter override-user edit
set user <user_str> set user-group <user_group_str>
end get webfilter override-user
Variable
<override_int> expires
<yyyy/mm/dd hh:mm:ss>
Description
The unique ID number of the override.
The date and time the override expires.
For example, the command to configure an expiry time of 6:45 p.m. on May 22, 2009 would be formatted this way: set expires 2010/05/22 18:45:00 initiator <user_name>
The user who initiated the override rule. This field is get-only.
ip <ipv4>
When the scope is IP, enter the IP address for which the override rule applies.
ip6 <ipv6>
When the scope is ip6, enter the IP address for which the override rule applies.
new-profile <profile_str> Specify the new web-filter profile to apply the override.
old-profile <profile_str>
Specify the web-filter profile for which the override applies.
scope {user | user-group
| ip | ip6}
The scope of the override rule.
status {enable | disable}
Enable or disable the override rule.
Default
15 minutes after the override is created.
0.0.0.0
:: null null user disable
Fortinet Technologies Inc.
Page 863 FortiOS™ - CLI Reference for FortiOS 5.0
webfilter
Variable
user <user_str> user-group
<user_group_str>
override-user
Description
When the scope is user, the user for which the override rule applies.
When the scope is user-group, the user group for which the override rule applies.
Default
Fortinet Technologies Inc.
Page 864 FortiOS™ - CLI Reference for FortiOS 5.0
webfilter
profile
profile
Use this command to configure UTM web filtering profiles for firewall policies. Web filtering profiles configure how web filtering and FortiGuard Web Filtering is applied to sessions accepted by a firewall policy that includes the web filter profile.
Syntax
config webfilter profile edit
set log-all-urls {enable | disable} set options {activexfilter | block-invalid-url | cookiefilter
| https-scan | intrinsic | javafilter | js | jscript
| per-user-bwl | rangeblock | unknown | vbs | wf-cookie
set
options {connect-request-bypass | error-allow
| ftgd-disable | http-err-detail | rate-image-urls
| rate-server-ip | redir-block | strict-blocking}
set
category-override <category_str>
set
exempt-quota {all | <category_str>}
set
exempt-ssl {all | <category_str>}
Fortinet Technologies Inc.
Page 865 FortiOS™ - CLI Reference for FortiOS 5.0
webfilter
end
edit
set
action {authenticate | block | monitor | warning}
set
auth-usr-group [group1 ...groupn]
set
category {category_int group_str}
set
set
end
set
set
set
set
set
end end
set
set
ovrd-dur-mode {ask | constant}
set
ovrd-scope {ask | ip | user | user-group}
set
ovrd-user-group <groupname_str> [<groupname_str>...]
set
set
profile-attribute <attribute_str>
set
end
set
bword-threshold <threshold_int>
set
bword-table <filter_list_name>
set
urlfilter-table <url_list_name>
set
content-header-list <list_number>
set
set
set
set
urlfilter-table <url_list_name>
set
youtube-edu-filter-id <accountid_int>
end
Variable
Description
<name_str>
Enter the name of the web filtering profile.
comment <comment_str> Optionally enter a description of up to 63 characters of the web filter profile.
extended-utm-log
{enable | disable} flow-based
{enable | disable} https-replacemsg
{enable | disable}
Enable or disable detailed UTM log messages.
Enable or disable flow-based web filtering.
Enable replacement message display for non-deep SSL inspection.
Default
disable disable enable
profile
Fortinet Technologies Inc.
Page 866 FortiOS™ - CLI Reference for FortiOS 5.0
webfilter
Variable
log-all-urls
{enable | disable}
Description
Enable to log all URLs, even if FortiGuard is not enabled. extended-utm-log must be enabled.
options {activexfilter
| block-invalid-url
| cookiefilter | https-scan
| intrinsic | javafilter | js
| jscript | per-user-bwl
| rangeblock | unknown
| vbs | wf-cookie
| wf-referer}
Select one or more options apply to web filtering. To select more than one, enter the option names separated by a space. Some options are only available for some protocols.
activexfilter — block ActiveX plugins.
block-invalid-url — block web pages with an invalid domain name.
cookiefilter — block cookies.
https-scan — enable encrypted content scanning for
HTTPS traffic. This option is available only on FortiGate units that support encrypted content scanning.
intrinsic — block intrinsic scripts.
javafilter — block Java applets.
js — block JavaScript applets.
jscript — block JavaScript applets.
per-user-bwl — per-user black/white list. This must
also be enabled in system global
.
rangeblock — block downloading parts of a file that have already been partially downloaded. Selecting this option prevents the unintentional download of virus files hidden in fragmented files. Note that some types of files, such as PDF, fragment files to increase download speed and enabling this option can cause download interruptions. Enabling this option may break certain applications that use the Range Header in the HTTP protocol, such as YUM, a Linux update manager.
unknown — block unknown scripts.
vbs — block VB scripts.
wf-cookie — block the contents of the HTTP header
“Cookie”.
wf-referer — block the contents of the HTTP header
“Referer”.
Separate multiple options with a space.To remove an option from the list or add an option to the list, retype the list with the option removed or added.
Default
disable
profile
Fortinet Technologies Inc.
Page 867 FortiOS™ - CLI Reference for FortiOS 5.0
webfilter
Variable
Description
ovrd-perm
[bannedword-override contenttype-check-overri de fortiguard-wf-override urlfilter-override]
Override permit options: bannedword-override — content block contenttype-check-override — filter based on content-type header override fortiguard-wf-override — FortiGuard Web Filter block override post-action {normal
| comfort | block} web-content-log
{enable | disable} web-filter-activex-log
{enable | disable} web-filter-commandblock-log
{enable | disable} web-filter-cookie-log
{enable | disable} web-filter-cookieremoval-log
{enable | disable} web-filter-applet-log
{enable | disable} web-filter-js-log
{enable | disable} web-filter-jscript-log
{enable | disable} web-filter-sdns-action
{redirect | block} web-filter-sdns-portal
<portal_ip> web-filter-vbs-log
{enable | disable} web-filter-unknown-log
{enable | disable} urlfilter-override — web url filter override
Select the action to take with HTTP POST traffic. This option is available for HTTPS normal — do not affect HTTP POST traffic.
comfort — use the comfort-interval and comfortamount http options of the
“firewall profile-protocoloptions” on page 190
to send comfort bytes to the server in case the client connection is too slow. Select this option to prevent a server timeout when scanning or other filtering tool is turned on.
block — block HTTP POST requests. When the post request is blocked the FortiGate unit sends the httppost-block replacement message to the user’s web browser.
Enable or disable logging for web content blocking.
normal enable
Enable or disable logging for activex script web filtering.
Enable or disable logging of web filter command block messages.
Enable or disable logging for cookie script web filtering.
Enable or disable logging for web filter cookie blocking.
Enable or disable logging for applet script web filtering.
Enable or disable logging for web script filtering on javascripts.
Enable or disable logging for web script filtering on
JScripts.
Select the action for FortiGuard DNS-based webfiltering: redirect user to a captive portal or block the connection.
Enter the captive portal IP address used for users redirected by FortiGuard DNS-based webfiltering.
Enable or disable logging for web script filtering on VBS scripts.
Enable or disable logging for web script filtering on unknown scripts.
Default
null enable enable enable enable enable enable enable redirect
0.0.0.0
enable enable
profile
Fortinet Technologies Inc.
Page 868 FortiOS™ - CLI Reference for FortiOS 5.0
webfilter profile
Variable
web-filter-referer-log
{enable | disable} web-ftgd-err-log
{enable | disable} web-ftgd-quota-usage
{enable | disable} web-invalid-domain-log
{enable | disable} web-url-log
{enable | disable}
Description
Enable or disable logging for webfilter referer block.
Enable or disable logging for FortiGuard Web Filtering rating errors.
Enable or disable logging for FortiGuard Web Filtering daily quota usage.
Enable or disable logging for web filtering of invalid domain names.
Enable or disable logging for web URL filtering.
Default
enable enable enable enable enable
config ftgd-wf
Configure FortiGuard Web Filtering options.
For the enable, disable, allow, deny, log, ovrd, ftgd-wf-ssl-exempt options, to view a list of available category codes with their descriptions, enter get, then find entries such as g01 Potentially Liable, 1 Drug Abuse, and c06 Spam URL. Separate multiple codes with a space. To delete entries, use the unset command to delete the entire list.
Variable
category-override
<category_str>
Description
Enable local categories to take precedence over
FortiGuard Web Filtering categories. Enter category numbers or group numbers separated by spaces.
Do not stop quota for these categories.
exempt-quota
{all | <category_str>} exempt-ssl
{all | <category_str>} options
{connect-request-bypass
| error-allow
| ftgd-disable
| http-err-detail
| rate-image-urls
| rate-server-ip
| redir-block
| strict-blocking}
Enter categories to exempt from SSL inspection.
Select options for FortiGuard web filtering, separating multiple options with a space.
connect-request-bypass — (http only) bypass
FortiGuard Web Filtering for HTTP sessions to the same address as bypassed HTTPS connections. error-allow — allow web pages with a rating error to pass through.
ftgd-disable — disable FortiGuard.
http-err-detail — display a replacement message for 4xx and 5xx HTTP errors. If error pages are allowed, malicious or objectionable sites could use these common error pages to circumvent web category blocking. This option does not apply to HTTPS.
Default
null rate-image-urls — rate images by URL. Blocked images are replaced with blanks. This option does not apply to HTTPS.
rate-server-ip — send both the URL and the IP address of the requested site for checking, providing additional security against attempts to bypass the
FortiGuard system.
Fortinet Technologies Inc.
Page 869 FortiOS™ - CLI Reference for FortiOS 5.0
webfilter profile
Variable
Description
redir-block — block HTTP redirects. Many web sites use HTTP redirects legitimately; however, in some cases, redirects may be designed specifically to circumvent web filtering, as the initial web page could have a different rating than the destination web page of the redirect.
Default
strict-blocking — block any web pages if any classification or category matches the rating. This option does not apply to HTTPS.
To remove an option from the list or add an option to the list, retype the list with the option removed or added.
These options take effect only if FortiGuard web filtering is enabled for the protocol.
Variables for config filters
<id_str>
Enter the ID number of the filter. Enter a new number to create a new filter. Enter an existing number to edit a filter.
action {authenticate | block | monitor | warning}
Enter the action to take for matches.
authenticate permits authenticated users to load the web page.
block block prevents the user from loading the web page.
monitor permits the user to load the web page but logs the action.
auth-usr-group [group1
...groupn] category {category_int group_str} log {enable | disable} warn-duration
<dur_string> warning requires that the user acknowledge a warning before they can proceed.
Enter the user groups who are permitted to authenticate.
No default.
This is available if action is authenticate.
Enter the categories and groups the filter will examine.
You can specify multiple categories and groups by separating them with a space character.
Enable or diable logging for this filter.
Set duration (nnhnnmnns, 23h59m59s for example) of warning.
This is available when action is warning or authenticated.
No default.
enable
5m
Fortinet Technologies Inc.
Page 870 FortiOS™ - CLI Reference for FortiOS 5.0
webfilter profile
config override
Configure web filtering overrides.
Variable
ovrd-dur
<###d##h##m> ovrd-dur-mode
{ask | constant} ovrd-scope {ask | ip
| user | user-group} ovrd-user-group
<groupname_str>
[<groupname_str>...] profile
<web_profile> profile-attribute
<attribute_str> profile-type
{list | radius}
Description
Enter the FortiGuard Web Filtering override duration in days, hours, and minutes in any combination. For example,
34d, 12h, 20m, 34d23m, 200d12h45m.
The maximum is 364d23h59m.
Default
15m
Enter the FortiGuard Web Filtering duration type, one of: constant constant — as specified in ftgd-wf-ovrd-dur ask — ask for duration when initiating override. ftgd-wf-ovrd-dur is the maximum
Enter the scope of the Web Filtering override, one of: user ask — ask for scope when initiating an override.
ip — override for the initiating IP
— user — override for the user user-group — override for a user group
Enter the names of user groups that can be used for
FortiGuard Web Filter overrides. Separate multiple names with spaces.
Enter the web profile name.
null
Enter the name of the profile attribute to retrieve from the RADIUS server. Available when profiletype is radius.
Enter list if the override profile chosen from a list.
Enter radius if the override profile is determined by a RADIUS server.
Login-LAT-service
config quota
Configure FortiGuard quotas.
Variable Description
edit <id>
Enter an ID for the quota.
category <id>
Set the category. The category must have action of monitor and must not be in exempt-ssl list.
duration <dur_str>
Set the duration (nnhnnmnns).
type {time | traffic} Set the quota type: time-based or traffic-based.
unit {B | GB | KB
| MB} value <int>
Set the unit for traffic based quota.
Set the quota numeric value.
Default
No default.
No default.
5m time
MB
0
Fortinet Technologies Inc.
Page 871 FortiOS™ - CLI Reference for FortiOS 5.0
webfilter profile
config web
Specify the web content filtering the web URL filtering lists to use with the web filtering profile and set other configuration setting such as the web content filter threshold.
Variable
bword-threshold
<threshold_int> bword-table
<filter_list_name> content-header-list
<list_number> keyword-match
<pattern_str> log-search
{enable | disable} safe-search
{url | header} urlfilter-table
<url_list_name> youtube-edu-filterid <accountid_int>
Description
If the combined scores of the web content filter patterns appearing in a web page exceed the threshold value, the web page is blocked. The rang is 0-2147483647.
Select the name of the web content filter list to use with the web filtering profile.
Select the content header list.
Search keywords to log.
Enable or disable logging all search phrases.
Select whether safe search is based on the request URL or header.
Select the name of the URL filter list to use with the web filtering profile.
Enter the account ID for YouTube Education Filter. Available when safe-search is header.
0
Default
10 disable
Null
No default.
No default.
Fortinet Technologies Inc.
Page 872 FortiOS™ - CLI Reference for FortiOS 5.0
webfilter search-engine
search-engine
Use this command to configure search engine definitions. Definitions for well-known search engines are included by default.
Syntax
config webfilter search-engine edit
end
Variable
<site_name> hostname
<url_regex> query <str> safesearch {disable
| header | url} safesearch-str url <url_str>
Description
Enter the name of the search engine.
Enter the regular expression to match the hostname portion of the search URL. For example,
.*\.google\..* for Google.
Enter the code used to prefix a query.
Select how to request safe search on this site.
Default
No default.
No default.
No default.
disable disable — site does not support safe search header — selected by search header, e.g. youtube.edu
url — selected with a parameter in the URL
Enter the safe search parameter used in the URL.
Example:
&safe=on
No default.
This is available if safesearch is url.
Enter the regular expression to match the search URL. For example
No default.
^\/((custom|search|images|videosearch|webhp)\?)
Fortinet Technologies Inc.
Page 873 FortiOS™ - CLI Reference for FortiOS 5.0
webfilter
urlfilter
urlfilter
Use this command to control access to specific URLs by adding them to the URL filter list. The
FortiGate unit exempts or blocks Web pages matching any specified URLs and displays a replacement message instead.
Configure the FortiGate unit to allow, block, or exempt all pages on a website by adding the top-level URL or IP address and setting the action to allow, block, or exempt.
Block individual pages on a website by including the full path and filename of the web page to block. Type a top-level URL or IP address to block access to all pages on a website. For example, www.example.com or 172.16.144.155 blocks access to all pages at this website.
Type a top-level URL followed by the path and filename to block access to a single page on a website. For example, www.example.com/news.html or 172.16.144.155/news.html blocks the news page on this website.
To block all pages with a URL that ends with example.com, add example.com to the block list. For example, adding example.com blocks access to www.example.com, mail.example.com, www.finance.example.com, and so on.
Use this command to exempt or block all URLs matching patterns created using text and regular expressions (or wildcard characters). For example, example.* matches example.com, example.org, example.net and so on. The FortiGate unit exempts or blocks
Web pages that match any configured pattern and displays a replacement message instead.
Syntax
config webfilter urlfilter edit
config entries edit
set
action {allow | block | exempt | monitor}
set
exempt {all activex-java-cookie av dlp fortiguard pass range-block web-content}
set
set
type {simple | regex | wildcard}
end end
Variable
<list_int> name <list_str> comment
<comment_str> one-arm-ips-urlfilter
{enable | disable}
<url_str>
Description
A unique number to identify the URL filter list.
The name of the URL filter list.
The comment attached to the URL filter list.
Enable or disable IPS URL filter.
The URL to added to the list.
Default
disable
Fortinet Technologies Inc.
Page 874 FortiOS™ - CLI Reference for FortiOS 5.0
webfilter urlfilter
Variable
action {allow | block
| exempt | monitor}
Description
The action to take for matches.
An allow match exits the URL filter list and checks the other web filters.
A block match blocks the URL and no further checking will be done.
Default
exempt
An exempt match stops all further checking including AV scanning for the current HTTP session, which can affect multiple URLs.
A monitor match passes the URL and generates a log message. The request is still subject to other
UTM inspections. exempt {all activex-java-cookie av dlp fortiguard pass range-block web-content}
Enter the types of scanning to skip for the exempt
URLs: all — Exempt from all.
activex-java-cookie — activeX, Java, and cookies activex-java-cookie all av dlp fortiguard range-block web-content av — antivirus scanning dlp — DLP scanning fortiguard — FortiGuard web filtering pass — pass single connection from all.
range-block — do not allow range-block web-content — web filter content matching
The status of the filter.
enable status
{enable | disable} type {simple | regex
| wildcard}
The type of URL filter: simple, regular expression, or wildcard.
simple
Fortinet Technologies Inc.
Page 875 FortiOS™ - CLI Reference for FortiOS 5.0
web-proxy
Use these commands to configure the FortiGate web proxy. You can use the FortiGate web proxy and interface settings to enable explicit HTTP and HTTPS proxying on one or more interfaces. When enabled, the FortiGate unit becomes a web proxy server. All HTTP and HTTPS session received by interfaces with explicit web proxy enabled are intercepted by the explicit web proxy relayed to their destinations.
To use the explicit proxy, users must add the IP address of a FortiGate interface and the explicit proxy port number to the proxy configuration settings of their web browsers.
On FortiGate units that support WAN optimization, you can also enable web caching for the explicit proxy.
Page 876
web-proxy
explicit
explicit
Use this command to enable the explicit web proxy, and configure the TCP port used by the explicit proxy.
Syntax
config web-proxy explicit set
set
ftp-over-http {enable | disable}
set
set
http-incoming-port <http_port_int>
set
https-incoming-port <https_port_int>
set
ftp-incoming-port <ftp_port_int>
set
socks-incoming-port <socks_port_int>
set
incoming-ip <incoming_interface_ipv4>
set
incoming-ip6 <incoming_interface_ipv6>
set
ipv6-status {enable | disable}
set
outgoing-ip <outgoing_interface_ipv4>
[<outgoing_interface_ipv4> ... <outgoing_interface_ipv4>]
set
outgoing-ip6 <outgoing_interface_ipv6>
[<outgoing_interface_ipv6> ... <outgoing_interface_ipv6>]
set
unknown-http-version {best-effort | reject}
set
set
sec-default-action {accept | deny}
set
pac-file-server-status {enable | disable}
set
pac-file-server-port <pac_port_int>
set
set
set
end set
ssl-algorithm {low | medium | high}
Variable
status {enable | disable} ftp-over-http
{enable | disable}
Description
Enable the explicit web proxy for HTTP and HTTPS sessions.
Default
disable
Configure the explicit proxy to proxy FTP sessions sent from a web browser. disable socks {enable | disable} http-incoming-port
<http_port_int>
The explicit proxy only supports FTP with a web browser and not with a standalone FTP client.
Configure the explicit proxy to proxy SOCKS sessions sent from a web browser. For information about
SOCKS, see RFC 1928 . The explicit web proxy supports SOCKs 4 and 5.
disable
Enter the port number that HTTP traffic from client web browsers use to connect to the explicit proxy. The range is 0 to 65535. Explicit proxy users must configure their web browser’s HTTP proxy settings to use this port.
8080
Fortinet Technologies Inc.
Page 877 FortiOS™ - CLI Reference for FortiOS 5.0
web-proxy explicit
Variable
https-incoming-port
<https_port_int> ftp-incoming-port
<ftp_port_int> socks-incoming-port
<socks_port_int>
Description
Enter the port number that HTTPS traffic from client web browsers use to connect to the explicit proxy. The range is 0 to 65535. Explicit proxy users must configure their web browser’s HTTPS proxy settings to use this port.
Default
0
The default value of 0 means use the same port as
HTTP.
Enter the port number that FTP traffic from client web browsers use to connect to the explicit proxy. The range is 0 to 65535. Explicit proxy users must configure their web browser’s FTP proxy settings to use this port.
0
The default value of 0 means use the same port as
HTTP.
Enter the port number that SOCKS traffic from client web browsers use to connect to the explicit proxy. The range is 0 to 65535. Explicit proxy users must configure their web browser’s SOCKS proxy settings to use this port.
0 incoming-ip
<incoming_interface_ipv4>
The default value of 0 means use the same port as
HTTP.
Enter the IP address of a FortiGate unit interface that should accept sessions for the explicit web proxy. Use this command to restrict the explicit web proxy to only accepting sessions from one FortiGate interface.
0.0.0.0
The destination IP address of explicit web proxy sessions should match this IP address. incoming-ip6
<incoming_interface_ipv6>
This field is not available in Transparent mode.
Enter the IPv6 address of a FortiGate unit interface that should accept sessions for the explicit web proxy. Use this command to restrict the explicit web proxy to only accepting sessions from one FortiGate interface.
::0 ipv6-status
{enable | disable} outgoing-ip
<outgoing_interface_ipv4>
[<outgoing_interface_ipv4>
...
<outgoing_interface_ipv4>]
This is available when ipv6-status is enable.
Enable or disable IPv6 web-proxy operation.
Enter the IP address of a FortiGate unit interface that explicit web proxy sessions should exit the FortiGate unit from. Multiple interfaces can be specified. Use this command to restrict the explicit web proxy to only allowing sessions to exit from one FortiGate interface.
disable
0.0.0.0
This IP address becomes the source address of web proxy sessions exiting the FortiGate unit.
This field is not available in Transparent mode.
Fortinet Technologies Inc.
Page 878 FortiOS™ - CLI Reference for FortiOS 5.0
web-proxy explicit
Variable
outgoing-ip6
<outgoing_interface_ipv6>
[<outgoing_interface_ipv6>
...
<outgoing_interface_ipv6>]
Description
Enter the IPv6 address of a FortiGate unit interface that explicit web proxy sessions should exit the FortiGate unit from. Multiple interfaces can be specified. Use this command to restrict the explicit web proxy to only allowing sessions to exit from one FortiGate interface.
Default
::0 unknown-http-version
{best-effort | reject}
This IP address becomes the source address of web proxy sessions exiting the FortiGate unit.
This field is not available in Transparent mode.
Select the action to take when the proxy server must handle an unknown HTTP version request or message.
Choose from either Reject or Best Effort. reject realm <realm_str> sec-default-action
{accept | deny} pac-file-server-status
{enable | disable}
Best Effort attempts to handle the HTTP traffic as best as it can. Reject treats unknown HTTP traffic as malformed and drops it. The Reject option is more secure.
Enter an authentication realm to identify the explicit web proxy. The realm is a text string of up to 63 characters. If the realm includes spaces enclose it in quotes. Only alphanumeric characters are permitted.
FortiOS rejects the string if it contains special characters.
default
When a user authenticates with the explicit proxy the
HTTP authentication dialog includes the realm so you can use the realm to identify the explicit web proxy for your users.
Configure the explicit web proxy to block (deny) or accept sessions if firewall policies have note been added for the explicit web proxy. To add firewall policies for the explicit web proxy add a firewall policy and set the source interface to web-proxy.
deny
The default setting denies access to the explicit web proxy before adding a firewall policy. If you set this option to accept the explicit web proxy server accepts sessions even if you haven’t defined a firewall policy.
Enable support for proxy auto-config (PAC). With PAC support enabled you can configure a PAC file on the
FortiGate unit and distribute the URL of this file to your web browser users. These users can enter this URL as an automatic proxy configuration URL and their browsers will automatically download proxy configuration settings. disable
You can use PAC to provide access to multiple proxy servers and access methods as well as other features.
To enable PAC you must edit or replace (by importing) the default PAC file installed in your FortiGate unit.
Fortinet Technologies Inc.
Page 879 FortiOS™ - CLI Reference for FortiOS 5.0
web-proxy explicit
Variable
pac-file-server-port
<pac_port_int>
Description
Select the port that PAC traffic from client web browsers use to connect to the explicit proxy. The range is 0 to 65535. Explicit proxy users must configure their web browser’s PAC proxy settings to use this port.
Default
0
The default value of 0 means use the same port as
HTTP.
pac-file-name <pac_file_str> Change the name of the PAC file. In most cases you could keep the default name.
pac-file-data <pac_file_str> Enter the contents of the PAC file made available from the explicit proxy server for PAC support. Enclose the
PAC file text in quotes. You can also copy the contents of a PAC text file and paste the contents into the CLI using this option. Enter the command followed by two sets of quotes then place the cursor between the quotes and paste the file content.
proxy.pac
The maximum PAC file size is 8192 bytes. pac-file-url <url_str> ssl-algorithm
{low | medium | high}
You can use any PAC file syntax that is supported by your users’s browsers. The FortiGate unit does not parse the PAC file.
Displays the PAC file URL in the format: http://<interface_ip>:
<PAC_port_int>/<pac_file_str>
For example, if the interface with the explicit web proxy has IP address 172.20.120.122, the PAC port is the same as the default HTTP explicit proxy port (8080) and the PAC file name is proxy.pac the PAC file URL would be: http://172.20.120.122:8080/proxy.pac
If the explicit web proxy is enabled on multiple interfaces there will be multiple PAC URLs. If you have configured an incoming-ip only one PAC file URL is listed that includes the incoming-ip.
Distribute this URL to PAC users.
You cannot use the pac-file-url option to edit the
PAC file URL.
Select the strength of encryption algorithms accepted for deep scan: medium high: AES, 3DES low: AES, 3DES, RC4, DES medium: AES, 3DES, RC4
Fortinet Technologies Inc.
Page 880 FortiOS™ - CLI Reference for FortiOS 5.0
web-proxy forward-server
forward-server
Use this command to support explicit web proxy forwarding, also called proxy chaining.
Syntax
config web-proxy forward-server edit <server_name_string>
end
set port <port_integer> set server-down-option {block | pass}
Variable
addr-type {fqdn | ip}
Description
Select whether proxy address is defined by domain name (fqdn) or IP address.
Optionally, enter a description.
Default
ip
No default.
comment
<comment_string> fqdn <fqdn_string> healthcheck
{enable | disable} ip <server_ipv4> monitor <http_url> port <port_integer> server-down-option
{block | pass}
Enter the fully qualified domain name of the forwarding web proxy server. Available if addrtype is fqdn.
Enable or disable proxy server health check. Health checking attempts to connect to a web server to make sure that the remote forwarding server is operating.
No default.
disable
Enter the IP address of the forwarding proxy server.
0.0.0.0
Available if addr-type is ip.
Enter the URL to use for health check monitoring.
This would be a URL that the web proxy would attempt to connect to through the forwarding server. If the web proxy can’t connect to this URL it assumes the forwarding server is down.
Enter the port number that the forwarding server expects to receive HTTP sessions on.
Select the action to take when the forwarding proxy server is down. You can either forward connections to
3128 block
Fortinet Technologies Inc.
Page 881 FortiOS™ - CLI Reference for FortiOS 5.0
web-proxy forward-server-group
forward-server-group
Use this command to configure a load-balanced group of web proxy forward servers.
Syntax
config web-proxy forward-server-group edit <fwdsrvr_group_name>
set affinity {enable | disable} set group-down-option {pass | block}
end
set ldb-method {least-session | weighted}
config server-list edit <fwd-srvr-name> set
end
Variable
affinity
{enable | disable} group-down-option
{pass | block} ldb-method
{least-session
| weighted} weight <weight_int>
Description
Enable to attach source-ip's traffic to assigned forward-server until forward-serveraffinity-timeout (see
Select action to take if all forward servers are down: pass traffic through or block traffic.
Select the load-balancing method.
Default
enable block weighted
Set weight of this server for load balancing. Range
1 to 100.
10
Fortinet Technologies Inc.
Page 882 FortiOS™ - CLI Reference for FortiOS 5.0
web-proxy
global
global
Configure global web-proxy settings that control how the web proxy functions and handles web traffic. In most cases you should not have to change the default settings of this command. If your FortiGate unit is operating with multiple VDOMS these settings affect all VDOMs.
Syntax
config web-proxy global set
add-header-client-ip {enable | disable}
set
add-header-via {enable | disable}
set
add-header-x-forwarded-for {enable | disable}
set
add-header-front-end-https {enable | disable}
set
forward-proxy-auth {enable | disable}
set
forward-server-affinity-timeout <minutes_int>
set
set
set
set
strict-web-check {enable | disable}
set
tunnel-non-http {enable | disable}
end set
unknown-http-version {tunnel | best-effort | reject}
Variable
add-header-client-ip
{enable | disable} add-header-front-end-https
{enable | disable} add-header-via
{enable | disable} add-header-x-forwarded-for
{enable | disable} forward-proxy-auth
{enable | disable}
Description
Enable to add the client IP to the header of forwarded requests
Default
disable
Enable to add a front-end-https header to forwarded requests.
disable
Enable to add the via header to forwarded requests.
disable
Enable to add x-forwarded-for header to forwarded requests.
disable
In explicit mode, enable to forward proxy authentication headers. By default proxy authentication headers are blocked by the explicit web proxy. You can set this option to enable if you need to allow proxy authentication through the explicit web proxy.
disable forward-server-affinitytimeout <minutes_int> max-message-length
<kBytes> max-request-length
<kBytes>
This option does not apply to web proxy transparent mode, because in transparent mode, proxy authentication headers are always forwarded by the web proxy.
The source-ip's traffic will attach to assigned forward-server until timeout. Range: 6 to 60 minutes.
Set the maximum length, in kBytes, of the HTTP message not including body. Range 16 to 256.
Set the maximum length, in kBytes, of the HTTP request line. Range 2 to 64.
30
32
4
Fortinet Technologies Inc.
Page 883 FortiOS™ - CLI Reference for FortiOS 5.0
web-proxy
Variable
proxy-fqdn <fqdn> strict-web-check
{enable | disable}
Description
Set the fully qualified domain name (FQDN) for the proxy.
Default
default.fqdn
This is the domain that clients connect to.
Enable to block web sites that send incorrect headers that do not conform to HTTP 1.1 as described in RFC 2616 .
disable
Disable to allow and cache websites that send incorrect headers that do not conform to the RFC.
This option is disabled by default so that web sites are not blocked. You can enable this option if you want to increase security by blocking sites that do not conform. Enabling this option may block some commonly used websites.
Enable to allow non-HTTP traffic.
enable tunnel-non-http
{enable | disable} unknown-http-version
{tunnel | best-effort | reject}
Select how to handle traffic if HTTP version is unknown: tunnel — tunnel the traffic best-effort — proceed with best effort reject — reject the traffic best-effort
global
Fortinet Technologies Inc.
Page 884 FortiOS™ - CLI Reference for FortiOS 5.0
web-proxy
url-match
Use this command to define URLs for forward-matching or cache exemption.
Syntax
config web-proxy url-match edit <url-pattern>
end
Variable
url-pattern <pattern_str>
Description
cache-exemption
{enable | disable}
Enable to set a cache exemption list. User defined
URLs in the list will be exempted from caching.
comment <comment_str>
Optionally enter a comment.
forward-server <name_str>
Enter the forward server name.
status {enable | disable}
Enable or disable per-URL pattern web proxy forwarding and cache exemptions.
Enter the URL pattern.
Default
disable enable
url-match
Fortinet Technologies Inc.
Page 885 FortiOS™ - CLI Reference for FortiOS 5.0
wireless-controller
Use these commands to create virtual wireless access points that can be associated with multiple physical wireless access points. Clients can roam amongst the physical access points, extending the range of the wireless network.
This chapter describes the following commands:
Page 886
wireless-controller
ap-status
ap-status
Use this command to designate detected access points as accepted or rogue or to suppress a rogue AP.
To get information about detected access points, use the get wireless-controller scan command.
Syntax
config wireless-controller ap-status edit
<ap_id> set bssid <bssid> set ssid <ssid>
end
set status {accepted | rogue | suppressed}
Variable
<ap_id> bssid <bssid> ssid <ssid> status {accepted | rogue
| suppressed}
Description
Enter a number to identify this access point.
Default
No default.
00:00:00:00:00:00
Enter the access point’s BSSID. This is the wireless AP’s wireless MAC address.
Enter the wireless service set identifier (SSID) or network name for the wireless interface.
No default.
Select the desired status for this AP: accepted or rogue.
rogue
Fortinet Technologies Inc.
Page 887 FortiOS™ - CLI Reference for FortiOS 5.0
wireless-controller
global
global
Use this command to configure global settings for physical access points, also known as WLAN
Termination Points (WTPs), configured using Control And Provisioning of Wireless Access
Points (CAPWAP) protocol.
Syntax
config wireless-controller global set
data-ethernet-II {enable | disable}
set
set
set
set
set
set
set
set
end set
rogue-scan-mac-adjacency <int>
Variable
data-ethernet-II
{enable | disable} dhcp-option-code
<option_int> discovery-mc-addr
<ipv4addr> local-radio-vdom
<vdom_name> location <string> max-clients <int> max-retransmit <int> mesh-eth-type <id_int> name <string> rogue-scan-mac-adjacency
<int>
Description
Enable or disable use of Ethernet frame type with
802.3 data tunnel mode.
Default
disable
Enter DHCP option code. This is available when ac-discovery-type is dhcp.
Enter the IP address for AP discovery. This is available when ac-discovery-type is multicast.
138
224.0.1.140
Select the VDOM to which the FortiWiFi unit’s builtin access point belongs.
root
Enter the location of your wireless network.
Enter the maximum number of clients permitted to connect simultaneously. Enter 0 for no limit.
No default.
0
Enter the maximum number of retransmissions for tunnel packet. Range 0 to 64.
3
Identifier included in packets. Useful for debugging.
8755
Enter a name for your wireless network.
Enter the maximum numeric difference between an
AP’s Ethernet and wireless MAC values to match for rogue detection.
No default.
7
Range: 0-7.
Fortinet Technologies Inc.
Page 888 FortiOS™ - CLI Reference for FortiOS 5.0
wireless-controller
setting
setting
Use this command to configure VDOM-specific options for the wireless controller.
Syntax
config wireless-controller setting set
ap-auto-suppress {enable | disable}
set
ap-bgscan-disable-day <day_list_str>
set
ap-bgscan-disable-end <time_str>
set
ap-bgscan-disable-start <time_str>
set
set
set
end set
on-wire-scan {enable | disable}
Variable
ap-auto-suppress
{enable | disable} ap-bgscan-disable-day
<day_list_str> ap-bgscan-disable-end
<time_str> ap-bgscan-disable-start
<time_str> ap-bgscan-period
<secs_int>
Description
Enable or disable automatic suppression of detected rogue APs. To enable ap-auto-suppress, first ap-scan and on-wire-scan must be enabled.
Enter the days of the week when background scanning is disabled.
Enter the end time (format hh:mm) for disabled background scanning. ap-bgscan-disable-day must be set.
Enter the start time (format hh:mm) for disabled background scanning. ap-bgscan-disable-day must be set.
Enter the period in seconds between background scans.
600 ap-scan {enable | disable} Enable or disable scanning for other APs available at your location.
country <country-code>
Select the country of operation for your wireless network.
This affects the radio channels that are available. To view the available country codes, enter set country ?
Default
disable null
00:00
00:00 disable
US on-wire-scan
{enable | disable}
You must set the country before you configure access point (WTP) profiles.
Enable or disable looking for MAC addresses of unknown
APs on the wired network to distinguish rogues from neighbors. Use this in conjunction with ap-scan.
disable
Fortinet Technologies Inc.
Page 889 FortiOS™ - CLI Reference for FortiOS 5.0
wireless-controller
timers
timers
Use this command to alter global timers for physical access points, also known as WLAN
Termination Points (WTPs) configured using Control And Provisioning of Wireless Access Points
(CAPWAP) protocol.
Syntax
config wireless-controller timers set
set
set
end set
set
set
set
Variable
client-idle-timeout
<seconds>
Description
Set the timeout period in seconds for inactive clients.
Default
300
Range: 20 to 3600, 0 for no timeout.
darrp-optimize
<seconds_int> fake-ap-log <int> rogue-ap-log <int>
Set the DARRP (Dynamic Automatic Radio Resource
Provisioning) optimization interval. Range: 0 to 86 400 seconds.
darrp-wtp-tune
<seconds_int> discovery-interval
<seconds>
Set the automatic channel selection interval. Range: 1 to
30 seconds.
Set the period between discovery requests. Range 2 to
180 seconds.
echo-interval <seconds>
Set the interval before WTP sends Echo Request after joining AC. Range 1 to 600 seconds.
1800
3
5
30
Set a period, in minutes, for periodic logging of fake APs.
1
Set a period, in minutes, for periodic logging of rogue APs.
0
Fortinet Technologies Inc.
Page 890 FortiOS™ - CLI Reference for FortiOS 5.0
wireless-controller
vap
vap
Use this command to configure Virtual Access Points.
Syntax
config wireless-controller vap edit
set auth {usergroup | radius} set broadcast-suppression {arp | dhcp}
set security {captive-portal | open | wep128 | wep64
| wpa-enterprise | wpa-only-enterprise | wpa-only-personal
Variable
broadcast-suppression
{arp | dhcp}
Description
auth {usergroup | radius}
Select whether WPA-Enterprise authentication uses FortiGate user groups or a RADIUS server.
Prevent ARP or DHCP messages being carried to other access points carrying the same SSID.
Default
usergroup dhcp arp
Fortinet Technologies Inc.
Page 891 FortiOS™ - CLI Reference for FortiOS 5.0
wireless-controller
Variable
broadcast-ssid
{enable | disable} dynamic-vlan
{enable | disable} encrypt {AES | TKIP |
TKIP-AES} external-fast-roaming
{enable | disable} fast-roaming
{enable | disable} gtk-rekey-intv <secs> intra-vap-privacy
{enable | disable} key <key_str> keyindex {1 | 2 | 3 | 4} local-authentication
{enable | disable} local-bridging
{enable | disable} local-switching
{enable | disable} max-clients <int> mesh-backhaul
{enable | disable} me-disable-thresh
<limit_int> multicast-enhance
{enable | disable}
Description
Enable broadcast of the SSID. Broadcasting the
SSID enables clients to connect to your wireless network without first knowing the SSID. For better security, do not broadcast the SSID.
Default
enable
Enable dynamic VLAN assignment for users based RADIUS attribute.
Enable or disable pre-authentication with external non-managed AP. disable
Select whether VAP uses AES or TKIP encryption, or accepts both. This is available if security is a
WPA type.
AES disable
Enabling fast-roaming enables pre-authentication where supported by clients. enable
3600
Set the WPA re-key interval. Some clients may require a longer interval. For WPA-RADIUS SSID, use ptk-rekey-intv. Range 60 to 864 000 seconds.
Enable to block communication between clients of the same AP.
disable
Enter the encryption key that the clients must use.
For WEP64, enter 10 hexadecimal digits. For
WEP128, enter 26 hexadecimal digits.
No default.
This is available when security is a WEP type.
Many wireless clients can configure up to four
WEP keys. Select which key clients must use.with this access point. This is available when security is a WEP type.
Enable authentication of clients by the FortiAP unit if the wireless controller is unavailable. This applies only if security is a WPA-Personal mode and local-bridging is enabled.
Enable or disable bridging of wireless and
Ethernet interfaces on the FortiAP unit. local-bridging is disabled if intra-vapprivacy is enabled.
Enable or disable local switching of traffic on the
FortiAP, not sending it to the WiFi controller. local-switching is disabled if intra-vapprivacy is enabled.
Enter the maximum number of clients permitted to connect simultaneously. Enter 0 for no limit.
1 disable disable enable
0 disable
Enable to use this Virtual Access Point as a WiFi mesh backhaul. WiFi clients cannot connect directly to this SSID.
Set the multicast enhancement threshold. Range
2 to 256 subscribers.
32
Enable conversion of multicast to unicast to improve performance.
disable
vap
Fortinet Technologies Inc.
Page 892 FortiOS™ - CLI Reference for FortiOS 5.0
wireless-controller
Variable
passphrase <hex_str> portal-message-overridegroup
<repl-msg-group_name> ptk-rekey-intv <secs> radius-server
<server_name> radius-mac-auth
{enable | disable} radius-mac-auth-server
<srv_str>
Description
Enter the encryption passphrase of 8 to 63 characters. This is available when security is a
WPA type and auth is PSK.
Enter the replacement message group for this virtual access point. The replacement message group must already exist in system replacemsg-group and its group-type must be captive-portal.
Default
No default.
Null.
This field is available when security is captive-portal.
Set the WPA-RADIUS re-key interval. Some clients may require a longer interval. Range 60 to
864 000 seconds.
3600
Enter the RADIUS server used to authenticate users. This is available when auth is radius.
Enable if you want MAC address authentication of clients. This is independent of other authentication protocols. You will also have to specify radius-mac-auth-server.
Specify the RADIUS server to use for MAC address authentication. This is available if radius-mac-auth is enabled.
No default.
disable null
vap
Fortinet Technologies Inc.
Page 893 FortiOS™ - CLI Reference for FortiOS 5.0
wireless-controller vap
Variable
security {captive-portal
| open | wep128 | wep64
| wpa-enterprise
| wpa-only-enterprise
| wpa-only-personal
| wpa-personal
| wpa2-only-enterprise
| wpa2_only-personal}
Description
Select the security mode for the wireless interface. Wireless users must use the same security mode to be able to connect to this wireless interface.
captive-portal — users are authenticated through a captive web portal.
open — has no security. Any wireless user can connect to the wireless network.
wep128 — 128-bit WEP. To use WEP128 you must enter a Key containing 26 hexadecimal digits (0-9 a-f) and inform wireless users of the key.
wep64 — 64-bit web equivalent privacy (WEP). To use WEP64 you must enter a Key containing 10 hexadecimal digits (0-9 a-f) and inform wireless users of the key.
Default
wpa-personal wpa-enterprise — WPA-Enterprise security,
WPA or WPA2. wpa-only-enterprise — WPA-Enterprise security, WPA only. wpa-only-personal — WPA-Personal security,
WPA only. wpa-personal — WPA-Personal security, WPA or WPA2. wpa2-only-enterprise — WPA-Enterprise security, WPA2 only. wpa2-only-personal — WPA-Personal security, WPA2 only. selected-usergroups
<groups_str>
Select the user groups that can authenticate. This is available when security is captiveportal.
ssid <string>
Enter the wireless service set identifier (SSID) or network name for this wireless interface. Users who want to use the wireless network must configure their computers with this network name.
usergroup <group_name>
Enter the usergroup for WPA-Enterprise authentication when auth is usergroup.
<vap_name>
Enter a name for this Virtual Access Point.
vdom <vdom_name>
Enter the name of the VDOM to which this VAP belongs.
vlanid <vlan_int>
Enter the VLAN ID, if a VLAN will be used. 0 means no VLAN.
vlan-auto
{enable | disable}
Enable or disable automatic VLAN assignment for authenticated users of this SSID. This is available if security is WPA Enterprise or captive portal and vlanid is not 0.
No default.
fortinet
No default.
No default.
No default.
0 disable
Fortinet Technologies Inc.
Page 894 FortiOS™ - CLI Reference for FortiOS 5.0
wireless-controller wids-profile
wids-profile
Use this command to configure Wireless Intrusion Detection (WIDS) profiles.
Syntax
config wireless-controller wids-profile edit
end
Variable
<wids-profile_name> comment <comment_str> asleap-attack
{enable | disable} assoc-frame-flood
{enable | disable} auth-frame-flood
{enable | disable}
Description
Enter a name for this WIDS profile.
Default
No default.
Optionally, enter a descriptive comment.
Enable to detect asleap attack (attempt to crack
LEAP security).
No default.
disable
Enable to detect association frame flood attack.
disable
Enable to detect authentication frame flood attack. disable
Fortinet Technologies Inc.
Page 895 FortiOS™ - CLI Reference for FortiOS 5.0
wireless-controller wids-profile
Variable
deauth-broadcast
{enable | disable} eapol-fail-flood
{enable | disable} eapol-fail-intv <int> eapol-fail-thres <int> eapol-logoff-flood
{enable | disable} eapol-logoff-intv <int> eapol-logoff-thres <int> eapol-pre-fail-flood
{enable | disable} eapol-pre-fail-intv <int> eapol-pre-fail-thres <int> eapol-pre-succ-flood
{enable | disable}
Description
Enable to detect EAP FAIL flood attack.
Set EAP FAIL detection interval.
Set EAP FAIL detection threshold.
Enable to detect EAP LOGOFF flood attack.
Set EAP LOGOFF detection interval.
Set EAP LOGOFF detection threshold.
Set EAP premature FAIL detection interval.
Set EAP premature FAIL detection threshold.
Enable to detect EAP premature SUCC flood attack.
disable
1
Default
disable
1
10 disable
10
Enable to detect EAP premature FAIL flood attack.
disable
1
10 disable eapol-pre-succ-intv <int> eapol-pre-succ-thres <int> eapol-start-flood
{enable | disable} eapol-start-intv <int> eapol-start-thres <int> eapol-succ-flood
{enable | disable}
Set EAP premature SUCC detection interval.
Set EAP premature SUCC detection threshold.
Enable to detect EAP START flood attack.
Set EAP START detection interval.
Set EAP START detection threshold.
Enable to detect EAP SUCC flood attack.
1
10 disable
1
10 disable eapol-succ-intv <int> eapol-succ-thres <int> invalid-mac-oui
{enable | disable}
Set EAP SUCC detection interval.
Set EAP SUCC detection threshold.
Enable to detect use of spoofed MAC addresses.
(The first three bytes should indicate a known manufacturer.)
1
10 disable long-duration-attack
{enable | disable} long-duration-thresh <int>
Enable for long duration attack detection based on long-duration-thresh.
disable
Enter the duration in usec for long-duration attack detection. This is available when longduration-attack is enable.
8200 null-ssid-probe-resp
{enable | disable} spoofed-deauth
{enable | disable}
Enable to detect spoofed deathentication packets.
disable disable weak-wep-iv {enable | disable} Enable to detect APs using weak WEP encryption. disable wireless-bridge
{enable | disable}
Enable to detect wireless bridge operation, which is suspicious if your network doesn’t use a wireless bridge. disable
Read-only variables (view using get command)
used-by
Fortinet Technologies Inc.
Page 896 FortiOS™ - CLI Reference for FortiOS 5.0
wireless-controller
wtp
wtp
Use this command to configure physical access points (APs) for management by the wireless controller, also known as an access controller (AC).
Syntax
config wireless-controller wtp
end config lan set
port1-mode {offline | bridge-to-ssid | bridge-to-wan}
set
end
To retrieve information about a physical access point: config wireless-controller wtp
end get
Along with the current configuration settings, information such as the current number of clients, is returned. See the read-only variables section of the table below.
Fortinet Technologies Inc.
Page 897 FortiOS™ - CLI Reference for FortiOS 5.0
wireless-controller
Variable
edit <wtp-id>
Description
Enter the ID for the AP unit.
admin <admin_status>
Set to one of the following:
Default
No default.
enable discovered — This is the setting for APs that have discovered this AC and registered themselves. To use such an AP, select enable.
disable — Do not manage this AP.
enable — Manage this AP.
ap-scan
{enable | disable} auto-power-level
{enable | disable} auto-power-low
<dBm_int> auto-power-high
<dBm_int>
Set automatic power level low limit, in dBm. Range 0 to
17dBm.
Set automatic power level high limit, in dBm. Range 0 to
17dBm.
band {2.4GHz | 5GHz}
Select 2.4GHz or 5GHz band. Applies when automatic profile is used.
coordinate-enable
{enable | disable} coordinate-x <int>
Enable or disable rogue AP scanning.
Enable or disable automatic power-level adjustment to prevent co-channel interference.
Enable AP unit coordinates.
Enter x and y coordinates for AP. This is available if coordinate-enable is enabled.
coordinate-y <int> image-download
{enable | disable} ip-fragment-preventing
[icmp-unreachable tcp-mss-adjust]
Enable or disable downloading of firmware to the AP unit.
Enable options to deal with CAPWAP packet fragmentation: icmp-unreachable — drop packet, send ICMP
Destination unreachable enable disable
10
17
2.4GHz
disable
0,0 enable null location <string> login-enable
{default | enable | disable} login-passwd
<pwd_string> tcp-mss-adjust — adjust MTU using tun-mtu-uplink and tun-mtu-downlink
Optionally, enter the location of this AP.
Enable or disable AP telnet login. Set to default to control the AP telnet login capability with the
TELNET_ALLOW setting on the AP unit.
Set the AP unit login password.
No default.
default
No default.
login-passwd-change
{default | yes | no} mesh-bridge-enable
{default | enable
| disable} name <string>
This is available if login-passwd-change is yes.
Select whether to change AP unit login password.
Select default to change the AP unit password back to its default.
Enable to create a bridge between the AP unit’s WiFi interface and its Ethernet interface. Set to default to use the setting configured on the FortiAP unit.
Enter a name to identify this access point.
no disable
No default.
wtp
Fortinet Technologies Inc.
Page 898 FortiOS™ - CLI Reference for FortiOS 5.0
wireless-controller wtp
Variable
power-level <int>
Description
Set radio power level. Range is 0 (minimum) to 100
(maximum).
Default
100
The maximum power level is set to the regulatory maximum for your region, as determined by your selection in the country field of
radio-enable
{enable | disable} tun-mtu-downlink {0
| 576 | 1500}
Enable or disable radio operation.
Set CAPWAP uplink MTU to 576 or 1500, or leave alone
(0).
tun-mtu-uplink {0 | 576
| 1500}
Set CAPWAP downlink MTU to 576 or 1500, or leave alone (0).
vap-all {enable | disable} Enable to inherit all VAPs. Disable to select VAPs.
vaps {vap1 ... vapn>
Set the virtual access points carried on this physical access point.
enable
0
0 enable
No default.
vlanid <vlanid_int> wtp-id <id_string> wtp-profile
<name_string>
config lan variables
port1-mode {offline
| bridge-to-ssid
| bridge-to-wan}
This is used only when wtp-profile is not set.
Optionally assign a VLAN ID for local bridge VAP traffic.
Enter the ID of the AP unit.
Enter the name of the wtp profile to apply to this access point.
Set FortiAP LAN port mode:
0
No default.
No default.
offline
• offline — not used
• bridge-to-ssid — bridge with specified SSID
• bridge-to-wan — bridge with WAN port
There is also port2-mode, port3-mode, etc., depending on the number of independent LAN interfaces on the FortiAP unit.
port1-ssid <ssid_name>
Enter the SSID to bridge with LAN port 1. This is available when port1-mode is bridge-to-ssid.
There is also port2-ssid, port3-ssid, etc., depending on the number of independent LAN interfaces on the FortiAP unit.
No default.
Read-only variables (view using get command)
base-bssid base-bssid-2
The wireless MAC address of each radio.
client-count connection-state image-downloadprogress
The number of clients connected to this managed access point.
Shows “connected” if FortiAP is connected, otherwise “idle”.
Shows 0-100% progress during FortiAP image upload. join-time last-failure last-failure-param last-failure-time local-ipv4-address
Date and time that the managed AP connected to the controller.
Last error message concerning this managed AP.
Additional information about the last error.
Date and time of last error message.
The IP address assigned to the AP.
Fortinet Technologies Inc.
Page 899 FortiOS™ - CLI Reference for FortiOS 5.0
wireless-controller
Variable
max-vaps max-vaps-2 oper-chan oper-chan-2 region-code software-version
Description
The maximum number of SSIDs supported on each radio.
Default
The current operating channel of each radio.
The region-code (country) currently set on the FortiAP unit.
The build number of the FortiAP firmware, e.g.:FAP22A-v4.0-build212
wtp
Fortinet Technologies Inc.
Page 900 FortiOS™ - CLI Reference for FortiOS 5.0
wireless-controller
wtp-profile
wtp-profile
Use this command to define an access point profile (wtp profile).
Syntax
config wireless-controller wtp-profile edit <name_string>
config deny-mac-list edit
end set
config lan set
port1-mode {offline | bridge-to-ssid | bridge-to-wan}
set
end config platform set
end config radio-1 set
ap-auto-suppress {enable | disable}
set
set
ap-bgscan-disable-day <day_list_str>
set
ap-bgscan-disable-end <time_str>
set
ap-bgscan-disable-start <time_str>
set
set
auto-power-level {enable | disable}
set
set
set
band {802.11a | 802.11b | 802.11g | 802.11n | 802.11n-5G}
set
set
set
set
set
set
set
set
set
Fortinet Technologies Inc.
Page 901 FortiOS™ - CLI Reference for FortiOS 5.0
wireless-controller wtp-profile
set
protection-mode {disable | ctsonly | rtscts}
set
set
short-guard-interval {enable | disable}
set
station-locate {enable | disable}
set
end config radio-2 set
ap-auto-suppress {enable | disable}
set
set
ap-bgscan-disable-day <day_list_str>
set
ap-bgscan-disable-end <time_str>
set
ap-bgscan-disable-start <time_str>
set
set
auto-power-level {enable | disable}
set
set
set
band {802.11a | 802.11b | 802.11g | 802.11n | 802.11n-5G}
set
set
set
channel-bonding {enable | disable}
set
set
set
set
set
set
set
set
protection-mode {disable | ctsonly | rtscts}
end set
set
short-guard-interval {enable | disable}
set
end
Variable
ap-country
<country-code>
Description
Set the country in which this AP will operate. To list available country codes, enter set ap-country ?
comment
<comment_string> dtls-policy {clear-text
| dtls-enabled}
Optionally, enter a description.
Select whether CAPWAP protocol uses clear-text or
DTLS encryption.
handoff-rssi <rssi_int>
Enter the minimum RSSI value for handoff.
handof-sta-thresh
<thresh_int>
Enter the threshold value for AP handoff.
Default
US
No default.
clear-text
25
30
Fortinet Technologies Inc.
Page 902 FortiOS™ - CLI Reference for FortiOS 5.0
wireless-controller wtp-profile
Variable
ip-fragment-preventing
[icmp-unreachable tcp-mss-adjust]
Description
Enable options to deal with CAPWAP packet fragmentation: icmp-unreachable — drop packet, send ICMP
Destination unreachable
Default
null max-clients <int> tcp-mss-adjust — adjust MTU using tun-mtu-uplink and tun-mtu-downlink
Enter the maximum number of clients this AP supports.
Use 0 for no limit.
0 preferred-oper-mode
{LE | SN} tun-mtu-downlink {0
| 576 | 1500} tun-mtu-uplink {0 | 576
| 1500}
Select the preferred operating mode:
• LE — local MAC and 802.3 frame tunnel mode
• SN — split MAC and 802.11 frame tunnel mode
• offline — not used
• bridge-to-ssid — bridge with specified SSID
LE
Set CAPWAP uplink MTU to 576 or 1500, or leave alone
(0).
0
Set CAPWAP downlink MTU to 576 or 1500, or leave alone (0).
config deny-mac-list variables
<mac_id>
Enter a number to identify this entry.
mac <mac>
Enter the wireless MAC address to deny.
config lan variables
port1-mode {offline
| bridge-to-ssid
| bridge-to-wan}
Set FortiAP LAN port mode:
0
No default.
No default.
offline
• bridge-to-wan — bridge with WAN port
There is also port2-mode, port3-mode, etc., depending on the number of independent LAN interfaces on the FortiAP unit.
port1-ssid <ssid_name>
Enter the SSID to bridge with LAN port 1. This is available when port1-mode is bridge-to-ssid.
No default.
There is also port2-ssid, port3-ssid, etc., depending on the number of independent LAN interfaces on the FortiAP unit.
config platform variables
type <type_string>
Enter the AP hardware type. To see a list of hardware types, enter set type ?
config radio-1, config radio-2 variables
ap-auto-suppress
{enable | disable}
Enable or disable automatic suppression of detected rogue APs. This is available only if mode is monitor.
ap-bgscan
{enable | disable}
Enable or disable background scanning.
Note: Scanning can reduce performance.
ap-bgscan-disable-day
<day_list_str> ap-bgscan-disable-end
<time_str> ap-bgscan-disable-start
<time_str>
Enter the days of the week when background scanning is disabled.
Enter the end time (format hh:mm) for disabled background scanning. ap-bgscan-disable-day must be set.
Enter the start time (format hh:mm) for disabled background scanning. ap-bgscan-disable-day must be set.
220B disable disable null
00:00
00:00
Fortinet Technologies Inc.
Page 903 FortiOS™ - CLI Reference for FortiOS 5.0
wireless-controller wtp-profile
Variable
ap-bgscan-period
<secs_int> auto-power-level
{enable | disable} auto-power-low
<dBm_int>
Description Default
Enter the period in seconds between background scans.
600
Enable or disable automatic power-level adjustment to prevent co-channel interference.
Set automatic power level low limit, in dBm. Range 0 to
17dBm.
auto-power-high
<dBm_int> band {802.11a | 802.11b
| 802.11g
| 802.11n | 802.11n-5G}
Set automatic power level high limit, in dBm. Range 0 to
17dBm.
Enter the wireless band to use. Available bands depend on the capabilities of the radio.
802.11n-5G is 802.11n on the 5GHz band.
beacon-interval <integer> Set the interval between beacon packets. Access Points broadcast beacons or Traffic Indication Messages (TIM) to synchronize wireless networks. In an environment with high interference, decreasing the beacon-interval might improve network performance. In a location with few wireless nodes, you can increase this value.
channel
<channels_string>
Enter a list of the radio channels your access point can use. Separate the channel numbers with spaces. The AP will use the least busy of the listed channels.
disable
10
17
No default.
100
No default.
To determine which channels are available for your selected radio band and geography, enter set channel ?
channel-bonding
{enable | disable}
Available for config radio-2 only.
darrp {enable | disable}
Enable Distributed Automatic Radio Resource
Provisioning.
dtim <int>
Set the interval for Delivery Traffic Indication Message
(DTIM). Range is 1 to 255.
frag-threshold <int> max-distance <m_int>
Set the maximum expected distance in meters between the AP and clients. This adjusts the ACK timeout to maintain throughput at the maximum distance. Range 0 to 20 000 meters. max-supported-mcs
<mcs_int>
Set the maximum packet size that can be sent without fragmentation. Range is 800 to 2346 bytes.
Range 0 - 31.
mode <mode_string>
Select one of the following modes for the access point: disable disable
1
2346
0
15 ap ap — Radio provides wireless Access Point service.
monitor — Radio performs scanning only.
power-level <dBm> protection-mode {disable
| ctsonly | rtscts} rts-threshold <int> disable — Radio is not used.
Set transmitter power level in dBm. Range 0 to 17.
Select 802.11g proection mode.
Set the packet size for RTS transmissions. Range 256 to
2346 bytes.
17 disable
2346
Fortinet Technologies Inc.
Page 904 FortiOS™ - CLI Reference for FortiOS 5.0
wireless-controller wtp-profile
Variable
short-guard-interval
{enable | disable} station-locate
{enable | disable} vaps {vap1 ... vapn> wids-profile
<wids-profile_name>
Description
Optionally, enabling this option might increase the data rate.
Default
disable
Enable station location for all clients, associated or not.
disable
Set the virtual access points carried on this physical access point.
Enter the WIDS profile name.
No default.
No default.
Fortinet Technologies Inc.
Page 905 FortiOS™ - CLI Reference for FortiOS 5.0
execute
The execute commands perform immediate operations on the FortiGate unit, including:
• Maintenance operations, such as back up and restore the system configuration, reset the configuration to factory settings, update antivirus and attack definitions, set the date and time.
• Network operations, such as view and clear DHCP leases, clear arp table entries, use ping or traceroute to diagnose network problems.
• View and delete log messages. Delete old log files.
• Generate certificate requests and install certificates for VPN authentication.
This chapter contains the following sections:
log fortianalyzer test-connectivity
policy-packet-capture delete-all
wireless-controller delete-wtp-image
wireless-controller list-wtp-image
wireless-controller restart-acd
wireless-controller restart-wtpd
wireless-controller upload-wtp-image
Page 906
execute
backup
backup
Back up the FortiGate configuration files, logs, or IPS user-defined signatures file to a TFTP or
FTP server, USB disk, or a management station. Management stations can either be a
FortiManager unit, or FortiGuard Analysis and Management Service. For more information, see
“system fortiguard” on page 516 or
“system central-management” on page 494
.
When virtual domain configuration is enabled (in system global
, vdom-admin is enabled), the content of the backup file depends on the administrator account that created it.
• A backup of the system configuration from the super admin account contains the global settings and the settings for all of the VDOMs. Only the super admin can restore the configuration from this file.
• When you back up the system configuration from a regular administrator account, the backup file contains the global settings and the settings for the VDOM to which the administrator belongs. Only a regular administrator account can restore the configuration from this file.
Syntax
execute backup
execute backup
execute backup
config management-station <comment_str>
execute backup
config tftp <filename_str> <server_ipv4>
execute backup
config usb <filename_str> [<backup_password_str>]
execute backup
config-with-forticlient-info usb-mode
execute backup
config-with-forticlient-info ftp <filename_str>
<server_ipv4[:port_int] | server_fqdn[:port_int]>
[<username_str> [<password_str>]] [<backup_password_str>]
execute backup
config-with-forticlient-info tftp <filename_str>
<server_ipv4> [<backup_password_str>]
execute backup
config-with-forticlient-info usb
execute backup
config-with-forticlient-info usb-mode
execute backup
full-config ftp <filename_str> <server_ipv4[: port_int] | server_fqdn[:port_int]> [<username_str>
[<password_str>]] [<backup_password_str>]
execute backup
full-config tftp <filename_str> <server_ipv4>
execute backup
full-config usb <filename_str>
execute backup
full-config usb-mode <filename_str>
execute backup
ipsuserdefsig ftp <filename_str> <server_ipv4[: port_int] | server_fqdn[:port_int]> [<username_str>
execute backup
ipsuserdefsig tftp tftp <filename_str> <server_ipv4>
execute backup
Fortinet Technologies Inc.
Page 907 FortiOS™ - CLI Reference for FortiOS 5.0
execute backup
execute backup
{disk | memory} alllogs tftp <server_ipv4>
execute backup
| event | ids | virus | webfilter | spam | dlp | voip | app-ctrl
execute backup
{disk | memory} log {ftp | tftp} <server_ipv4> netscan
Variable
config flash <comment> config ftp <filename_str> <server_ipv4[: port_int] | server_fqdn[:port_int]>
[<username_str> [<password_str>]]
[<backup_password_str>] config management-station <comment_str>
Description
Back up the system configuration to the flash disk. Optionally, include a comment.
Back up the system configuration to an FTP server.
Optionally, you can specify a password to protect the saved data.
Back up the system configuration to a configured management station. If you are adding a comment, do not add spaces, underscore characters (_), or quotation marks (“ “) or any other punctuation marks.
For example, uploadedthetransparentmodeconfigfortheaccoun tingdepartmentwilluploadonadailybasis.
The comment you enter displays in both the portal website and FortiGate web-based manager
(System > Maintenance > Revision). config tftp <filename_str> <server_ipv4>
[<backup_password_str>]
Back up the system configuration to a file on a
TFTP server. Optionally, you can specify a password to protect the saved data.
config usb <filename_str>
[<backup_password_str>]
Back up the system configuration to a file on a
USB disk. Optionally, you can specify a password to protect the saved data.
config usb-mode [<backup_password_str>]
Back up the system configuration to a USB disk
(Global admin only). Optionally, you can specify a password to protect the saved data.
config-with-forticlient-info ftp <filename_str>
<server_ipv4[:port_int] | server_fqdn[: port_int]> [<username_str> [<password_str>]]
[<backup_password_str>] config-with-forticlient-info tftp <filename_str>
<server_ipv4> [<backup_password_str>]
Back up the system configuration to a file on an
FTP server. Optionally, you can specify a password to protect the saved data.
Back up the system configuration to a file on a
TFTP server. Optionally, you can specify a password to protect the saved data.
config-with-forticlient-info usb
[<backup_password_str>]
Back up the system configuration to a file on a
USB disk. Optionally, you can specify a password to protect the saved data.
config-with-forticlient-info usb-mode
[<backup_password_str>]
Back up the system configuration to a USB disk
(Global admin only). Optionally, you can specify a password to protect the saved data.
full-config ftp <filename_str> <server_ipv4[: port_int] | server_fqdn[:port_int]>
[<username_str> [<password_str>]]
[<backup_password_str>]
Back up the full system configuration to a file on an FTP server. You can optionally specify a password to protect the saved data.
Fortinet Technologies Inc.
Page 908 FortiOS™ - CLI Reference for FortiOS 5.0
execute backup
Variable
full-config tftp <filename_str> <server_ipv4>
[<backup_password_str>] full-config usb <filename_str>
[<backup_password_str>] full-config usb-mode <filename_str>
[<backup_password_str>]
Description
Back up the full system configuration to a file on a
TFTP server. You can optionally specify a password to protect the saved data.
Back up the full system configuration to a file on a
USB disk. You can optionally specify a password to protect the saved data.
Back up the full system configuration to a file on a
USB disk (Global admin only). You can optionally specify a password to protect the saved data.
Backup IPS user-defined signatures to a file on an
FTP server. ipsuserdefsig ftp <filename_str>
<server_ipv4[:port_int] | server_fqdn[: port_int]> [<username_str> [<password_str>]] ipsuserdefsig tftp tftp <filename_str>
<server_ipv4>
{disk | memory} alllogs ftp <server_ipv4[: port_int] | server_fqdn[:port_int]>
[<username_str> <password_str>]
Back up IPS user-defined signatures to a file on a
TFTP server.
Back up either all memory or all hard disk log files for this VDOM to an FTP server. The disk option is available on FortiGate models that log to a hard disk.
{disk | memory} alllogs tftp <server_ipv4>
The file name has the form:
<log_file_name>_<VDOM>_<date>_<time>
Back up either all memory or all hard disk log files for this VDOM to a TFTP server. he disk option is available on FortiGate models that log to a hard disk.
The file name has the form:
<log_file_name>_<VDOM>_<date>_<time>
{disk | memory} log ftp <server_ipv4[: port_int] | server_fqdn[:port_int]>
<username_str> <password_str> {traffic
| event | ids | virus | webfilter | spam | dlp | voip
| app-ctrl | netscan}
{disk | memory} log tftp <server_ipv4> {traffic
| event | ids | virus | webfilter | spam | dlp | voip
| app-ctrl | netscan}
Back up the specified type of log file from either hard disk or memory to an FTP server.
The disk option is available on FortiGate models that log to a hard disk.
Back up the specified type of log file from either hard disk or memory to an FTP server.
The disk option is available on FortiGate models that log to a hard disk.
{disk | memory} log {ftp | tftp} <server_ipv4> netscan
Back up the specified type of log file from either hard disk or memory to FTP or TFTP server.
The disk option is available on FortiGate models that log to a hard disk.
Example
This example shows how to backup the FortiGate unit system configuration to a file named fgt.cfg on a TFTP server at IP address 192.168.1.23.
execute backup config tftp fgt.cfg 192.168.1.23
Fortinet Technologies Inc.
Page 909 FortiOS™ - CLI Reference for FortiOS 5.0
execute
batch
Execute a series of CLI commands.
execute batch commands are controlled by the Maintenance (mntgrp) access control group.
Syntax
execute batch [<cmd_cue>] where <cmd_cue> is one of:
• end — exit session and run the batch commands
• lastlog — read the result of the last batch commands
• start — start batch mode
• status — batch mode status reporting if batch mode is running or stopped
Example
To start batch mode: execute batch start
Enter batch mode...
To enter commands to run in batch mode: config system global set refresh 5 end
To execute the batch commands: execute batch end
Exit and run batch commands...
batch
Fortinet Technologies Inc.
Page 910 FortiOS™ - CLI Reference for FortiOS 5.0
execute bypass-mode
bypass-mode
Use this command to manually switch a FortiGate-600C or FortiGate-1000C into bypass mode.
This is available in transparent mode only. If manually switched to bypass mode, the unit remains in bypass-mode until bypass mode is disabled.
Syntax
execute bypass-mode {enable | disable}
Fortinet Technologies Inc.
Page 911 FortiOS™ - CLI Reference for FortiOS 5.0
execute carrier-license
carrier-license
Use this command to enter a l FortiOS Carrier license key if you have installed a FortiOS Carrier build on a FortiGate unit and need to enter a license key to enable FortiOS Carrier functionality.
Contact Fortinet Support for more information about this command.
Syntax
execute carrier-license
Variable
<license_key>
Description
Enter the FortiOS Carrier license key supplied by Fortinet.
Fortinet Technologies Inc.
Page 912 FortiOS™ - CLI Reference for FortiOS 5.0
execute central-mgmt
central-mgmt
Update Central Management Service account information. Also used receive configuration file updates from an attached FortiManager unit.
Syntax
execute central-mgmt set-mgmt-id <management_id> execute central-mgmt register-device <fmg-serial-number>
<fmg-register-password> <fgt-user-name> <fgt-password> execute central-mgmt unregister-device <fmg-serial-number> set-mgmt-id is used to change or initially set the management ID, or your account number for
Central Management Services. This account ID must be set for the service to be enabled.
register-device registers the FortiGate unit with a specific FortiManager unit specified by serial number. You must also specify the administrator name and password that the
FortiManager unit uses to log on to the FortiGate unit. unregister-device removes the FortiGate unit from the specified FortiManager unit’s device list. update is used to update your Central Management Service contract with your new management account ID. This command is to be used if there are any changes to your management service account.
Example
If you are registering with the Central Management Service for the first time, and your account number is 123456, you would enter the following: execute central-mgmt set-mgmt-id 123456
Fortinet Technologies Inc.
Page 913 FortiOS™ - CLI Reference for FortiOS 5.0
execute
cfg reload
cfg reload
Use this command to restore the saved configuration when the configuration change mode is manual or revert. This command has no effect if the mode is automatic, the default. The set cfg-save command in system global sets the configuration change mode.
When you reload the saved system configuration, the your session ends and the FortiGate unit restarts.
In the default configuration change mode, automatic, CLI commands become part of the saved unit configuration when you execute them by entering either next or end.
In manual mode, commands take effect but do not become part of the saved configuration unless you execute the execute cfg save command. When the FortiGate unit restarts, the saved configuration is loaded. Configuration changes that were not saved are lost.
The revert mode is similar to manual mode, except that configuration changes are saved automatically if the administrative session is idle for more than a specified timeout period. This provides a way to recover from an erroneous configuration change, such as changing the IP address of the interface you are using for administration. You set the timeout in system global using the set cfg-revert-timeout command.
Syntax
execute cfg reload
Example
This is sample output from the command when successful:
# execute cfg reload configs reloaded. system will reboot.This is sample output from the command when not in runtime-only configuration mode:
# execute cfg reload no config to be reloaded.
Fortinet Technologies Inc.
Page 914 FortiOS™ - CLI Reference for FortiOS 5.0
execute
cfg save
cfg save
Use this command to save configuration changes when the configuration change mode is manual or revert. If the mode is automatic, the default, all changes are added to the saved configuration as you make them and this command has no effect. The set cfg-save command in system global sets the configuration change mode.
In manual mode, commands take effect but do not become part of the saved configuration unless you execute the execute cfg save command. When the FortiGate unit restarts, the saved configuration is loaded. Configuration changes that were not saved are lost.
The revert mode is similar to manual mode, except that configuration changes are reverted automatically if the administrative session is idle for more than a specified timeout period. This provides a way to recover from an erroneous configuration change, such as changing the IP address of the interface you are using for administration. To change the timeout from the default of 600 seconds, go to system global and use the set cfg-revert-timeout command.
Syntax
execute cfg save
Example
This is sample output from the command:
# execute cfg save config saved.
This is sample output when not in runtime-only configuration mode. It also occurs when in runtime-only configuration mode and no changes have been made:
# execute cfg save no config to be saved.
Fortinet Technologies Inc.
Page 915 FortiOS™ - CLI Reference for FortiOS 5.0
execute
clear system arp table
Clear all the entries in the arp table.
Syntax
execute clear system arp table
clear system arp table
Fortinet Technologies Inc.
Page 916 FortiOS™ - CLI Reference for FortiOS 5.0
execute
cli check-template-status
Reports the status of the secure copy protocol (SCP) script template.
Syntax
execute cli check-template-status
cli check-template-status
Fortinet Technologies Inc.
Page 917 FortiOS™ - CLI Reference for FortiOS 5.0
execute cli status-msg-only
cli status-msg-only
Enable or disable displaying standardized CLI error output messages. If executed, this command stops other debug messages from displaying in the current CLI session. This command is used for compatibility with FortiManager.
Syntax
execute cli
status-msg-only [enable | disable]
Variable
status-msg-only
[enable | disable]
Description
Enable or disable standardized CLI error output messages.
Entering the command without enable or disable disables displaying standardized output.
Default
enable
Fortinet Technologies Inc.
Page 918 FortiOS™ - CLI Reference for FortiOS 5.0
execute
client-reputation
Use these commands to retrieve or remove client reputation information.
Syntax
To erase all client reputation data
execute client-reputation erase
To retrieve client reputation host count
execute client-reputation host-count <rows>
To retrieve client reputation host details
execute client-reputation host detail <host>
To retrieve client reputation host summary
execute client-reputation host summary <host>
To purge old data
execute client-reputation purge
To view the top n records
execute client-reputation <n | all>
client-reputation
Fortinet Technologies Inc.
Page 919 FortiOS™ - CLI Reference for FortiOS 5.0
execute
date
date
Get or set the system date.
Syntax
execute date [<date_str>] date_str has the form yyyy-mm-dd, where
• yyyy is the year and can be 2001 to 2037
• mm is the month and can be 01 to 12
• dd is the day of the month and can be 01 to 31
If you do not specify a date, the command returns the current system date. Shortened values, such as ‘06’ instead of ‘2006’ for the year or ‘1’ instead of ‘01’ for month or day, are not valid.
Example
This example sets the date to 17 September 2004: execute date 2004-09-17
Fortinet Technologies Inc.
Page 920 FortiOS™ - CLI Reference for FortiOS 5.0
execute
disk
disk
Use this command to list and format hard disks installed in FortiGate units or individual partitions on these hard disks.
Syntax
execute disk format <partition1_ref_int> [...<partitionn_ref_int>] execute disk list
Variable
format list
<ref_int>
Description
Format the referenced disk partitions or disks. Separate reference numbers with spaces.
If you enter a partition reference number the disk partition is formatted. If you enter a disk reference number the entire disk and all of its partitions are formatted.
List the disks and partitions and the reference number for each one.
Disk (device) or partition reference number.
The execute disk format command formats the specified partitions or disks and then reboots the system if a reboot is required.
In most cases you need to format the entire disk only if there is a problem with the partition.
Formatting the partition removes all data from the partition. Formatting the disk removes all data from the entire disk and creates a single partition on the disk.
Examples
Use the following command to list the disks and partitions. execute disk list
Device I1 29.9 GB ref: 256 SUPER TALENT (IDE)
partition 1 29.9 GB ref: 257 label: 224E6EE7177E1652
In this example (for a FortiGate-51B), the disk (device) reference number is 256 and the reference number for the single partition is 257.
Enter the following command to format the partition.
execute disk format 257
After a confirmation message the FortiGate unit formats the partition and restarts. This can take a few minutes.
Enter the following command to format the entire disk.
execute disk format 256
After a confirmation message the FortiGate unit formats the disk, restores the original partition, and restarts. This can take a few minutes.
Fortinet Technologies Inc.
Page 921 FortiOS™ - CLI Reference for FortiOS 5.0
execute
disk raid
disk raid
Use this command to view information about and change the raid settings on FortiGate units that support RAID.
Syntax
execute disk raid disable execute disk raid enable {Raid-0 | Raid-1 | Raid-5} execute disk raid rebuild execute disk raid status
Variable
disable enable {Raid-0
| Raid-1 | Raid-5} rebuild status
Description
Disable raid for the FortiGate unit.
Change the RAID level on the FortiGate unit.
Rebuild RAID on the FortiGate unit at the same RAID level. You can only execute this command if a RAID error has been detected. Changing the
RAID level takes a while and deletes all data on the disk array.
Display information about the RAID disk array in the FortiGate unit.
Examples
Use the following command to display information about the RAID disk array in a FortiGate-
82C.
execute disk raid status
RAID Level: Raid-1
RAID Status: OK
RAID Size: 1000GB
Disk 1: OK Used 1000GB
Disk 2: OK Used 1000GB
Disk 3: OK Used 1000GB
Disk 4: Unavailable Not-Used 0GB
Fortinet Technologies Inc.
Page 922 FortiOS™ - CLI Reference for FortiOS 5.0
execute
dhcp lease-clear
Clear all DHCP address leases.
Syntax
For IPv4: execute dhcp lease-clear
For IPv6 execute dhcp6 lease-clear
dhcp lease-clear
Fortinet Technologies Inc.
Page 923 FortiOS™ - CLI Reference for FortiOS 5.0
execute dhcp lease-list
dhcp lease-list
Display DHCP leases on a given interface
Syntax
For IPv4: execute dhcp lease-list [interface_name]
For IPv6: execute dhcp6 lease-list [interface_name]
If you specify an interface, the command lists only the leases issued on that interface.
Otherwise, the list includes all leases issued by DHCP servers on the FortiGate unit.
If there are no DHCP leases in user on the FortiGate unit, an error will be returned.
Fortinet Technologies Inc.
Page 924 FortiOS™ - CLI Reference for FortiOS 5.0
execute disconnect-admin-session
disconnect-admin-session
Disconnect an administrator who is logged in.
Syntax
execute disconnect-admin-session <index_number>
To determine the index of the administrator that you want to disconnect, view the list of loggedin administrators by using the following command: execute disconnect-admin-session ?
The list of logged-in administrators looks like this:
Connected:
INDEX USERNAME TYPE FROM TIME
0 admin WEB 172.20.120.51 Mon Aug 14 12:57:23
2006
1 admin2 CLI ssh(172.20.120.54) Mon Aug 14 12:57:23
2006
Example
This example shows how to disconnect the logged administrator admin2 from the above list.
execute disconnect-admin-session 1
Fortinet Technologies Inc.
Page 925 FortiOS™ - CLI Reference for FortiOS 5.0
execute
enter
enter
Use this command to go from global commands to a specific virtual domain (VDOM).
Only available when virtual domains are enabled and you are in config global.
After you enter the VDOM, the prompt will not change from “
(global)”. However you will be in the VDOM with all the commands that are normally available in VDOMs.
Syntax
execute enter <vdom>
Use “?” to see a list of available VDOMs.
Fortinet Technologies Inc.
Page 926 FortiOS™ - CLI Reference for FortiOS 5.0
execute
erase-disk
Use this command to reformat the boot device or an attached hard disk. Optionally, this command can restore the image from a TFTP server after erasing.
Syntax
execute erase-disk <disk_name>
The
<disk_name> for the boot device is boot.
erase-disk
Fortinet Technologies Inc.
Page 927 FortiOS™ - CLI Reference for FortiOS 5.0
execute factoryreset
factoryreset
Reset the FortiGate configuration to factory default settings.
Syntax
execute factoryreset [keepvmlicense]
If keepvmlicense is specified (VM models only), the VM license is retained after reset.
Apart from the keepvmlicense option, this procedure deletes all changes that you have made to the FortiGate configuration and reverts the system to its original configuration, including resetting interface addresses.
Fortinet Technologies Inc.
Page 928 FortiOS™ - CLI Reference for FortiOS 5.0
execute factoryreset2
factoryreset2
Reset the FortiGate configuration to factory default settings except VDOM and interface settings.
Syntax
execute factoryreset2 [keepvmlicense]
If keepvmlicense is specified (VM models only), the VM license is retained after reset.
Fortinet Technologies Inc.
Page 929 FortiOS™ - CLI Reference for FortiOS 5.0
execute formatlogdisk
formatlogdisk
Format the FortiGate hard disk to enhance performance for logging.
Syntax
execute formatlogdisk
In addition to deleting logs, this operation will erase all other data on the disk, including system configuration, quarantine files, and databases for antivirus and IPS.
Fortinet Technologies Inc.
Page 930 FortiOS™ - CLI Reference for FortiOS 5.0
execute
forticarrier-license
Use this command to perform a FortiCarrier license upgrade.
Syntax
execute forticarrier-license <activation-code>
forticarrier-license
Fortinet Technologies Inc.
Page 931 FortiOS™ - CLI Reference for FortiOS 5.0
execute
forticlient
Use these commands to manage FortiClient licensing.
Syntax
To view FortiClient license information
execute forticlient info
To show current FortiClient count
execute forticlient list <connection_type> where
<connection_type> is one of:
• 0 - IPsec
• 1 - SSLVPN
• 2 - NAC (Endpoint Security)
• 3 - WAN optimization
• 4 - Test
forticlient
Fortinet Technologies Inc.
Page 932 FortiOS™ - CLI Reference for FortiOS 5.0
execute fortiguard-log
fortiguard-log
Use this to manage FortiGuard Analysis and Management Service (FortiCloud) operation.
Syntax
To create a FortiCloud account
execute fortiguard-log create-account
To activity FortiCloud certification
execute fortiguard-log certification
To retrieve the FortiCloud agreement
execute fortiguard-log agreement
To log in to a FortiCloud account
execute fortiguard-log login <account-id> <password>
To update the FortiGuard Analysis and Management Service contract
execute fortiguard-log update
Fortinet Technologies Inc.
Page 933 FortiOS™ - CLI Reference for FortiOS 5.0
execute
fortisandbox test-connectivity
Use this command to query FortiSandbox connection status.
Syntax
execute fortisandbox test-connectivity
fortisandbox test-connectivity
Fortinet Technologies Inc.
Page 934 FortiOS™ - CLI Reference for FortiOS 5.0
execute
fortitoken
fortitoken
Use these commands to activate and synchronize a FortiToken device. FortiToken devices are used in two-factor authentication of administrator and user account logons. The device generates a random six-digit code that you enter during the logon process along with user name and password.
Before they can be used to authenticate account logins, FortiToken devices must be activated with the FortiGuard service. When successfully activated, the status of the FortiToken device will change from New to Active.
Synchronization is sometimes needed due to the internal clock drift of the FortiToken device. It is not unusual for new FortiToken units to require synchronization before being put into service.
Synchronization is accomplished by entering two sequential codes provided by the FortiToken.
Syntax
To activate one or more FortiToken devices
execute fortitoken activate <serial_number> [serial_number2 ... serial_numbern]
To import FortiToken OTP seeds
execute fortitoken import <seeds_file> <seeds_file_preshared_key>
To synchronize a FortiToken device
execute fortitoken sync <serial_number> <code> <next code>
Fortinet Technologies Inc.
Page 935 FortiOS™ - CLI Reference for FortiOS 5.0
execute fortitoken-mobile
fortitoken-mobile
Use these commands to activate and synchronize a FortiToken Mobile card. FortiToken Mobile cards are used in two-factor authentication of administrator and user account logons. The
FortiGate unit sends a random six-digit code to the mobile device by email or SMS that the user enters during the logon process along with user name and password.
Syntax
To import the FortiToken Mobile card serial number
execute fortitoken-mobile import <activation_code>
To poll a FortiToken Mobile token state
execute fortitoken-mobile poll
To provision a FortiToken Mobile token
execute fortitoken-mobile provision <token_serial_number>
Fortinet Technologies Inc.
Page 936 FortiOS™ - CLI Reference for FortiOS 5.0
execute fsso refresh
fsso refresh
Use this command to manually refresh user group information from Directory Service servers connected to the FortiGate unit using the Fortinet Single Sign On (FSSO) agent.
Syntax
execute fsso refresh
Fortinet Technologies Inc.
Page 937 FortiOS™ - CLI Reference for FortiOS 5.0
execute ha disconnect
ha disconnect
Use this command to disconnect a FortiGate unit from a functioning cluster. You must specify the serial number of the unit to be disconnected. You must also specify an interface name and assign an IP address and netmask to this interface of the disconnected unit. You can disconnect any unit from the cluster even the primary unit. After the unit is disconnected the cluster responds as if the disconnected unit has failed. The cluster may renegotiate and may select a new primary unit.
To disconnect the unit from the cluster, the execute ha disconnect command sets the HA mode of the disconnected unit to standalone. In addition, all interface IP addresses of the disconnected unit are set to 0.0.0.0. The interface specified in the command is set to the IP address and netmask that you specify in the command. In addition all management access to this interface is enabled. Once the FortiGate unit is disconnected you can use SSH, telnet,
HTTPS, or HTTP to connect to and manage the FortiGate unit.
Syntax
execute ha disconnect <
cluster-member-serial_str > < interface_str >
<address_ipv4> <address_ipv4mask>
Variable Description
cluster-member-serial_str The serial number of the cluster unit to be disconnected.
interface_str
The name of the interface to configure. The command configures the
IP address and netmask for this interface and also enables all management access for this interface.
Example
This example shows how to disconnect a cluster unit with serial number FGT5002803033050.
The internal interface of the disconnected unit is set to IP address 1.1.1.1 and netmask
255.255.255.0.
execute ha disconnect FGT5002803033050 internal 1.1.1.1 255.255.255.0
Fortinet Technologies Inc.
Page 938 FortiOS™ - CLI Reference for FortiOS 5.0
execute ha ignore-hardware-revision
ha ignore-hardware-revision
Use this command to set ignore-hardware-revision status.
Syntax
To view ignore-hardware-revision status
execute ha ignore-hardware-revision status
To set ignore-hardware-revision status
execute ha ignore-hardware-revision {enable | disable}
Fortinet Technologies Inc.
Page 939 FortiOS™ - CLI Reference for FortiOS 5.0
execute
ha manage
ha manage
Use this command from the CLI of a FortiGate unit in an HA cluster to log into the CLI of another unit in the cluster. Usually you would use this command from the CLI of the primary unit to log into the CLI of a subordinate unit. However, if you have logged into a subordinate unit CLI, you can use this command to log into the primary unit CLI, or the CLI of another subordinate unit.
You can use CLI commands to manage the cluster unit that you have logged into. If you make changes to the configuration of any cluster unit (primary or subordinate unit) these changes are synchronized to all cluster units.
Syntax
execute ha manage <
Variable
cluster-index
Description
The cluster index is assigned by the FortiGate Clustering Protocol according to cluster unit serial number. The cluster unit with the highest serial number has a cluster index of 0. The cluster unit with the second highest serial number has a cluster index of 1 and so on.
Enter
? to list the cluster indexes of the cluster units that you can log into.
The list does not show the unit that you are already logged into.
Example
This example shows how to log into a subordinate unit in a cluster of three FortiGate units. In this example you have already logged into the primary unit. The primary unit has serial number
FGT3082103000056. The subordinate units have serial numbers FGT3012803021709 and
FGT3082103021989.
execute ha manage ?
<id> please input slave cluster index.
<0> Subsidary unit FGT3012803021709
<1> Subsidary unit FGT3082103021989
Type 0 and press enter to connect to the subordinate unit with serial number
FGT3012803021709. The CLI prompt changes to the host name of this unit. To return to the primary unit, type exit.
From the subordinate unit you can also use the execute ha manage command to log into the primary unit or into another subordinate unit. Enter the following command: execute ha manage ?
<id> please input slave cluster index.
<1> Subsidary unit FGT3082103021989
<2> Subsidary unit FGT3082103000056
Type 2 and press enter to log into the primary unit or type 1 and press enter to log into the other subordinate unit. The CLI prompt changes to the host name of this unit.
Fortinet Technologies Inc.
Page 940 FortiOS™ - CLI Reference for FortiOS 5.0
execute ha synchronize
ha synchronize
Use this command from a subordinate unit in an HA cluster to manually synchronize its configuration with the primary unit or to stop a synchronization process that is in progress.
Syntax
execute ha synchronize {start | stop}
Variable
start stop
Description
Start synchronizing the cluster configuration.
Stop the cluster from completing synchronizing its configuration.
Fortinet Technologies Inc.
Page 941 FortiOS™ - CLI Reference for FortiOS 5.0
execute interface dhcpclient-renew
interface dhcpclient-renew
Renew the DHCP client for the specified DHCP interface and close the CLI session. If there is no DHCP connection on the specified port, there is no output.
Syntax
execute interface dhcpclient-renew <port>
Example
This is the output for renewing the DHCP client on port1 before the session closes:
# execute interface dhcpclient-renew port1 renewing dhcp lease on port1
Fortinet Technologies Inc.
Page 942 FortiOS™ - CLI Reference for FortiOS 5.0
execute interface pppoe-reconnect
interface pppoe-reconnect
Reconnect to the PPPoE service on the specified PPPoE interface and close the CLI session. If there is no PPPoE connection on the specified port, there is no output.
Syntax
execute interface pppoe-reconnect <port>
Fortinet Technologies Inc.
Page 943 FortiOS™ - CLI Reference for FortiOS 5.0
execute log client-reputation-report
log client-reputation-report
Use these commands to control client-reputation log actions.
Syntax
To accept a host so that it has its own baselines
execute log client-reputation-report accept <policy-id> <host>
To clear all auto-profile data
execute log client-reputation-report clear
To ignore a host, removing it from the abnormal list
execute log client-reputation-report ignore <policy-id> <host>
To refresh the data of one option result
execute log client-reputation-report refresh <policy-id> <option>
<action>
•
<option> is one of bandwidth, session, failconn, geo, or app
•
<action> is one of data, baseline, or data_baseline (both data and baseline)
To get baseline/average information of one option
execute log client-reputation-report result baseline <policy-id>
<option>
•
<option> is one of bandwidth, session, or failconn
To get hourly data of a host visiting a country or using an application
execute log client-reputation-report result details {hourly | total}
<policy-id> <option> <name> <host>
•
<option> is geo or app
•
<name> is the name of the country or application
To list abnormal hosts of one or all options
execute log client-reputation-report result list <policy-id> <option>
•
<option> is geo, app, or all
To list periodical data of one host of one option
execute log client-reputation-report result period <policy-id>
<option> <host> <periods>
•
<option> is one of bandwidth, session, failconn, geo, or app
•
<periods> is number of periods to list
To list the top 10 abnormal hosts of one option
execute log client-reputation-report result top10 <policy-id>
<option>
•
<option> is one of bandwidth, session, failconn, geo, or app
To run reports immediately
execute log client-reputation-report run <policy-id>
Fortinet Technologies Inc.
Page 944 FortiOS™ - CLI Reference for FortiOS 5.0
execute log convert-oldlogs
log convert-oldlogs
Use this command to convert old compact logs to the new format. This command is available only if you have upgraded from an earlier version of FortiOS and have old compact logs on your system.
Syntax
execute log convert-oldlogs
Fortinet Technologies Inc.
Page 945 FortiOS™ - CLI Reference for FortiOS 5.0
execute log delete-all
log delete-all
Use this command to clear all log entries in memory and current log files on hard disk. If your
FortiGate unit has no hard disk, only log entries in system memory will be cleared. You will be prompted to confirm the command.
Syntax
execute log delete-all
Fortinet Technologies Inc.
Page 946 FortiOS™ - CLI Reference for FortiOS 5.0
execute log delete-oldlogs
log delete-oldlogs
Use this command to delete old compact logs. This command is available only if you have upgraded from an earlier version of FortiOS and have old compact logs on your system.
Syntax
execute log delete-oldlogs
Fortinet Technologies Inc.
Page 947 FortiOS™ - CLI Reference for FortiOS 5.0
execute
log display
log display
Use this command to display log messages that you have selected with the execute log filter command.
Syntax
execute log display
The console displays the first 10 log messages. To view more messages, run the command again. You can do this until you have seen all of the selected log messages. To restart viewing the list from the beginning, use the commands execute log filter start-line 1 execute log display
You can restore the log filters to their default values using the command execute log filter reset
Fortinet Technologies Inc.
Page 948 FortiOS™ - CLI Reference for FortiOS 5.0
execute
log filter
log filter
Use this command to select log messages for viewing or deletion. You can view one log category on one device at a time. Optionally, you can filter the messages to select only specified date ranges or severities of log messages. For traffic logs, you can filter log messages by source or destination IP address.
Commands are cumulative. If you omit a required variable, the command displays the current setting.
Use as many execute log filter commands as you need to define the log messages that you want to view.
execute log filter
execute log filter
execute log filter
execute log filter
execute log filter
execute log filter
execute log filter
execute log filter
execute log filter
Variable
category <category_name> device {disk | memory} dump field <name> ha-member <unitsn_str> reset [all | field] rolled_number <number> start-line <line_number> view-lines <count>
Description
Enter the type of log you want to select. To see a list of available categories, enter
Default
event execute log filter category
Device where the logs are stored.
Display current filter settings.
disk
No default.
Press Enter to view the fields that are available for the associated category. Enter the fields you want, using commas to separate multiple fields.
No default.
Select logs from the specified HA cluster member.
Enter the serial number of the unit.
Execute this command to reset all filter settings.
You can use field option to reset only filter field settings.
Select logs from rolled log file. 0 selects current log file.
No default.
0
Select logs starting at specified line number.
Set lines per view. Range: 5 to 1000
1
10
Fortinet Technologies Inc.
Page 949 FortiOS™ - CLI Reference for FortiOS 5.0
execute log fortianalyzer test-connectivity
log fortianalyzer test-connectivity
Use this command to test the connection to the FortiAnalyzer unit. This command is available only when FortiAnalyzer is configured.
Syntax
execute log fortianalyzer test-connectivity
Example
When FortiAnalyzer is connected, the output looks like this:
FortiAnalyzer Host Name: FortiAnalyzer-800B
FortiGate Device ID: FG50B3G06500085
Registration: registered
Connection: allow
Disk Space (Used/Allocated): 468/1003 MB
Total Free Space: 467088 MB
Log: Tx & Rx
Report: Tx & Rx
Content Archive: Tx & Rx
Quarantine: Tx & Rx
When FortiAnalyzer is not connected, the output is:
Connect Error
Fortinet Technologies Inc.
Page 950 FortiOS™ - CLI Reference for FortiOS 5.0
execute
log list
log list
You can view the list of current and rolled log files on the console. The list shows the file name, size and timestamp.
Syntax
execute log list <category>
To see a list of available categories, enter execute log list
Example
The output looks like this: elog 8704 Fri March 6 14:24:35 2009 elog.1 1536 Thu March 5 18:02:51 2009 elog.2 35840 Wed March 4 22:22:47 2009
At the end of the list, the total number of files in the category is displayed. For example:
501 event log file(s) found.
Fortinet Technologies Inc.
Page 951 FortiOS™ - CLI Reference for FortiOS 5.0
execute log rebuild-sqldb
log rebuild-sqldb
Use this command to rebuild the SQL database from log files.
If run in the VDOM context, only this VDOM’s SQL database is rebuilt. If run in the global context, the SQL database is rebuilt for all VDOMs.
If SQL logging is disabled, this command is unavailable.
Syntax
execute log rebuild-sqldb
Fortinet Technologies Inc.
Page 952 FortiOS™ - CLI Reference for FortiOS 5.0
execute
log recreate-sqldb
Use this command to recreate SQL log database.
If SQL logging is disabled, this command is unavailable.
Syntax
execute log recreate-sqldb
log recreate-sqldb
Fortinet Technologies Inc.
Page 953 FortiOS™ - CLI Reference for FortiOS 5.0
execute
log-report reset
Use this command to delete all logs, archives and user configured report templates.
Syntax
execute log-report reset
log-report reset
Fortinet Technologies Inc.
Page 954 FortiOS™ - CLI Reference for FortiOS 5.0
execute
log roll
Use this command to roll all log files.
Syntax
execute log roll
log roll
Fortinet Technologies Inc.
Page 955 FortiOS™ - CLI Reference for FortiOS 5.0
execute
log upload-progress
Use this command to display the progress of the latest log upload.
Syntax
execute log upload-progress
log upload-progress
Fortinet Technologies Inc.
Page 956 FortiOS™ - CLI Reference for FortiOS 5.0
execute modem dial
modem dial
Dial the modem.
The dial command dials the accounts configured in config system modem until it makes a connection or it has made the maximum configured number of redial attempts.
This command can be used if the modem is in Standalone mode.
Syntax
execute modem dial
Fortinet Technologies Inc.
Page 957 FortiOS™ - CLI Reference for FortiOS 5.0
execute
modem hangup
Hang up the modem.
This command can be used if the modem is in Standalone mode.
Syntax
execute modem hangup
modem hangup
Fortinet Technologies Inc.
Page 958 FortiOS™ - CLI Reference for FortiOS 5.0
execute modem trigger
modem trigger
This command sends a signal to the modem daemon, which causes the state machine to reevaluate its current state. If for some reason the modem should be connected but isn't, then it will trigger a redial. If the modem should not be connected but is, this command will cause the modem to disconnect.
Syntax
execute modem trigger
Fortinet Technologies Inc.
Page 959 FortiOS™ - CLI Reference for FortiOS 5.0
execute mrouter clear
mrouter clear
Clear multicast routes, RP-sets, IGMP membership records or routing statistics.
Syntax
Clear IGMP memberships: execute mrouter clear igmp-group {{
<group-address> } <interfacename>
} execute mrouter clear igmp-interface
Clear multicast routes: execute mrouter clear
<route-type> { <group-address>
}}
Clear PIM-SM RP-sets learned from the bootstrap router (BSR): execute mrouter clear sparse-mode-bsr
Clear statistics: execute mrouter clear statistics {
}}
Variable Description
<interface-name>
Enter the name of the interface on which you want to clear IGMP memberships.
<group-address>
Optionally enter a group address to limit the command to a particular group.
<route-type>
Enter one of:
• dense-routes - clear only PIM dense routes
• multicast-routes - clear all types of multicast routes
• sparse-routes - clear only sparse routes
<source-address>
Optionally, enter a source address to limit the command to a particular source address. You must also specify group-address.
Fortinet Technologies Inc.
Page 960 FortiOS™ - CLI Reference for FortiOS 5.0
execute
netscan
Use this command to start and stop the network vulnerability scanner and perform related functions.
Syntax
execute netscan import execute netscan list execute netscan start scan execute netscan status execute netscan stop
Variable
import list start scan status stop
Description
Import hosts discovered on the last asset discovery scan.
List the hosts discovered on the last asset discover scan.
Start configured vulnerability scan.
Display the status of the current network vulnerability scan.
Stop the current network vulnerability scan.
netscan
Fortinet Technologies Inc.
Page 961 FortiOS™ - CLI Reference for FortiOS 5.0
execute
pbx
pbx
Use this command to view active channels and to delete, list or upload music files for when music is playing while a caller is on hold.
Syntax
execute pbx
execute pbx
execute pbx
execute pbx
music-on-hold {delete | list | upload}
execute pbx
prompt upload ftp <file.tgz> <ftp_server_address>[:port]
execute pbx
prompt upload tftp <file.tgz> <ftp_server_address>[:port]
execute pbx
prompt upload usb <file.tgz> <ftp_server_address>[:port]
execute pbx
execute pbx
Variables
active-call <list> extension <list> ftgd-voice-pkg {sip-trunk} music-on-hold {delete | list
| upload} prompt upload ftp <file.tgz>
<ftp_server_address>[:port]
[<username>] [password>] prompt upload tftp <file.tgz>
<ftp_server_address>[:port]
[<username>] [password>] prompt upload usb <file.tgz>
<ftp_server_address>[:port]
[<username>] [password>] restore-default-prompts sip-trunk list
Description
Enter to display a list of the active calls being processed by the
FortiGate Voice unit.
Enter to display the status of all extensions with SIP phones that have connected to the FortiGate Voice unit.
Enter to retrieve FortiGuard voice package sip trunk information.
Enter to either delete, list or upload music on hold files. You can upload music on hold files using FTP, TFTP, or from a USB drive plugged into the FortiGate Voice unit.
Upload new pbx voice prompt files using FTP. The voice prompt files should be added to a tar file and zipped. This file would usually have the extension tgz. You must include the filename,
FTP server address (domain name of IPv4 address) and if required the username and password for the server.
Upload new pbx voice prompt files using TFTP. The voice prompt files should be added to a tar file and zipped. This file would usually have the extension tgz. You must include the filename and
TFTP server IP address.
Upload new pbx voice prompt files from a USB drive plugged into the FortiGate Voice unit. The voice prompt files should be added to a tar file and zipped. This file would usually have the extension tgz. You must include the filename.
Restore default English voicemail and other PBX system prompts.
Use this command if you have changed the default prompts and want to restore the default settings.
Enter to display the status of all SIP trunks that have been added to the FortiGate Voice configuration.
Fortinet Technologies Inc.
Page 962 FortiOS™ - CLI Reference for FortiOS 5.0
execute pbx
Example command output
Enter the following command to view active calls: execute pbx active-call
Call-From Call-To Durationed
6016 6006 00:00:46
Enter the following command to display the status of all extensions execute pbx extension list
Extension Host Dialplan
6052 Unregister company-default
6051 Unregister company-default
6050 Unregister company-default
6022 Unregister company-default
6021/6021 172.30.63.34 company-default
6020 Unregister company-default
Enter the following command to display the status of all SIP trunks execute pbx sip-trunk list
Name Host Username Account-Type State
Provider_1 192.169.20.1 +5555555 Static N/A
Fortinet Technologies Inc.
Page 963 FortiOS™ - CLI Reference for FortiOS 5.0
execute
ping
Send an ICMP echo request (ping) to test the network connection between the FortiGate unit and another network device.
Syntax
execute ping {<address_ipv4> | <host-name_str>}
<host-name_str> should be an IP address, or a fully qualified domain name.
Example
This example shows how to ping a host with the IP address 172.20.120.16.
#execute ping 172.20.120.16
PING 172.20.120.16 (172.20.120.16): 56 data bytes
64 bytes from 172.20.120.16: icmp_seq=0 ttl=128 time=0.5 ms
64 bytes from 172.20.120.16: icmp_seq=1 ttl=128 time=0.2 ms
64 bytes from 172.20.120.16: icmp_seq=2 ttl=128 time=0.2 ms
64 bytes from 172.20.120.16: icmp_seq=3 ttl=128 time=0.2 ms
64 bytes from 172.20.120.16: icmp_seq=4 ttl=128 time=0.2 ms
--- 172.20.120.16 ping statistics ---
5 packets transmitted, 5 packets received, 0% packet loss round-trip min/avg/max = 0.2/0.2/0.5 ms
ping
Fortinet Technologies Inc.
Page 964 FortiOS™ - CLI Reference for FortiOS 5.0
execute ping-options, ping6-options
ping-options, ping6-options
Set ICMP echo request (ping) options to control the way ping tests the network connection between the FortiGate unit and another network device.
Syntax
execute ping-options
execute ping-options
execute ping-options
execute ping-options
execute ping-options
source {auto | <source-intf_ip>}
execute ping-options
execute ping-options
execute ping-options
execute ping-options
execute ping-options
Variable
data-size <bytes>
Description
Specify the datagram size in bytes.
df-bit {yes | no}
Set df-bit to yes to prevent the ICMP packet from being fragmented. Set df-bit to no to allow the ICMP packet to be fragmented.
pattern <2-byte_hex>
Used to fill in the optional data buffer at the end of the
ICMP packet. The size of the buffer is specified using the data_size parameter. This allows you to send out packets of different sizes for testing the effect of packet size on the connection.
Default
56 no
No default.
repeat-count <repeats>
Specify how many times to repeat ping.
source
{auto | <sourceintf_ip>}
Specify the FortiGate interface from which to send the ping. If you specify auto, the FortiGate unit selects the source address and interface based on the route to the
<host-name_str> or <host_ip>. Specifying the IP address of a FortiGate interface tests connections to different network segments from the specified interface.
timeout <seconds> tos <service_type>
Specify, in seconds, how long to wait until ping times out.
2
Set the ToS (Type of Service) field in the packet header to provide an indication of the quality of service wanted.
0
5 auto
• lowdelay = minimize delay
• throughput = maximize throughput
• reliability = maximize reliability
• lowcost = minimize cost ttl <hops>
Specify the time to live. Time to live is the number of hops the ping packet should be allowed to make before being discarded or returned.
validate-reply {yes | no} Select yes to validate reply data.
view-settings
Display the current ping-option settings.
64 no
No default.
Fortinet Technologies Inc.
Page 965 FortiOS™ - CLI Reference for FortiOS 5.0
execute ping-options, ping6-options
Example
Use the following command to increase the number of pings sent.
execute ping-options repeat-count 10
Use the following command to send all pings from the FortiGate interface with IP address
192.168.10.23.
execute ping-options source 192.168.10.23
Fortinet Technologies Inc.
Page 966 FortiOS™ - CLI Reference for FortiOS 5.0
execute
ping6
ping6
Send an ICMP echo request (ping) to test the network connection between the FortiGate unit and an IPv6 capable network device.
Syntax
execute ping6 {<address_ipv6> | <host-name_str>}
Example
This example shows how to ping a host with the IPv6 address
12AB:0:0:CD30:123:4567:
89AB:CDEF.
execute ping6 12AB:0:0:CD30:123:4567:89AB:CDEF
Fortinet Technologies Inc.
Page 967 FortiOS™ - CLI Reference for FortiOS 5.0
execute
policy-packet-capture delete-all
Use this command to delete captured packets.
Syntax
execute policy-packet-capture delete-all
You will be asked to confirm that you want delete the packets.
policy-packet-capture delete-all
Fortinet Technologies Inc.
Page 968 FortiOS™ - CLI Reference for FortiOS 5.0
execute
reboot
reboot
Restart the FortiGate unit.
Abruptly powering off your FortiGate unit may corrupt its configuration. Using the reboot and shutdown options here or in the web-based manager ensure proper shutdown procedures are followed to prevent any loss of configuration.
Syntax
execute reboot <comment “comment_string”>
<comment “comment_string”> allows you to optionally add a message that will appear in the hard disk log indicating the reason for the reboot. If the message is more than one word it must be enclosed in quotes.
Example
This example shows the reboot command with a message included.
execute reboot comment “December monthly maintenance”
Fortinet Technologies Inc.
Page 969 FortiOS™ - CLI Reference for FortiOS 5.0
execute
report
Use these commands to manage reports.
Syntax
To flash report caches:
execute report flash-cache
To recreate the report database:
execute report recreate-db
To generate a report:
execute report run [<layout_name>["start-time" "end-time"]]
The start and end times have the format yyyy-mm-dd hh:mm:ss
report
Fortinet Technologies Inc.
Page 970 FortiOS™ - CLI Reference for FortiOS 5.0
execute report-config reset
report-config reset
Use this command to reset report templates to the factory default. Logs are not deleted.
If SQL logging is disabled, this command is unavailable.
Syntax
execute report-config reset
Fortinet Technologies Inc.
Page 971 FortiOS™ - CLI Reference for FortiOS 5.0
execute
restore
restore
Use this command to
• restore the configuration from a file
• change the FortiGate firmware
• change the FortiGate backup firmware
• restore an IPS custom signature file
When virtual domain configuration is enabled (in system global
, vdom-admin is enabled), the content of the backup file depends on the administrator account that created it.
• A backup of the system configuration from the super admin account contains the global settings and the settings for all of the VDOMs. Only the super admin account can restore the configuration from this file.
• A backup file from a regular administrator account contains the global settings and the settings for the VDOM to which the administrator belongs. Only a regular administrator account can restore the configuration from this file.
Syntax
execute restore
ase ftp <filename_str> <server_ipv4[:port_int]
| server_fqdn[:port_int]> [<username_str> <password_str>]
execute restore
ase tftp <filename_str> <server_ipv4[:port_int]>
execute restore
av ftp <filename_str> <server_ipv4[:port_int]
| server_fqdn[:port_int]> [<username_str> <password_str>]
execute restore
av tftp <filename_str> <server_ipv4[:port_int]>
execute restore
execute restore
config ftp <filename_str> <server_ipv4[:port_int]
| server_fqdn[:port_int]> [<username_str> <password_str>]
execute restore
config management-station {normal | template
execute restore
config tftp <filename_str> <server_ipv4>
execute restore
config usb <filename_str> [<backup_password_str>]
execute restore
config usb-mode [<backup_password_str>]
execute restore
forticlient tftp <filename_str> <server_ipv4>
execute restore
execute restore
image ftp <filename_str> <server_ipv4[:port_int]
| server_fqdn[:port_int]> [<username_str> <password_str>]
execute restore
image management-station <version_int>
execute restore
image tftp <filename_str> <server_ipv4>
execute restore
execute restore
ips ftp <filename_str> <server_ipv4[:port_int]
| server_fqdn[:port_int]> [<username_str> <password_str>]
execute restore
ips tftp <filename_str> <server_ipv4>
execute restore
ipsuserdefsig ftp <filename_str> <server_ipv4[: port_int] | server_fqdn[:port_int]> [<username_str>
execute restore
ipsuserdefsig tftp <filename_str> <server_ipv4>
Fortinet Technologies Inc.
Page 972 FortiOS™ - CLI Reference for FortiOS 5.0
execute restore
execute restore
execute restore
secondary-image tftp <filename_str> <server_ipv4>
execute restore
secondary-image usb <filename_str>
execute restore
execute restore
vcm {ftp | tftp} <filename_str> <server_ipv4>
execute restore
vmlicense {ftp | tftp} <filename_str> <server_ipv4>
Variable
ase ftp <filename_str>
<server_ipv4[:port_int]
| server_fqdn[:port_int]>
[<username_str>
<password_str>] ase tftp <filename_str>
<server_ipv4[:port_int]> av ftp <filename_str>
<server_ipv4[:port_int]
| server_fqdn[:port_int]>
[<username_str>
<password_str>] av tftp <filename_str>
<server_ipv4[:port_int]> config flash <revision>
Description
Restore the antispam engine. Download the restore file from an
FTP server. The user and password to access the FTP server are only necessary if the server requires them
Restore the antispam engine. Download the restore file from a
TFTP server.
Download the antivirus database file from an FTP server to the
FortiGate unit. config ftp <filename_str>
<server_ipv4[:port_int]
| server_fqdn[:port_int]>
[<username_str>
<password_str>]
[<backup_password_str>] config management-station
{normal | template | script}
<rev_int>
Download the antivirus database file from a TFTP server to the
FortiGate unit.
Restore the specified revision of the system configuration from the flash disk.
Restore the system configuration from an FTP server. The new configuration replaces the existing configuration, including administrator accounts and passwords.
If the backup file was created with a password, you must specify the password.
config tftp <filename_str>
<server_ipv4>
[<backup_password_str>] config usb <filename_str>
[<backup_password_str>]
Restore the system configuration from the central management server. The new configuration replaces the existing configuration, including administrator accounts and passwords.
rev_int is the revision number of the saved configuration to restore. Enter
0 for the most recent revision.
Restore the system configuration from a file on a TFTP server. The new configuration replaces the existing configuration, including administrator accounts and passwords.
If the backup file was created with a password, you must specify the password.
Restore the system configuration from a file on a USB disk. The new configuration replaces the existing configuration, including administrator accounts and passwords.
If the backup file was created with a password, you must specify the password.
Fortinet Technologies Inc.
Page 973 FortiOS™ - CLI Reference for FortiOS 5.0
execute restore
Variable
config usb-mode
[<backup_password_str>]
Description
Restore the system configuration from a USB disk. The new configuration replaces the existing configuration, including administrator accounts and passwords. When the USB drive is removed, the FortiGate unit needs to reboot and revert to the unit’s existing configuration.
forticlient tftp
<filename_str>
<server_ipv4> image flash <revision> image ftp <filename_str>
<server_ipv4[:port_int]
| server_fqdn[:port_int]>
[<username_str>
<password_str>] image management-station
<version_int>
If the backup file was created with a password, you must specify the password.
Download the FortiClient image from a TFTP server to the
FortiGate unit. The filename must have the format:
FortiClientSetup_versionmajor.versionminor.build.exe.
For example, FortiClientSetup.4.0.377.exe.
Restore specified firmware image from flash disk.
Download a firmware image from an FTP server to the FortiGate unit. The FortiGate unit reboots, loading the new firmware.
This command is not available in multiple VDOM mode.
Download a firmware image from the central management station.
This is available if you have configured a FortiManager unit as a central management server. This is also available if your account with FortiGuard Analysis and Management Service allows you to upload firmware images.
Download a firmware image from a TFTP server to the FortiGate unit. The FortiGate unit reboots, loading the new firmware.
image tftp <filename_str>
<server_ipv4>
This command is not available in multiple VDOM mode.
image usb <filename_str>
Download a firmware image from a USB disk to the FortiGate unit.
The FortiGate unit reboots, loading the new firmware.
ips ftp <filename_str>
<server_ipv4[:port_int]
| server_fqdn[:port_int]>
[<username_str>
<password_str>] ips tftp <filename_str>
<server_ipv4> ipsuserdefsig ftp
<filename_str>
<server_ipv4[:port_int]
| server_fqdn[:port_int]>
[<username_str>
<password_str>] ipsuserdefsig tftp
<filename_str>
<server_ipv4> secondary-image ftp
<filename_str>
<server_ipv4[:port_int]
| server_fqdn[:port_int]>
[<username_str>
<password_str>]
Download the IPS database file from an FTP server to the
FortiGate unit.
Download the IPS database file from a TFTP server to the
FortiGate unit.
Restore IPS custom signature file from an FTP server. The file will overwrite the existing IPS custom signature file.
Restore an IPS custom signature file from a TFTP server. The file will overwrite the existing IPS custom signature file.
Download a firmware image from an FTP server as the backup firmware of the FortiGate unit. Available on models that support backup firmware images.
Fortinet Technologies Inc.
Page 974 FortiOS™ - CLI Reference for FortiOS 5.0
execute restore
Variable
secondary-image tftp
<filename_str>
<server_ipv4> secondary-image usb
<filename_str>
Description
Download a firmware image from a TFTP server as the backup firmware of the FortiGate unit. Available on models that support backup firmware images.
Download a firmware image from a USB disk as the backup firmware of the FortiGate unit. The unit restarts when the upload is complete. Available on models that support backup firmware images.
Download source visibility signature package.
Restore VCM engine/plugin from an ftp or tftp server.
src-vis <src-vis-pkgfile> vcm {ftp | tftp}
<filename_str>
<server_ipv4> vmlicense {ftp | tftp}
<filename_str>
<server_ipv4>
Restore VM license (VM version of product only).
Example
This example shows how to upload a configuration file from a TFTP server to the FortiGate unit and restart the FortiGate unit with this configuration. The name of the configuration file on the
TFTP server is backupconfig. The IP address of the TFTP server is 192.168.1.23.
execute restore config tftp backupconfig 192.168.1.23
Fortinet Technologies Inc.
Page 975 FortiOS™ - CLI Reference for FortiOS 5.0
execute
revision
Use these commands to manage configuration and firmware image files on the local disk.
Syntax
To delete a configuration file
execute revision delete config <revision>
To delete a firmware image file
execute revision delete image <revision>
To list the configuration files
execute revision list config
To delete a firmware image file
execute revision list image
revision
Fortinet Technologies Inc.
Page 976 FortiOS™ - CLI Reference for FortiOS 5.0
execute router clear bfd session
router clear bfd session
Use this command to clear bi-directional forwarding session.
Syntax
execute router clear bfd session
Variable
<src_ip>
<dst_ip>
<interface>
Description
Select the source IP address of the session.
Select the destination IP address of the session.
Select the interface for the session.
Fortinet Technologies Inc.
Page 977 FortiOS™ - CLI Reference for FortiOS 5.0
execute router clear bgp
router clear bgp
Use this command to clear BGP peer connections.
Syntax
execute router clear bgp
execute router clear bgp
as <as_number> [ soft ] [in | out]
execute router clear bgp
dampening {ip_address | ip/netmask}
execute router clear bgp
external {in prefix-filter} [ soft ] [in | out]
execute router clear bgp
flap-statistics {ip_address | ip/netmask}
execute router clear bgp
ip <ip_address> [ soft ] [in | out]
Variable
all
Description
Clear all BGP peer connections.
as <as_number>
Clear BGP peer connections by AS number.
dampening {ip_address | ip/netmask}
Clear route flap dampening information for peer or network.
external {in prefix-filter} ip <ip_address> peer-group
[in | out]
Clear all external peers.
Clear BGP peer connections by IP address.
Clear all members of a BGP peer-group.
Optionally limit clear operation to inbound only or outbound only.
flap-statistics {ip_address | ip/netmask} Clear flap statistics for peer or network.
soft
Do a soft reset that changes the configuration but does not disturb existing sessions.
Fortinet Technologies Inc.
Page 978 FortiOS™ - CLI Reference for FortiOS 5.0
execute
router clear ospf process
Use this command to clear and restart the OSPF router.
Syntax
IPv4: execute router clear ospf process
IPv6: execute router clear ospf6 process
router clear ospf process
Fortinet Technologies Inc.
Page 979 FortiOS™ - CLI Reference for FortiOS 5.0
execute
router restart
Use this command to restart the routing software.
Syntax
execute router restart
router restart
Fortinet Technologies Inc.
Page 980 FortiOS™ - CLI Reference for FortiOS 5.0
execute send-fds-statistics
send-fds-statistics
Use this command to send an FDS statistics report now, without waiting for the FDS statistics report interval to expire.
Syntax
execute send-fds-statistics
Fortinet Technologies Inc.
Page 981 FortiOS™ - CLI Reference for FortiOS 5.0
execute set system session filter
set system session filter
Use these commands to define the session filter for get system session commands.
Syntax
To clear the filter settings
execute set system session filter clear
{all|dport|dst|duration|expire|policy|proto|sport|src|vd}
To specify destination port
execute set system session filter dport <port_range>
To specify destination IP address
execute set system session filter dst <ip_range>
To specify duration
execute set system session filter duration <duration_range>
To specify expiry
execute set system session filter expire <expire_range>
To list the filter settings
execute set system session filter list
To invert a filter setting
execute set system session filter negate
{dport|dst|duration|expire|policy|proto|sport|src|vd}
To specify firewall policy ID
execute set system session filter policy <policy_range>
To specify protocol
execute set system session filter proto <protocol_range>
To specify source port
execute set system session filter sport <port_range>
To specify source IP address
execute set system session filter src <ip_range>
To specify virtual domain
execute set system session filter vd <vdom_index>
Variable
<duration_range>
<expire_range>
<ip_range>
<policy_range>
<port_range>
Description
The start and end times, separated by a space.
The start and end times, separated by a space.
The start and end IP addresses, separated by a space.
The start and end policy numbers, separated by a space.
The start and end port numbers, separated by a space.
Fortinet Technologies Inc.
Page 982 FortiOS™ - CLI Reference for FortiOS 5.0
execute
Variable
<protocol_range>
<vdom_index>
set system session filter
Description
The start and end protocol numbers, separated by a space.
The VDOM index number.
-1 means all VDOMs.
Fortinet Technologies Inc.
Page 983 FortiOS™ - CLI Reference for FortiOS 5.0
execute set-next-reboot
set-next-reboot
Use this command to start the FortiGate unit with primary or secondary firmware after the next reboot. Available on models that can store two firmware images. By default, the FortiGate unit loads the firmware from the primary partition.
VDOM administrators do not have permission to run this command. It must be executed by a super administrator.
Syntax
execute set-next-reboot {primary | secondary}
Fortinet Technologies Inc.
Page 984 FortiOS™ - CLI Reference for FortiOS 5.0
execute sfp-mode-sgmii
sfp-mode-sgmii
Change the SFP mode for an NP2 card to SGMII. By default when an AMC card is inserted the
SFP mode is set to SERDES mode by default.
If a configured NP2 card is removed and re-inserted, the SFP mode goes back to the default.
In these situations, the sfpmode-sgmii command will change the SFP mode from SERDES to
SGMII for the interface specified.
Syntax
execute sfpmode-sgmii <interface>
<interface> is the NP2 interface where you are changing the SFP mode.
Fortinet Technologies Inc.
Page 985 FortiOS™ - CLI Reference for FortiOS 5.0
execute
shutdown
shutdown
Shut down the FortiGate unit now. You will be prompted to confirm this command.
Abruptly powering off your FortiGate unit may corrupt its configuration. Using the reboot and shutdown options here or in the web-based manager ensure proper shutdown procedures are followed to prevent any loss of configuration.
Syntax
execute shutdown [comment <comment_string>] comment is optional but you can use it to add a message that will appear in the event log message that records the shutdown. The comment message of the does not appear on the
Alert Message console. If the message is more than one word it must be enclosed in quotes.
Example
This example shows the reboot command with a message included.
execute shutdown comment “emergency facility shutdown”
An event log message similar to the following is recorded:
2009-09-08 11:12:31 critical admin 41986 ssh(172.20.120.11) shutdown
User admin shutdown the device from ssh(172.20.120.11). The reason is 'emergency facility shutdown'
Fortinet Technologies Inc.
Page 986 FortiOS™ - CLI Reference for FortiOS 5.0
execute
ssh
Use this command to establish an ssh session with another system.
Syntax
execute ssh <destination> [<port>]
<destination> - the destination in the form user@ip or user@host.
[<port>] - optional TCP port number
Example
execute ssh [email protected]
To end an ssh session, type exit:
FGT-6028030112 # exit
Connection to 172.20.120.122 closed.
FGT-8002805000 #
ssh
Fortinet Technologies Inc.
Page 987 FortiOS™ - CLI Reference for FortiOS 5.0
execute
sync-session
Use this command to force a session synchronization.
Syntax
execute sync-session
sync-session
Fortinet Technologies Inc.
Page 988 FortiOS™ - CLI Reference for FortiOS 5.0
execute
tac report
tac report
Use this command to create a debug report to send to Fortinet Support. Normally you would only use this command if requested to by Fortinet Support.
Syntax
execute tac report
Fortinet Technologies Inc.
Page 989 FortiOS™ - CLI Reference for FortiOS 5.0
execute
telnet
Use telnet client. You can use this tool to test network connectivity.
Syntax
execute telnet <telnet_ipv4>
<telnet_ipv4> is the address to connect with.
Type exit to close the telnet session.
telnet
Fortinet Technologies Inc.
Page 990 FortiOS™ - CLI Reference for FortiOS 5.0
execute
time
time
Get or set the system time.
Syntax
execute time [<time_str>] time_str has the form hh:mm:ss, where
• hh is the hour and can be 00 to 23
• mm is the minutes and can be 00 to 59
• ss is the seconds and can be 00 to 59
If you do not specify a time, the command returns the current system time.
You are allowed to shorten numbers to only one digit when setting the time. For example both
01:01:01 and 1:1:1 are allowed.
Example
This example sets the system time to 15:31:03: execute time 15:31:03
Fortinet Technologies Inc.
Page 991 FortiOS™ - CLI Reference for FortiOS 5.0
execute
traceroute
traceroute
Test the connection between the FortiGate unit and another network device, and display information about the network hops between the device and the FortiGate unit.
Syntax
execute traceroute {<ip_address> | <host-name>}
Example
This example shows how to test the connection with http://docs.forticare.com
. In this example the traceroute command times out after the first hop indicating a possible problem.
#execute traceoute docs.forticare.com
traceroute to docs.forticare.com (65.39.139.196), 30 hops max, 38 byte packets
1 172.20.120.2 (172.20.120.2) 0.324 ms 0.427 ms 0.360 ms
2 * * *
If your FortiGate unit is not connected to a working DNS server, you will not be able to connect to remote host-named locations with traceroute.
Fortinet Technologies Inc.
Page 992 FortiOS™ - CLI Reference for FortiOS 5.0
execute
tracert6
tracert6
Test the connection between the FortiGate unit and another network device using IPv6 protocol, and display information about the network hops between the device and the FortiGate unit.
Syntax
tracert6 [-Fdn] [-f first_ttl] [-i interface] [-m max_ttl]
[-s src_addr] [-q nprobes] [-w waittime] [-z sendwait] host [paddatalen]
Variable
-F
-d
-n
-f <first_ttl>
-i <interface>
-m <max_ttl>
-s <src_addr>
-q <nprobes>
-w <waittime>
-z <sendwait> host
<paddatalen>
Description
Set Don’t Fragment bit.
Enable debugging.
Do not resolve numeric address to domain name.
Set the initial time-to-live used in the first outgoing probe packet.
Select interface to use for tracert.
Set the max time-to-live (max number of hops) used in outgoing probe packets.
Set the source IP address to use in outgoing probe packets.
Set the number probes per hop.
Set the time in seconds to wait for response to a probe. Default is 5.
Set the time in milliseconds to pause between probes.
Enter the IP address or FQDN to probe.
Set the packet size to use when probing.
Fortinet Technologies Inc.
Page 993 FortiOS™ - CLI Reference for FortiOS 5.0
execute
update-ase
Use this command to manually initiate the antispam engine and rules update.
Syntax
execute update-ase
update-ase
Fortinet Technologies Inc.
Page 994 FortiOS™ - CLI Reference for FortiOS 5.0
execute
update-av
update-av
Use this command to manually initiate the virus definitions and engines update. To update both virus and attack definitions, use the execute update-now command.
Syntax
execute update-av
Fortinet Technologies Inc.
Page 995 FortiOS™ - CLI Reference for FortiOS 5.0
execute update-geo-ip
update-geo-ip
Use this command to obtain an update to the IP geography database from FortiGuard.
Syntax
execute update-geo-ip
Fortinet Technologies Inc.
Page 996 FortiOS™ - CLI Reference for FortiOS 5.0
execute
update-ips
update-ips
Use this command to manually initiate the Intrusion Prevention System (IPS) attack definitions and engine update. To update both virus and attack definitions, use the execute update-now command.
Syntax
execute update-ips
Fortinet Technologies Inc.
Page 997 FortiOS™ - CLI Reference for FortiOS 5.0
execute update-now
update-now
Use this command to manually initiate both virus and attack definitions and engine updates. To initiate only virus or attack definitions, use the execute update-av or execute updateids command respectively.
Syntax
execute update-now
Fortinet Technologies Inc.
Page 998 FortiOS™ - CLI Reference for FortiOS 5.0
execute update-src-vis
update-src-vis
Use this command to trigger an FDS update of the source visibility signature package.
Syntax
execute update-src-vis
Fortinet Technologies Inc.
Page 999 FortiOS™ - CLI Reference for FortiOS 5.0
execute upd-vd-license
upd-vd-license
Use this command to enter a Virtual Domain (VDOM) license key.
If you have a FortiGate- unit that supports VDOM licenses, you can purchase a license key from
Fortinet to increase the maximum number of VDOMs to 25, 50, 100 or 500. By default, FortiGate units support a maximum of 10 VDOMs.
Available on FortiGate models that can be licensed for more than 10 VDOMs.
Syntax
execute upd-vd-license
Variable Description
<license_key>
The license key is a 32-character string supplied by Fortinet. Fortinet requires your unit serial number to generate the license key.
Fortinet Technologies Inc.
Page 1000 FortiOS™ - CLI Reference for FortiOS 5.0
execute
upload
upload
Use this command to upload system configurations and firmware images to the flash disk from
FTP, TFTP, or USB sources.
Syntax
To upload configuration files:
execute upload config ftp <filename_str> <comment> <server_ipv4[: port_int] | server_fqdn[:port_int]> [<username_str>
[<password_str>]] [<backup_password_str>] execute upload config tftp <filename_str> <comment> <server_ipv4> execute upload config usb <filename_str> <comment>
To upload firmware image files:
execute upload image ftp <filename_str> <comment> <server_ipv4[: port_int] | server_fqdn[:port_int]> [<username_str>
[<password_str>]] execute upload image tftp <filename_str> <comment> <server_ipv4> execute upload image usb <filename_str> <comment>
To upload report image files:
execute upload report-img ftp <filename_str> <server_ipv4[:port_int]
| server_fqdn[:port_int]> [<username_str> [<password_str>]] execute upload report-img tftp <filename_str> <server_ipv4>
Variable
<comment>
Description
Comment string.
<filename_str>
Filename to upload.
<server_fqdn[:port_int]>
Server fully qualified domain name and optional port.
<server_ipv4[:port_int]>
Server IP address and optional port number.
<username_str>
Username required on server.
<password_str>
<backup_password_str>
Password required on server.
Password for backup file.
Fortinet Technologies Inc.
Page 1001 FortiOS™ - CLI Reference for FortiOS 5.0
execute
usb-device
Use these commands to manage FortiExplorer IOS devices.
Syntax
List connected FortiExplorer IOS devices
execute usb-device list
Disconnect FortiExplorer IOS devices
execute usb-device disconnect
usb-device
Fortinet Technologies Inc.
Page 1002 FortiOS™ - CLI Reference for FortiOS 5.0
execute
usb-disk
Use these commands to manage your USB disks.
Syntax
execute usb-disk
execute usb-disk
execute usb-disk
execute usb-disk
Variable
delete <filename>
Description
Delete the named file from the USB disk.
format list
Format the USB disk.
List the files on the USB disk.
rename <old_name> <new_name>
Rename a file on the USB disk.
usb-disk
Fortinet Technologies Inc.
Page 1003 FortiOS™ - CLI Reference for FortiOS 5.0
execute vpn certificate ca
vpn certificate ca
Use this command to import a CA certificate from a TFTP or SCEP server to the FortiGate unit, or to export a CA certificate from the FortiGate unit to a TFTP server.
Before using this command you must obtain a CA certificate issued by a CA.
Digital certificates are used to ensure that both participants in an IPSec communications session are trustworthy, prior to an encrypted VPN tunnel being set up between the participants. The CA certificate is the certificate that the FortiGate unit uses to authenticate itself to other devices.
VPN peers must use digital certificates that adhere to the X.509 standard.
Digital certificates are not required for configuring FortiGate VPNs. Digital certificates are an advanced feature provided for the convenience of system administrators. This manual assumes the user has prior knowledge of how to configure digital certificates for their implementation.
Syntax
execute vpn certificate ca export tftp
execute vpn certificate ca import auto
execute vpn certificate ca import tftp
Variable
import export
Description
Import the CA certificate from a TFTP server to the FortiGate unit.
Export or copy the CA certificate from the FortiGate unit to a file on the
TFTP server. Type ? for a list of certificates.
<certificate-name_str>
Enter the name of the CA certificate.
<file-name_str>
Enter the file name on the TFTP server.
<tftp_ip> auto tftp
Enter the TFTP server address.
Retrieve a CA certificate from a SCEP server.
Import the CA certificate to the FortiGate unit from a file on a TFTP server (local administrator PC).
<ca_server_url>
<ca_identifier_str>
Enter the URL of the CA certificate server.
CA identifier on CA certificate server (optional).
Examples
Use the following command to import the CA certificate named trust_ca to the FortiGate unit from a TFTP server with the address
192.168.21.54.
execute vpn certificate ca import trust_ca 192.168.21.54
Fortinet Technologies Inc.
Page 1004 FortiOS™ - CLI Reference for FortiOS 5.0
execute vpn certificate crl
vpn certificate crl
Use this command to get a CRL via LDAP, HTTP, or SCEP protocol, depending on the autoupdate configuration.
In order to use the command execute vpn certificate crl, the authentication servers must already be configured.
Digital certificates are used to ensure that both participants in an IPSec communications session are trustworthy, prior to an encrypted VPN tunnel being set up between the participants. The CA certificate is the certificate that the FortiGate unit uses to authenticate itself to other devices.
VPN peers must use digital certificates that adhere to the X.509 standard.
Digital certificates are not required for configuring FortiGate VPNs. Digital certificates are an advanced feature provided for the convenience of system administrators. This manual assumes the user has prior knowledge of how to configure digital certificates for their implementation.
Syntax
execute vpn certificate crl import auto
Variable
import
Description
Import the CRL from the configured LDAP, HTTP, or SCEP authentication server to the FortiGate unit.
<crl-name>
Enter the name of the CRL.
auto
Trigger an auto-update of the CRL from the configured LDAP, HTTP, or SCEP authentication server.
Fortinet Technologies Inc.
Page 1005 FortiOS™ - CLI Reference for FortiOS 5.0
execute vpn certificate local
vpn certificate local
Use this command to generate a local certificate, to export a local certificate from the FortiGate unit to a TFTP server, and to import a local certificate from a TFTP server to the FortiGate unit.
Digital certificates are used to ensure that both participants in an IPSec communications session are trustworthy, prior to an encrypted VPN tunnel being set up between the participants. The local certificate is the certificate that the FortiGate unit uses to authenticate itself to other devices.
When you generate a certificate request, you create a private and public key pair for the local
FortiGate unit. The public key accompanies the certificate request. The private key remains confidential.
When you receive the signed certificate from the CA, use the vpn certificate local command to install it on the FortiGate unit.
VPN peers must use digital certificates that adhere to the X.509 standard.
Digital certificates are not required for configuring FortiGate VPNs. Digital certificates are an advanced feature provided for the convenience of system administrators. This manual assumes the user has prior knowledge of how to configure digital certificates for their implementation.
Syntax - generate
execute vpn certificate local generate
{<host_ip> | <domain-name_str> | email-addr_str>}
Variable
<certificate-name_str>
Description
Enter a name for the certificate. The name can contain numbers (0-
9), uppercase and lowercase letters (A-Z, a-z), and the special characters - and _. Other special characters and spaces are not allowed.
<host_ip>
{<host_ip>
| <domain-name_str>
| email-addr_str>}
Enter the host IP address ( host_ip), the domain name
( domain-name_str), or an email address (email-addr_str) to identify the FortiGate unit being certified. Preferably use an IP address or domain name. If this is impossible (such as with a dialup client), use an e-mail address.
For host_ip, enter the IP address of the FortiGate unit.
For domain-name_str, enter the fully qualified domain name of the FortiGate unit.
For email-addr_str, enter an email address that identifies the
FortiGate unit.
If you specify a host IP or domain name, use the IP address or domain name associated with the interface on which IKE negotiations will take place (usually the external interface of the local FortiGate unit). If the IP address in the certificate does not match the IP address of this interface (or if the domain name in the certificate does not match a DNS query of the FortiGate unit’s IP), then some implementations of IKE may reject the connection.
Enforcement of this rule varies for different IPSec products.
Fortinet Technologies Inc.
Page 1006 FortiOS™ - CLI Reference for FortiOS 5.0
execute vpn certificate local
Variable
Description
<key-length>
Enter 1024, 1536 or 2048 for the size in bits of the encryption key.
[<optional_information>]
Enter optional_information as required to further identify the certificate. See
“Optional information variables” on page 1007 for
the list of optional information variables. You must enter the optional variables in order that they are listed in the table. To enter any optional variable you must enter all of the variables that come before it in the list. For example, to enter the organization_name_str, you must first enter the country_code_str, state_name_str, and city_name_str.
While entering optional variables, you can type ? for help on the next required variable.
Optional information variables
Variable
<country_code_str>
Description
Enter the two-character country code. Enter execute vpn certificates local generate <name_str> country followed by a
? for a list of country codes. The country code is case sensitive. Enter null if you do not want to specify a country.
<state_name_str>
Enter the name of the state or province where the FortiGate unit is located.
<city_name_str>
<organization-name_str>
Enter the name of the organization that is requesting the certificate for the FortiGate unit.
<organization-unit_name_str> Enter a name that identifies the department or unit within the organization that is requesting the certificate for the FortiGate unit.
<email_address_str>
<ca_server_url>
Enter the name of the city, or town, where the person or organization certifying the FortiGate unit resides.
Enter a contact e-mail address for the FortiGate unit.
Enter the URL of the CA (SCEP) certificate server that allows auto-signing of the request.
<challenge_password>
Enter the challenge password for the SCEP certificate server.
Example - generate
Use the following command to generate a local certificate request with the name branch_cert, the domain name www.example.com and a key size of 1536.
execute vpn certificate local generate branch_cert 1536 www.example.com
Syntax - import/export
execute vpn certificate local import tftp
execute vpn certificate local export tftp
Fortinet Technologies Inc.
Page 1007 FortiOS™ - CLI Reference for FortiOS 5.0
execute vpn certificate local
Variable
import export
Description
Import the local certificate from a TFTP server to the FortiGate unit.
Export or copy the local certificate from the FortiGate unit to a file on the TFTP server. Type ? for a list of certificates.
<certificate-name_str>
Enter the name of the local certificate.
<tftp_ip>
Enter the TFTP server address.
<file-name_str> list
Enter the file name on the TFTP server.
List local certificates.
Examples - import/export
Use the following command to export the local certificate request generated in the above example from the FortiGate unit to a TFTP server. The example uses the file name testcert for the downloaded file and the TFTP server address 192.168.21.54.
execute vpn certificate local export branch_cert testcert
192.168.21.54
Use the following command to import the signed local certificate named branch_cert to the
FortiGate unit from a TFTP server with the address 192.168.21.54.
execute vpn certificate local import branch_cert 192.168.21.54
Fortinet Technologies Inc.
Page 1008 FortiOS™ - CLI Reference for FortiOS 5.0
execute vpn certificate remote
vpn certificate remote
Use this command to import a remote certificate from a TFTP server, or export a remote certificate from the FortiGate unit to a TFTP server. The remote certificates are public certificates without a private key. They are used as OCSP (Online Certificate Status Protocol) server certificates.
Syntax
execute vpn certificate remote import tftp
execute vpn certificate remote export tftp
Field/variable
import
Description
export
Export or copy the remote certificate from the FortiGate unit to a file on the TFTP server. Type ? for a list of certificates.
<certificate-name_str>
Enter the name of the public certificate.
<file-name_str>
Enter the file name on the TFTP server.
<tftp_ip> tftp
Import the remote certificate from the TFTP server to the FortiGate unit.
Enter the TFTP server address.
Import/export the remote certificate via a TFTP server.
Fortinet Technologies Inc.
Page 1009 FortiOS™ - CLI Reference for FortiOS 5.0
execute vpn ipsec tunnel down
vpn ipsec tunnel down
Use this command to shut down an IPsec VPN tunnel.
Syntax
execute vpn ipsec tunnel down <phase2> [<phase1> <phase2_serial>] where:
•
<phase2> is the phase 2 name
•
<phase1> is the phase 1 name
•
<phase2_serial> is the phase 2 serial number
<phase1> is required on a dial-up tunnel.
Fortinet Technologies Inc.
Page 1010 FortiOS™ - CLI Reference for FortiOS 5.0
execute vpn ipsec tunnel up
vpn ipsec tunnel up
Use this command to activate an IPsec VPN tunnel.
Syntax
execute vpn ipsec tunnel up <phase2> [<phase1> <phase2_serial>] where:
•
<phase2> is the phase 2 name
•
<phase1> is the phase 1 name
•
<phase2_serial> is the phase 2 serial number
This command cannot activate a dial-up tunnel.
Fortinet Technologies Inc.
Page 1011 FortiOS™ - CLI Reference for FortiOS 5.0
execute
vpn sslvpn del-all
Use this command to delete all SSL VPN connections in this VDOM.
Syntax
execute vpn sslvpn del-all
vpn sslvpn del-all
Fortinet Technologies Inc.
Page 1012 FortiOS™ - CLI Reference for FortiOS 5.0
execute vpn sslvpn del-tunnel
vpn sslvpn del-tunnel
Use this command to delete an SSL tunnel connection.
Syntax
execute vpn sslvpn del-tunnel <tunnel_index>
<tunnel_index> identifies which tunnel to delete if there is more than one active tunnel.
Fortinet Technologies Inc.
Page 1013 FortiOS™ - CLI Reference for FortiOS 5.0
execute vpn sslvpn del-web
vpn sslvpn del-web
Use this command to delete an active SSL VPN web connection.
Syntax
execute vpn sslvpn del-web <web_index>
<web_index> identifies which web connection to delete if there is more than one active connection.
Fortinet Technologies Inc.
Page 1014 FortiOS™ - CLI Reference for FortiOS 5.0
execute
vpn sslvpn list
Use this command to list current SSL VPN tunnel connections.
Syntax
execute vpn sslvpn list {web | tunnel}
vpn sslvpn list
Fortinet Technologies Inc.
Page 1015 FortiOS™ - CLI Reference for FortiOS 5.0
execute webfilter quota-reset
webfilter quota-reset
Use this command to reset user quota.
Syntax
execute webfilter quota-reset <wf-profile> <user_ip4addr> execute webfilter quota-reset <wf-profile> <user_name>
Fortinet Technologies Inc.
Page 1016 FortiOS™ - CLI Reference for FortiOS 5.0
execute wireless-controller delete-wtp-image
wireless-controller delete-wtp-image
Use this command to delete all firmware images for WLAN Termination Points (WTPs), also known as physical access points.
Syntax
execute wireless-controller delete-wtp-image
Fortinet Technologies Inc.
Page 1017 FortiOS™ - CLI Reference for FortiOS 5.0
execute wireless-controller list-wtp-image
wireless-controller list-wtp-image
Use this command to list all firmware images for WLAN Termination Points (WTPs), also known as WiFi physical access points.
Syntax
execute wireless-controller list-wtp-image
Example output
WTP Images on AC:
FAP22A-IMG.wtp 3711132 FAP22A-v4.0-build212 Mon Jun 6
12:26:41 2011
Fortinet Technologies Inc.
Page 1018 FortiOS™ - CLI Reference for FortiOS 5.0
execute wireless-controller reset-wtp
wireless-controller reset-wtp
Use this command to reset a physical access point (WTP).
If the FortiGate unit has a more recent version of the FortiAP firmware, the FortiAP unit will
download and install it. Use the command execute wireless-controller upload-wtp-image to
upload FortiAP firmware to the FortiGate unit.
Syntax
execute wireless-controller reset-wtp {<serialNumber_str> | all} where
<serialNumber_str> is the FortiWiFi unit serial number.
Use the all option to reset all APs.
Fortinet Technologies Inc.
Page 1019 FortiOS™ - CLI Reference for FortiOS 5.0
execute
wireless-controller restart-acd
Use this command to restart the wireless-controller daemon.
Syntax
execute wireless-controller restart-acd
wireless-controller restart-acd
Fortinet Technologies Inc.
Page 1020 FortiOS™ - CLI Reference for FortiOS 5.0
execute
wireless-controller restart-wtpd
Use this command to restart the wireless access point daemon.
Syntax
execute wireless-controller restart-wtpd
wireless-controller restart-wtpd
Fortinet Technologies Inc.
Page 1021 FortiOS™ - CLI Reference for FortiOS 5.0
execute wireless-controller upload-wtp-image
wireless-controller upload-wtp-image
Use this command to upload a FortiWiFi firmware image to the FortiGate unit. Wireless APs controlled by this wireless controller can download the image as needed. Use the
execute wireless-controller reset-wtp command to trigger FortiAP units to update their firmware.
Syntax
FTP: execute wireless-controller upload-wtp-image ftp <filename_str>
<server_ipv4[:port_int]> [<username_str> <password_str>]
TFTP: execute wireless-controller upload-wtp-image tftp <filename_str>
<server_ipv4>
Fortinet Technologies Inc.
Page 1022 FortiOS™ - CLI Reference for FortiOS 5.0
get
The get commands retrieve information about the operation and performance of your FortiGate unit.
This chapter contains the following sections:
system fortianalyzer-connectivity
system fortiguard-log-service status
system fortiguard-service status
system session-helper-info list
wireless-controller rf-analysis
wireless-controller vap-status
wireless-controller wlchanlistlic
wireless-controller wtp-status
Page 1023
get endpoint-control app-detect
endpoint-control app-detect
Use this command to retrieve information about predefined application detection signatures for
Endpoint NAC.
Syntax
get endpoint-control app-detect predefined-category status get endpoint-control app-detect predefined-group status get endpoint-control app-detect predefined-signature status get endpoint-control app-detect predefined-vendor status
Example output (partial)
get endpoint-control app-detect predefined-category status
FG200A2907500558 # get endpoint-control app-detect predefined-category status name: "Anti-Malware Software" id: 1 group: 1 name: "Authentication and Authorization" id: 2 group: 1 name: "Encryption, PKI" id: 3 group: 1 name: "Firewalls" id: 4 group: 1 get endpoint-control app-detect predefined-group status
FG200A2907500558 # get endpoint-control app-detect predefined-group status name: "Security" id: 1 name: "Multimedia" id: 2 name: "Communication" id: 3 name: "Critical Functions" id: 4
Fortinet Technologies Inc.
Page 1024 FortiOS™ - CLI Reference for FortiOS 5.0
get endpoint-control app-detect
get endpoint-control app-detect predefined-signature status
FG200A2907500558 # get endpoint-control app-detect predefined-signature status name: "Apache HTTP Server" id: 256 category: 26 vendor: 149 name: "RealPlayer (32-bit)" id: 1 category: 10 vendor: 68 name: "VisualSVN Server" id: 257 category: 26 vendor: 162 name: "QQ2009" id: 2 category: 14 vendor: 78 get endpoint-control app-detect predefined-vendor status
FG200A2907500558 # get endpoint-control app-detect predefined-vendor status name: "Access Remote PC (www.access-remote-pc.com)" id: 3 name: "ACD Systems, Ltd." id: 4 name: "Adobe Systems Incorporated" id: 5 name: "Alen Soft" id: 6
Fortinet Technologies Inc.
Page 1025 FortiOS™ - CLI Reference for FortiOS 5.0
get
firewall dnstranslation
Use this command to display the firewall DNS translation table.
Syntax
get firewall dnstranslation
firewall dnstranslation
Fortinet Technologies Inc.
Page 1026 FortiOS™ - CLI Reference for FortiOS 5.0
get firewall iprope appctrl
firewall iprope appctrl
Use this command to list all application control signatures added to an application control list and display a summary of the application control configuration.
Syntax
get firewall iprope appctrl {list | status}
Example output
In this example, the FortiGate unit includes one application control list that blocks the FTP application.
get firewall iprope appctrl list app-list=app_list_1/2000 other-action=Pass
app-id=15896 list-id=2000 action=Block get firewall iprope appctrl status appctrl table 3 list 1 app 1 shaper 0
Fortinet Technologies Inc.
Page 1027 FortiOS™ - CLI Reference for FortiOS 5.0
get firewall iprope list
firewall iprope list
Use this command to list all of the FortiGate unit iprope firewall policies. Optionally include a group number in hexidecimal format to display a single policy. Policies are listed in FortiOS format.
Syntax
get firewall iprope list [<group_number_hex>]
Example output
get firewall iprope list 0010000c policy flag (8000000): pol_stats flag2 (20): ep_block shapers: / per_ip= imflag: sockport: 1011 action: redirect index: 0 schedule() group=0010000c av=00000000 au=00000000 host=0 split=00000000 chk_client_info=0x0 app_list=0 misc=0 grp_info=0 seq=0 hash=0 npu_sensor_id=0
tunnel= zone(1): 0 ->zone(1): 0 source(0): dest(0): source wildcard(0): destination wildcard(0): service(1):
[6:0x8:1011/(0,65535)->(80,80)] nat(0): mms: 0 0
Fortinet Technologies Inc.
Page 1028 FortiOS™ - CLI Reference for FortiOS 5.0
get
firewall proute, proute6
Use these commands to list policy routes.
Syntax
For IPv4 policy routes: get firewall proute
For IPv6 policy routes: get firewall proute6
Example output
get firewall proute list route policy info(vf=root): iff=5 src=1.1.1.0/255.255.255.0 tos=0x00 tos_mask=0x00 dst=0.0.0.0/0.0.0.0 protocol=80 port=1:65535
oif=3 gwy=1.2.3.4
firewall proute, proute6
Fortinet Technologies Inc.
Page 1029 FortiOS™ - CLI Reference for FortiOS 5.0
get firewall service custom
firewall service custom
Use this command to view the list of custom services. If you do not specify a <service_name> the command lists all of the pre-defined services.
Syntax
get firewall service custom
This lists the services.
To view details about all services
config firewall service custom show full-configuration
To view details about a specific service
This example lists the configuration for the ALL_TCP service: config firewall service custom edit ALL_TCP show full-configuration
Example output
This is a partial output.
get firewall service custom
== [ ALL ] name: ALL
== [ ALL_TCP ] name: ALL_TCP
== [ ALL_UDP ] name: ALL_UDP
== [ ALL_ICMP ] name: ALL_ICMP
== [ ALL_ICMP6 ] name: ALL_ICMP6
== [ GRE ] name: GRE
== [ AH ] name: AH
== [ ESP ] name: ESP
== [ AOL ] name: AOL
== [ BGP ] name: BGP
== [ DHCP ] name: DHCP
== [ DNS ] name: DNS
== [ FINGER ] name: FINGER
Fortinet Technologies Inc.
Page 1030 FortiOS™ - CLI Reference for FortiOS 5.0
get
firewall shaper
Use these command to retrieve information about traffic shapers.
Syntax
To get information about per-ip traffic shapers
get firewall shaper per-ip
To get information about shared traffic shapers
get firewall shaper traffic-shaper
firewall shaper
Fortinet Technologies Inc.
Page 1031 FortiOS™ - CLI Reference for FortiOS 5.0
get
grep
grep
In many cases the get and show (and diagnose) commands may produce a large amount of output. If you are looking for specific information in a large get or show command output you can use the grep command to filter the output to only display what you are looking for. The grep command is based on the standard UNIX grep, used for searching text output based on regular expressions.
Information about how to use grep and regular expressions is available from the Internet. For example, see http://www.opengroup.org/onlinepubs/009695399/utilities/grep.html
.
Syntax
{get | show| diagnose} | grep <regular_expression>
Example output
Use the following command to display the MAC address of the FortiGate unit internal interface: get hardware nic internal | grep Current_HWaddr
Current_HWaddr 00:09:0f:cb:c2:75
Use the following command to display all TCP sessions in the session list and include the session list line number in the output get system session list | grep -n tcp
19:tcp 1110 10.31.101.10:1862 172.20.120.122:30670
69.111.193.57:1469 -
38:tcp 3594 10.31.101.10:4780 172.20.120.122:49700
172.20.120.100:445 -
43:tcp 3582 10.31.101.10:4398 172.20.120.122:49574
24.200.188.171:48726 -
Use the following command to display all lines in HTTP replacement message commands that contain
URL (upper or lower case): show system replacemsg http | grep -i url set buffer "<HTML><BODY>The page you requested has been blocked because it contains a banned word. URL =
%%PROTOCOL%%%%URL%%</BODY></HTML>" config system replacemsg http "url-block"
set buffer "<HTML><BODY>The URL you requested has been blocked.
URL = %%URL%%</BODY></HTML>" config system replacemsg http "urlfilter-err"
.
.
.
Fortinet Technologies Inc.
Page 1032 FortiOS™ - CLI Reference for FortiOS 5.0
get gui console status
gui console status
Display information about the CLI console.
Syntax
get gui console status
Example
The output looks like this:
Preferences:
User: admin
Colour scheme (RGB): text=FFFFFF, background=000000
Font: style=monospace, size=10pt
History buffer=50 lines, external input=disabled
Fortinet Technologies Inc.
Page 1033 FortiOS™ - CLI Reference for FortiOS 5.0
get gui topology status
gui topology status
Display information about the topology viewer database. The topology viewer is available only if the Topology widget has been added to a customized web-based manager menu layout.
Syntax
get gui topology status
Example output
Preferences:
Canvas dimensions (pixels): width=780, height=800
Colour scheme (RGB): canvas=12ff08, lines=bf0f00, exterior=ddeeee
Background image: type=none, placement: x=0, y=0
Line style: thickness=2
Custom background image file: none
Topology element database:
__FortiGate__: x=260, y=340
Office: x=22, y=105
ISPnet: x=222, y=129
__Text__: x=77, y=112: "Ottawa"
__Text__: x=276, y=139: "Internet"
Fortinet Technologies Inc.
Page 1034 FortiOS™ - CLI Reference for FortiOS 5.0
get hardware cpu
hardware cpu
Use this command to display detailed information about all of the CPUs in your FortiGate unit.
Syntax
get hardware cpu
Example output
get hardware npu legacy list
No npu ports are found
620_ha_1 # get hardware cpu processor : 0 vendor_id : GenuineIntel cpu family : 6 model : 15 model name : Intel(R) Core(TM)2 Duo CPU E4300 @ 1.80GHz
stepping : 13 cpu MHz : 1795.545
cache size : 64 KB fdiv_bug : no hlt_bug : no f00f_bug : no coma_bug : no fpu : yes fpu_exception : yes cpuid level : 10 wp : yes flags : fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush dts acpi mmx fxsr sse sse2 ss ht tm pbe lm pni monitor ds_cpl tm2 est bogomips : 3578.26
processor : 1 vendor_id : GenuineIntel cpu family : 6 model : 15 model name : Intel(R) Core(TM)2 Duo CPU E4300 @ 1.80GHz
stepping : 13 cpu MHz : 1795.545
cache size : 64 KB fdiv_bug : no hlt_bug : no f00f_bug : no coma_bug : no fpu : yes fpu_exception : yes cpuid level : 10
Fortinet Technologies Inc.
Page 1035 FortiOS™ - CLI Reference for FortiOS 5.0
get hardware cpu
wp : yes flags : fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush dts acpi mmx fxsr sse sse2 ss ht tm pbe lm pni monitor ds_cpl tm2 est bogomips : 3578.26
Fortinet Technologies Inc.
Page 1036 FortiOS™ - CLI Reference for FortiOS 5.0
get hardware memory
hardware memory
Use this command to display information about FortiGate unit memory use including the total, used, and free memory.
Syntax
get hardware memory
Example output
get hardware memory
total: used: free: shared: buffers: cached: shm:
Mem: 3703943168 348913664 3355029504 0 192512 139943936
137314304
Swap: 0 0 0
MemTotal: 3617132 kB
MemFree: 3276396 kB
MemShared: 0 kB
Buffers: 188 kB
Cached: 136664 kB
SwapCached: 0 kB
Active: 22172 kB
Inactive: 114740 kB
HighTotal: 1703936 kB
HighFree: 1443712 kB
LowTotal: 1913196 kB
LowFree: 1832684 kB
SwapTotal: 0 kB
SwapFree: 0 kB
Fortinet Technologies Inc.
Page 1037 FortiOS™ - CLI Reference for FortiOS 5.0
get hardware nic
hardware nic
Use this command to display hardware and status information about each FortiGate interface.
The hardware information includes details such as the driver name and version and chip revision. Status information includes transmitted and received packets, and different types of errors.
Syntax
get hardware nic <interface_name>
Variable Description
<interface_name>
A FortiGate interface name such as port1, wan1, internal, etc.
Example output
get hardware nic port9
Chip_Model FA2/ISCP1B-v3/256MB
FPGA_REV_TAG 06101916
Driver Name iscp1a/b-DE
Driver Version 0.1
Driver Copyright Fortinet Inc.
Link down
Speed N/A
Duplex N/A
State up
Rx_Packets 0
Tx_Packets 0
Rx_Bytes 0
Tx_Bytes 0
Current_HWaddr 00:09:0f:77:09:68
Permanent_HWaddr 00:09:0f:77:09:68
Frame_Received 0
Bad Frame Received 0
Tx Frame 0
Tx Frame Drop 0
Receive IP Error 0
FIFO Error 0
Small PktBuf Left 125
Normal PktBuf Left 1021
Jumbo PktBuf Left 253
NAT Anomaly 0
Fortinet Technologies Inc.
Page 1038 FortiOS™ - CLI Reference for FortiOS 5.0
get hardware npu
hardware npu
Use this command to display information about the network processor unit (NPU) hardware installed in a FortiGate unit. The NPUs can be built-in or on an installed AMC module.
Syntax
get hardware npu legacy {list | session <device_name_str> | setting
<device_name_str>} get hardware npu np1 {list | status} get hardware npu np2 {list | performance <device_id_int> | status
<device_id_int>} get hardware npu np4 {list | status <device_id_int>} get hardware npu sp {list | status}
Example output
get hardware npu np1 list
ID Interface
0 port9 port10 get hardware npu np1 status
ISCP1A 10ee:0702
RX SW Done 0 MTP 0x00000000 desc_size = 0x00001000 count = 0x00000100 nxt_to_u = 0x00000000 nxt_to_f = 0x00000000
Total Number of Interfaces: 2
Number of Interface In-Use: 2
Interface[0] Tx done: 0 desc_size = 0x00004000 count = 0x00000100 nxt_to_u = 0x00000000 nxt_to_f = 0x00000000
TX timeout = 0x00000000 BD_empty = 0x00000000
HRx Packets= 0x00000000 HTXBytes = 0x00000000 HRXBytes = 0x00000000
Interface[1] Tx done: 0 desc_size = 0x00004000 count = 0x00000100 nxt_to_u = 0x00000000 nxt_to_f = 0x00000000
TX timeout = 0x00000000 BD_empty = 0x00000000
HRx Packets= 0x00000000 HTXBytes = 0x00000000 HRXBytes = 0x00000000
NAT Information: head = 0x00000001 tail = 00000001
ISCP1A Performance [Top]:
Nr_int : 0x00000000 INTwoInd : 0x00000000 RXwoDone :
0x00000000
PKTwoEnd : 0x00000000 PKTCSErr : 0x00000000
PKTidErr : 0x00000000 PHY0Int : 0x00000000 PHY1INT :
0x00000000
CSUMOFF : 0x00000000 BADCSUM : 0x00000000 MSGINT :
0x00000000
IPSEC : 0x00000000 IPSVLAN : 0x00000000 SESMISS :
0x00000000
TOTUP : 0x00000000 RSVD MEMU : 0x00000010
Fortinet Technologies Inc.
Page 1039 FortiOS™ - CLI Reference for FortiOS 5.0
get hardware npu
MSG Performance:
QLEN: 0x00001000(QW) HEAD: 0x00000000
Performance:
TOTMSG: 0x00000000 BADMSG: 0x00000000 TOUTMSG: 0x00000000 QUERY:
0x00000000
NULLTK: 0x00000000
NAT Performance: BYPASS (Enable) BLOCK (Disable)
IRQ : 00000001 QFTL : 00000000 DELF : 00000000 FFTL : 00000000
OVTH : 00000001 QRYF : 00000000 INSF : 00000000 INVC : 00000000
ALLO : 00000000 FREE : 00000000 ALLOF : 00000000 BPENTR: 00000000
BKENTR: 00000000
PBPENTR: 00000000 PBKENTR: 00000000 NOOP : 00000000 THROT :
00000000(0x002625a0)
SWITOT : 00000000 SWDTOT : 00000000 ITDB : 00000000 OTDB : 00000000
SPISES : 00000000 FLUSH : 00000000
APS (Disabled) information:
MODE: BOTH UDPTH 255 ICMPTH 255 APSFLAGS: 0x00000000
IPSEC Offload Status: 0x58077dcb get hardware npu np2 list
ID PORTS
-- -----
0 amc-sw1/1
0 amc-sw1/2
0 amc-sw1/3
0 amc-sw1/4
ID PORTS
-- -----
1 amc-dw2/1
ID PORTS
-- -----
2 amc-dw2/2 get hardware npu np2 status 0
NP2 Status
ISCP2 f7750000 (Neighbor 00000000) 1a29:0703 256MB Base f8aad000 DBG
0x00000000
RX SW Done 0 MTP 0x0 desc_alloc = f7216000 desc_size = 0x2000 count = 0x100 nxt_to_u = 0x0 nxt_to_f = 0x0
Total Interfaces: 4 Total Ports: 4
Number of Interface In-Use: 4
Interface f7750100 netdev 81b1e000 0 Name amc-sw1-1
PHY: Attached
LB Mode 0 LB IDX 0/1 LB Ports: f7750694, 00000000, 00000000, 00000000
Fortinet Technologies Inc.
Page 1040 FortiOS™ - CLI Reference for FortiOS 5.0
get hardware npu
Port f7750694 Id 0 Status Down ictr 4 desc = 8128c000 desc_size = 0x00001000 count = 0x00000100 nxt_to_u = 0x00000000 nxt_to_f = 0x00000000
Intf f7750100
Interface f7750264 netdev 81b2cc00 1 Name amc-sw1-2
PHY: Attached
LB Mode 0 LB IDX 0/1 LB Ports: f7750748, 00000000, 00000000, 00000000
Port f7750748 Id 1 Status Down ictr 0 desc = 81287000 desc_size = 0x00001000 count = 0x00000100 nxt_to_u = 0x00000000 nxt_to_f = 0x00000000
Intf f7750264
Interface f77503c8 netdev 81b2c800 2 Name amc-sw1-3
PHY: Attached
LB Mode 0 LB IDX 0/1 LB Ports: f77507fc, 00000000, 00000000, 00000000
Port f77507fc Id 2 Status Down ictr 0 desc = 81286000 desc_size = 0x00001000 count = 0x00000100 nxt_to_u = 0x00000000 nxt_to_f = 0x00000000
Intf f77503c8
Interface f775052c netdev 81b2c400 3 Name amc-sw1-4
PHY: Attached
LB Mode 0 LB IDX 0/1 LB Ports: f77508b0, 00000000, 00000000, 00000000
Port f77508b0 Id 3 Status Down ictr 0 desc = 81281000 desc_size = 0x00001000 count = 0x00000100 nxt_to_u = 0x00000000 nxt_to_f = 0x00000000
Intf f775052c
NAT Information: cmdq_qw = 0x2000 cmdq = 82160000 head = 0x1 tail = 0x1
APS (Enabled) information:
Session Install when TMM TSE OOE: Disable
Session Install when TMM TAE OOE: Disable
IPS anomaly check policy: Follow config
MSG Base = 82150000 QL = 0x1000 H = 0x0
Fortinet Technologies Inc.
Page 1041 FortiOS™ - CLI Reference for FortiOS 5.0
get hardware status
hardware status
Report information about the FortiGate unit hardware including FortiASIC version, CPU type, amount of memory, flash drive size, hard disk size (if present), USB flash size (if present), network card chipset, and WiFi chipset (FortiWifi models). This information can be useful for troubleshooting, providing information about your FortiGate unit to Fortinet Support, or confirming the features that your FortiGate model supports.
Syntax
get hardware status
Example output
Model name: Fortigate-620B
ASIC version: CP6
ASIC SRAM: 64M
CPU: Intel(R) Core(TM)2 Duo CPU E4300 @ 1.80GHz
RAM: 2020 MB
Compact Flash: 493 MB /dev/sda
Hard disk: 76618 MB /dev/sdb
USB Flash: not available
Network Card chipset: Broadcom 570x Tigon3 Ethernet Adapter
(rev.0x5784100)
Fortinet Technologies Inc.
Page 1042 FortiOS™ - CLI Reference for FortiOS 5.0
get
ips decoder status
Displays all the port settings of all the IPS decoders.
Syntax
get ips decoder status
Example output
# get ips decoder status decoder-name: "back_orifice" decoder-name: "dns_decoder" port_list: 53 decoder-name: "ftp_decoder" port_list: 21 decoder-name: "http_decoder" decoder-name: "im_decoder" decoder-name: "imap_decoder" port_list: 143
Ports are shown only for decoders with configurable port settings.
ips decoder status
Fortinet Technologies Inc.
Page 1043 FortiOS™ - CLI Reference for FortiOS 5.0
get
ips rule status
Displays current configuration information about IPS rules.
Syntax
get ips rule status
Example output
# get ips rule status rule-name: "IP.Land" rule-id: 12588 rev: 2.464
action: pass status: disable log: enable log-packet: disable severity: 3.high
service: All location: server, client os: All application: All rule-name: "IP.Loose.Src.Record.Route.Option" rule-id: 12805 rev: 2.464
action: pass status: disable log: enable log-packet: disable severity: 2.medium
service: All location: server, client os: All application: All
ips rule status
Fortinet Technologies Inc.
Page 1044 FortiOS™ - CLI Reference for FortiOS 5.0
get
ips session
Displays current IPS session status.
Syntax
get ips session
Example output
get ips session
SYSTEM: memory capacity 279969792 memory used 5861008 recent pps\bps 0\0K session in-use 0
TCP: in-use\active\total 0\0\0
UDP: in-use\active\total 0\0\0
ICMP: in-use\active\total 0\0\0
ips session
Fortinet Technologies Inc.
Page 1045 FortiOS™ - CLI Reference for FortiOS 5.0
get
ipsec tunnel
List the current IPSec VPN tunnels and their status.
Syntax
To view details of all IPsec tunnels:
get ipsec tunnel details
To list IPsec tunnels by name:
get ipsec tunnel name
To view a summary of IPsec tunnel information:
get ipsec tunnel summary
ipsec tunnel
Fortinet Technologies Inc.
Page 1046 FortiOS™ - CLI Reference for FortiOS 5.0
get ips view-map
ips view-map
Use this command to view the policies examined by IPS. This is mainly used for debugging. If there is no ips view map, it means IPS is not used or enabled.
Syntax
get ips view-map <id>
Example output
id : 1 id-policy-id : 0 policy-id : 2 vdom-id : 0 which : firewall
Variable
id id-policy-id policy-id vdom-id which
Description
IPS policy ID
Identity-based policy ID (0 means none)
Policy ID
VDOM, identified by ID number
Type of policy id: firewall, firewall6, sniffer, sniffer6, interface, interface6
Fortinet Technologies Inc.
Page 1047 FortiOS™ - CLI Reference for FortiOS 5.0
get mgmt-data status
mgmt-data status
Use this command to display information additional to that provided by get system status or get hardware status.
Syntax
get mgmt-data status
Sample output
FG100D3G12801361 # get mgmt-data status
Model name: FortiGate-100D
CPU: 4
RAM: 1977 MB disk_is_ssd_available: 0 is_logdisk_mounted: 1 is_support_log_on_boot_device: 1 is_rev_support_wanopt: 1
Fortinet Technologies Inc.
Page 1048 FortiOS™ - CLI Reference for FortiOS 5.0
get netscan settings
netscan settings
Use this command to display tcp and udp ports that are scanned by the current scan mode.
Syntax
get netscan settings
Example output
scan-mode : full tcp-ports : 1-65535 udp-ports : 1-65535
Fortinet Technologies Inc.
Page 1049 FortiOS™ - CLI Reference for FortiOS 5.0
get
pbx branch-office
Use this command to list the configured branch offices.
Syntax
get pbx branch-office
Example output
== [ Branch 15 ] name: Branch 15
== [ Branch 12 ] name: Branch 12
pbx branch-office
Fortinet Technologies Inc.
Page 1050 FortiOS™ - CLI Reference for FortiOS 5.0
get
pbx dialplan
Use this command to list the configured dial plans.
Syntax
get pbx dialplan
Example output
== [ company-default ] name: company-default
== [ inbound ] name: inbound
pbx dialplan
Fortinet Technologies Inc.
Page 1051 FortiOS™ - CLI Reference for FortiOS 5.0
get
pbx did
Use this command to list the configured direct inward dial (DID) numbers.
Syntax
get pbx did
Example output
== [ Operator ] name: Operator
== [ Emergency ] name: Emergency
pbx did
Fortinet Technologies Inc.
Page 1052 FortiOS™ - CLI Reference for FortiOS 5.0
get
pbx extension
Use this command to list the configured extensions.
Syntax
get pbx extension
Example output
== [ 6555 ] extension: 6555
== [ 6777 ] extension: 6777
== [ 6111 ] extension: 6111
pbx extension
Fortinet Technologies Inc.
Page 1053 FortiOS™ - CLI Reference for FortiOS 5.0
get
pbx ftgd-voice-pkg
Use this command to display the current FortiGate Voice service package status.
Syntax
get pbx ftgd-voice-pkg status
Example output
Status: Activated
Total 1 Packages:
Package Type: B, Credit Left: 50.00, Credit Used: 0.00,
Expiration Date: 2011-01-01 12:00:00
Total 1 Dids:
12345678901
Total 1 Efaxs:
12345678902
Total 0 Tollfrees:
pbx ftgd-voice-pkg
Fortinet Technologies Inc.
Page 1054 FortiOS™ - CLI Reference for FortiOS 5.0
get
pbx global
Use this command to display the current global pbx settings.
Syntax
get pbx global
Example output
block-blacklist : enable country-area : USA country-code : 1 efax-check-interval : 5 extension-pattern : 6XXX fax-admin-email : [email protected]
ftgd-voice-server : service.fortivoice.com local-area-code : 408 max-voicemail : 60 outgoing-prefix : 9 ring-timeout : 20 rtp-hold-timeout : 0 rtp-timeout : 60 voicemail-extension : *97
pbx global
Fortinet Technologies Inc.
Page 1055 FortiOS™ - CLI Reference for FortiOS 5.0
get
pbx ringgrp
Use this command to display the currently configured ring groups.
Syntax
get pbx ringgrp
Example output
== [ 6001 ] name: 6001
== [ 6002 ] name: 6002
pbx ringgrp
Fortinet Technologies Inc.
Page 1056 FortiOS™ - CLI Reference for FortiOS 5.0
get
pbx sip-trunk
Use this command to display the currently configured SIP trunks.
Syntax
get pbx sip-trunk
Example output
== [ __FtgdVoice_1 ] name: __FtgdVoice_1
pbx sip-trunk
Fortinet Technologies Inc.
Page 1057 FortiOS™ - CLI Reference for FortiOS 5.0
get pbx voice-menu
pbx voice-menu
Use this command to display the current voice menu and recorder extension configuration.
Syntax
get pbx voice-menu
Example output
comment : general password : * press-0:
ring-group : 6001
type : ring-group press-1:
type : voicemail press-2:
type : directory press-3:
type : none press-4:
type : none press-5:
type : none press-6:
type : none press-7:
type : none press-8:
type : none press-9:
type : none recorder-exten : *30
Fortinet Technologies Inc.
Page 1058 FortiOS™ - CLI Reference for FortiOS 5.0
get report database schema
report database schema
Use this command to display the FortiGate SQL reporting database schema.
Syntax
get report database schema
Fortinet Technologies Inc.
Page 1059 FortiOS™ - CLI Reference for FortiOS 5.0
get router info bfd neighbor
router info bfd neighbor
Use this command to list state information about the neighbors in the bi-directional forwarding table.
Syntax
get router info bfd neighbour
Fortinet Technologies Inc.
Page 1060 FortiOS™ - CLI Reference for FortiOS 5.0
get router info bgp
router info bgp
Use this command to display information about the BGP configuration.
Syntax
get router info bgp <keyword>
<keyword>
cidr-only community community-info community-list dampening {dampened-paths
| flap-statistics | parameters} filter-list inconsistent-as memory neighbors [<address_ipv4>
| <address_ipv4> advertised-routes
| <address_ipv4> received prefix-filter
| <address_ipv4> received-routes
| <address_ipv4> routes] network [<address_ipv4mask>]
Description
Show all BGP routes having non-natural network masks.
Show all BGP routes having their COMMUNITY attribute set.
Show general information about the configured BGP communities, including the routes in each community and their associated network addresses.
Show all routes belonging to configured BGP community lists.
Display information about dampening:
• Type dampened-paths to show all paths that have been suppressed due to flapping.
• Type flap-statistics to show flap statistics related to BGP routes.
• Type parameters to show the current dampening settings.
Show all routes matching configured AS-path lists.
Show all routes associated with inconsistent autonomous systems of origin.
Show the BGP memory table.
Show information about connections to TCP and BGP neighbors. network-longer-prefixes
<address_ipv4mask> paths prefix-list <name> quote-regexp <regexp_str> regexp <regexp_str>
Show general information about the configured BGP networks, including their network addresses and associated prefixes.
Show general information about the BGP route that you specify (for example,
12.0.0.0/14) and any specific routes associated with the prefix.
Show general information about BGP AS paths, including their associated network addresses.
Show all routes matching configured prefix list
<name>.
Enter the regular expression to compare to the
AS_PATH attribute of BGP routes (for example,
^730$) and enable the use of output modifiers (for example, include, exclude, and begin) to search the results.
Enter the regular expression to compare to the
AS_PATH attribute of BGP routes (for example,
^730$).
Fortinet Technologies Inc.
Page 1061 FortiOS™ - CLI Reference for FortiOS 5.0
get router info bgp
<keyword>
route-map scan summary
Description
Show all routes matching configured route maps.
Show information about next-hop route scanning, including the scan interval setting.
Show information about BGP neighbor status.
Example output
get router info bgp memory
Memory type Alloc count Alloc bytes
=================================== ============= ===============
BGP structure : 2 1408
BGP VR structure : 2 104
BGP global structure : 1 56
BGP peer : 2 3440
BGP as list master : 1 24
Community list handler : 1 32
BGP Damp Reuse List Array : 2 4096
BGP table : 62 248
----------------------------------- ------------- ---------------
Temporary memory : 4223 96095
Hash : 7 140
Hash index : 7 28672
Hash bucket : 11 132
Thread master : 1 564
Thread : 4 144
Link list : 32 636
Link list node : 24 288
Show : 1 396
Show page : 1 4108
Show server : 1 36
Prefix IPv4 : 10 80
Route table : 4 32
Route node : 63 2772
Vector : 2180 26160
Vector index : 2180 18284
Host config : 1 2
Message of The Day : 1 100
IMI Client : 1 708
VTY master : 1 20
VTY if : 11 2640
VTY connected : 5 140
Message handler : 2 120
NSM Client Handler : 1 12428
NSM Client : 1 1268
Host : 1 64
Log information : 2 72
Context : 1 232
----------------------------------- ------------- ---------------
Fortinet Technologies Inc.
Page 1062 FortiOS™ - CLI Reference for FortiOS 5.0
get
bgp proto specifc allocations : 9408 B bgp generic allocations : 196333 B bgp total allocations : 205741 B
router info bgp
Fortinet Technologies Inc.
Page 1063 FortiOS™ - CLI Reference for FortiOS 5.0
get
router info gwdetect
Use this command to view the status of gateway detection.
Syntax
get router info gwdetect
router info gwdetect
Fortinet Technologies Inc.
Page 1064 FortiOS™ - CLI Reference for FortiOS 5.0
get
router info isis
Use this command to display information about the FortiGate ISIS.
Syntax
get router info isis interface get router info isis neighbor get router info isis is-neighbor get router info isis database get router info isis route get router info isis topology
router info isis
Fortinet Technologies Inc.
Page 1065 FortiOS™ - CLI Reference for FortiOS 5.0
get router info kernel
router info kernel
Use this command to display the FortiGate kernel routing table. The kernel routing table displays information about all of the routes in the kernel.
Syntax
get router info kernel [<routing_type_int>]
Fortinet Technologies Inc.
Page 1066 FortiOS™ - CLI Reference for FortiOS 5.0
get router info multicast
router info multicast
Use this command to display information about a Protocol Independent Multicasting (PIM) configuration. Multicast routing is supported in the root virtual domain only.
Syntax
get router info multicast <keywords>
<keywords>
igmp pim dense-mode pim sparse-mode
Description
Show Internet Group Management Protocol (IGMP) membership information according to one of these qualifiers:
• Type groups [{<interface-name> | <group-address>}] to show IGMP information for the multicast group(s) associated with the specified interface or multicast group address.
• Type groups-detail [{<interface-name> | <groupaddress>}] to show detailed IGMP information for the multicast group(s) associated with the specified interface or multicast group address.
• Type interface [<interface-name>] to show IGMP information for all multicast groups associated with the specified interface.
Show information related to dense mode operation according to one of these qualifiers:
• Type interface to show information about PIM-enabled interfaces.
• Type interface-detail to show detailed information about PIMenabled interfaces.
• Type neighbor to show the current status of PIM neighbors.
• Type neighbor-detail to show detailed information about PIM neighbors.
• Type next-hop to show information about next-hop PIM routers.
• Type table [<group-address>][<source-address>] to show the multicast routing table entries associated with the specified multicast group address and/or multicast source address.
Show information related to sparse mode operation according to one of these qualifiers:
• Type bsr-info to show Boot Strap Router (BSR) information.
• Type interface to show information about PIM-enabled interfaces.
• Type interface-detail to show detailed information about PIMenabled interfaces.
• Type neighbor to show the current status of PIM neighbors.
• Type neighbor-detail to show detailed information about PIM neighbors.
• Type next-hop to show information about next-hop PIM routers.
• Type rp-mapping to show Rendezvous Point (RP) information.
• Type table [<group-address>][<source-address>] to show the multicast routing table entries associated with the specified multicast group address and/or multicast source address.
Fortinet Technologies Inc.
Page 1067 FortiOS™ - CLI Reference for FortiOS 5.0
get router info multicast
<keywords>
table
[<group-address>]
[<source-address>] table-count
[<group-address>]
[<source-address>]
Description
Show the multicast routing table entries associated with the specified multicast group address and/or multicast source address.
Show statistics related to the specified multicast group address and/or multicast source address.
Fortinet Technologies Inc.
Page 1068 FortiOS™ - CLI Reference for FortiOS 5.0
get router info ospf
router info ospf
Use this command to display information about the FortiGate OSPF configuration and/or the
Link-State Advertisements (LSAs) that the FortiGate unit obtains and generates. An LSA identifies the interfaces of all OSPF-enabled routers in an area, and provides information that enables OSPF-enabled routers to select the shortest path to a destination.
Syntax
get router info ospf <keyword>
<keyword>
border-routers database <qualifier>
Description
Show OSPF routing table entries that have an Area Border Router
(ABR) or Autonomous System Boundary Router (ASBR) as a destination.
Show information from the OSPF routing database according to the of these qualifiers.
Some qualifiers require a target that can be one of the following values:
• Type adv_router <address_ipv4> to limit the information to
LSAs originating from the router at the specified IP address.
• Type self-originate <address_ipv4> to limit the information to LSAs originating from the FortiGate unit.
adv-router
<address_ipv4> asbr-summary
<target> brief
Type
Router link states for the router at the given IP address.
Type
LSAs.
adv-router <address_ipv4> to show ospf Advertising asbr-summary to show information about ASBR summary
Type brief to show the number and type of LSAs associated with each OSPF area.
external <target>
Type external to show information about external LSAs.
max-age
Type max-age to show all LSAs in the MaxAge list.
network <target>
Type network to show information about network LSAs.
nssa-external
<target>
Type nssa-external to show information about not-so-stubby external LSAs.
opaque-area
<address_ipv4> opaque-as
<address_ipv4>
Type opaque-area <address_ipv4> to show information about opaque Type 10 (area-local) LSAs (see RFC 2370).
Type opaque-as <address_ipv4> to show information about opaque Type 11 LSAs (see RFC 2370), which are flooded throughout the AS.
opaque-link
<address_ipv4>
Type opaque-link <address_ipv4> to show information about opaque Type 9 (link-local) LSAs (see RFC 2370).
router <target> interface
[<interface_name>]
Type router to show information about router LSAs.
self-originate
Type self-originate to show self-originated LSAs. summary <target> Type summary to show information about summary LSAs.
Show the status of one or all FortiGate interfaces and whether
OSPF is enabled on those interfaces.
Fortinet Technologies Inc.
Page 1069 FortiOS™ - CLI Reference for FortiOS 5.0
get router info ospf
<keyword>
neighbor [all
| <neighbor_id> | detail
| detail all
| interface <address_ipv4>]
Description
Show general information about OSPF neighbors, excluding downstatus neighbors:
• Type all to show information about all neighbors, including down-status neighbors.
• Type
<neighbor_id> to show detailed information about the specified neighbor only.
• Type detail to show detailed information about all neighbors, excluding down-status neighbors.
• Type detail all to show detailed information about all neighbors, including down-status neighbors.
• Type interface <address_ipv4> to show neighbor information based on the FortiGate interface IP address that was used to establish the neighbor’s relationship.
route status virtual-links
Show the OSPF routing table.
Show general information about the OSPF routing processes.
Show information about OSPF virtual links.
Fortinet Technologies Inc.
Page 1070 FortiOS™ - CLI Reference for FortiOS 5.0
get router info protocols
router info protocols
Use this command to show the current states of active routing protocols. Inactive protocols are not displayed.
Syntax
get router info protocols
Routing Protocol is "rip"
Sending updates every 30 seconds with +/-50%
Timeout after 180 seconds, garbage collect after 120 seconds
Outgoing update filter list for all interface is not set
Incoming update filter list for all interface is not set
Default redistribution metric is 1
Redistributing:
Default version control: send version 2, receive version 2
Interface Send Recv Key-chain
Routing for Networks:
Routing Information Sources:
Gateway Distance Last Update Bad Packets Bad Routes
Distance: (default is 120)
Routing Protocol is "ospf 0"
Invalid after 0 seconds, hold down 0, flushed after 0
Outgoing update filter list for all interfaces is
Incoming update filter list for all interfaces is
Redistributing:
Routing for Networks:
Routing Information Sources: Gateway Distance Last Update
Distance: (default is 110) Address Mask Distance
List
Routing Protocol is "bgp 5"
IGP synchronization is disabled
Automatic route summarization is disabled
Default local-preference applied to incoming route is 100
Redistributing:
Neighbor(s):
Address AddressFamily FiltIn FiltOut DistIn DistOut RouteMapIn
RouteMapOut Weight
192.168.20.10 unicast
Fortinet Technologies Inc.
Page 1071 FortiOS™ - CLI Reference for FortiOS 5.0
get router info rip
router info rip
Use this command to display information about the RIP configuration.
Syntax
get router info rip <keyword>
<keyword>
database
Description
Show the entries in the RIP routing database.
interface [<interface_name>] Show the status of the specified FortiGate unit interface
<interface_name> and whether RIP is enabled.
If interface is used alone it lists all the FortiGate unit interfaces and whether RIP is enabled on each.
Fortinet Technologies Inc.
Page 1072 FortiOS™ - CLI Reference for FortiOS 5.0
get router info routing-table
router info routing-table
Use this command to display the routes in the routing table.
Syntax
get router info routing-table <keyword>
<keyword>
all bgp connected
Description
Show all entries in the routing table.
Show the BGP routes in the routing table.
Show the connected routes in the routing table.
database
Show the routing information database.
details [<address_ipv4mask>]
Show detailed information about a route in the routing table, including the next-hop routers, metrics, outgoing interfaces, and protocol-specific information.
ospf rip static
Show the OSPF routes in the routing table.
Show the RIP routes in the routing table.
Show the static routes in the routing table.
Fortinet Technologies Inc.
Page 1073 FortiOS™ - CLI Reference for FortiOS 5.0
get
router info vrrp
Use this command to display information about the VRRP configuration.
Syntax
get router info vrrp
Example output
Interface: port1, primary IP address: 9.1.1.2
VRID: 1 vrip: 9.1.1.254, priority: 100, state: BACKUP adv_interval: 1, preempt: 1, start_time: 3 vrdst: 0.0.0.0
router info vrrp
Fortinet Technologies Inc.
Page 1074 FortiOS™ - CLI Reference for FortiOS 5.0
get router info6 bgp
router info6 bgp
Use this command to display information about the BGP IPv6 configuration.
Syntax
get router info6 bgp <keyword>
<keyword>
Description
community community-list
Show all BGP routes having their COMMUNITY attribute set.
Show all routes belonging to configured BGP community lists.
dampening {dampened-paths
| flap-statistics | parameters}
Display information about dampening:
• Type dampened-paths to show all paths that have been suppressed due to flapping.
• Type flap-statistics to show flap statistics related to
BGP routes.
• Type parameters to show the current dampening settings.
filter-list inconsistent-as
Show all routes matching configured AS-path lists.
Show all routes associated with inconsistent autonomous systems of origin.
neighbors [<address_ipv6mask>
Show information about connections to TCP and BGP neighbors. network [<address_ipv6mask>]
Show general information about the configured BGP networks, including their network addresses and associated prefixes.
network-longer-prefixes
<address_ipv6mask>
Show general information about the BGP route that you specify (for example,
12.0.0.0/14) and any specific routes associated with the prefix. paths
Show general information about BGP AS paths, including their associated network addresses.
prefix-list <name> quote-regexp <regexp_str>
Show all routes matching configured prefix list <name>.
Enter the regular expression to compare to the AS_PATH attribute of BGP routes (for example,
^730$) and enable the use of output modifiers (for example, include, exclude, and begin) to search the results.
regexp <regexp_str>
Enter the regular expression to compare to the AS_PATH attribute of BGP routes (for example,
^730$).
route-map summary
Show all routes matching configured route maps.
Show information about BGP neighbor status.
Fortinet Technologies Inc.
Page 1075 FortiOS™ - CLI Reference for FortiOS 5.0
get router info6 interface
router info6 interface
Use this command to display information about IPv6 interfaces.
Syntax
get router info6 interface <interface_name>
Example output
The command returns the status of the interface and the assigned IPv6 address.
dmz2 [administratively down/down]
2001:db8:85a3:8d3:1319:8a2e:370:7348
fe80::209:fff:fe04:4cfd
Fortinet Technologies Inc.
Page 1076 FortiOS™ - CLI Reference for FortiOS 5.0
get router info6 kernel
router info6 kernel
Use this command to display the FortiGate kernel routing table. The kernel routing table displays information about all of the routes in the kernel.
Syntax
get router info6 kernel
Fortinet Technologies Inc.
Page 1077 FortiOS™ - CLI Reference for FortiOS 5.0
get
router info6 ospf
Use this command to display information about the OSPF IPv6 configuration.
Syntax
get router info6 ospf
router info6 ospf
Fortinet Technologies Inc.
Page 1078 FortiOS™ - CLI Reference for FortiOS 5.0
get router info6 protocols
router info6 protocols
Use this command to display information about the configuration of all IPv6 dynamic routing protocols.
Syntax
get router info6 protocols
Fortinet Technologies Inc.
Page 1079 FortiOS™ - CLI Reference for FortiOS 5.0
get
router info6 rip
Use this command to display information about the RIPng configuration.
Syntax
get router info6 rip
router info6 rip
Fortinet Technologies Inc.
Page 1080 FortiOS™ - CLI Reference for FortiOS 5.0
get
router info6 routing-table
Use this command to display the routes in the IPv6 routing table.
Syntax
get router info6 routing-table <item> where <item> is one of the following:
Variable
<ipv6_ip> bgp connected database ospf rip static
Description
Destination IPv6 address or prefix.
Show BGP routing table entries.
Show connected routing table entries.
Show routing information base.
Show OSPF routing table entries.
Show RIP routing table entries.
Show static routing table entries.
router info6 routing-table
Fortinet Technologies Inc.
Page 1081 FortiOS™ - CLI Reference for FortiOS 5.0
get system admin list
system admin list
View a list of all the current administration sessions.
Syntax
get system admin list
Example output
# get system admin list username local device remote started admin sshv2 port1:172.20.120.148:22 172.20.120.16:4167 2006-08-
09 12:24:20 admin https port1:172.20.120.148:443 172.20.120.161:56365 2006-08-
09 12:24:20 admin https port1:172.20.120.148:443 172.20.120.16:4214 2006-08-
09 12:25:29 username
Name of the admin account for this session local
The protocol this session used to connect to the FortiGate unit.
device
The interface, IP address, and port used by this session to connect to the
FortiGate unit.
remote
The IP address and port used by the originating computer to connect to the
FortiGate unit.
started
The time the current session started.
Fortinet Technologies Inc.
Page 1082 FortiOS™ - CLI Reference for FortiOS 5.0
get system admin status
system admin status
View the status of the currently logged in admin and their session.
Syntax
get system admin status
Example
The output looks like this:
# get system admin status username: admin login local: sshv2 login device: port1:172.20.120.148:22 login remote: 172.20.120.16:4167 login vdom: root login started: 2006-08-09 12:24:20 current time: 2006-08-09 12:32:12 username login local
Name of the admin account currently logged in.
The protocol used to start the current session.
login device
The login information from the FortiGate unit including interface, IP address, and port number.
login remote
The computer the user is logging in from including the IP address and port number.
login vdom
The virtual domain the admin is current logged into.
login started
The time the current session started.
current time
The current time of day on the FortiGate unit
Fortinet Technologies Inc.
Page 1083 FortiOS™ - CLI Reference for FortiOS 5.0
get
system arp
View the ARP table entries on the FortiGate unit.
This command is not available in multiple VDOM mode.
Syntax
get system arp
Example output
# get system arp
Address Age(min) Hardware Addr Interface
172.20.120.16 0 00:0d:87:5c:ab:65 internal
172.20.120.138 0 00:08:9b:09:bb:01 internal
system arp
Fortinet Technologies Inc.
Page 1084 FortiOS™ - CLI Reference for FortiOS 5.0
get system auto-update
system auto-update
Use this command to display information about the status FortiGuard updates on the FortiGate unit.
Syntax
get system auto-update status get system auto-update versions
Example output
get system auto-update status
FDN availability: available at Thu Apr 1 08:22:58 2010
Push update: disable
Scheduled update: enable
Update daily: 8:22
Virus definitions update: enable
IPS definitions update: enable
Server override: disable
Push address override: disable
Web proxy tunneling: disable
Fortinet Technologies Inc.
Page 1085 FortiOS™ - CLI Reference for FortiOS 5.0
get
system central-management
View information about the Central Management System configuration.
Syntax
get system central-management
Example
The output looks like this:
FG600B3908600705 # get system central-management status : enable type : fortimanager auto-backup : disable schedule-config-restore: enable schedule-script-restore: enable allow-push-configuration: enable allow-pushd-firmware: enable allow-remote-firmware-upgrade: enable allow-monitor : enable fmg : 172.20.120.161 vdom : root authorized-manager-only: enable serial-number : "FMG-3K2404400063"
system central-management
Fortinet Technologies Inc.
Page 1086 FortiOS™ - CLI Reference for FortiOS 5.0
get system checksum
system checksum
View the checksums for global, root, and all configurations. These checksums are used by HA to compare the configurations of each cluster unit.
Syntax
get system checksum status
Example output
# get system checksum status global: 7a 87 3c 14 93 bc 98 92 b0 58 16 f2 eb bf a4 15 root: bb a4 80 07 42 33 c2 ff f1 b5 6e fe e4 bb 45 fb all: 1c 28 f1 06 fa 2e bc 1f ed bd 6b 21 f9 4b 12 88
Fortinet Technologies Inc.
Page 1087 FortiOS™ - CLI Reference for FortiOS 5.0
get system cmdb status
system cmdb status
View information about cmdbsvr on the FortiGate unit. FortiManager uses some of this information.
Syntax
get system cmdb status
Example output
# get system cmdb status version: 1 owner id: 18 update index: 6070 config checksum: 12879299049430971535 last request pid: 68 last request type: 29 last request: 78
Variable
version owner id update index config checksum last request pid last requst type last request
Description
Version of the cmdb software.
Process ID of the cmdbsvr daemon.
The updated index shows how many changes have been made in cmdb.
The config file version used by FortiManager.
The last process to access the cmdb.
Type of the last attempted access of cmdb.
The number of the last attempted access of cmdb.
Fortinet Technologies Inc.
Page 1088 FortiOS™ - CLI Reference for FortiOS 5.0
get system fortianalyzer-connectivity
system fortianalyzer-connectivity
Display connection and remote disk usage information about a connected FortiAnalyzer unit.
Syntax
get fortianalyzer-connectivity status
Example output
# get system fortianalyzer-connectivity status
Status: connected
Disk Usage: 0%
Fortinet Technologies Inc.
Page 1089 FortiOS™ - CLI Reference for FortiOS 5.0
get system fortiguard-log-service status
system fortiguard-log-service status
Command returns information about the status of the FortiGuard Log & Analysis Service including license and disk information.
Syntax
get system fortiguard-log-service status
Example output
# get system fortiguard-log-service status
FortiGuard Log & Analysis Service
Expire on: 20071231
Total disk quota: 1111 MB
Max daily volume: 111 MB
Current disk quota usage: n/a
Fortinet Technologies Inc.
Page 1090 FortiOS™ - CLI Reference for FortiOS 5.0
get system fortiguard-service status
system fortiguard-service status
COMMAND REPLACED. Command returns information about the status of the FortiGuard service including the name, version late update, method used for the last update and when the update expires. This information is shown for the AV Engine, virus definitions, attack definitions, and the IPS attack engine.
Syntax
get system fortiguard-service status
Example output
AV Engine 2.002 2006-01-26 19:45:00 manual 2006-06-12
08:00:00
Virus Definitions 6.513 2006-06-02 22:01:00 manual 2006-06-12
08:00:00
Attack Definitions 2.299 2006-06-09 19:19:00 manual 2006-06-12
08:00:00
IPS Attack Engine 1.015 2006-05-09 23:29:00 manual 2006-06-12
08:00:00
Fortinet Technologies Inc.
Page 1091 FortiOS™ - CLI Reference for FortiOS 5.0
get
system ha-nonsync-csum
FortiManager uses this command to obtain a system checksum.
Syntax
get system ha-nonsync-csum
system ha-nonsync-csum
Fortinet Technologies Inc.
Page 1092 FortiOS™ - CLI Reference for FortiOS 5.0
get system ha status
system ha status
Use this command to display information about an HA cluster. The command displays general
HA configuration settings. The command also displays information about how the cluster unit that you have logged into is operating in the cluster.
Usually you would log into the primary unit CLI using SSH or telnet. In this case the get system ha status command displays information about the primary unit first, and also displays the HA state of the primary unit (the primary unit operates in the work state). However, if you log into the primary unit and then use the execute ha manage command to log into a subordinate unit, (or if you use a console connection to log into a subordinate unit) the get system status command displays information about this subordinate unit first, and also displays the HA state of this subordinate unit. The state of a subordinate unit is work for an active-active cluster and standby for an active-passive cluster.
For a virtual cluster configuration, the get system ha status command displays information about how the cluster unit that you have logged into is operating in virtual cluster 1 and virtual cluster 2. For example, if you connect to the cluster unit that is the primary unit for virtual cluster 1 and the subordinate unit for virtual cluster 2, the output of the get system ha status command shows virtual cluster 1 in the work state and virtual cluster 2 in the standby state. The get system ha status command also displays additional information about virtual cluster 1 and virtual cluster 2.
Syntax
get system ha status
The command display includes the following fields. For more information see the examples that follow.
Variable
Model
Mode
Group
Debug ses_pickup load_balance schedule
Master
Slave
Description
The FortiGate model number.
The HA mode of the cluster: a-a or a-p.
The group ID of the cluster.
The debug status of the cluster.
The status of session pickup: enable or disable.
The status of the load-balance-all field: enable or disable. Displayed for active-active clusters only.
The active-active load balancing schedule. Displayed for active-active clusters only.
Master displays the device priority, host name, serial number, and actual cluster index of the primary (or master) unit.
Slave displays the device priority, host name, serial number, and actual cluster index of the subordinate (or slave, or backup) unit or units.
The list of cluster units changes depending on how you log into the CLI.
Usually you would use SSH or telnet to log into the primary unit CLI. In this case the primary unit would be at the top the list followed by the other cluster units.
If you use execute ha manage or a console connection to log into a subordinate unit CLI, and then enter get system ha status the subordinate unit that you have logged into appears at the top of the list of cluster units.
Fortinet Technologies Inc.
Page 1093 FortiOS™ - CLI Reference for FortiOS 5.0
get system ha status
Variable
number of vcluster
The number of virtual clusters. If virtual domains are not enabled, the cluster has one virtual cluster. If virtual domains are enabled the cluster has two virtual clusters.
vcluster 1
Description
The HA state (hello, work, or standby) and HA heartbeat IP address of the cluster unit that you have logged into in virtual cluster 1. If virtual domains are not enabled, vcluster 1 displays information for the cluster.
If virtual domains are enabled, vcluster 1 displays information for virtual cluster 1.
The HA heartbeat IP address is 10.0.0.1 if you are logged into a the primary unit of virtual cluster 1 and 10.0.0.2 if you are logged into a subordinate unit of virtual cluster 1. vcluster 1 also lists the primary unit (master) and subordinate units
(slave) in virtual cluster 1. The list includes the operating cluster index and serial number of each cluster unit in virtual cluster 1. The cluster unit that you have logged into is at the top of the list.
If virtual domains are not enabled and you connect to the primary unit CLI, the HA state of the cluster unit in virtual cluster 1 is work. The display lists the cluster units starting with the primary unit.
If virtual domains are not enabled and you connect to a subordinate unit
CLI, the HA state of the cluster unit in virtual cluster 1 is standby. The display lists the cluster units starting with the subordinate unit that you have logged into.
If virtual domains are enabled and you connect to the virtual cluster 1 primary unit CLI, the HA state of the cluster unit in virtual cluster 1 is work.
The display lists the cluster units starting with the virtual cluster 1 primary unit.
If virtual domains are enabled and you connect to the virtual cluster 1 subordinate unit CLI, the HA state of the cluster unit in virtual cluster 1 is standby. The display lists the cluster units starting with the subordinate unit that you are logged into.
In a cluster consisting of two cluster units operating without virtual domains enabled all clustering actually takes place in virtual cluster 1. HA is designed to work this way to support virtual clustering. If this cluster was operating with virtual domains enabled, adding virtual cluster 2 is similar to adding a new copy of virtual cluster 1. Virtual cluster 2 is visible in the get system ha status command output when you add virtual domains to virtual cluster 2.
Fortinet Technologies Inc.
Page 1094 FortiOS™ - CLI Reference for FortiOS 5.0
get
Variable
vcluster 2
system ha status
Description
vcluster 2 only appears if virtual domains are enabled. vcluster 2 displays the HA state (hello, work, or standby) and HA heartbeat IP address of the cluster unit that you have logged into in virtual cluster 2.
The HA heartbeat IP address is 10.0.0.2 if you are logged into the primary unit of virtual cluster 2 and 10.0.0.1 if you are logged into a subordinate unit of virtual cluster 2.
vcluster 2 also lists the primary unit (master) and subordinate units
(slave) in virtual cluster 2. The list includes the cluster index and serial number of each cluster unit in virtual cluster 2. The cluster unit that you have logged into is at the top of the list.
If you connect to the virtual cluster 2 primary unit CLI, the HA state of the cluster unit in virtual cluster 2 is work. The display lists the cluster units starting with the virtual cluster 2 primary unit.
If you connect to the virtual cluster 2 subordinate unit CLI, the HA state of the cluster unit in virtual cluster 2 is standby. The display lists the cluster units starting with the subordinate unit that you are logged into.
Fortinet Technologies Inc.
Page 1095 FortiOS™ - CLI Reference for FortiOS 5.0
get system info admin ssh
system info admin ssh
Use this command to display information about the SSH configuration on the FortiGate unit such as:
• the SSH port number
• the interfaces with SSH enabled
• the hostkey DSA fingerprint
• the hostkey RSA fingerprint
Syntax
get system info admin ssh
Example output
# get system info admin ssh
SSH v2 is enabled on port 22
SSH is enabled on the following 1 interfaces:
internal
SSH hostkey DSA fingerprint = cd:e1:87:70:bb:f0:9c:7d:e3:7b:73:f7:44:
23:a5:99
SSH hostkey RSA fingerprint = c9:5b:49:1d:7c:ba:be:f3:9d:39:33:4d:48:
9d:b8:49
Fortinet Technologies Inc.
Page 1096 FortiOS™ - CLI Reference for FortiOS 5.0
get system info admin status
system info admin status
Use this command to display administrators that are logged into the FortiGate unit.
Syntax
get system info admin status
Example
This shows sample output.
Index User name Login type From
0 admin CLI ssh(172.20.120.16)
1 admin WEB 172.20.120.16
Index
User name
Login type
From
The order the administrators logged in.
The name of the user account logged in.
Which interface was used to log in.
The IP address this user logged in from.
Related topics
•
Fortinet Technologies Inc.
Page 1097 FortiOS™ - CLI Reference for FortiOS 5.0
get system interface physical
system interface physical
Use this command to list information about the unit’s physical network interfaces.
Syntax
get system interface physical
The output looks like this:
# get system interface physical
== [onboard]
==[dmz1]
mode: static
ip: 0.0.0.0 0.0.0.0
status: down
speed: n/a
==[dmz2]
mode: static
ip: 0.0.0.0 0.0.0.0
status: down
speed: n/a
==[internal]
mode: static
ip: 172.20.120.146 255.255.255.0
status: up speed: 100
==[wan1]
mode: pppoe
ip: 0.0.0.0 0.0.0.0
status: down
speed: n/a
==[wan2]
mode: static
ip: 0.0.0.0 0.0.0.0
status: down
speed: n/a
==[modem]
mode: static
ip: 0.0.0.0 0.0.0.0
status: down
speed: n/a
Fortinet Technologies Inc.
Page 1098 FortiOS™ - CLI Reference for FortiOS 5.0
get system mgmt-csum
system mgmt-csum
FortiManager uses this command to obtain checksum information from FortiGate units.
Syntax
get system mgmt-csum {global | vdom | all} where global retrieves global object checksums vdom retrieves VDOM object checksums all retrieves all object checksums.
Fortinet Technologies Inc.
Page 1099 FortiOS™ - CLI Reference for FortiOS 5.0
get system performance firewall
system performance firewall
Use this command to display packet distribution and traffic statistics information for the
FortiGate firewall.
Syntax
get system performance firewall packet-distribution get system performance firewall statistics
Variable Description
packet-distribution Display a list of packet size ranges and the number of packets of each size accepted by the firewall since the system restarted. You can use this information to learn about the packet size distribution on your network.
statistics
Display a list of traffic types (browsing, email, DNS etc) and the number of packets and number of payload bytes accepted by the firewall for each type since the FortiGate unit was restarted.
Example output
get system performance firewall packet-distribution getting packet distribution statistics...
0 bytes - 63 bytes: 655283 packets
64 bytes - 127 bytes: 1678278 packets
128 bytes - 255 bytes: 58823 packets
256 bytes - 383 bytes: 70432 packets
384 bytes - 511 bytes: 1610 packets
512 bytes - 767 bytes: 3238 packets
768 bytes - 1023 bytes: 7293 packets
1024 bytes - 1279 bytes: 18865 packets
1280 bytes - 1500 bytes: 58193 packets
> 1500 bytes: 0 packets get system performance firewall statistics getting traffic statistics...
Browsing: 623738 packets, 484357448 bytes
DNS: 5129187383836672 packets, 182703613804544 bytes
E-Mail: 23053606 packets, 2 bytes
FTP: 0 packets, 0 bytes
Gaming: 0 packets, 0 bytes
IM: 0 packets, 0 bytes
Newsgroups: 0 packets, 0 bytes
P2P: 0 packets, 0 bytes
Streaming: 0 packets, 0 bytes
TFTP: 654722117362778112 packets, 674223966126080 bytes
VoIP: 16834455 packets, 10 bytes
Generic TCP: 266287972352 packets, 8521215115264 bytes
Generic UDP: 0 packets, 0 bytes
Generic ICMP: 0 packets, 0 bytes
Generic IP: 0 packets, 0 bytes
Fortinet Technologies Inc.
Page 1100 FortiOS™ - CLI Reference for FortiOS 5.0
get system performance status
system performance status
Use this command to display FortiGate CPU usage, memory usage, network usage, sessions, virus, IPS attacks, and system up time.
Syntax
get system performance status
Variable
CPU states
Description
The percentages of CPU cycles used by user, system, nice and idle categories of processes. These categories are:
• user -CPU usage of normal user-space processes
• system -CPU usage of kernel
• nice - CPU usage of user-space processes having other-thannormal running priority
• idle - Idle CPU cycles
Adding user, system, and nice produces the total CPU usage as seen on the CPU widget on the web-based system status dashboard.
Memory states
Average sessions
The percentage of memory used.
Average network usage
The average amount of network traffic in kbps in the last 1, 10 and 30 minutes.
The average number of sessions connected to the FortiGate unit over the list 1, 10 and 30 minutes.
Virus caught
The number of viruses the FortiGate unit has caught in the last 1 minute.
IPS attacks blocked
The number of IPS attacks that have been blocked in the last 1 minute.
Uptime
How long since the FortiGate unit has been restarted.
Example output
# get system performance status
CPU states: 0% user 0% system 0% nice 100% idle
Memory states: 18% used
Average network usage: 0 kbps in 1 minute, 0 kbps in 10 minutes, 1 kbps in 30 minutes
Average sessions: 5 sessions in 1 minute, 6 sessions in 10 minutes, 5 sessions in 30 minutes
Virus caught: 0 total in 1 minute
IPS attacks blocked: 0 total in 1 minute
Uptime: 9days, 22 hours, 0 minutes
Fortinet Technologies Inc.
Page 1101 FortiOS™ - CLI Reference for FortiOS 5.0
get system performance top
system performance top
Use this command to display the list of processes running on the FortiGate unit (similar to the
Linux top command).
You can use the following commands when get system performance top is running:
• Press Q or Ctrl+C to quit.
• Press P to sort the processes by the amount of CPU that the processes are using.
• Press M to sort the processes by the amount of memory that the processes are using.
Syntax
get system performance top [<delay_int>] <max_lines_int>]]
Variable
<delay_int>
Description
The delay, in seconds, between updating the process list. The default is
5 seconds.
<max_lines_int>
The maximum number of processes displayed in the output. The default is
20 lines.
Fortinet Technologies Inc.
Page 1102 FortiOS™ - CLI Reference for FortiOS 5.0
get system session list
system session list
Command returns a list of all the sessions active on the FortiGate unit. or the current virtual domain if virtual domain mode is enabled.
Syntax
get system session list
Example output
PROTO EXPIRE SOURCE SOURCE-
NAT DESTINATION DESTINATION-NAT tcp 0 127.0.0.1:1083 - 127.0.0.1:514 - tcp 0 127.0.0.1:1085 - 127.0.0.1:514 - tcp 10 127.0.0.1:1087 - 127.0.0.1:514 - tcp 20 127.0.0.1:1089 - 127.0.0.1:514 - tcp 30 127.0.0.1:1091 - 127.0.0.1:514 - tcp 40 127.0.0.1:1093 - 127.0.0.1:514 - tcp 60 127.0.0.1:1097 - 127.0.0.1:514 - tcp 70 127.0.0.1:1099 - 127.0.0.1:514 - tcp 80 127.0.0.1:1101 - 127.0.0.1:514 - tcp 90 127.0.0.1:1103 - 127.0.0.1:514 - tcp 100 127.0.0.1:1105 - 127.0.0.1:514 - tcp 110 127.0.0.1:1107 - 127.0.0.1:514 - tcp 103 172.20.120.16:3548 - 172.20.120.133:22 - tcp 3600 172.20.120.16:3550 - 172.20.120.133:22 - udp 175 127.0.0.1:1026 - 127.0.0.1:53 - tcp 5 127.0.0.1:1084 - 127.0.0.1:514 - tcp 5 127.0.0.1:1086 - 127.0.0.1:514 - tcp 15 127.0.0.1:1088 - 127.0.0.1:514 - tcp 25 127.0.0.1:1090 - 127.0.0.1:514 - tcp 45 127.0.0.1:1094 - 127.0.0.1:514 - tcp 59 127.0.0.1:1098 - 127.0.0.1:514 - tcp 69 127.0.0.1:1100 - 127.0.0.1:514 - tcp 79 127.0.0.1:1102 - 127.0.0.1:514 - tcp 99 127.0.0.1:1106 - 127.0.0.1:514 - tcp 109 127.0.0.1:1108 - 127.0.0.1:514 - tcp 119 127.0.0.1:1110 - 127.0.0.1:514 -
Variable
PROTO
EXPIRE
SOURCE
Description
The transfer protocol of the session.
How long before this session will terminate.
The source IP address and port number.
SOURCE-NAT
DESTINATION
The source of the NAT. ‘-’ indicates there is no NAT.
The destination IP address and port number.
DESTINATION-NAT
The destination of the NAT. ‘-’ indicates there is no NAT.
Fortinet Technologies Inc.
Page 1103 FortiOS™ - CLI Reference for FortiOS 5.0
get system session status
system session status
Use this command to display the number of active sessions on the FortiGate unit, or if virtual domain mode is enabled it returns the number of active sessions on the current VDOM. In both situations it will say ‘the current VDOM.
Syntax
get system session status
Example output
The total number of sessions for the current VDOM: 3100
Fortinet Technologies Inc.
Page 1104 FortiOS™ - CLI Reference for FortiOS 5.0
get system session-helper-info list
system session-helper-info list
Use this command to list the FortiGate session helpers and the protocol and port number configured for each one.
Syntax
get system sesion-helper-info list
Example output
pptp sip mms tns h245 h323 ras tftp list builtin help module: mgcp dcerpc rsh pmap dns-tcp dns-udp rtsp ftp list session help: help=pmap, protocol=17 port=111 help=rtsp, protocol=6 port=8554 help=rtsp, protocol=6 port=554 help=pptp, protocol=6 port=1723 help=rtsp, protocol=6 port=7070 help=sip, protocol=17 port=5060 help=pmap, protocol=6 port=111 help=rsh, protocol=6 port=512 help=dns-udp, protocol=17 port=53 help=tftp, protocol=17 port=69 help=tns, protocol=6 port=1521 help=mgcp, protocol=17 port=2727 help=dcerpc, protocol=17 port=135 help=rsh, protocol=6 port=514 help=ras, protocol=17 port=1719 help=ftp, protocol=6 port=21 help=mgcp, protocol=17 port=2427 help=dcerpc, protocol=6 port=135 help=mms, protocol=6 port=1863 help=h323, protocol=6 port=1720
Fortinet Technologies Inc.
Page 1105 FortiOS™ - CLI Reference for FortiOS 5.0
get system session-info
system session-info
Use this command to display session information.
Syntax
get system session-info expectation get system session-info full-stat get system session-info list get system session-info statistics get system session-info ttl
Variable Description
expectation
Display expectation sessions. full-stat
Display detailed information about the FortiGate session table including a session table and expect session table summary, firewall error statistics, and other information.
list
Display detailed information about all current FortiGate sessions. For each session the command displays the protocol number, traffic shaping information, policy information, state information, statistics and other information.
statistics
Display the same information as the full-stat command except for the session table and expect session table summary.
ttl
Display the current setting of the including the overall session timeout as well as the timeouts for specific protocols.
config system session-ttl command
Example output
get system session-info statistics misc info: session_count=15 exp_count=0 clash=0 memory_tension_drop=0 ephemeral=1/32752 removeable=14 delete=0, flush=0, dev_down=0/0 firewall error stat: error1=00000000 error2=00000000 error3=00000000 error4=00000000 tt=00000000 cont=00000000 ids_recv=00000000 url_recv=00000000 av_recv=00000000 fqdn_count=00000001 tcp reset stat:
syncqf=0 acceptqf=0 no-listener=227 data=0 ses=0 ips=0 global: ses_limit=0 ses6_limit=0 rt_limit=0 rt6_limit=0
Fortinet Technologies Inc.
Page 1106 FortiOS™ - CLI Reference for FortiOS 5.0
get system source-ip
system source-ip
Use this command to list defined source-IPs.
Syntax
get system source-ip
Example output
# get sys source-ip status
The following services force their communication to use a specific source IP address: service=NTP source-ip=172.18.19.101
service=DNS source-ip=172.18.19.101
vdom=root service=RADIUS name=server-pc25 source-ip=10.1.100.101
vdom=root service=TACACS+ name=tac_plus_pc25 source-ip=10.1.100.101
vdom=root service=FSAE name=pc26 source-ip=172.18.19.101
vdom=V1 service=RADIUS name=pc25-Radius source-ip=172.16.200.101
vdom=V1 service=TACACS+ name=pc25-tacacs+ source-ip=172.16.200.101
vdom=V1 service=FSAE name=pc16 source-ip=172.16.200.101
Fortinet Technologies Inc.
Page 1107 FortiOS™ - CLI Reference for FortiOS 5.0
get system startup-error-log
system startup-error-log
Use this command to display information about system startup errors. This command only displays information if an error occurs when the FortiGate unit starts up.
Syntax
get system startup-error-log
Fortinet Technologies Inc.
Page 1108 FortiOS™ - CLI Reference for FortiOS 5.0
get system status
system status
Use this command to display system status information including:
• FortiGate firmware version, build number and branch point
• virus and attack definitions version
• FortiGate unit serial number and BIOS version
• log hard disk availability
• host name
• operation mode
• virtual domains status: current VDOM, max number of VDOMs, number of NAT and TP mode
VDOMs and VDOM status
• current HA status
• system time
• the revision of the WiFi chip in a FortiWiFi unit
Syntax
get system status
Example output
Version: Fortigate-620B v4.0,build0271,100330 (MR2)
Virus-DB: 11.00643(2010-03-31 17:49)
Extended DB: 11.00643(2010-03-31 17:50)
Extreme DB: 0.00000(2003-01-01 00:00)
IPS-DB: 2.00778(2010-03-31 12:55)
FortiClient application signature package: 1.167(2010-04-01 10:11)
Serial-Number: FG600B3908600705
BIOS version: 04000006
Log hard disk: Available
Hostname: 620_ha_1
Operation Mode: NAT
Current virtual domain: root
Max number of virtual domains: 10
Virtual domains status: 1 in NAT mode, 0 in TP mode
Virtual domain configuration: disable
FIPS-CC mode: disable
Current HA mode: a-p, master
Distribution: International
Branch point: 271
Release Version Information: MR2
System time: Thu Apr 1 15:27:29 2010
Fortinet Technologies Inc.
Page 1109 FortiOS™ - CLI Reference for FortiOS 5.0
get
test
test
Use this command to display information about FortiGate applications and perform operations on FortiGate applications. You can specify an application name and a test level. Enter ? to display the list of applications. The test level performs various functions depending on the application but can include displaying memory usage, dropping connections and restarting the application.
The test levels are different for different applications. In some cases when you enter the command and include an application name but no test level (or an invalid test level) the command output includes a list of valid test levels.
Syntax
get test <application_name_str> <test_level_int>
Example output
get test http
Proxy Worker 0 - http
[0:H] HTTP Proxy Test Usage
[0:H]
[0:H] 2: Drop all connections
[0:H] 22: Drop max idle connections
[0:H] 222: Drop all idle connections
[0:H] 4: Display connection stat
[0:H] 44: Display info per connection
[0:H] 444: Display connections per state
[0:H] 4444: Display per-VDOM statistics
[0:H] 44444: Display information about idle connections
[0:H] 55: Display tcp info per connection get test http 4
HTTP Common
Current Connections 0/8032
HTTP Stat
Bytes sent 0 (kb)
Bytes received 0 (kb)
Error Count (alloc) 0
Error Count (accept) 0
Error Count (bind) 0
Error Count (connect) 0
Error Count (socket) 0
Error Count (read) 0
Error Count (write) 0
Error Count (retry) 0
Error Count (poll) 0
Error Count (scan reset) 0
Error Count (urlfilter wait) 0
Fortinet Technologies Inc.
Page 1110 FortiOS™ - CLI Reference for FortiOS 5.0
get
Last Error 0
Web responses clean 0
Web responses scan errors 0
Web responses detected 0
Web responses infected with worms 0
Web responses infected with viruses 0
Web responses infected with susp 0
Web responses file blocked 0
Web responses file exempt 0
Web responses bannedword detected 0
Web requests oversize pass 0
Web requests oversize block 0
URL requests exempt 0
URL requests blocked 0
URL requests passed 0
URL requests submit error 0
URL requests rating error 0
URL requests rating block 0
URL requests rating allow 0
URL requests infected with worms 0
Web requests detected 0
Web requests file blocked 0
Web requests file exempt 0
POST requests clean 0
POST requests scan errors 0
POST requests infected with viruses 0
POST requests infected with susp 0
POST requests file blocked 0
POST requests bannedword detected 0
POST requests oversize pass 0
POST requests oversize block 0
Web request backlog drop 0
Web response backlog drop 0
HTTP Accounting setup_ok=0 setup_fail=0 conn_ok=0 conn_inp=0 urlfilter=0/0/0 uf_lookupf=0 scan=0 clt=0 srv=0
test
Fortinet Technologies Inc.
Page 1111 FortiOS™ - CLI Reference for FortiOS 5.0
get
user adgrp
user adgrp
Use this command to list Directory Service user groups.
Syntax
get user adgrp [<dsgroupname>]
If you do not specify a group name, the command returns information for all Directory Service groups. For example:
== [ DOCTEST/Cert Publishers ] name: DOCTEST/Cert Publishers server-name: DSserv1
== [ DOCTEST/Developers ] name: DOCTEST/Developers server-name: DSserv1
== [ DOCTEST/Domain Admins ] name: DOCTEST/Domain Admins server-name: DSserv1
== [ DOCTEST/Domain Computers ] name: DOCTEST/Domain Computers server-name: DSserv1
== [ DOCTEST/Domain Controllers ] name: DOCTEST/Domain Controllers server-name: DSserv1
== [ DOCTEST/Domain Guests ] name: DOCTEST/Domain Guests server-name: DSserv1
== [ DOCTEST/Domain Users ] name: DOCTEST/Domain Users server-name: DSserv1
== [ DOCTEST/Enterprise Admins ] name: DOCTEST/Enterprise Admins server-name: DSserv1
== [ DOCTEST/Group Policy Creator Owners ] name: DOCTEST/Group Policy Creator Owners server-name: DSserv1
== [ DOCTEST/Schema Admins ] name: DOCTEST/Schema Admins server-name: DSserv1
If you specify a Directory Service group name, the command returns information for only that group. For example: name : DOCTEST/Developers server-name : ADserv1
The server-name is the name you assigned to the Directory Service server when you configured it in the user fsae command.
Fortinet Technologies Inc.
Page 1112 FortiOS™ - CLI Reference for FortiOS 5.0
get
vpn ike gateway
Use this command to display information about FortiGate IPsec VPN IKE gateways.
Syntax
get vpn ike gateway [<gateway_name_str>]
vpn ike gateway
Fortinet Technologies Inc.
Page 1113 FortiOS™ - CLI Reference for FortiOS 5.0
get
vpn ipsec tunnel details
Use this command to display information about IPsec tunnels.
Syntax
get vpn ipsec tunnel details
vpn ipsec tunnel details
Fortinet Technologies Inc.
Page 1114 FortiOS™ - CLI Reference for FortiOS 5.0
get
vpn ipsec tunnel name
Use this command to display information about a specified IPsec VPN tunnel.
Syntax
get vpn ipsec tunnel name <tunnel_name_str>
vpn ipsec tunnel name
Fortinet Technologies Inc.
Page 1115 FortiOS™ - CLI Reference for FortiOS 5.0
get vpn ipsec stats crypto
vpn ipsec stats crypto
Use this command to display information about the FortiGate hardware and software crypto configuration.
Syntax
get vpn ipsec stats crypto
Example output
get vpn ipsec stats crypto
IPsec crypto devices in use:
CP6 (encrypted/decrypted):
null: 0 0
des: 0 0
3des: 0 0
aes: 0 0
CP6 (generated/validated):
null: 0 0
md5: 0 0
sha1: 0 0
sha256: 0 0
SOFTWARE (encrypted/decrypted):
null: 0 0
des: 0 0
3des: 0 0
aes: 0 0
SOFTWARE (generated/validated):
null: 0 0
md5: 0 0
sha1: 0 0
sha256: 0 0
Fortinet Technologies Inc.
Page 1116 FortiOS™ - CLI Reference for FortiOS 5.0
get
vpn ipsec stats tunnel
Use this command to view information about IPsec tunnels.
Syntax
get vpn ipsec stats tunnel
Example output
#get vpn ipsec stats tunnel tunnels
total: 0
static/ddns: 0
dynamic: 0
manual: 0
errors: 0 selectors
total: 0
up: 0
vpn ipsec stats tunnel
Fortinet Technologies Inc.
Page 1117 FortiOS™ - CLI Reference for FortiOS 5.0
get vpn ssl monitor
vpn ssl monitor
Use this command to display information about logged in SSL VPN users and current SSL VPN sessions.
Syntax
get vpn ssl monitor
Example output
Fortinet Technologies Inc.
Page 1118 FortiOS™ - CLI Reference for FortiOS 5.0
get
vpn status l2tp
Use this command to display information about L2TP tunnels.
Syntax
get vpn status l2tp
vpn status l2tp
Fortinet Technologies Inc.
Page 1119 FortiOS™ - CLI Reference for FortiOS 5.0
get
vpn status pptp
Use this command to display information about PPTP tunnels.
Syntax
get vpn status pptp
vpn status pptp
Fortinet Technologies Inc.
Page 1120 FortiOS™ - CLI Reference for FortiOS 5.0
get vpn status ssl
vpn status ssl
Use this command to display SSL VPN tunnels and to also verify that the FortiGate unit includes the CP6 or greater FortiASIC device that supports SSL acceleration.
Syntax
get vpn status ssl hw-acceleration-status get vpn status ssl list
Variable
list
Description
hw-acceleration-status
Display whether or not the FortiGate unit contains a FortiASIC device that supports SSL acceleration.
Display information about all configured SSL VPN tunnels.
Fortinet Technologies Inc.
Page 1121 FortiOS™ - CLI Reference for FortiOS 5.0
get webfilter ftgd-statistics
webfilter ftgd-statistics
Use this command to display FortiGuard Web Filtering rating cache and daemon statistics.
Syntax
get webfilter ftgd-statistics
Example output
get webfilter ftgd-statistics
Rating Statistics:
=====================
DNS failures : 0
DNS lookups : 0
Data send failures : 0
Data read failures : 0
Wrong package type : 0
Hash table miss : 0
Unknown server : 0
Incorrect CRC : 0
Proxy request failures : 0
Request timeout : 0
Total requests : 0
Requests to FortiGuard servers : 0
Server errored responses : 0
Relayed rating : 0
Invalid profile : 0
Allowed : 0
Blocked : 0
Logged : 0
Errors : 0
Cache Statistics:
=====================
Maximum memory : 0
Memory usage : 0
Nodes : 0
Leaves : 0
Prefix nodes : 0
Exact nodes : 0
Requests : 0
Misses : 0
Hits : 0
Prefix hits : 0
Exact hits : 0
Fortinet Technologies Inc.
Page 1122 FortiOS™ - CLI Reference for FortiOS 5.0
get
No cache directives : 0
Add after prefix : 0
Invalid DB put : 0
DB updates : 0
Percent full : 0%
Branches : 0%
Leaves : 0%
Prefix nodes : 0%
Exact nodes : 0%
Miss rate : 0%
Hit rate : 0%
Prefix hits : 0%
Exact hits : 0%
webfilter ftgd-statistics
Fortinet Technologies Inc.
Page 1123 FortiOS™ - CLI Reference for FortiOS 5.0
get
webfilter status
Use this command to display FortiGate Web Filtering rating information.
Syntax
get webfilter status [<refresh-rate_int>]
webfilter status
Fortinet Technologies Inc.
Page 1124 FortiOS™ - CLI Reference for FortiOS 5.0
get wireless-controller rf-analysis
wireless-controller rf-analysis
Use this command to show information about RF conditions at the access point.
Syntax
get wireless-controller rf-analysis [<wtp_id>]
Example output
# get wireless-controller rf-analysis
<wtp-id> wtp id
FWF60C3G11004319 (global) # get wireless-controller rf-analysis
WTP: FWF60C-WIFI0 0-127.0.0.1:15246
channel rssi-total rf-score overlap-ap interfere-ap
1 418 1 24 26
2 109 5 0 34
3 85 7 1 34
4 64 9 0 35
5 101 6 1 35
6 307 1 8 11
7 82 7 0 16
8 69 8 1 15
9 42 10 0 15
10 53 10 0 14
11 182 1 5 6
12 43 10 0 6
13 20 10 0 5
14 8 10 0 5
Controller: FWF60C3G11004319-0
channel rssi_total
1 418
2 109
3 85
4 64
5 101
6 307
7 82
8 69
9 42
10 53
11 182
12 43
13 20
14 8
Fortinet Technologies Inc.
Page 1125 FortiOS™ - CLI Reference for FortiOS 5.0
get wireless-controller scan
wireless-controller scan
Use this command to view the list of access points detected by wireless scanning.
Syntax
get wireless-controller scan
Example output
CMW SSID BSSID CHAN RATE S:N INT CAPS ACT LIVE AGE
WIRED
UNN 00:0e:8f:24:18:6d 64 54M 16:0 100 Es N 62576 1668
?
UNN ftiguest 00:15:55:23:d8:62 157 130M 6:0 100 EPs N 98570 2554
?
Fortinet Technologies Inc.
Page 1126 FortiOS™ - CLI Reference for FortiOS 5.0
get
wireless-controller status
Use this command to view the numbers of wtp sessions and clients.
Syntax
get wireless-controller status
Example output
# get wireless-controller status
Wireless Controller :
wtp-session-count: 1
client-count : 1/0
wireless-controller status
Fortinet Technologies Inc.
Page 1127 FortiOS™ - CLI Reference for FortiOS 5.0
get
wireless-controller vap-status
Use this command to view information about your SSIDs.
Syntax
get wireless-controller vap-status
Example output
# get wireless-controller vap-status
WLAN: mesh.root
name : mesh.root
vdom : root
ssid : fortinet.mesh.root
status : up
mesh backhaul : yes
ip : 0.0.0.0
mac : 00:ff:0a:57:95:ca
station info : 0/0
WLAN: wifi
name : wifi
vdom : root
ssid : ft-mesh
status : up
mesh backhaul : yes
ip : 10.10.80.1
mac : 00:ff:45:e1:55:81
station info : 1/0
wireless-controller vap-status
Fortinet Technologies Inc.
Page 1128 FortiOS™ - CLI Reference for FortiOS 5.0
get wireless-controller wlchanlistlic
wireless-controller wlchanlistlic
Use this command to display a list of the channels allowed in your region, including
• the maximum permitted power for each channel
• the channels permitted for each wireless type (802.11n, for example)
The list is in XML format.
Syntax
get wireless-controller wlchanlistlic
Sample output
country name: UNITED STATES2, country code:841, iso name:US channels on 802.11A band without channel bonding: channel= 36 maxRegTxPower= 23 maxTxPower= 63/2 minTxPower= 63/2 channel= 40 maxRegTxPower= 23 maxTxPower= 63/2 minTxPower= 63/2 channel= 44 maxRegTxPower= 23 maxTxPower= 63/2 minTxPower= 63/2 channel= 48 maxRegTxPower= 23 maxTxPower= 63/2 minTxPower= 63/2 channel=149 maxRegTxPower= 30 maxTxPower= 63/2 minTxPower= 63/2 channel=153 maxRegTxPower= 30 maxTxPower= 63/2 minTxPower= 63/2 channel=157 maxRegTxPower= 30 maxTxPower= 63/2 minTxPower= 63/2 channel=161 maxRegTxPower= 30 maxTxPower= 63/2 minTxPower= 63/2 channel=165 maxRegTxPower= 30 maxTxPower= 63/2 minTxPower= 63/2 channels on 802.11B band without channel bonding: channel= 1 maxRegTxPower= 27 maxTxPower= 63/2 minTxPower= 63/2 channel= 2 maxRegTxPower= 27 maxTxPower= 63/2 minTxPower= 63/2 channel= 3 maxRegTxPower= 27 maxTxPower= 63/2 minTxPower= 63/2 channel= 4 maxRegTxPower= 27 maxTxPower= 63/2 minTxPower= 63/2 channel= 5 maxRegTxPower= 27 maxTxPower= 63/2 minTxPower= 63/2 channel= 6 maxRegTxPower= 27 maxTxPower= 63/2 minTxPower= 63/2 channel= 7 maxRegTxPower= 27 maxTxPower= 63/2 minTxPower= 63/2 channel= 8 maxRegTxPower= 27 maxTxPower= 63/2 minTxPower= 63/2 channel= 9 maxRegTxPower= 27 maxTxPower= 63/2 minTxPower= 63/2 channel= 10 maxRegTxPower= 27 maxTxPower= 63/2 minTxPower= 63/2 channel= 11 maxRegTxPower= 27 maxTxPower= 63/2 minTxPower= 63/2 channels on 802.11G band without channel bonding: channel= 1 maxRegTxPower= 27 maxTxPower= 63/2 minTxPower= 63/2 channel= 2 maxRegTxPower= 27 maxTxPower= 63/2 minTxPower= 63/2 channel= 3 maxRegTxPower= 27 maxTxPower= 63/2 minTxPower= 63/2 channel= 4 maxRegTxPower= 27 maxTxPower= 63/2 minTxPower= 63/2 channel= 5 maxRegTxPower= 27 maxTxPower= 63/2 minTxPower= 63/2 channel= 6 maxRegTxPower= 27 maxTxPower= 63/2 minTxPower= 63/2 channel= 7 maxRegTxPower= 27 maxTxPower= 63/2 minTxPower= 63/2 channel= 8 maxRegTxPower= 27 maxTxPower= 63/2 minTxPower= 63/2 channel= 9 maxRegTxPower= 27 maxTxPower= 63/2 minTxPower= 63/2
Fortinet Technologies Inc.
Page 1129 FortiOS™ - CLI Reference for FortiOS 5.0
get wireless-controller wlchanlistlic
channel= 10 maxRegTxPower= 27 maxTxPower= 63/2 minTxPower= 63/2 channel= 11 maxRegTxPower= 27 maxTxPower= 63/2 minTxPower= 63/2 channels on 802.11N 2.4GHz band without channel bonding: channel= 1 maxRegTxPower= 27 maxTxPower= 63/2 minTxPower= 63/2 channel= 2 maxRegTxPower= 27 maxTxPower= 63/2 minTxPower= 63/2 channel= 3 maxRegTxPower= 27 maxTxPower= 63/2 minTxPower= 63/2 channel= 4 maxRegTxPower= 27 maxTxPower= 63/2 minTxPower= 63/2 channel= 5 maxRegTxPower= 27 maxTxPower= 63/2 minTxPower= 63/2 channel= 6 maxRegTxPower= 27 maxTxPower= 63/2 minTxPower= 63/2 channel= 7 maxRegTxPower= 27 maxTxPower= 63/2 minTxPower= 63/2 channel= 8 maxRegTxPower= 27 maxTxPower= 63/2 minTxPower= 63/2 channel= 9 maxRegTxPower= 27 maxTxPower= 63/2 minTxPower= 63/2 channel= 10 maxRegTxPower= 27 maxTxPower= 63/2 minTxPower= 63/2 channel= 11 maxRegTxPower= 27 maxTxPower= 63/2 minTxPower= 63/2 channels on 802.11N 2.4GHz band with channel bonding plus: channel= 1 maxRegTxPower= 27 maxTxPower= 63/2 minTxPower= 63/2 channel= 2 maxRegTxPower= 27 maxTxPower= 63/2 minTxPower= 63/2 channel= 3 maxRegTxPower= 27 maxTxPower= 63/2 minTxPower= 63/2 channel= 4 maxRegTxPower= 27 maxTxPower= 63/2 minTxPower= 63/2 channel= 5 maxRegTxPower= 27 maxTxPower= 63/2 minTxPower= 63/2 channel= 6 maxRegTxPower= 27 maxTxPower= 63/2 minTxPower= 63/2 channel= 7 maxRegTxPower= 27 maxTxPower= 63/2 minTxPower= 63/2 channels on 802.11N 2.4GHz band with channel bonding minus: channel= 5 maxRegTxPower= 27 maxTxPower= 63/2 minTxPower= 63/2 channel= 6 maxRegTxPower= 27 maxTxPower= 63/2 minTxPower= 63/2 channel= 7 maxRegTxPower= 27 maxTxPower= 63/2 minTxPower= 63/2 channel= 8 maxRegTxPower= 27 maxTxPower= 63/2 minTxPower= 63/2 channel= 9 maxRegTxPower= 27 maxTxPower= 63/2 minTxPower= 63/2 channel= 10 maxRegTxPower= 27 maxTxPower= 63/2 minTxPower= 63/2 channel= 11 maxRegTxPower= 27 maxTxPower= 63/2 minTxPower= 63/2 channels on 802.11N 5GHz band without channel bonding: channel= 36 maxRegTxPower= 23 maxTxPower= 63/2 minTxPower= 63/2 channel= 40 maxRegTxPower= 23 maxTxPower= 63/2 minTxPower= 63/2 channel= 44 maxRegTxPower= 23 maxTxPower= 63/2 minTxPower= 63/2 channel= 48 maxRegTxPower= 23 maxTxPower= 63/2 minTxPower= 63/2 channel=149 maxRegTxPower= 30 maxTxPower= 63/2 minTxPower= 63/2 channel=153 maxRegTxPower= 30 maxTxPower= 63/2 minTxPower= 63/2 channel=157 maxRegTxPower= 30 maxTxPower= 63/2 minTxPower= 63/2 channel=161 maxRegTxPower= 30 maxTxPower= 63/2 minTxPower= 63/2 channel=165 maxRegTxPower= 30 maxTxPower= 63/2 minTxPower= 63/2 channels on 802.11N 5GHz band with channel bonding all: channel= 36 maxRegTxPower= 23 maxTxPower= 63/2 minTxPower= 63/2 channel= 40 maxRegTxPower= 23 maxTxPower= 63/2 minTxPower= 63/2 channel= 44 maxRegTxPower= 23 maxTxPower= 63/2 minTxPower= 63/2
Fortinet Technologies Inc.
Page 1130 FortiOS™ - CLI Reference for FortiOS 5.0
get wireless-controller wlchanlistlic
channel= 48 maxRegTxPower= 23 maxTxPower= 63/2 minTxPower= 63/2 channel=149 maxRegTxPower= 30 maxTxPower= 63/2 minTxPower= 63/2 channel=153 maxRegTxPower= 30 maxTxPower= 63/2 minTxPower= 63/2 channel=157 maxRegTxPower= 30 maxTxPower= 63/2 minTxPower= 63/2 channel=161 maxRegTxPower= 30 maxTxPower= 63/2 minTxPower= 63/2
Fortinet Technologies Inc.
Page 1131 FortiOS™ - CLI Reference for FortiOS 5.0
get wireless-controller wtp-status
wireless-controller wtp-status
Syntax
get wireless-controller wtp-status
Example output
# get wireless-controller wtp-status
WTP: FAP22B3U11005354 0-192.168.3.110:5246
wtp-id : FAP22B3U11005354
region-code :
name :
mesh-uplink : mesh
mesh-downlink : disabled
mesh-hop-count : 1
parent-wtp-id :
software-version :
local-ipv4-addr : 0.0.0.0
board-mac : 00:00:00:00:00:00
join-time : Mon Apr 2 10:23:32 2012
connection-state : Disconnected
image-download-progress: 0
last-failure : 0 -- N/A
last-failure-param:
last-failure-time: N/A
Radio 1 : Monitor
Radio 2 : Ap
country-name : NA
country-code : N/A
client-count : 0
base-bssid : 00:00:00:00:00:00
max-vaps : 7
oper-chan : 0
Radio 3 : Not Exist
WTP: FWF60C-WIFI0 0-127.0.0.1:15246
wtp-id : FWF60C-WIFI0
region-code : ALL
name :
mesh-uplink : ethernet
mesh-downlink : enabled
mesh-hop-count : 0
parent-wtp-id :
software-version : FWF60C-v5.0-build041
local-ipv4-addr : 127.0.0.1
board-mac : 00:09:0f:fe:cc:56
join-time : Mon Apr 2 10:23:35 2012
connection-state : Connected
image-download-progress: 0
last-failure : 0 -- N/A
Fortinet Technologies Inc.
Page 1132 FortiOS™ - CLI Reference for FortiOS 5.0
get
last-failure-param:
last-failure-time: N/A
Radio 1 : Ap
country-name : US
country-code : N/A
client-count : 1
base-bssid : 00:0e:8e:3b:63:99
max-vaps : 7
oper-chan : 1
Radio 2 : Not Exist
Radio 3 : Not Exist
wireless-controller wtp-status
Fortinet Technologies Inc.
Page 1133 FortiOS™ - CLI Reference for FortiOS 5.0
tree
The tree command displays FortiOS config CLI commands in a tree structure called the configuration tree. Each configuration command forms a branch of the tree.
Syntax
tree [branch] [sub-branch]
You can enter the tree command from the top of the configuration tree the command displays the complete configuration tree. Commands are displayed in the order that they are processed when the
FortiGate unit starts up. For example, the following output shows the first 10 lines of tree command output: tree
-- -- system -- [vdom] --*name (12)
+- vcluster-id (0,0)
|- <global> -- language
|- gui-ipv6
|- gui-voip-profile
|- gui-lines-per-page (20,1000)
|- admintimeout (0,0)
|- admin-concurrent
|- admin-lockout-threshold (0,0)
|- admin-lockout-duration (1,2147483647)
|- refresh (0,2147483647)
|- interval (0,0)
|- failtime (0,0)
|- daily-restart
|- restart-time
...
You can include a branch name with the tree command to view the commands in that branch: tree user
-- user -- [radius] --*name (36)
|- server (64)
|- secret
|- secondary-server (64)
|- secondary-secret
...
|- [tacacs+] --*name (36)
|- server (64)
|- secondary-server (64)
|- tertiary-server (64)
...
|- [ldap] --*name (36)
|- server (64)
|- secondary-server (64)
|- tertiary-server (64)
|- port (1,65535)
...
Page 1134
tree
You can include a branch and sub branch name with the tree command to view the commands in that sub branch: tree user local
-- [local] --*name (36)
|- status
|- type
|- passwd
|- ldap-server (36)
|- radius-server (36)
+- tacacs+-server (36)
...
If you enter the tree command from inside the configuration tree the command displays the tree for the current command: config user ldap tree
-- [ldap] --*name (36)
|- server (64)
|- cnid (21)
|- dn (512)
|- port (1,65535)
|- type
...
The tree command output includes information about field limits. These apply in both the CLI and the web-based manager. For a numeric field, the two numbers in in parentheses show the lower and upper limits. For example (0,32) indicates that values from 0 to 32 inclusive are accepted. For string values, the number in parentheses is one more than the maximum number of characters permitted.
In the following example, the FQDN can contain up to 255 characters.
config firewall address tree
-- [address] --*name (64)
|- subnet
|- type
|- start-ip
|- end-ip
|- fqdn (256)
|- country (3)
|- cache-ttl (0,86400)
|- wildcard
|- comment
|- visibility
|- associated-interface (36)
|- color (0,32)
+- [tags] --*name (64)
Fortinet Technologies Inc.
Page 1135 FortiOS™ - CLI Reference for FortiOS 5.0
Letöltés
A nyilvános link frissítve
A csevegés nyilvános linkje frissítve lett. You may view and manage your chat links after registration here.
Dokumentum nyilvános linkje
Hirdetés