execute. Fortinet FortiWeb 5.7
Below you will find brief information for Web Application Firewall FortiWeb 5.7. Web Application Firewall FortiWeb 5.7 is a dedicated appliance that protects web applications from common attacks such as SQL injection, cross-site scripting, and brute-force attacks. It also includes features such as WAF rule management, user tracking, and traffic log analysis. FortiWeb 5.7 can be used to protect web services and web applications from unauthorized access and security threats.
Advertisement
Advertisement
execute
execute
backup cli-config
execute date execute db rebuild
The execute command has an immediate and decisive effect on your FortiWeb appliance and, for that reason, should be used with care. Unlike config commands, most execute commands do not result in any configuration change.
This chapter describes the following commands:
execute erasedisk execute factoryreset execute factoryreset
execute formatlogdisk execute ha disconnect
execute ha md5sum execute ha synchronize
execute restore secondary-image
execute shutdown execute telnet
backup cli-config
Use this command to manually back up the configuration file to a TFTP server.
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
618
backup cli-config execute
This method does not include uploaded files such as: l private keys l certificates l error pages l
WSDL files l
W3C Schema l vulnerability scan settings
If your configuration has these files, use either a full TFTP or FTP/SFTP backup instead. See
or
This command does
not include settings that remain at their default values for the currently installed version of the firmware. If you require a backup that includes those settings, instead use
Alternatively, you can back up the configuration to an FTP or SFTP server. See
To use this command, your administrator account’s access control profile must have either w or rw permission to the mntgrp area. For more information, see
Syntax
execute backup cli-config tftp
<filename_str> <tftp_ipv4> {entire | profile}
Variable
<filename_str>
<tftp_ipv4>
{entire | profile}
Description Default
Type the name of the file to be used for the backup file, such as
FortiWeb_backup.conf
.
No default.
Type the IP address of the TFTP server.
No default.
Select either: l entire
— Back up the core configuration file only.
Note: This is not literally the entire configuration. It only contains the core configuration file, comprised of a CLI script.
It does
not include uploaded files such as error pages and private keys.
l profile
— Back up only the web protection profiles.
619 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
execute
Variable
[<password_str>]
Description
Type a password for use when encrypting the backup file using 128-bit AES.
If you do not provide a password, the backup file will be stored as clear text.
Caution: Remember the password or keep it in a secure location. You will be required to enter the same password when restoring an encrypted backup file. If you forget or lose the password, you will not be able to use that encrypted backup file.
backup full-config
Default
No default.
Example
This example uploads the FortiWeb appliance’s system configuration to a file named fweb.cfg on a TFTP server at IP address 192.168.1.23. The file will not be password-encrypted.
execute backup cli-config tftp fweb.cfg 192.168.1.23 entire
Related topics
l
l
l
backup full-config
Use this command to manually back up the entire configuration file,
including those settings that remain at their default values, to a TFTP server.
Fortinet strongly recommends that you password-encrypt this backup, and store it in a secure location. This backup method includes sensitive data such as your HTTPS certificates’ private keys. Unauthorized access to private keys compromises the security of all HTTPS requests using those certificates.
Alternatively, you can back up the configuration to an FTP or SFTP server. See
This backup includes settings that remain at their default values increases the file size of the backup, but may be useful in some cases, such as when you want to compare the default settings with settings that you have configured.
To use this command, your administrator account’s access control profile must have either w or rw permission to the mntgrp area. For more information, see
Syntax
execute backup full-config tftp
<filename_str> <tftp_ipv4> [<password_str>]
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
620
certificate ca
Variable
<filename_str>
<tftp_ipv4>
[<password_str>]
Description Default
Type the name of the file to be used for the backup file, such as
FortiWeb_backup.conf
.
No default.
Type the IP address of the TFTP server.
No default.
Type a password for use when encrypting the backup file using 128-bit AES.
If you do not provide a password, the backup file will be stored as clear text.
Caution: Remember the password or keep it in a secure location. You will be required to enter the same password when restoring an encrypted backup file. If you forget or lose the password, you will not be able to use that encrypted backup file.
No default.
execute
Example
This example uploads the FortiWeb appliance’s entire configuration, including uploaded error page and HTTPS certificate files, to a file named fweb.cfg on a TFTP server at IP address 192.168.1.23. The file is encrypted with the password P@ssword1.
execute backup full-config tftp fweb.cfg 192.168.1.23 P@ssword1
Related topics
l
l
certificate ca
Use this command to upload a trusted CA certificate.
Certificate authorities (CAs) validate and sign others’ certificates. FortiWeb determines whether a client or device’s certificate is genuine by comparing the CA’s signature and the copy of the CA certificate that you have uploaded. If they are made by the same private key, the CA’s signature is genuine, and therefore the client or device’s certificate is legitimate.
Syntax
execute certificate ca import
{tftp | auto} {<vdom_name> | root} <cert_name>
]
621 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
execute certificate crl
Variable
{tftp | auto}
{<vdom_name> | root}
<cert_name>
{<tftp_ipv4> | <scep_ url>}
<ca_id>
Description
Use one of the following options to specify the location of the
CA certificate:
• tftp — From a TFTP server.
• auto — From a SCEP (Simple Certificate Enrollment
Protocol) server.
Default
No default.
Specifies the administrative domain (ADOM) that the certificate applies to.
No default.
If ADOMs are not enabled, specify root.
If the certificate is located on a TFTP server, the name of the certificate file.
If the certificate is located on a TFTP server, the IP address of the server.
If the source of the certificate is a SCEP server, the URL of the server.
Optionally, if the source of the certificate is a SCEP server, you can use a CA identifier to specify a specific CA.
No default.
No default.
No default.
Example
This example uploads the trusted CA certificate file ca.cer from the TFTP server 192.168.1.23.
execute certificate ca import tftp root ca.cer 192.168.1.23
This example uploads the trusted CA certificate file from the SCAEP server at http://10.0.0.31/certsrv/mscep/mscep.dll
.
Related topics
l
l
l
l
certificate crl
Use this command to install a Certificate Revocation List (CRL).
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
622
certificate crl execute
To ensure that your FortiWeb appliance validates only certificates that have not been revoked, you should periodically upload a current certificate revocation list (CRL), which may be provided by certificate authorities
(CA).
Syntax
execute certificate crl import
{tftp | auto | http} {<vdom_name> | root} <crl_name>
{<tftp_ipv4> | <scep_url> | <http_url>}
Variable
{tftp | auto | http}
{<vdom_name> | root}
<crl_name>
{<tftp_ipv4> | <scep_ url> | <http_url>}
Description
Use one of the following options to specify the location of the
CRL to upload to FortiWeb:
• tftp — A TFTP server.
• auto — A SCEP (Simple Certificate Enrollment Protocol) server.
• http — An HTTP server.
Default
No default.
Specifies the administrative domain (ADOM) that the CRL applies to.
If ADOMs are not enabled, specify root.
No default.
If the source of the CRL is a TFTP server, the name of the CRL file.
No default.
If the source of the CRL is a TFTP server, the IP address of the server.
If the source of the CRL is a SCEP server, the URL of the server.
If the source of the CRL is an HTTP server, the URL of the server.
No default.
Example
This example uploads the CRL file Cert31.crl from the TFTP server 192.168.1.23.
execute certificate crl import tftp root Cert31.crl 192.168.1.23
This example uploads the CRL file Cert31.crl from the HTTP server 10.0.0.31.
execute certificate crl import http root http://10.0.0.31/certsrv/CertEnroll/Cert31.crl
This example uploads a CRL file from the SCEP server at http://155.229.15.173/cert/scep.
execute certificate crl import auto root http://155.229.15.173/cert/scep
623 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
execute certificate inter-ca
Related topics
l
l
l
l
certificate inter-ca
Use this command to upload an intermediate CA’s certificate.
If a server certificate is signed by an intermediate (non-root) certificate authority rather than a root CA, before the client trusts the server’s certificate, you must demonstrate a link with trusted root CAs. This mechanism proves that the server’s certificate is genuine. Otherwise, the server certificate may cause the end-user’s web browser to display certificate warnings.
Syntax
execute certificate inter-ca import
{tftp | auto} {<vdom_name> | root} <cert_name>
]
Variable
{tftp | auto}
{<vdom_name> | root}
<cert_name>
{<tftp_ipv4> | <scep_ url>}
<ca_id>
Description
Use one of the following options to specify the location of the certificate to upload to FortiWeb:
• tftp — A TFTP server.
• auto — A SCEP (Simple Certificate Enrollment Protocol) server.
Default
No default.
Specifies the administrative domain (ADOM) that the certificate applies to.
No default.
If ADOMs are not enabled, specify root.
If the certificate is located on a TFTP server, the name of the certificate file.
No default.
If the certificate is located on a TFTP server, the IP address of the server.
If the source of the certificate is a SCEP server, the URL of the server.
Optionally, if the source of the certificate is a SCEP server, you can use a CA identifier to specify a specific CA.
No default.
No default.
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
624
certificate local execute
Example
This example uploads the certificate file ca.cer from the TFTP server 192.168.1.23.
execute certificate inter-ca import tftp root ca.cer 192.168.1.23
This example uploads the certificate file from the SCEP server at http://10.0.0.31/certsrv/mscep/mscep.dll
.
execute certificate inter-ca import auto root http://10.0.0.31/certsrv/mscep/mscep.dll
Related topics
l
config system certificate intermediate-certificate
l
l
l
certificate local
Use this command to upload a server certificate from a TFTP server. You also use it to upload a client certificate for FortiWeb.
For more information about server certificates, see
config system certificate local
.
Syntax
execute certificate local
import tftp
<cert_name> <key_name> <password_str>
Variable
{cert | pkcs12-cert}
{<vdom_name> | root}
<cert_name>
Description Default
Use one of the following options to specify the type of certificate file to upload:
No default.
• cert — An unencrypted certificate in PEM format. The key is in a separate file.
• pkcs12-cert — A PKCS #12 encrypted certificate with key.
Specifies the administrative domain (ADOM) that the certificate applies to.
root
If ADOMs are not enabled, specify root.
Specifies the name of the certificate file.
No default.
625 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
execute create-raid level
Variable
<key_name>
<tftp_ipv4>
<password_str>
Description
If the certificate is unencrypted with the key in a separate file, specifies the key file to upload with the certificate.
Specifies the IP address of the TFTP server.
Default
No default.
No default.
If the certificate is encrypted, specify the password that was used to encrypt the file.
If the certificate is not encrypted, FortiWeb ignores this value.
No default.
Example
This example uploads the certificate file pc40.crt and its key file pc40.key from the TFTP server
192.168.1.23
. The certificate is encrypted using the password fortinet.
execute certificate local cert import tftp root pc40.crt pc40.key 192.168.1.23 fortinet
This example uploads the certificate file frompc31.pfx from the TFTP server 192.168.1.23. The certificate is encrypted using the password fortinet.
execute certificate local pkcs12-cert import tftp root frompc31.pfx 192.168.1.23 fortinet
Related topics
l
config system certificate local
l
l
l
create-raid level
Use the this command to initialize the RAID.
Currently, only RAID level 1 is supported, and only on FortiWeb-1000B, 1000C, 3000C/CFsx, 3000E, and 4000E shipped with FortiWeb 4.0 MR1 or later.
On older appliances that have been upgraded to FortiWeb 4.0 MR1, RAID cannot be activated.
Back up any data before initializing the array.
Back up the data regularly. RAID is not a substitute for regular backups. RAID 1
(mirroring) is designed to improve hardware fault tolerance, but cannot negate all risks.
To use this command, your administrator account’s access control profile must have either w or rw permission to the sysgrp area. For more information, see
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
626
create-raid rebuild execute
Syntax
execute create-raid
Variable
level {raid1}
Description Default
Type the RAID level. Currently, only RAID level 1 is supported.
raid1
Related topics
l
l
l
create-raid rebuild
Use the this command to rebuild the RAID.
Currently, only RAID level 1 is supported, and only on FortiWeb-1000B, 1000C, 3000C/CFsx, 3000E, and 4000E shipped with FortiWeb 4.0 MR1 or later.
On older appliances that have been upgraded to FortiWeb 4.0 MR1, RAID cannot be activated.
Back up the data regularly. RAID is not a substitute for regular backups. RAID 1
(mirroring) is designed to improve hardware fault tolerance, but cannot negate all risks.
Rebuilding the array due to disk failure may result in some loss of packet log data.
To use this command, your administrator account’s access control profile must have either w or rw permission to the sysgrp area. For more information, see
Syntax
execute create-raid rebuild
Example
This example rebuilds the RAID array.
execute create-raid rebuild
The CLI displays the following:
This operation will clear all data on disk :0!
Do you want to continue? (y/n)
After you enter y (yes), the CLI displays additional messages.
627 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
execute
Related topics
l l
date
Use this command to display or set the system date.
To use this command, your administrator account’s access control profile must have either w or rw permission to the sysgrp area. For more information, see
Syntax
execute
Variable
date [<date_str>]
Description
Type the current date for the FortiWeb appliance’s time zone, using the format yyyy-mm-dd, where: l yyyy is the year. Valid years are 2001 to 2037.
l mm is the month. Valid months are 01 to 12.
l dd is the day of the month. Valid days are 01 to 31.
If you do not specify a date, the command returns the current system date. Shortened values, such as 06 instead of 2006 for the year or 1 instead of 01 for the month or day, are not valid.
Default
No default.
Example
This example sets the date to 17 September 2011: execute date 2011-09-17
Related topics
l
l
db rebuild
U se this command to rebuild the FortiWeb appliance’s internal database that it uses to store log messages.
date
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
628
erase-disk execute
To use this command, your administrator account’s access control profile must have either w or rw permission to the mntgrp area. For more information, see
Syntax
execute db rebuild
Related topics
l
l
diagnose debug application miglogd
l
erase-disk
Use this command to erase the hard disk or flash memory.
This command requires a console connection to the appliance and is available only when Federal Information
Processing Standards (FIPS) and Common Criteria (CC) compliant mode is enabled (see
Syntax
execute erase-disk
[
]
Variable
{ flash | disk }
<erase-times>
Description
Specify whether to erase the flash memory or the hard disk.
Enter the number of times to overwrite the specified memory with random data.
Valid values are 1 to 35.
1
Default
No default.
factoryreset
U se this command to reset the FortiWeb appliance to its default settings for the currently installed firmware version. If you have not upgraded or downgraded the firmware, this restores factory default settings.
Back up your configuration first. This command resets all changes that you have made to the FortiWeb appliance’s configuration file and reverts the system to the default values for the firmware version. Depending on the firmware version, this could include factory default settings for the IP addresses of network interfaces. For information on creating a backup, see
629 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
execute formatlogdisk
To use this command, your administrator account’s access control profile must have either w or rw permission to the mntgrp area. For more information, see
Syntax
execute factoryreset
Related topics
l
l
l
formatlogdisk
Use this command to clear the logs from the FortiWeb appliance’s hard disk and reformat the disk.
This operation deletes all locally stored log files.
To use this command, your administrator account’s access control profile must have either w or rw permission to the sysgrp area. For more information, see
When you execute this command, the FortiWeb appliance displays the following message:
This operation will clear all data on the log disk and take a few minutes according to the disk size!!
Do you want to continue? (y/n)
Syntax
execute formatlogdisk
Related topics
l
ha disconnect
Use this command to manually force a FortiWeb appliance to leave the HA group, without unplugging any cables. This can be useful, for example, if you need to remove a standby appliance from the HA cluster in order to configure it for standalone operation, and want to do so
without disrupting traffic, and without unplugging cables.
Behavior varies by which appliance you eject: l
Active — Failover occurs. The standby remains as a member of the HA group, and will elect itself as the new active appliance, assuming all of the HA cluster’s configured IP addresses and traffic processing duties.
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
630
ha disconnect execute l
Standby — No failover occurs. The active appliance remains actively processing traffic.
To ensure that you can re-connect to the ejected appliance’s GUI or CLI via a remote network connection (not only via its local console), this command requires that you specify an IP address and port name that will become its new management interface. By default, it will be accessible via HTTP, HTTPS, SSH, and telnet. (All other network interfaces on the ejected appliance will be brought down and reset to 0.0.0.0/0.0.0.0. To configure them, you must connect to the ejected appliance’s GUI or CLI.)
To use this command, your administrator account’s access control profile must have either w or rw permission to the sysgrp area. For more information, see
Syntax
execute ha
disconnect <serial-number_str> <interface_name> <interface_ipv4mask>
Variable
disconnect <serialnumber_str>
<interface_name>
<interface_ipv4mask>
Description
Type the serial number of the FortiWeb appliance that you want to disconnect from the cluster.
To display the serial number of each appliance in the HA group, type: execute ha disconnect ?
Default
No default.
Type the name of the network interface, such as port1, that will be configured as the ejected appliance’s management interface.
No default.
Type the IP address and netmask that will be configured as the ejected appliance’s management interface.
No default.
Example
This example ejects the standby appliance whose serial number is FV-1KC3R11111111, assigning its port1 to be the web UI/GUI interface, reachable at 10.0.0.1.
execute ha disconnect FV-1KC3R11111111 port1 10.0.0.1/24
After the command completes, to reconfigure the ejected appliance, you could then use either a web browser or
SSH client to connect to 10.0.0.1 in order to reconfigure it for standalone operation.
Related topics
l
l
l
l
l
l
l
631 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
execute ha manage
ha manage
Use this command to log in to another appliance in the HA group via the HA link. In most cases, you log into a standby appliance (also called the secondary, or slave) from the main (primary or master) appliance, but you can also use a standby appliance to access the main appliance.
To use this command, your administrator account’s access control profile must have either w or rw permission to the sysgrp area. For more information, see
Syntax
execute ha manage
Variable
<cluster-index>
Description
Specifies an index value that the FortiWeb HA feature assigns to a cluster member based on its serial number.
The cluster member with the highest serial number has a cluster index of 0, the one with the second-highest serial number has a cluster index of 1, and so on.
To display the index numbers of the cluster members, enter the following command: execute ha manage ?
Default
No default.
Example
In this example, you are logged in to the main appliance.
execute ha manage ?
<id> please input peer box index.
<2> Subsidary unit FV-1KD3A12345678
<3> Subsidary unit FV-1KD3A11345678
The cluster index and serial number of the appliance you are currently logged in to is not displayed.
Enter 3 to connect to the standby appliance with serial number FV-1KD3A11345678. The CLI prompt changes to the host name of this unit and the login prompt is displayed.
To return to the primary unit, type exit.
Related topics
l
l
l
l
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
632
ha md5sum l
l
execute
ha md5sum
Use this command to retrieves the CLI system configuration MD5 from the two appliances in a HA cluster.
This information allows you to confirm whether HA configuration is synchronized.
Syntax
execute ha md5sum
Example
Below is a sample output.
CLI configuration MD5SUM :
[master]:555393AE023104AB41C195F6B1CCD177
[slave ]:555393AE023104AB41C195F6B1CCD177
System configuration MD5SUM :
[master]:39B9A403673ABB7333A5EC6BAD9BEE25
[slave ]:39B9A403673ABB7333A5EC6BAD9BEE25
Related topics
l
l
l
ha synchronize
Use this command to manually control the synchronization of configuration files and FortiGuard service-related packages from the active HA appliance to the standby appliance.
Typically, most HA synchronization happens automatically, whenever changes are made. However, in some cases, you may want to use this command to manually initiate full or partial HA synchronization.
l l l
To delay synchronization to a more convenient time if you are planning to make large batch changes, and therefore delayed synchronization is preferable for network performance reasons
To manually force synchronization of files that are not automatically synchronized
To trigger automatic synchronization if it has been interrupted due to HA link failure, daemon crashes, etc.
To use this command, your administrator account’s access control profile must have either w or rw permission to the sysgrp area. For more information, see
633 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
execute ha synchronize
Syntax
execute ha execute ha
synchronize {all | avupd | cli | geodb | sys} synchronize {start | stop}
Variable
synchronize {all | avupd | cli | geodb | sys} synchronize {start | stop}
Description Default
Select which part of the configuration and/or FortiGuard servicerelated packages to synchronize.
l all
— Entire configuration, including CLI configuration, system files, and signature databases.
l l avupd
— Only the FortiGuard Antivirus service package, including the virus signatures, scan engine, and proxy.
cli
— Only the core CLI configuration file (fwb_ system.conf). (You can use the show command to view the contents of the configuration file.) l l geodb
— Only the geography-to-IP address mappings.
Similar to firmware, these can be downloaded from the
Fortinet Technical Support web site .
sys
— Only the IP Reputation Database (IRDB) and system files such as X.509 certificates.
Note: This command has no effect if you use the command execute ha synchronize stop. to pause it manually.
No default.
Select whether to start or stop synchronization.
No default.
Example
This example shows how to manually synchronize the virus signature and engine package to the standby appliance.
FortiWeb # execute ha synchronize avupd starting synchronize with HA master...
Related topics
l
l
l
l
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
634
ping execute
ping
U se this command to perform an ICMP ECHO request (also called a ping) to a host by specifying its fully qualified domain name (FQDN) or IPv4 address, using the options configured by
Pings are often used to test IP-layer connectivity during troubleshooting.
To use this command, your administrator account’s access control profile must have at least r permission to the sysgrp area. For more information, see
.
Syntax
execute
ping {<host_fqdn> | <host_ipv4>}
Variable
ping {<host_fqdn> |
<host_ipv4>}
Description
Type either the IPv4 address or fully qualified domain name
(FQDN) of the host.
Default
No default.
Example
This example pings a host with the IP address 172.16.1.10.
execute ping 172.16.1.10
The CLI displays the following:
PING 172.16.1.10 (172.16.1.10): 56 data bytes
64 bytes from 172.16.1.10: icmp_seq=0 ttl=128 time=0.5 ms
64 bytes from 172.16.1.10: icmp_seq=1 ttl=128 time=0.2 ms
64 bytes from 172.16.1.10: icmp_seq=2 ttl=128 time=0.2 ms
64 bytes from 172.16.1.10: icmp_seq=3 ttl=128 time=0.2 ms
64 bytes from 172.16.1.10: icmp_seq=4 ttl=128 time=0.2 ms
--- 172.16.1.10 ping statistics ---
5 packets transmitted, 5 packets received, 0% packet loss round-trip min/avg/max = 0.2/0.2/0.5 ms
The results indicate that a route exists between the FortiWeb appliance and 172.16.1.10. It also indicates that during the sample period, there was no packet loss, and the average response time was 0.2 milliseconds.
Example
This example pings a host with the IP address 10.0.0.1.
execute ping 10.0.0.1
The CLI displays the following:
PING 10.0.0.1 (10.0.0.1): 56 data bytes
After several seconds, no output appears. The administrator halts the ping by pressing Ctrl+C. The CLI displays the following:
--- 10.0.0.1 ping statistics ---
635 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
execute ping6
5 packets transmitted, 0 packets received, 100% packet loss
The results indicate the host may be down, or there is no route between the FortiWeb appliance and 10.0.0.1. To determine the point of failure along the route, further diagnostic tests are required, such as
Related topics
l
l
l
l
l
l
l
l
l
ping6
U se this command to perform an ICMP ECHO request (also called a ping) to a host by specifying its IPv6 address, using the options configured by
Pings are often used to test IP-layer connectivity during troubleshooting.
To use this command, your administrator account’s access control profile must have at least r permission to the sysgrp area. For more information, see
.
Syntax
execute
ping6 {<host_fqdn> | <host_ipv6>}
Variable Description
ping6 {<host_fqdn> |
<host_ipv6>}
Type either the IP address or fully qualified domain name
(FQDN) of the host.
Default
No default.
Example
This example pings a host with the IP address 2001:0db8:85a3:::8a2e:0370:7334.
execute ping6 2607:f0b0:f:420::
The CLI displays the following:
PING 2607:f0b0:f:420:: (2607:f0b0:f:420::): 56 data bytes
After several seconds, no output appears. The administrator halts the ping by pressing Ctrl+C. The CLI displays the following:
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
636
ping-options execute
--- 2607:f0b0:f:420:: ping statistics ---
5 packets transmitted, 0 packets received, 100% packet loss
The results indicate the host may be down, or there is no route between the FortiWeb appliance and
2607:f0b0:f:420::. To determine the point of failure along the route, further diagnostic tests are required, such as
Related topics
l
l
l
l
l
l
l
l
l
ping-options
Use these commands to configure the behavior of the
command.
To use this command, your administrator account’s access control profile must have at least r permission to the sysgrp area. For more information, see
.
Syntax
execute ping-options execute ping-options execute ping-options execute ping-options execute ping-options execute ping-options execute ping-options execute ping-options execute ping-options execute ping-options
Variable
data-size <bytes_int>
Description Default
Enter datagram size in bytes.This allows you to send out packets of different sizes for testing the effect of packet size on the connection. If you want to configure the pattern that will be used to buffer small datagrams to reach this size, also configure
.
56
637 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
execute ping-options
Variable
df-bit {yes | no} pattern <bufferpattern_ hex>
Description
Enter either yes to set the DF bit in the IP header to prevent the ICMP packet from being fragmented, or enter no to allow the ICMP packet to be fragmented.
Default
no
Enter a hexadecimal pattern, such as 00ffaabb, to fill the optional data buffer at the end of the ICMP packet. The size of the buffer is determined by
No default.
repeat-count <repeat_ int> source {auto |
<interface_ipv4>}
Enter the number of times to repeat the ping.
5 timeout <seconds_int> tos {<service_type>} ttl <hops_int> validate-reply
{yes | no}
Select the network interface from which the ping is sent. Enter either auto or a FortiWeb network interface IP address.
auto
Enter the ping response timeout in seconds.
2 default l
Enter the IP type-of-service option value, either: default
— Do not indicate. (That is, set the TOS byte to
0.) l lowcost
— Minimize cost.
l lowdelay
— Minimize delay.
l reliability
— Maximize reliability.
l throughput
— Maximize throughput.
Enter the time-to-live (TTL) value.
Select whether or not to validate ping replies.
64 no view-settings Display the current ping option settings.
No default.
Example
This example sets the number of pings to three and the source IP address to 10.10.10.1, then views the ping options to verify their configuration.
execute ping-option repeat-count 3 execute ping-option source 10.10.10.1
execute ping-option view-settings
The CLI would display the following:
Ping Options:
Repeat Count: 3
Data Size: 56
Timeout: 2
TTL: 64
TOS: 0
DF bit: unset
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
638
ping6-options
Source Address: 10.10.10.1
Pattern:
Pattern Size in Bytes: 0
Validate Reply: no
Related topics
l
l
execute
ping6-options
Use these commands to configure the behavior of the
command.
To use this command, your administrator account’s access control profile must have at least r permission to the sysgrp area. For more information, see
.
Syntax
execute ping6-options execute ping6-options execute ping6-options execute ping6-options execute ping6-options execute ping6-options execute ping6-options execute ping6-options execute ping6-options
Variable Description
data-size <bytes_int>
Default
Enter datagram size in bytes.This allows you to send out packets of different sizes for testing the effect of packet size on the connection. If you want to configure the pattern that will be used to buffer small datagrams to reach this size, also configure
.
56 pattern <bufferpattern_ hex> repeat-count <repeat_ int>
Enter a hexadecimal pattern, such as 00ffaabb, to fill the optional data buffer at the end of the ICMP packet. The size of the buffer is determined by
No default.
Enter the number of times to repeat the ping.
5 source {auto |
<interface_ipv6>} timeout <seconds_int>
Select the network interface from which the ping is sent. Enter either auto or a FortiWeb network interface IP address.
auto
Enter the ping response timeout in seconds.
2
639 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
execute
Variable
tos {<service_type>} ttl <hops_int> validate-reply
{yes | no} view-settings
Description
Enter the IP type-of-service option value, either: l default
— Do not indicate. (That is, set the TOS byte to
0.) l lowcost
— Minimize cost.
l lowdelay
— Minimize delay.
l reliability
— Maximize reliability.
l throughput
— Maximize throughput.
Enter the time-to-live (TTL) value.
Select whether or not to validate ping replies.
Display the current ping option settings.
Default
default
64 no
No default.
Example
This example sets the number of pings to 3, then views the ping options to verify their configuration.
execute ping6-option repeat-count 3 execute ping6-option view-settings
The CLI would display the following:
IPV6 Ping Options:
Repeat Count: 3
Data Size: 56
Timeout: 2
Interval: 1
TTL: 64
TOS: 0
Source Address: auto
Pattern:
Pattern Size in Bytes: 0
Validate Reply: no
Related topics
l
l
reboot
U se this command to restart the FortiWeb appliance.
reboot
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
640
restore config execute
To use this command, your administrator account’s access control profile must have either w or rw permission to the mntgrp area. For more information, see
Syntax
execute reboot
Example
This example shows the reboot command in action.
execute reboot
The CLI displays the following:
This operation will reboot the system !
Do you want to continue? (y/n)
After you enter y (yes), the CLI displays the following:
System is rebooting...
If you are connected to the CLI through a local console, the CLI displays messages while the reboot is occurring.
If you are connected to the CLI through the network, the CLI will not display any notification while the reboot is occurring, as this occurs after the network interfaces have been shut down. Instead, you may notice that the connection is terminated. Time required by the reboot varies by many factors, such as whether or not hard disk verification is required, but may be several minutes.
Related topics
l
l
restore config
Use this command to restore the configuration from a configuration backup file on an TFTP server, or to install primary or backup firmware.
Back up the configuration before restoring the configuration. This command restores configuration changes only, and does not affect settings that remain at their default values. Default values may vary by firmware version. For backup commands, see
and
.
To use this command, your administrator account’s access control profile must have either w or rw permission to the mntgrp area. For more information, see
Syntax
execute restore config tftp
<filename_str> <tftp_ipv4> [<password_str>]
641 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
execute
Variable
<filename_str>
<tftp_ipv4>
[<password_str>]
Description
Type the name of the backup or firmware image file.
Type the IP address of the TFTP server.
Type the password that was used to encrypt the backup file, if any.
If you do not provide a password, the backup file must have been stored as clear text.
restore image
Default
No default.
No default.
No default.
Example
This example downloads a configuration file named backup.conf from the TFTP server, 192.168.1.23, to the
FortiWeb appliance. The backup file was encrypted with the password P@ssword1.
execute restore config tftp backup.conf 192.168.1.23 P@ssword1
The FortiWeb appliance then applies the configuration backup and reboots.
Related topics
l
l
l
l
execute restore secondary-image
restore image
Use this command to install firmware on the primary partition and reboot.
Back up the configuration before installing new firmware. Installing new firmware can change default settings and reset settings that are incompatible with the new version.
For backup commands, see
and
Unlike installing firmware via TFTP during a boot interrupt, installing firmware using this command will attempt to preserve settings and files, and not necessarily restore the FortiWeb appliance to its firmware/factory default configuration.
To use this command, your administrator account’s access control profile must have either w or rw permission to the mntgrp area. For more information, see
Syntax
execute restore image ftp
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
642
restore secondary-image execute restore image tftp
Variable
<filename_str>
Description
Type the name of the firmware image file.
<ftp_ipv4>
<tftp_ipv4>
Type the IP address of the TFTP server.
Type the IP address of the FTP server.
Default
No default.
No default.
No default.
execute
Example
This example installs a firmware file named firmware.out from the TFTP server, 192.168.1.23, to the
FortiWeb appliance.
execute restore image tftp firmware.out 192.168.1.23
The FortiWeb appliance downloads the firmware file, installs it, and reboots.
Related topics
l
l
l
l
execute restore secondary-image
l
l
restore secondary-image
Use this command to install backup firmware on the secondary partition and reboot.
Back up the configuration before installing new firmware. Installing new firmware can change default settings and reset settings that are incompatible with the new version.
For backup commands, see
backup full-config on page 620
and
.
Unlike installing firmware via TFTP during a boot interrupt, installing firmware using this command will attempt to preserve settings and files, and not necessarily restore the FortiWeb appliance to its firmware/factory default configuration.
To use this command, your administrator account’s access control profile must have either w or rw permission to the mntgrp area. For more information, see
643 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
execute restore vmlicense
Syntax
execute restore secondary-image ftp execute restore secondary-image tftp
Variable
<filename_str>
Description
Type the name of the firmware image file.
<ftp_ipv4>
<tftp_ipv4>
Type the IP address of the FTP server.
Type the IP address of the TFTP server.
Default
No default.
No default.
No default.
Example
This example installs a firmware file named firmware.out from the TFTP server, 192.168.1.23, to the
FortiWeb appliance.
execute restore secondary-image tftp firmware.out 192.168.1.23
The FortiWeb appliance downloads the firmware file, installs it, and reboots.
Related topics
l
l
l
l
l
l
restore vmlicense
Use this command to upload a FortiWeb-VM license file from an FTP or TFTP server.
After you enter the command, FortiWeb prompts you to confirm the upload.
After the license is authenticated successfully, the following message is displayed:
“*ATTENTION*: license registration status changed to 'VALID', please logout and re-login”
To use this command, your administrator account’s access control profile must have either w or rw permission to the mntgrp area. For more information, see
For more information on FortiWeb-VM licenses, see the
FortiWeb-VM Install Guide
.
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
644
session-cleanup execute
Syntax
execute restore vmlicense
{ftp | tftp} <license-file_str>
{
<user_ str> : <password_str> @ <ftp_ipv4> | <tftp_ipv4>
}
Variable
{ftp | tftp}
<license-file_str>
<ftp_ipv4>
<user_str>
<password_str>
<tftp_ipv4>
Description
Specify whether to connect to the server using file transfer protocol (FTP) or trivial file transfer protocol (TFTP).
The name of the license file.
The IP address of the FTP server.
The user name that FortiWeb uses to authenticate with the server.
The password for the account specified by <user_str>.
The IP address of the TFTP server.
Default
No default.
No default.
No default.
No default.
No default.
No default.
Example
This example uploads the license file
FVVM040000010871.lic
from the TFTP server 192.168.1.23 to the FortiWeb appliance.
execute restore vmlicense tftp FVVM040000010871.lic 192.168.1.23
The FortiWeb appliance uploads the file, and then prompts you to log out and log in again.
session-cleanup
Use this command to immediately clean up all sessions.
To use this command, your administrator account’s access control profile must have either w or rw permission to the mntgrp area. For more information, see
Syntax
execute session-cleanup
645 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
execute shutdown
shutdown
Use this command to prepare the FortiWeb appliance to be powered down by halting the software, clearing all buffers, and writing all cached data to disk.
Power off the FortiWeb appliance only after issuing this command. Unplugging or switching off the FortiWeb appliance without issuing this command could result in data loss.
To use this command, your administrator account’s access control profile must have either w or rw permission to the mntgrp area. For more information, see
Syntax
execute shutdown
Example
This example shows the reboot command in action.
execute shutdown
The CLI displays the following:
This operation will halt the system
(power-cycle needed to restart)!Do you want to continue? (y/n)
After you enter y (yes), the CLI displays the following:
System is shutting down...(power-cycle needed to restart)
If you are connected to the CLI through a local console, the CLI displays a message when the shutdown is complete.
If you are connected to the CLI through the network, the CLI will not display any notification when the shutdown is complete, as this occurs after the network interfaces have been shut down. Instead, you may notice that the connection times out.
Related topics
l
telnet
Use this command to open a Telnet connection to a server using IPv4 to port 23.
Telnet connections are not secure. Eavesdroppers could easily obtain your administrator password. Only use telnet over a trusted, physically secured network, such as a direct connection between your computer and the appliance.
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
646
telnettest execute
To use this command, your administrator account’s access control profile must have at least r permission to the sysgrp area. For more information, see
.
Syntax
execute
Variable
telnet <host_ipv4>
Description
Type the IP address of the host.
Default
No default.
Example
This example Telnets to a host with the IP address 172.16.1.10.
execute telnet 172.16.1.10
login: admin
Password: *******
Related topics
l
l
l
telnettest
U se this command to open a Telnet connection to a server using an IPv4 or IPv6 address or fully qualified domain name (FQDN). This command can be useful for troubleshooting (for example, when the server does not support the HTTP versions, methods, headers, and so on, that the client uses).
Telnet connections are not secure. Eavesdroppers could easily obtain your administrator password. Only use Telnet over a trusted, physically secured network, such as a direct connection between your computer and the appliance, and from the appliance to the server.
To use this command, your administrator account’s access control profile must have at least r permission to the sysgrp area. For more information, see
.
Syntax
execute
telnettest {<host_ipv4> | <host_ipv6> | <host_fqdn>}
647 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
execute
Variable
telnettest {<host_ ipv4> | <host_ipv6> |
<host_fqdn>}
Description
Type the IP address or fully qualified domain name (FQDN) of the host.
Default
No default.
time
Example
This example Telnets to a host with the IPv4 address 172.16.1.10 on port 80, the IANA standard port for HTTP.
FortiWeb#
exec telnettest 172.16.1.10:80
Connected
GET /
Entering interactive mode. Type CTRL-D to exit.
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>501 Method Not Implemented</title>
</head><body>
<h1>Method Not Implemented</h1>
<p>Get to /index.html not supported.<br />
</p>
<hr>
<address>Apache/2.2.22 (Unix) DAV/2 mod_ssl/2.2.22 OpenSSL/0.9.8x Server at irene.local
Port 80</address>
</body></html>
Connection closed.
Connection status to 172.16.1.10 port 80:
Connecting to remote host succeeded.
Related topics
l
l
l
time
Use this command to display or set the system time.
To use this command, your administrator account’s access control profile must have either w or rw permission to the sysgrp area. For more information, see
Syntax
execute
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
648
traceroute
Variable
time [<time_str>]
Description
Type the current date for the FortiWeb appliance’s time zone, using the format hh:mm:ss, where: l hh is the hour. Valid hours are 00 to 23.
l mm is the minute. Valid minutes are 00 to 59.
l ss is the second. Valid seconds are 00 to 59.
If you do not specify a time, the command returns the current system time.
Shortened values, such as 1 instead of 01 for the hour, are valid. For example, you could enter either 01:01:01 or
1:1:1
.
Default
No default.
execute
Example
This example sets the system time to 15:31:03: execute time 15:31:03
Related topics
l
l
traceroute
Use this command to use ICMP to test the connection between the FortiWeb appliance and another network device, and display information about the time required for network hops between the device and the FortiWeb appliance.
To use this command, your administrator account’s access control profile must have at least r permission to the sysgrp area. For more information, see
.
Syntax
execute
traceroute {<host_fqdn> | <host_ipv4>}
Variable
traceroute {<host_ fqdn> | <host_ipv4>}
Description
Type either the IP address or fully qualified domain name
(FQDN) of the host.
Default
No default.
649 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
execute traceroute
Example
This example tests connectivity between the FortiWeb appliance and docs.fortinet.com. In this example, the trace times out after the first hop, indicating a possible connectivity problem at that point in the network.
FortiWeb#
execute traceroute docs.fortinet.com
traceroute to docs.fortinet.com (65.39.139.196), 30 hops max, 38 byte packets
1 172.16.1.200 (172.16.1.200) 0.324 ms 0.427 ms 0.360 ms
2 * * *
Example
This example tests the availability of a network route to the server example.com.
execute traceroute example.com
The CLI displays the following: traceroute to example.com (192.168.1.10), 32 hops max, 72 byte packets
1 172.16.1.2
0 ms 0 ms 0 ms
2 10.10.10.1 <static.isp.example.net> 2 ms 1 ms 2 ms
3 10.20.20.1 1 ms 5 ms 1 ms
4 10.10.10.2
<core.isp.example.net> 171 ms 186 ms 14 ms
5 10.30.30.1 <isp2.example.net> 10 ms 11 ms 10 ms
6 10.40.40.1 73 ms 74 ms 75 ms
7 192.168.1.1 79 ms 77 ms 79 ms
8 192.168.1.2 73 ms 73 ms 79 ms
9 192.168.1.10 73 ms 73 ms 79 ms
10 192.168.1.10 73 ms 73 ms 79 ms
Example
This example attempts to test connectivity between the FortiWeb appliance and example.com. However, the
FortiWeb appliance could not trace the route, because the primary or secondary DNS server that the FortiWeb appliance is configured to query could not resolve the FQDN example.com into an IP address, and it therefore did not know to which IP address it should connect. As a result, an error message is displayed.
FortiWeb#
execute traceroute example.com
traceroute: unknown host example.com
Command fail. Return code 1
To resolve the error message in order to perform connectivity testing, the administrator would first configure the
FortiWeb appliance with the IP addresses of DNS servers that can resolve the FQDN example.com. For details, see
.
Related topics
l
l
l
l
l
FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
650
update-now execute
update-now
Use this command to initiate an update of the predefined robots, data types, suspicious URLS, and attack signatures used by your FortiWeb appliance.
FortiWeb appliances receive updates from the FortiGuard Distribution Network (FDN). The FDN is a world-wide network of FortiGuard Distribution Servers (FDS). FortiWeb appliances connect to the FDN by connecting to the
FDS nearest to the FortiWeb appliance by its configured time zone.
The time required for the update varies with the availability of the updates, the size of the updates, and the speed of the FortiWeb appliance’s network connection. If event logging is enabled, and the FortiWeb appliance cannot connect successfully, it will log the message update failed, failed to connect any fds servers!
or FortiWeb is unauthorized
To use this command, your administrator account’s access control profile must have either w or rw permission to the mntgrp area. For more information, see
Syntax
execute update-now
651 FortiWeb 5.7 CLI Reference Guide
Fortinet Technologies Inc.
Download
Public link updated
The public link to your chat has been updated. You may view and manage your chat links after registration here.
Document public link
Advertisement
Key features
Protects web applications from attacks
Includes features for traffic management
Provides security auditing capabilities
Can be deployed in a variety of environments
Supports a wide range of security protocols
Is easy to configure and manage
Frequently asked questions
A WAF is a security application that filters malicious traffic from reaching a web application. It works by inspecting incoming traffic for known attack patterns and blocking or mitigating any threats.
FortiWeb 5.7 provides a wide range of security features, including protection against SQL injection, cross-site scripting (XSS), and brute-force attacks. It also includes features for traffic management, security auditing, and advanced security protocols.
You can configure and manage FortiWeb 5.7 using the command-line interface (CLI) or the web-based interface. The FortiWeb 5.7 CLI Reference Guide provides detailed instructions on how to use the CLI to configure and manage the firewall.
