Fortigate CLI Cheat Sheet - Release date 20151105 – v 0.5.2.

1 get router info routing­ diag debug crashlog read Show crashlog

Display the current routing table
By Frederic Kasmirczak (http://www.frederick.lu) table database
Collect lots of information
diag debug report
Main command structure diag ip route list  Display the kernel routing table (show tech Cisco like)

show Display changes to the default configuration Backup / Restore VPN

get List the configuration of the current object or table exe restore conf Backup Fortigate configuration diag vpn ike gateway list Show phase 1
Create or edit a table in the current object. exe backup config Restore Fortigate configuration diag vpn tunnel list
edit Show phase 2
edit 0 will use the next ID available in a sequence number
diag vpn ike gateway flush name 
set/unset Set a filed / Reset a field to the default value High availability <phase1> Flush a phase 1

end Save the current changes get sys ha status

Show HA conf summary diag vpn tunnel up <phase2> Bring up a phase 2
diag sys ha status
abort Exit commands without saving the fields diag debug app ike ­1
diag deb en Troubleshoot VPN issue
delete diag debug enable
Remove a table from the current object diag deb console timestamp
en Troubleshoot HA synchronization issue
Basic diag deb app hatalk ­1
diag deb app hasync ­1
get sys status Show status summary
Show the config file checksum (can be execute
get sys perf stat Show Fortigate ressources summary diag sys ha showcsum <int>
on both members to compare)
execute ping Ping something exec ha synchronize all Synchronize all parts of the configuration
execute shutdown Shutdown the device/reboot with reboot diag sys ha reset­uptime Reset ha uptime criteria
get sys arp Show the current arp table diag sniffer packet haint 
Sniffer on heartbeat ports (here haint)
execute date/time Show the current date / time 'ether[12:2]=0x8890' 6

delete Remove a table from the current object exec ha manage <id> Connect on a subordonate device

Interface
show sys int
config sys interface
edit port1
set ip x.x.x.x/y.y
set allowaccess ssh ping
end
diag netlink device list
get hardware nic port1
Disk
diag hard deviceinfo disk
diag sys flash list
execute set­next­reboot
execute factoryreset
execute formatlogdisk
Static routing
Show interfaces status
Sh sys int ? will show a summary
Basic interface ip configuration
Show interfaces statistics (errors)
Show interfaces statistics
Show disks and partitions usage
Show partitions status
Select partition for the next reboot
Reset to factory default (2 to keep network)
Format log disk
Debug
diag debug enable
diag debug flow show console enable
diag debug flow show function­name en
diag debug flow filter saddr x.x.x.x Debug flow
diag debug flow filter daddr y.y.y.y
diag debug flow filter dport z
diag debug flow trace start 100
diag sniffer packet <interface> 
<filter> <verbose> <count> <a>
<interface> physical, virtual, any
<filter> functionality using filter
<verbose> there are six verbose levels:
1­print header of packets
2­print header and data from the IP header of
the packets
3­print header and data from the Ethernet  Packet capture
header of the packets
4­print header of packets with interface name
5­print header and data from ip of packets 
with interface name
6­print header and data from Ethernet of 
packets with interface name
<count> the number of packets
<a> to enable absolute timestamp

config router static diag sys session filter dst x.x.x.x
edit 0 diag sys session filter src y.y.y.y
Show session table
set device internal diag sys session filter proto Z
Add a static route diag sys session list
Set dst x.x.x.x/y.y
set gateway z.z.z.z diag sys session filter src x.x.x.x
end diag sys session filter proto z
Clear session table
get router info routing­ diag sys session filter dport y
Display the route used to reach the IP x.x.x.x
table details x.x.x.x diag sys session clear
Default gw will show Network not in table
 This document is distributed under the free license:
Attribution-ShareAlike 4.0 International
Creative Commons BY-SA 4.0
https://creativecommons.org/licenses/by-sa/4.0/

You are free to:

• Share — copy and redistribute the material in any medium or format.

• Adapt — remix, transform, and build upon the material for any purpose, even commercially.

The licensor cannot revoke these freedoms as long as you follow the license terms.

Under the following terms:

• Attribution — You must give appropriate credit, provide a link to the license, and indicate if changes were made. You may do so in any
reasonable manner, but not in any way that suggests the licensor endorses you or your use.

• ShareAlike — If you remix, transform, or build upon the material, you must distribute your contributions under the same license as the original.

• No additional restrictions — You may not apply legal terms or technological measures that legally restrict others from doing anything the
license permits.