Fortinet Cheat Sheet

A Software › Nope cheat sheet in English by nicox82

Fortigate Firewalls Cheatsheet

11,269 views 1,615 downloads 11 Jan 2022 History

Process Inform­ation

get system perfor­mance status
General perfor­mance Inform­ation
diag sys top [sec] {number]
Process list Sort with P (CPU) /M(Memory)
diag sys top-su­mmary [sec]
Process list with grouped proccesses and shared memory
diag debug crashlog read
Crash log

High availa­bility

execute ha manage [index] [admin]
Jump to cluster member
get sys ha status
Inform­ation about current HA status
diag sys ha dump-by vcluster
Show cluster member uptime
diag sys ha reset-­uptime
Reset cluster member uptime, triggers failov­er!­!!!!!!!
diag sys ha checksum cluster
show config checksums of all cluster members
diag debug appl hatalk -1
Debugging of HA-Talk protocols
diag debug appl hasync -1
Debugging of HA-Sync protocols

FQDN

diagnose test applic­ation dnsproxy 6
Dump FQDN cache
diagnose firewall fqdn list
List all FQDN

Traffic Shaper

diag firewall shaper traffi­c-s­haper list / stats
Traffic shaper list / statistics
diag firewall shaper per-ip­-shaper list / stats
Per IP traffi­c-s­haper list / statistics

VDOM

config vdom / edit <vd­om-­nam­e>
change to vdom <vd­om-­nam­e>
sudo global / vdom-name   diag / execute / show / get
Sudo-c­ommand to access global / VDOM Settings directly

General debugging

diag debug appl [appl-­name] [debug­_level]
Realtime debugger for several applic­ations
diax test appl [appl-­name] [test_­level]
Monitor proxy operations
diag debug console timestamp enable
Enables timestamp in console
diag debug enable   diag debug disable
Enable­/di­sable output for "diag debug" and "diag ip" commands
diag debug reset
Reset debug levels

Packet Sniffer

diag snivver packet [if] '­[fi­lte­r]' [verbose] [count] [ts]
Packet sniffer. Use Filters!   Verbose levels 1-6 for different output

Flow Trace

diag debug flow show iprop en   diag debug flow show fun en  diag debug flow trace start [packet count]
Debug command for traffic flow
diag debug flow filter [filter]
Use filters to narrow down search results

Firewall session troubl­esh­ooting

diag sys session filter
Filter for session list
diag sys session list[e­xpect]
Lists all (or expected) sessions
diag sys session clear
Clear all / filtered sessions
diag sys session stat
Sessions statis­tics, memory memory tension, ephemral drops
diag firewall iprope clear 100004 [<i­d>]
Resets counter for all or specific firewall policy id

Fortiguard Distri­bution Network (FDN)

update.fo­rti­gua­rd.net   servic­e.f­ort­igu­ard.net   suppor­t.f­ort­ine­t.com
**URLs to access the FortiGuard Distri­bution Netowrk (FDN)

Signature Update

diag debug rating
Webfilter / AntiSpan Server inform­ation
diag autoupdate versions
Detailed versions of packages
diag debug appl update -1 exec update-now
Troubl­esh­ooting update process

IPS

diag ips anomaly list
Lists statistics of DoS-Po­licies
diag ips packet status
IPS packet statistics
diag test appl ipsmonitor 2
Enable / disable IPS engine
diag test appl ipsmonitor 5
Toggle bypass status
diag test appl ipsmonitor 99
Restart all ipsengine and monitor

Comments

No comments yet.

Cheatography n. The art of mapping complex subjects into clear, instantly navigable reference guides.