Skip to main content

FortiOS

Various FortiOS notes I've made for myself over the years.

I've been working with Fortinet firewalls now since v5.0.0. Mostly small deployments (F-60 class) but I have worked with larger devices. My main bread-and-butter firewalls was a cluster of FGT-300D units, which were replaced by a cluster of FGT-600F units. These clusters were run in a multi-customer environment without excessive reliance on vdoms. I've also worked with FGT-200F clusters in intercontinental scenarios and 10G scenarios.

v7.4.x

v7.2.x

v7.0.x

Show FQDN IPs in DNS Cache

(2025-06-04) diagnose firewall fqdn list-ip diagnose firewall fqdn list-all dia firewall fqdn li...

Looking at logs via CLI

(2024-11-28) fw # exec log filter category Category. device Device to ...

Link Monitor

(2023-11-15) Example Link Monitor Configuration config system link-monitor edit "VLAN601" set src...

IPsec MTU Varies By Encryption Algorythm

(2024-11-13) Stronger encryption algorithms equals to lower MTU values. For example, the FortiGat...

IPsec MTU Adjustments

MTU can be adjusted via three ways: Adjusting the MTU of the physical interface where the IPsec...

Export Logs From Fortigate Disk Over FTP

(2025-03-18) # execute backup disk alllogs ftp <IP_address> <username> <password> <compressed | u...

Debug sdwan

(2025-03-31) # di sys sdwan member Member. service ...

Debug PPPoE Connections

(2025-06-18) Commands to show what pppd is up to: diagnose debug reset diagnose debug disable dia...

Debug messages with timestamp

(2025-06-18) diagnose debug console timestamp enable

CLI Policy Lookup

(2024-02-06) Problem CLI way to duplicate the "policy lookup" tool Solution diagnose firewall ipr...

Check Geo-IP Region For A Specific IP

(2025-01-31) FGVM # di geoip ip2c 147.45.47.173 147.45.47.173 - Netherlands, is not anycast ip F...

Basic SDWAN Setup

(2025-06) What This Is About In the course of my day-to-day duties I've been seeing a lot of sdwa...

Debug SSLVPN Authentication Issues

(20215-07-25) diagnose debug reset diagnose debug application sslvpn -1 diagnose debug applicatio...

v6.4.x

v6.2.x

v6.0.x

v5.6.x

VPN Ciphers, Encryption, DH Settings Recommendations

(2019-03-13) Problem What are the recommended settings for IPSEC VPNs? (Updated 25 April 2023) IK...

Traffic Shaping Policy

(2019-07-08) Problem Traffic shaping wtf? Solution In 5.6, traffic shaping was removed from IPv4 ...

System Version from CLI

(2019-01-10) What firmware am I running? # get system status Version: FortiGate-60D v5.6.2,build1...

SSLVPN DNS Suffix

(2019-03-13) Problem SSLVPN users have to use FQDNs instead of short names when connecting to off...

SSL Security Settings

(2019-03-13) Problem Standard configuration for (more) secure crypto Solution config sys global ...

SSH Pubkey Login

(2018-12-19) Problem Want SSH Pubkey authentication for my AD-backed administrative user. Specifi...

Routing Table

(2019-05-28) Problem Routing table? Solution get router info routing-table all get router info ...

Microsoft Office Whitelisting

(2020-03-13) Creating Whitelists For Microsoft Internet Services See: (https://docs.microsoft.com...

List DHCP Clients CLI

(2019-02-13) Problem Using the CLI, list current assigned DHCP leases. Solution For interface "in...

IPsec Not Passing Packets

(2019-09-12) Problem IPsec tunnel to another device (in this case, a Watchguard). Tunnel shows as...

FortiOS LLDP

(2019-01-22) Solution So apparently FortiGates can do LLDP, you just have to turn it on. config s...

BGP Sessions

(2020-06-24) Problem Soft-bounce bgp sessions. This should cause peers to hold on to the routes w...

BGP Neighbors

(2020-06-18) BGP Neighbor status? # get router info bgp neighbors … # get router info bgp neighbo...

v5.4.x

Wifi Clients Connect But Can't Get DHCP Lease

(2019-04-17) Problem Wifi clients connect but can't get DHCP lease from either the Fortigate or f...

VPN Flapping Leads To Bogus Routing

(2018-01-30) Problem Two computers, A and B, trying to connect across a site-to-site VPN to compu...

System Time

(2018-12-03) Problem Show system time on a FortiGate. Solution # exec time current time is: 19:0...

SSLVPN Logs Out After 8 Hours

(2018-01-26) Problem SSLVPN disconnects after 8 hours. Solution config vpn ssl settings set auth-...

RTC Power Status Failed

(2018-12-03) Problem Firewall doesn't boot. When you hook a console up to it, it says: Error: RTC...

List SSLVPN Users

(2018-06-11) Problem List connected SSLVPN users. Solution exec vpn sslvpn list

List DHCP Client Leases

(2018-08-15) Problem Find the current list of DHCP clients for a Fortigate DHCP server. Solution ...

Forticlient Registering To Fortigate

(2018-02-02) Problem My FortiClient users are getting prompted to "register" their FortiClients a...

Fixing HA Sync Problems

(2017-11-13) Problem: fgt300d-b (global) # get system ha status HA Health Status: OK Model: Forti...

Factory Reset

(2018-03-01) Problem The reset to factory settings using the GUI is not available in v5.4. Soluti...

Debug Sniffer

(2017-11-23) Problem Want to sniff traffic flow. Solution # diag sniffer packet <interface> <'fil...

Debug Session

(2018-01-30) Session operations di sys session list Set a filter: di sys session filter di sys s...

Debug Flow

(2018-01-30) Debugging Flow Example: diag debug enable diag debug flow filter addr 203.160.224.97...

CPU is pinned

(2018-06-11) Problem CPU on Fortigate is maxed out for a long period of time (hours, days). Solut...

Connecting Multiple vDOMs to the same VLAN

(2018-02-26) Problem I have more vDOMs to connect to a VLAN than I have physical interfaces. (The...

CLI Upgrade Firmware

Problem Upgrading firmwares via the web UI is tedious, especially when you have 50 or 60+ of thes...

CLI Disk Scan FSCK

(2018-08-22) Problem It is a good idea to run a disk check before doing a firmware upgrade, espec...

v5.2.x

v5.0.x

Test Authentication Servers

Testing authentication These cli commands can help you test your radius or ldap server: # diag te...

Syslog

(2014-08-22) To enable logging to a syslog server: config log syslogd setting set status enab...

Simple Commands

(2013-11-13) Ping # exec ping $TARGET Options execute ping-options view-settings execute ping-o...

Routing Table

(2013-08-26) Display the routing table: # get router info routing-table all

Reset to Factory Defaults

(2013-08-28) Reset To Factory Defaults You have two minutes from power reset to perform this task...

Reset Admin Password

(2014-07-03) Problem Nobody remembers the password for a given admin account. We have another sup...

Radius Server Definition

(2014-06-14) On the smaller FortiGates, the GUI doesn't include the ability to define Radius serv...

Packet Capture

(2013-07-18) Show information of packets seen on an interface: # diag sniffer packet internal non...

Memory Logging

(2015-03-12) Problem By default, baby firewalls (which seems to mean up to and including F90Ds ) ...

Interface Status

(2015-04-01) Interface State Show IP, status, speed/duplex: get system interface physical Show p...

Interface Mode

(2014-06-24) To set interface mode: make sure the default Internal interface has no DHCP server ...

Interface Duplex

(2013-12-17) Problem Need to force speed/duplex on a physical interface. Solution There's no GUI ...

HA Cluster Member Firmware Revisions

(2014-11-20) Verify the firmware versions of cluster members:         fw-ottawa-A # get syste...

DHCP Reservation

(2015-01-29) Warning: this method does not work in 5.2 (and presumably higher). config system dhc...

DHCP Client Leases

(2015-04-22) List the DHCP leases handed out on $INTERFACE. # exec dhcp lease-list $INTERFACE

DHCP and PPPoE

Problem:        Cannot set mode to DHCP or PPPoE when HA is on. It doesn't work. Note: this is ...

crashlog

(2015-04-22) List the firewall's internal crashlog: # di de crashlog read

Backup ISP with some traffic selection

(2013-08-26) Problem: My scenario is that I have a FortiGate 60D with two ISPs: a static DSL, and...

arp

(2015-04-20) Show the arp table: # get system arp