Fortigate 防火墙常用命令

来源 https://www.cnblogs.com/kunlunsun/p/11423552.html

 

1. 命令结构

　　　　#config 对策略，对象等进行配置

　　　　#get  查看相关对象的参数

　　　　#show 查看配置文件

　　　　#diagnose 诊断命令 

　　　　#execute  常用的工具命令，如ping treacert,执行某条命令。

　　　　#exit  退出

　　　　#end 保存退出

 

　　2.常用命令

　　1、配置接口地址

　　　FortiGate # config system interface

　　　FortiGate (interface) # edit port1

　　　FortiGate (port1) # set ip 192.168.8.99/24

　　　FortiGate (port1) # end

 

　　2.配置静态路由

　　FortiGate (static) # edit 1

       FortiGate (1) # set device wan1

       FortiGate (1) # set dst 10.0.0.0 255.0.0.0

       FortiGate (1) # set gateway 192.168.57.1

       FortiGate (1) # end

　　3.配置默认路由

　　FortiGate (1) # set gateway 192.168.57.1

       FortiGate (1) # set device wan1

       FortiGate (1) # end

　　4.添加地址

　　FortiGate # config firewall address

       FortiGate (address) # edit clientnet

        new entry 'clientnet' added

       FortiGate (clientnet) # set subnet 192.168.1.0 255.255.255.0

       FortiGate (clientnet) # end

　　5.添加ip池

　　FortiGate (ippool) # edit nat-pool

        new entry 'nat-pool' added

       FortiGate (nat-pool) # set startip 100.100.100.1

       FortiGate (nat-pool) # set endip 100.100.100.100

       FortiGate (nat-pool) # end

　　6.添加虚拟ip

　　FortiGate # config firewall vip

       FortiGate (vip) # edit webserver

        new entry 'webserver' added

       FortiGate (webserver) # set extip 202.0.0.167

       FortiGate (webserver) # set extintf wan1

       FortiGate (webserver) # set mappedip 192.168.0.168

       FortiGate (webserver) # end

 

  7、配置上网策略

       FortiGate # config firewall policy

       FortiGate (policy) # edit 1        

       FortiGate (1)#set srcintf internal //源接口

       FortiGate (1)#set dstintf wan1    //目的接口

       FortiGate (1)#set srcaddr all        //源地址

       FortiGate (1)#set dstaddr all       //目的地址

       FortiGate (1)#set action accept      //动作

       FortiGate (1)#set schedule always    //时间

       FortiGate (1)#set service ALL          //服务

       FortiGate (1)#set logtraffic disable     //日志开关

       FortiGate (1)#set nat enable               //开启nat

       end

 

  8、配置映射策略

       FortiGate # config firewall policy

       FortiGate (policy) #edit 2

       FortiGate (2)#set srcintf wan1  //源接口

       FortiGate (2)#set dstintf internal //目的接口

       FortiGate (2)#set srcaddr all          //源地址

       FortiGate (2)#set dstaddr FortiGate1  //目的地址，虚拟ip映射，事先添加好的

       FortiGate (2)#set action accept     //动作

       FortiGate (2)#set schedule always //时间

       FortiGate (2)#set service ALL     //服务

       FortiGate (2)#set logtraffic all   //日志开关

       end

 

  9、把internal交换接口修改为路由口

       确保关于internal口的路由、dhcp、防火墙策略都删除

       FortiGate # config system global

       FortiGate (global) # set internal-switch-mode interface

       FortiGate (global) #end

       重启

--------------------------------------

     1、查看主机名，管理端口

            FortiGate # show system global

     2、查看系统状态信息，当前资源信息

            FortiGate # get hardware status  // 查看设备硬件信息

            FortiGate # get system status  // 查看系统信息

            FortiGate # get system performance status  // 查看系统当前运行状态

     3、查看应用流量统计

           FortiGate # get system performance firewall statistics

     4、查看arp表  

           FortiGate # get system arp

     5、查看arp丰富信息

           FortiGate # diagnose ip arp list

     6、清楚arp缓存

            FortiGate # execute clear system arp table

     7、 查看当前会话表

            FortiGate # diagnose sys session stat 或 FortiGate # diagnose sys session full-stat；

     8、 查看会话列表

            FortiGate # diagnose sys session list

     9、查看物理接口状态

           FortiGate # get system interface physical

    10、查看默认路由配置

          FortiGate # show router static

    11、查看路由表中的静态路由

          FortiGate # get router info routing-table static

    12、查看ospf相关配置

           FortiGate # show router ospf

    13、查看全局路由表

          FortiGate # get router info routing-table all

-----------------------------------------------

    1、查看HA状态

        FortiGate # get system ha status

    2、查看主备机是否同步

     FortiGate # diagnose sys ha showcsum

---------------------------------------------------

   3.诊断命令：

      FortiGate # diagnose debug application ike -1

  ---------------------------------------------------

      execute 命令：

       FortiGate #execute  ping  8.8.8.8                                       //常规ping操作

       FortiGate #execute  ping-options source  192.168.1.200    //指定ping数据包的源地址 192.168.1.200

       FortiGate #execute  ping  8.8.8.8                                        //继续输入ping的目标地址，即可通过192.168.1.200的源地址执行ping操作

       FortiGate #execute  traceroute   8.8.8.8                  

       FortiGate #execute  telnet 2.2.2.2      //进行telnet访问                  

       FortiGate #execute  ssh  2.2.2.2        //进行ssh 访问

       FortiGate #execute  factoryreset        //恢复出厂设置

       FortiGate #execute  reboot              //重启设备

       FortiGate #execute  shutdown            //关闭设备

 

===========

Fortinet防火墙命令行概述

来源 https://blog.51cto.com/it568/1910241

 

1. 可以通过SSH, Telnet, 或者serial console

2. CLI的配置是分级的结构，如下所示：
config system interface
edit "internal"
set vdom "root"
set ip 192.168.100.99 255.255.255.0
set allowaccess ping https ssh snmp http telnet
set type physical
next
end

3. 命令行层次结构具体有下面这些关键字：

config

edit

next

end

exit

abort

4. 使用 “?” 可以查询可用当前级别可以的指令

5. 使用 <tab> 可以将当前命令补齐

6. 设置wan2的IP:的例子：

FortiGate-60 # config system interface
(interface)# edit wan2
(wan2)# set ip 192.177.11.12 255.255.255.248
(wan2)# end
FortiGate-60 #

7. 可以用“get”命令显示参数和当前值：
(internal)# get
name : internal
vdom : root
cli-conn-status : 0
mode : static
dhcp-relay-service :
dhcp-relay-ip :
dhcp-relay-type :
ip : 192.168.96.254 255.255.255.0
allowaccess : ping HTTPS HTTP telnet

8. 可以用“show”命令显示当前配置：
FGT50B3 # config system interface
FGT50B3 (interface) # edit internal
FGT50B3 (internal) # show
config system interface
edit "internal"
set vdom "root"
set ip 192.168.100.99 255.255.255.0
set allowaccess ping https ssh snmp http telnet
set type physical
next
end

9. 可以用“show full-configuration”命令显示当前完全配置：
FGT50B3 # config system interface
FGT50B3 (interface) # edit internal
FGT50B3 (internal) # show full-configuration
config system interface
edit "internal"
set vdom "root"
set mode static
set dhcp-relay-service disable
unset dhcp-relay-ip
set dhcp-relay-type regular
set ip 192.168.100.99 255.255.255.0
set allowaccess ping https ssh snmp http telnet
set gwdetect disable
unset detectserver
set ha-priority 0
set pptp-client disable
set arpforward enable
set broadcast-forward disable
set bfd global
set l2forward disable
set icmp-redirect enable
set vlanforward enable
set stpforward disable
set ident-accept disable
set ipmac disable
set subst disable
set log disable
set fdp disable
set ddns disable
set status up
set netbios-forward disable
set wins-ip 0.0.0.0
set type physical
set tcp-mss 0
set inbandwidth 0
set outbandwidth 0
set description ''
set alias ''
set l2tp-client disable
config ipv6
set autoconf disable
set ip6-address ::/0
unset ip6-allowaccess
set ip6-default-life 1800
set ip6-hop-limit 0
set ip6-link-mtu 0
set ip6-manage-flag disable
set ip6-max-interval 600
set ip6-min-interval 198
set ip6-other-flag disable
set ip6-reachable-time 0
set ip6-retrans-time 0
set ip6-send-adv disable
end
set idle-timeout 0
unset macaddr
set mtu-override disable
next
end

10. 执行某些命令，例如:
execute factoryreset
execute ping
execute backup
execute traceroute
execute reboot

========== End

 

标签：execute,set,disableset,Fortigate,system,192.168,防火墙,常用命令,FortiGate
来源： https://www.cnblogs.com/lsgxeva/p/16053056.html