admin
Use the following commands to configure admin related settings.
admin group
Use this command to add, edit, and delete admin user groups.
Syntax
config system admin group
edit <name>
set member <string>
end
|
Variable |
Description |
|---|---|
|
<name> |
Enter the name of the group you are editing or enter a new name to create an entry (character limit = 63). |
|
member <string> |
Add group members. |
admin ldap
Use this command to add, edit, and delete Lightweight Directory Access Protocol (LDAP) users.
Syntax
config system admin ldap
edit <server>
set adom-access {all | specify}
set adom-attr <string>
set adom <adom-name>
set attributes <filter>
set ca-cert <string>
set cnid <string>
set dn <string>
set filter <string>
set group <string>
set memberof-attr <string>
set password <passwd>
set port <integer>
set profile-attr <string>
set secondary-server <string>
set secure {disable | ldaps | starttls}
set server <string>
set tertiary-server <string>
set type {anonymous | regular | simple}
set username <string>
end
|
Variable |
Description |
|---|---|
|
adom-access {all | specify} |
Set all or specify the ADOM access type (default = all). |
|
<server> |
Enter the name of the LDAP server or enter a new name to create an entry (character limit = 63). |
|
adom-attr <string> |
The attribute used to retrieve ADOM. |
|
adom <adom-name> |
Set the ADOM name to link to the LDAP configuration. |
|
attributes <filter> |
Attributes used for group searching (for multi-attributes, a use comma as a separator). For example:
|
|
ca-cert <string> |
CA certificate name. This variable appears only when |
|
cnid <string> |
Enter the common name identifier (character limit = 20, default = cn). |
|
dn <string> |
Enter the distinguished name. |
|
filter <string> |
Enter content for group searching. For example: (&(objectcategory=group)(member=*)) (&(objectclass=groupofnames)(member=*)) (&(objectclass=groupofuniquenames)(uniquemember=*)) (&(objectclass=posixgroup)(memberuid=*)) |
|
group <string> |
Enter an authorization group. The authentication user must be a member of this group (full DN) on the server. |
|
memberof-attr <string> |
The attribute used to retrieve memeberof. |
|
password <passwd> |
Enter a password for the username above. This variable appears only when |
|
port <integer> |
Enter the port number for LDAP server communication (1 - 65535, default = 389). |
|
profile-attr <string> |
The attribute used to retrieve admin profile. |
|
secondary-server <string> |
Enter the secondary LDAP server domain name or IPv4 address. Enter a new name to create a new entry. |
|
secure {disable | ldaps | starttls} |
Set the SSL connection type:
|
|
server <string> |
Enter the LDAP server domain name or IPv4 address. Enter a new name to create a new entry. |
|
tertiary-server <string> |
Enter the tertiary LDAP server domain name or IPv4 address. Enter a new name to create a new entry. |
|
type {anonymous | regular | simple} |
Set a binding type:
|
|
username <string> |
Enter a username. This variable appears only when |
Example
This example shows how to add the LDAP user user1 at the IPv4 address 206.205.204.203.
config system admin ldap
edit user1
set server 206.205.204.203
set dn techdoc
set type regular
set username auth1
set password auth1_pwd
set group techdoc
end
admin profile
Use this command to configure access profiles. In a newly-created access profile, no access is enabled. Setting an option to none hides it from administrators with that profile assigned.
Syntax
config system admin profile
edit <profile_name>
set adom-admin {enable | disable}
set adom-lock {none | read | read-write}
set adom-switch {none | read | read-write}
set allow-to-install {enable | disable}
set change-password {enable | disable}
set datamask {enable | disable}
set datamask-custom-priority {enable | disable}
set datamask-fields <fields>
set datamask-key <passwd>
set datamask-unmasked-time <integer>
set description <text>
set device-ap {none | read | read-write}
set device-fortiextender {none | read | read-write}
set device-fortiswitch {none | read | read-write}
set device-manager {none | read | read-write}
set device-op {none | read | read-write}
set device-policy-package-lock {none | read | read-write}
set device-wan-link-load-balance {none | read | read-write}
set event-management {none | read | read-write}
set execute-playbook {none | read | read-write}
set extension-access {none | read | read-write}
set fabric-viewer {none | read | read-write}
set fgt-gui-proxy {enable | disable}
set ips-lock {none | read | read-write}
set ipv6_trusthost1 <IPv6 prefix>
set ipv6_trusthost2 <IPv6 prefix>
set ipv6_trusthost3 <IPv6 prefix>
.
.
.
set ipv6_trusthost10 <IPv6 prefix>
set log-viewer {none | read | read-write}
set report-viewer {none | read | read-write}
set rpc-permit {none | read | read-write}
set run-report {none | read | read-write}
set scope {adom | global}
set script-access {none | read | read-write}
set super-user-profile {enable | disable}
set system-setting {none | read | read-write}
set triage-events {none | read | read-write}
set trusthost1 <ip&netmask>
set trusthost2 <ip&netmask>
set trusthost3 <ip&netmask>
.
.
.
set trusthost10 <ip&netmask>
set update-incidents {none | read | read-write}
set write-passwd-access {all | specify-by-profile | specify-by-user}
set write-passwd-profiles <profile list>
set write-passwd-user-list <user list>
config datamask-custom-fields
edit <field>
set field-category {alert | all | fortiview | log | euba}
set field-status {enable | disable}
set field-type {email | ip | mac | string}
next
end
|
When creating a new admin profile, the default for all permissions is |
|
Variable |
Description |
|---|---|
|
<profile> |
Edit the access profile. Enter a new name to create a new profile (character limit = 35). The pre-defined access profiles are No_Permission_User, Password_Change_User, Super_User, Standard_User, and Restricted_User. |
|
adom-admin {enable | disable} |
Enable/disable Adom Admin (default = disable). Users with an ADOM Admin profile can only manage administrators within their own ADOM. This admin profile can only be assigned to users with a single specified ADOM. |
|
adom-lock {none | read | read-write} |
Configure ADOM locking permissions for profile:
Controlled functions: ADOM locking. |
|
adom-switch {none | read | read-write} |
Configure administrative domain (ADOM) permissions for this profile. Controlled functions: ADOM settings in DVM, ADOM settings in All ADOMs page (under System Settings tab) Dependencies: If |
|
allow-to-install {enable | disable} |
Enable/disable allowing restricting users to install objects to the devices (default = enable). |
|
change-password {enable | disable} |
Enable/disable allowing restricted users to change their password (default = disable). |
|
datamask {enable | disable} |
Enable/disable data masking (default = disable). |
|
datamask-custom-priority {enable | disable} |
Enable/disable custom field search priority. |
|
datamask-fields <fields> |
Enter that data masking fields, separated by spaces.
|
|
datamask-key <passwd> |
Enter the data masking encryption key. |
|
datamask-unmasked-time <integer> |
Enter the time without data masking, in days (default = 0). |
|
description <string> |
Enter a description for this access profile (character limit = 1023). Enclose the description in quotes if it contains spaces. |
|
device-ap {none | read | read-write} |
Set the AP Manager permissions. |
|
device-fortiextender {none | read | read-write} |
Set the FortiExtender Manager permissions. |
|
device-fortiswitch {none | read | read-write} |
Set the FortiSwitch Manager permissions. |
|
device-manager {none | read | read-write} |
Enter the level of access to Device Manager settings for this profile. This command corresponds to the Device Manager option in the GUI administrator profile. Controlled functions: Device Manager |
|
device-op {none | read | read-write} |
Add the capability to add, delete, and edit devices to this profile. This command corresponds to the Add/Delete Devices/Groups option in the GUI administrator profile. This is a sub-setting of Controlled functions: Add or delete devices or groups |
|
device-policy-package-lock {none | read | read-write} |
Configure device policy package locking permissions for this profile. Controlled functions: Policy package locking. |
|
device-wan-link-load-balance {none | read | read-write} |
Set the SD-WAN permissions. |
|
event-management {none | read | read-write} |
Set the Event Management permissions. This command corresponds to the Event Management option in the GUI administrator profile. Controlled functions: Event Management tab and all its operations |
|
execute-playbook {none | read | read-write} |
Configure execute playbook permissions. |
|
extension-access {none | read | read-write} |
Manage extension access. |
|
fabric-viewer {none | read | read-write} |
Configure Fabric Viewer permissions. |
|
fgt-gui-proxy {enable | disable} |
Enable/disable the FortiGate GUI proxy (default = disable). |
|
ips-lock {none | read | read-write} |
Set the IPS locking permission. |
|
ipv6_trusthost1 <IPv6 prefix> ipv6_trusthost2 <IPv6 prefix> ipv6_trusthost3 <IPv6 prefix> ... ipv6_trusthost10 <IPv6 prefix> |
The admin user trusted host IPv6 address. Defaults =
others: |
|
log-viewer {none | read | read-write} |
Set the Log View permissions. This command corresponds to the Log View option in the GUI administrator profile. Controlled functions: Log View and all its operations |
|
report-viewer {none | read | read-write} |
Set the Reports permissions. This command corresponds to the Reports option in the GUI administrator profile. Controlled functions: Reports tab and all its operations |
|
rpc-permit {none | read | read-write} |
Set the rpc-permission |
|
run-report {none | read | read-write} |
Configure run reports permission for this profile. |
|
scope (Not Applicable) |
CLI command is not in use. |
|
script-access {none | read | read-write} |
Configure script access. |
|
super-user-profile {enable | disable} |
Enable/disable the super user profile (default = disable). |
|
system-setting {none | read | read-write} |
Configure System Settings permissions for this profile. This command corresponds to the System Settings option in the GUI administrator profile. Controlled functions: System Settings tab, all the settings under System setting, and CLI access |
|
triage-events {none | read | read-write} |
Set the triage events permissions for this profile. |
|
trusthost1 <ip&netmask> trusthost2 <ip&netmask> trusthost2 <ip&netmask> ... trusthost10 <ip&netmask> |
The admin user trusted host IP address. Defaults :
others: |
|
update-incidents {none | read | read-write} |
Create/update incidents. |
|
write-passwd-access {all | specify-by-profile | specify-by-user} |
Set the write password access mode. Only available for the default
|
|
write-passwd-profiles <profile list> |
Enter the profile list. Use a space between each entry in the list; for example, Only available for the |
|
write-passwd-user-list <user list> |
Enter the user list. Use a space between each entry in the list; for example, Only available for the |
|
Variables for |
|
|
<field> |
Enter the custom field name. |
|
field-category {alert | all | fortiview | log | euba} |
Enter the field category (default = all). |
|
field-status {enable | disable} |
Enable/disable the field (default = enable). |
|
field-type {email | ip | mac | string} |
Enter the field type (default = string). |
admin radius
Use this command to add, edit, and delete administration RADIUS servers.
Syntax
config system admin radius
edit <server>
set auth-type {any | chap | mschap2 | pap}
set nas-ip <ipv4_address>
set port <integer>
set secondary-secret <passwd>
set secondary-server <string>
set secret <passwd>
set server <string>
end
|
Variable |
Description |
|---|---|
|
<server> |
Enter the name of the RADIUS server or enter a new name to create an entry (character limit = 63). |
|
auth-type {any | chap | mschap2 | pap} |
The authentication protocol the RADIUS server will use.
|
|
nas-ip <ipv4_address> |
The network access server (NAS) IPv4 address and called station ID. |
|
port <integer> |
The RADIUS server port number (1 - 65535, default = 1812). |
|
secondary-secret <passwd> |
The password to access the RADIUS secondary-server (character limit = 64). |
|
secondary-server <string> |
The RADIUS secondary-server DNS resolvable domain name or IPv4 address. |
|
secret <passwd> |
The password to access the RADIUS server (character limit = 64). |
|
server <string> |
The RADIUS server DNS resolvable domain name or IPv4 address. |
Example
This example shows how to add the RADIUS server RAID1 at the IPv4 address 206.205.204.203 and set the shared secret as R1a2D3i4U5s.
config system admin radius
edit RAID1
set server 206.205.204.203
set secret R1a2D3i4U5s
end
admin setting
Use this command to configure system administration settings, including web administration ports, timeout, and language.
Syntax
config system admin setting
set access-banner {enable | disable}
set admin-https-redirect {enable | disable}
set admin-login-max <integer>
set admin_server_cert <admin_server_certificate>
set auth-addr <string>
set auth-port <integer>
set banner-message <string>
set fgt-gui-proxy {enable | disable}
set fgt-gui-proxy-port <integer>
set firmware-upgrade-check {enable | disable}
set fsw-ignore-platform-check {enable | disable}
set gui-theme <theme>
set http_port <integer>
set https_port <integer>
set idle_timeout <integer>
set idle_timeout_api <integer>
set idle_timeout_gui <integer>
set idle_timeout_sso <integer>
set objects-force-deletion {enable | disable}
set preferred-fgfm-intf <string>
set show-add-multiple {enable | disable}
set show-checkbox-in-table {enable | disable}
set show-device-import-export {enable | disable}
set show-fct-manager {enable | disable}
set show_hostname {enable | disable}
set show-log-forwarding {enable | disable}
set unreg_dev_opt {add_allow_service | add_no_service}
set webadmin_language {auto_detect | english | french | japanese | korean | simplified_chinese | spanish | traditional_chinese}
end
|
Variable |
Description |
||
|---|---|---|---|
|
access-banner {enable | disable} |
Enable/disable the access banner (default = disable). |
||
|
admin-https-redirect {enable | disable} |
Enable/disable redirection of HTTP admin traffic to HTTPS (default = enable). |
||
|
admin-login-max <integer> |
Set the maximum number of admin users that be logged in at one time (1 - 256, default = 256). |
||
|
admin_server_cert <admin_server_certificate> |
Enter the name of an https server certificate to use for secure connections (default = server.crt). FortiAnalyzer has server.crt and Fortinet_Local certificates pre-loaded. |
||
|
auth-addr <string> |
Enter the IP which is used by FortiGate to authorize FortiAnalyzer. |
||
|
auth-port <integer> |
Set the port which is used by FortiGate to authorize FortiAnalyzer (default = 443). |
||
|
banner-message <string> |
Set the banner messages (character limit = 32768). |
||
|
fgt-gui-proxy {enable | disable} |
Enable/disable FortiGate GUI proxy (default = enable). |
||
|
fgt-gui-proxy-port <integer> |
Enter the FortiGate GUI proxy port (default = 8082). |
||
|
firmware-upgrade-check {enable | disable} |
Enable/disable firmware upgrade check (default = enable). |
||
|
fsw-ignore-platform-check {enable | disable} |
Enable/disable FortiSwitch Manager switch platform support check (default = disable). |
||
|
gui-theme <theme> |
Configure the GUI theme (default = jade). |
||
|
http_port <integer> |
Enter the HTTP port number for web administration (1 - 65535, default = 80). |
||
|
https_port <integer> |
Enter the HTTPS port number for web administration (1 - 65535, default = 443). |
||
|
idle_timeout <integer> |
Enter the idle timeout value, in seconds (60 - 28800, default = 900). The |
||
|
idle_timeout_api <integer> |
Enter the idle timeout for the API sessions, in seconds (1 - 28800, default = 900). |
||
|
idle_timeout_gui <integer> |
Enter the idle timeout for the GUI sessions, in seconds (60 - 28800, default = 900). |
||
|
idle_timeout_sso <integer> |
Enter the idle timeout for the SSO sessions, in seconds (60 - 28800, default = 900). |
||
|
objects-force-deletion {enable | disable} |
Enable/disable forced deletion of used objects (default = enable). |
||
|
preferred-fgfm-intf <string> |
Preferred interface for FGFM connection. |
||
|
show-add-multiple {enable | disable} |
Enable/disable show the add multiple button in the GUI (default = disable). |
||
|
show-checkbox-in-table {enable | disable} |
Enable/disable show checkboxes in tables in the GUI (default = disable). |
||
|
show-device-import-export {enable | disable} |
Enable/disable import/export of ADOM, device, and group lists (default = disable). |
||
|
show-fct-manager {enable | disable} |
Enable/disable FCT manager (default = disable).
|
||
|
show_hostname {enable | disable} |
Enable/disable showing the hostname on the GUI login page (default = disable). |
||
|
show-log-forwarding {enable | disable} |
Enable/disable show log forwarding tab in analyzer mode (default= enable). |
||
|
unreg_dev_opt {add_allow_service | add_no_service} |
Select action to take when an unregistered device connects to FortiAnalyzer:
|
||
|
webadmin_language {auto_detect | english | french | japanese | korean | simplified_chinese | spanish | traditional_chinese} |
Enter the language to be used for web administration. The following options are available:
|
Use the show command to display the current configuration if it has been changed from its default value:
show system admin setting
admin tacacs
Use this command to add, edit, and delete administration TACACS+ servers.
Syntax
config system admin tacacs
edit <server>
set authen-type {ascii | auto |chap | mschap | pap}
set authorization {enable | disable}
set key <passwd>
set port <integer>
set secondary-key <passwd>
set secondary-server <string>
set server <string>
set tertiary-key <passwd>
set tertiary-server <string>
end
|
Variable |
Description |
|---|---|
|
<server> |
Enter the name of the TACACS+ server or enter a new name to create an entry (character limit = 63). |
|
authen-type {ascii | auto |chap | mschap | pap} |
Choose which authentication type to use:
|
|
authorization {enable | disable} |
Enable/disable TACACS+ authorization (default = disable). |
|
key <passwd> |
Key to access the server (character limit = 128). |
|
port <integer> |
Port number of the TACACS+ server (1 - 65535, default = 49). |
|
secondary-key <passwd> |
Key to access the secondary server (character limit = 128). |
|
secondary-server <string> |
Secondary server domain name or IPv4 address. |
|
server <string> |
The server domain name or IPv4 address. |
|
tertiary-key <passwd> |
Key to access the tertiary server (character limit = 128). |
|
tertiary-server <string> |
Tertiary server domain name or IPv4 address. |
Example
This example shows how to add the TACACS+ server TAC1 at the IPv4 address 206.205.204.203 and set the key as R1a2D3i4U5s.
config system admin tacacs
edit TAC1
set server 206.205.204.203
set key R1a2D3i4U5s
end
admin user
Use this command to add, edit, and delete administrator accounts.
You must use a super user administrator account to add, edit, or delete administrator accounts and control their permission levels. Each administrator account must include a minimum of an access profile. The access profile list is ordered alphabetically, capitals first. If custom profiles are defined, it may change the default profile from Restricted_User. You cannot delete the admin administrator account. You cannot delete an administrator account if that user is logged on.
|
|
You can create meta-data fields for administrator accounts. These objects must be created using the FortiAnalyzer GUI. The only information you can add to the object is the value of the field (pre-determined text/numbers). For more information, see System Settings in the FortiAnalyzer Administration Guide. |
Syntax
config system admin user
edit <name_str>
set login-max <integer>
set password <passwd>
set change-password {enable | disable}
set th-from-profile <integer>
set th6-from-profile <integer>
set trusthost1 <ipv4_mask>
set trusthost2 <ipv4_mask>
set trusthost3 <ipv4_mask>
...
set trusthost10 <ipv4_mask>
set ipv6_trusthost1 <ipv6_mask>
set ipv6_trusthost2 <ipv6_mask>
set ipv6_trusthost3 <ipv6_mask>
...
set ipv6_trusthost10 <ipv6_mask>
set profileid <profile-name>
set adom <adom_name(s)>
set adom-access {all | exclude | specify}
set dev-group <group-name>
set description <string>
set user_type {api | group | ldap | local | pki-auth | radius | tacacs-plus}
set group <string>
set ldap-server <string>
set radius_server <string>
set tacacs-plus-server <string>
set ssh-public-key1 <key-type> <key-value>
set ssh-public-key2 <key-type>, <key-value>
set ssh-public-key3 <key-type> <key-value>
set avatar <string>
set wildcard <enable | disable>
set ext-auth-accprofile-override <enable | disable>
set ext-auth-adom-override <enable | disable>
set ext-auth-group-match <string>
set password-expire <yyyy-mm-dd>
set force-password-change {enable | disable}
set fingerprint <string>
set subject <string>
set ca <string>
set cors-allow-origin <string>
set two-factor-auth {disable | ftc-email | ftc-ftm | ftc-sms}
set rpc-permit {none | read-only | read-write}
set use-global-theme {enable | disable}
set user-theme {astronomy | autumn | binary-tunnel | blue-sea | calla-lily | canyon | cat | cave | circuit-board | contrast-dark | dark-matter | fish | forest | graphite | jade | mariner | mars | mountain | northern-light | panda | penguin | spring | summer | technology | twilight | winter | zebra}
set fortiai {enable | disable}
set last-name <string>
set first-name <string>
set email-address <string>
set phone-number <string>
set mobile-number <string>
set pager-number <string>
config meta-data
edit <fieldname>
set fieldlength
set fieldvalue <string>
set importance
set status
end
config dashboard-tabs
edit tabid <integer>
set name <string>
end
config dashboard
edit moduleid
set name <string>
set column <column_pos>
set diskio-content-type
set diskio-period {1hour | 24hour | 8hour}
set refresh-inverval <integer>
set status {close | open}
set tabid <integer>
set widget-type <string>
set log-rate-type {device | log}
set log-rate-topn {1 | 2 | 3 | 4 | 5}
set log-rate-period {1hour | 2min | 6hours}
set res-view-type {history | real-time}
set res-period {10min | day | hour}
set res-cpu-display {average | each}
set num-entries <integer>
set time-period {1hour | 24hour | 8hour}
end
end
|
Variable |
Description |
|---|---|
|
<name_string> |
Enter the name of the admin user or enter a new name to create a new user (character limit = 35). |
|
login-max <integer> |
Set the maximum number of login sessions for this user (default = 32). |
|
password <passwd> |
Enter a password for the administrator account (character limit = 128). For improved security, the password should be at least 6 characters long. This variable is available only if |
|
change-password {enable | disable} |
Enable/disable allowing restricted users to change their password (default = disable). |
|
th-from-profile <integer> |
|
|
th6-from-profile <integer> |
|
|
trusthost1 <ipv4_mask> trusthost2 <ipv4_mask> ... trusthost10 <ipv4_mask> |
Optionally, type the trusted host IPv4 address and network mask from which the administrator can log in to the FortiAnalyzer system. You can specify up to ten trusted hosts. Setting trusted hosts for all of your administrators can enhance the security of your system. Defaults:
others: |
|
ipv6_trusthost1 <ipv6_mask> ipv6_trusthost2 <ipv6_mask> ... ipv6_trusthost10 <ipv6_mask> |
Optionally, type the trusted host IPv6 address from which the administrator can log in to the FortiAnalyzer system. You can specify up to ten trusted hosts. Setting trusted hosts for all of your administrators can enhance the security of your system. Defaults:
others: |
|
profileid <profile-name> |
Enter the name of the access profile to assign to this administrator account (character limit = 35, default = Restricted_User). Access profiles control administrator access to FortiAnalyzer features. |
|
adom <adom_name(s)> |
Enter the name(s) of the ADOM(s) the administrator belongs to. Any configuration of ADOMs takes place via the FortiAnalyzer GUI. |
|
adom-access {all | exclude | specify} |
Set all/specify/exclude ADOM access mode (default = specify). |
|
dev-group <group-name> |
Enter the device group that the admin use can access. This option can only be used for administrators with access to only one ADOM. |
|
description <string> |
Enter a description for this administrator account (character limit = 127). Enclose the description in quotes if it contains spaces. |
|
user_type {group | ldap | local | pki-auth | radius | tacacs-plus} |
Select the administrator type:
|
|
group <string> |
Enter the group name. |
|
ldap-server <string> |
Enter the LDAP server name if the user type is set to LDAP. |
|
radius_server <string> |
Enter the RADIUS server name if the user type is set t o RADIUS. |
|
tacacs-plus-server <string> |
Enter the TACACS+ server name if the user type is set to TACACS+. |
|
ssh-public-key1 <key-type> <key-value> ssh-public-key2 <key-type> <key-value> ssh-public-key3 <key-type> <key-value> |
You can specify the public keys of up to three SSH clients. These clients are authenticated without being asked for the administrator password. You must create the public-private key pair in the SSH client application.
|
|
avatar <string> |
Image file for the administrator's avatar (maximum 4K base64 encode). |
|
wildcard <enable | disable> |
Enable/disable wildcard remote authentication (default = disable). |
|
ext-auth-accprofile-override <enable | disable> |
Enable/disable allowing the use of the access profile provided by the remote authentication server (default = disable). |
|
ext-auth-adom-override <enable | disable> |
Enable/disable allowing the use of the ADOM provided by the remote authentication server (default = disable). In order to support vendor specific attributes (VSA), the authentication server requires a dictionary to define which VSAs to support. The Fortinet RADIUS vendor ID is |
|
ext-auth-group-match <string> |
Only admin users that belong to this group are allowed to log in. |
|
password-expire <yyyy-mm-dd> |
When enforcing the password policy, enter the date that the current password will expire. |
|
force-password-change {enable | disable} |
Enable/disable force password change on next log in. |
|
fingerprint <string> |
PKI user certificate fingerprint based on MD5, SHA-1, or SHA-256 hash function. Format the fingerprint by removing spaces or replacing them with ' This command is available when an API or PKI administrator account is configured. |
|
subject <string> |
PKI user certificate name constraints. This command is available when an API or PKI administrator account is configured. |
|
ca <string> |
PKI user certificate CA (CA name in local). This command is available when an API or PKI administrator account is configured. |
|
cors-allow-origin <string> |
Value for access-control-allow-origin on API responses (default = null). This command is available when an API administrator account is configured. |
|
two-factor-auth {disable | ftc-email | ftc-ftm | ftc-sms} |
Enable/disable two-factor authentication (default = disable). You can enable for FortiToken Cloud email, mobile, or SMS. This command is available when a PKI administrator account is configured. |
|
rpc-permit {none | read-only | read-write} |
Set the permission level for log in via Remote Procedure Call (RPC) (default = none). |
|
use-global-theme {enable | disable} |
Enable/disble global theme for administration GUI (default = enable). |
|
user-theme {astronomy | autumn | binary-tunnel | blue-sea | calla-lily | canyon | cat | cave | circuit-board | contrast-dark | dark-matter | fish | forest | graphite | jade | mariner | mars | mountain | northern-light | panda | penguin | spring | summer | technology | twilight | winter | zebra} |
Set the color scheme to use for the admin user GUI (default = jade):
This command is available when |
|
fortiai {enable | disable} |
Enable/disable FortiAI (default = disabled). If you have already reached the maximum number of users allowed, you will receive an error. |
|
last-name <string> |
Administrator's last name (character limit = 63). |
|
first-name <string> |
Administrator's first name (character limit = 63). |
|
email-address <string> |
Administrator's email address. |
|
phone-number <string> |
Administrator's phone number. |
|
mobile-number <string> |
Administrator's mobile phone number. |
|
pager-number <string> |
Administrator's pager number. |
|
Variables for This subcommand can only change the value of an existing field. To create a new metadata field, use the |
|
|
fieldname |
The label/name of the field (read-only, default = 50). Enclose the name in quotes if it contains spaces. |
|
fieldlength |
The maximum number of characters allowed for this field (read-only, default = 50). |
|
fieldvalue <string> |
Enter a pre-determined value for the field. This is the only value that can be changed with the |
|
importance |
Indicates whether the field is compulsory ( |
|
status |
The status of the field (read-only, default = enable). |
|
Variables for |
|
|
tabid <integer> |
Tab ID. |
|
name <string> |
Tab name. |
|
Variables for |
|
|
moduleid |
Widget ID. |
|
name <string> |
Widget name (character limit = 63). |
|
column <column_pos> |
Widget column ID (default = 0). |
|
diskio-content-type {blks | iops | util} |
Set the Disk I/O Monitor widget's chart type.
|
|
diskio-period {1hour | 24hour | 8hour} |
Set the Disk I/O Monitor widget's data period (default = 1hour). |
|
refresh-inverval <integer> |
Widget refresh interval (default = 300). |
|
status {close | open} |
Widget opened/closed status (default = open). |
|
tabid <integer> |
ID of the tab where the widget is displayed (default = 0). |
|
widget-type <string> |
Widget type:
|
|
log-rate-type {device | log} |
Log receive monitor widget’s statistics breakdown options (default = device). |
|
log-rate-topn {1 | 2 | 3 | 4 | 5} |
Log receive monitor widgets’s number of top items to display (default = 5). |
|
log-rate-period {1hour | 2min | 6hours} |
Log receive monitor widget’s data period (default = 2min). |
|
res-view-type {history | real-time} |
Widget’s data view type (default = history). |
|
res-period {10min | day | hour} |
Widget data period:
|
|
res-cpu-display {average | each} |
Widget CPU display type:
|
|
num-entries <integer> |
Number of entries (default = 10). |
|
time-period {1hour | 24hour | 8hour} |
Set the Log Database Monitor widget's data period (default = 1hour). |
Using trusted hosts
Setting trusted hosts for all of your administrators increases the security of your network by further restricting administrative access. In addition to knowing the password, an administrator must connect only through the subnet or subnets you specify. You can even restrict an administrator to a single IPv4 address if you define only one trusted host IPv4 address with a netmask of 255.255.255.255.
When you set trusted hosts for all administrators, the FortiAnalyzer system does not respond to administrative access attempts from any other hosts. This provides the highest security. If you leave even one administrator unrestricted, the unit accepts administrative access attempts on any interface that has administrative access enabled, potentially exposing the unit to attempts to gain unauthorized access.
The trusted hosts you define apply both to the GUI and to the CLI when accessed through SSH. CLI access through the console connector is not affected.
Example
Use the following commands to add a new administrator account named admin_2 with the password set to p8ssw0rd and the Super_User access profile. Administrators that log in to this account will have administrator access to the FortiAnalyzer system from any IPv4 address.
config system admin user
edit admin_2
set description "Backup administrator"
set password p8ssw0rd
set profileid Super_User
end