Fortinet black logo

Handbook

CLI scripts

6.0.0
Copy Link
Copy Doc ID 4afb0436-a998-11e9-81a4-00505692583a:220261
Download PDF

CLI scripts

To upload bulk CLI commands and scripts, go to System > Advanced.

Scripts are text files containing CLI command sequences. Scripts can be used to deploy identical configurations to many devices. For example, if all of your devices use identical security policies, you can enter the commands required to create the security policies in a script, and then deploy the script to all the devices which should use those same settings.

Use a text editor such as Notepad or other application that creates simple text files. Enter the commands in sequence, with each line as one command, similar to examples throughout the FortiOS documentation set.

If you are using a FortiGate unit that is not remotely managed by a FortiManager unit or the FortiGuard Analysis and Management Service, the scripts you upload are executed and discarded. If you want to execute a script more than once, you must keep a copy on your management PC.

If your FortiGate unit is configured to use a FortiManager unit, you can upload your scripts to the FortiManager unit, and run them from any FortiGate unit configured to use the FortiManager unit. If you upload a script directly to a FortiGate unit, it is executed and discarded.

If your FortiGate unit is configured to use FortiGuard Analysis and Management Service, scripts you upload are executed and stored. You can run uploaded scripts from any FortiGate unit configured with your FortiGuard Analysis and Management Service account. The uploaded script files appear on the FortiGuard Analysis and Management Service portal web site.

Uploading script files

After you have created a script file, you can then upload it through System > Advanced. When a script is uploaded, it is automatically executed.

Commands that require the FortiGate unit to reboot when entered in the command line will also force a reboot if included in a script.

To execute a script
  1. Go to System > Advanced.
  2. Enable Configuration Scripts.
  3. Select Upload and Run a New Script to locate the script file.
  4. Select Apply.

If the FortiGate unit is not configured for remote management, or if it is configured to use a FortiManager unit, uploaded scripts are discarded after execution. Save script files to your management PC if you want to execute them again later.

If the FortiGate unit is configured to use the FortiGuard Analysis and Management Service, the script file is saved to the remote server for later reuse. You can view the script or run it from the FortiGuard Analysis and Management Service portal web site.

Auto repeat of CLI commands

Occasionally there is a need to repeatedly run a diagnose command over a long period of time (like checking CPU or memory usage, or checking proxy health), Previously, this could only be done with external console connections. With FortiOS 5.4.0, this can be done in a script using the interval and repeat commands.

Scripts can be uploaded as a file from the CLI or GUI. To upload scripts from the GUI go to System > Advanced > Configuration Scripts and upload and run the script.

To configure the schedule and scripts, use the following syntax:

config system auto-script

edit <ScriptName>

set interval

set repeat

set script

end

end

interval the interval time in seconds between instances of the script running.

repeat the number of times to repeat the running of the script. The value 0 is used to set an infinite number of repetitions.

start select manual to start the script manually or auto to start the script automatically

script the contents of the script.

This feature may not be available on all models as a hard drive is necessary to make use of it.

CLI option to limit script output size

The CLI command set output-size limits the size of an auto script in megabytes and prevents the memory from being used up by the script's output.

CLI Syntax

config system auto-script

edit <script name>

set output-size <integer>

next

end

Enter an integer value from 10 to 1024. Default is 10.

Execute restore script command

The execute restore script command merges arbitrary configlets into the running configuration from a script. You can carry out the command's authentication with either a username and password or with a certificate.

If the configuration in the script fails for any reason, the system will revert back to running configurations without interrupting the network.

To load script from the FTP, SCP, or TFTP servers, enter the following CLI command:

execute restore script {ftp | scp | tftp} <dir / filename in server> <server ip> <username> <password>

To view the results of the last restored script, enter the following CLI command:

execute restore script lastlog <dir / filename in server> <server ip> <username> <password>

CLI scripts

To upload bulk CLI commands and scripts, go to System > Advanced.

Scripts are text files containing CLI command sequences. Scripts can be used to deploy identical configurations to many devices. For example, if all of your devices use identical security policies, you can enter the commands required to create the security policies in a script, and then deploy the script to all the devices which should use those same settings.

Use a text editor such as Notepad or other application that creates simple text files. Enter the commands in sequence, with each line as one command, similar to examples throughout the FortiOS documentation set.

If you are using a FortiGate unit that is not remotely managed by a FortiManager unit or the FortiGuard Analysis and Management Service, the scripts you upload are executed and discarded. If you want to execute a script more than once, you must keep a copy on your management PC.

If your FortiGate unit is configured to use a FortiManager unit, you can upload your scripts to the FortiManager unit, and run them from any FortiGate unit configured to use the FortiManager unit. If you upload a script directly to a FortiGate unit, it is executed and discarded.

If your FortiGate unit is configured to use FortiGuard Analysis and Management Service, scripts you upload are executed and stored. You can run uploaded scripts from any FortiGate unit configured with your FortiGuard Analysis and Management Service account. The uploaded script files appear on the FortiGuard Analysis and Management Service portal web site.

Uploading script files

After you have created a script file, you can then upload it through System > Advanced. When a script is uploaded, it is automatically executed.

Commands that require the FortiGate unit to reboot when entered in the command line will also force a reboot if included in a script.

To execute a script
  1. Go to System > Advanced.
  2. Enable Configuration Scripts.
  3. Select Upload and Run a New Script to locate the script file.
  4. Select Apply.

If the FortiGate unit is not configured for remote management, or if it is configured to use a FortiManager unit, uploaded scripts are discarded after execution. Save script files to your management PC if you want to execute them again later.

If the FortiGate unit is configured to use the FortiGuard Analysis and Management Service, the script file is saved to the remote server for later reuse. You can view the script or run it from the FortiGuard Analysis and Management Service portal web site.

Auto repeat of CLI commands

Occasionally there is a need to repeatedly run a diagnose command over a long period of time (like checking CPU or memory usage, or checking proxy health), Previously, this could only be done with external console connections. With FortiOS 5.4.0, this can be done in a script using the interval and repeat commands.

Scripts can be uploaded as a file from the CLI or GUI. To upload scripts from the GUI go to System > Advanced > Configuration Scripts and upload and run the script.

To configure the schedule and scripts, use the following syntax:

config system auto-script

edit <ScriptName>

set interval

set repeat

set script

end

end

interval the interval time in seconds between instances of the script running.

repeat the number of times to repeat the running of the script. The value 0 is used to set an infinite number of repetitions.

start select manual to start the script manually or auto to start the script automatically

script the contents of the script.

This feature may not be available on all models as a hard drive is necessary to make use of it.

CLI option to limit script output size

The CLI command set output-size limits the size of an auto script in megabytes and prevents the memory from being used up by the script's output.

CLI Syntax

config system auto-script

edit <script name>

set output-size <integer>

next

end

Enter an integer value from 10 to 1024. Default is 10.

Execute restore script command

The execute restore script command merges arbitrary configlets into the running configuration from a script. You can carry out the command's authentication with either a username and password or with a certificate.

If the configuration in the script fails for any reason, the system will revert back to running configurations without interrupting the network.

To load script from the FTP, SCP, or TFTP servers, enter the following CLI command:

execute restore script {ftp | scp | tftp} <dir / filename in server> <server ip> <username> <password>

To view the results of the last restored script, enter the following CLI command:

execute restore script lastlog <dir / filename in server> <server ip> <username> <password>