CLI Reference

• FortiOS CLI reference
• Managing firmware with the FortiGate BIOS
  • Accessing the BIOS
  • Loading firmware
  • Booting the backup firmware
• Using the CLI
  • Connecting to the CLI
  • Command syntax
  • Sub-commands
  • Permissions
  • Tips
• config
  • alertemail
    • alertemail setting
  • antivirus
    • antivirus heuristic
    • antivirus profile
    • antivirus quarantine
    • antivirus settings
  • application
    • application custom
    • application list
    • application name
    • application rule-settings
  • authentication
    • authentication rule
    • authentication scheme
    • authentication setting
  • aws
    • aws setting
  • certificate
    • certificate ca
    • certificate crl
    • certificate local
  • dlp
    • dlp filepattern
    • dlp fp-doc-source
    • dlp fp-sensitivity
    • dlp sensor
    • dlp settings
  • dnsfilter
    • dnsfilter domain-filter
    • dnsfilter profile
  • endpoint-control
    • endpoint-control forticlient-ems
    • endpoint-control forticlient-registration-sync
    • endpoint-control profile
    • endpoint-control settings
  • extender-controller
    • extender-controller extender
  • firewall
    • firewall {acl | acl6}
    • firewall {address | address6}
    • firewall address6-template
    • firewall {addrgrp | addgrp6}
    • firewall auth-portal
    • firewall carrier-endpoint-bwl
    • firewall central-snat-map
    • firewall dnstranslation
    • firewall {DoS-policy | DoS-policy6}
    • firewall gtp
    • firewall identity-based-route
    • firewall {interface-policy | interface-policy6}
    • firewall internet-service
    • firewall internet-service-custom
    • firewall internet-service-custom-group
    • firewall internet-service-group
    • firewall ipmacbinding setting
    • firewall ipmacbinding table
    • firewall {ippool | ippool6}
    • firewall ip-translation
    • firewall ipv6-eh-filter
    • firewall ldb-monitor
    • firewall {local-in-policy | local-in-policy6}
    • firewall mms-profile
    • firewall {multicast-address | multicast-address6}
    • firewall {multicast-policy | multicast-policy6}
    • firewall {policy | policy6}
    • firewall {policy46 | policy64}
    • firewall profile-group
    • firewall profile-protocol-options
    • firewall proxy-address
    • firewall proxy-addrgrp
    • firewall proxy-policy
    • firewall schedule group
    • firewall schedule onetime
    • firewall schedule recurring
    • firewall service category
    • firewall service custom
    • firewall service group
    • firewall shaper per-ip-shaper
    • firewall shaper traffic-shaper
    • firewall shaping-policy
    • firewall shaping-profile
    • firewall sniffer
    • firewall ssh host-key
    • firewall ssh local-ca
    • firewall ssh local-key
    • firewall ssh setting
    • firewall ssl setting
    • firewall ssl-server
    • firewall ssl-ssh-profile
    • firewall ttl-policy
    • firewall {vip | vip6}
    • firewall {vip46 | vip64}
    • firewall {vipgrp | vipgrp6}
    • firewall {vipgrp46 | vipgrp64}
    • firewall wildcard-fqdn custom
    • firewall wildcard-fqdn group
  • ftp-proxy
    • ftp-proxy explicit
  • icap
    • icap profile
    • icap server
  • ips
    • ips custom
    • ips decoder
    • ips global
    • ips rule
    • ips rule-settings
    • ips sensor
    • ips settings
  • log
    • log {azure-security-center | azure-security-center2} filter
    • log {azure-security-center | azure-security-center2} setting
    • log custom-field
    • log disk filter
    • log disk setting
    • log eventfilter
    • log fortianalyzer override-filter
    • log fortianalyzer override-setting
    • log {fortianalyzer | fortianalyzer2 | fortianalyzer3} filter
    • log {fortianalyzer | fortianalyzer2 | fortianalyzer3} setting
    • log fortiguard filter
    • log fortiguard override-filter
    • log fortiguard override-setting
    • log fortiguard setting
    • log gui-display
    • log memory filter
    • log memory global-setting
    • log memory setting
    • log null-device filter
    • log null-device setting
    • log setting
    • log syslogd override-filter
    • log syslogd override-setting
    • log {syslogd | syslogd2 | syslogd3 | syslogd4} filter
    • log {syslogd | syslogd2 | syslogd3 | syslogd4} setting
    • log threat-weight
    • log webtrends filter
    • log webtrends setting
  • monitoring
    • np6-ipsec-engine
  • report
    • report chart
    • report dataset
    • report layout
    • report setting
    • report style
    • report theme
  • router
    • router {access-list | access-list6}
    • router aspath-list
    • router auth-path
    • router bfd
    • router bgp
    • router community-list
    • router isis
    • router key-chain
    • router multicast
    • router multicast6
    • router multicast-flow
    • router {ospf | ospf6}
    • router {policy | policy6}
    • router {prefix-list | prefix-list6}
    • router rip
    • router ripng
    • router route-map
    • router setting
    • router {static | static6}
  • spamfilter
    • spamfilter bwl
    • spamfilter bword
    • spamfilter dnsbl
    • spamfilter fortishield
    • spamfilter iptrust
    • spamfilter mheader
    • spamfilter options
    • spamfilter profile
  • ssh-filter
    • ssh-filter profile
  • switch-controller
    • switch-controller 802-1X-settings
    • switch-controller custom-command
    • switch-controller global
    • switch-controller igmp-snooping
    • switch-controller lldp-profile
    • switch-controller lldp-settings
    • switch-controller mac-sync-settings
    • switch-controller managed-switch
    • switch-controller qos dot1p-map
    • switch-controller qos ip-dscp-map
    • switch-controller qos qos-policy
    • switch-controller qos queue-policy
    • switch-controller security-policy 802-1X
    • switch-controller security-policy captive-portal
    • switch-controller sflow
    • switch-controller storm-control
    • switch-controller stp-settings
    • switch-controller switch-group
    • switch-controller switch-interface-tag
    • switch-controller switch-log
    • switch-controller switch-profile
    • switch-controller system
    • switch-controller virtual-port-pool
    • switch-controller vlan
  • system
    • system 3g-modem custom
    • system accprofile
    • system admin
    • system affinity-interrupt
    • system affinity-packet-redistribution
    • system alarm
    • system alias
    • system api-user
    • system arp-table
    • system auto-install
    • system auto-script
    • system automation-action
    • system automation-destination
    • system automation-stitch
    • system automation-trigger
    • system auto-scale
    • system autoupdate push-update
    • system autoupdate schedule
    • system autoupdate tunneling
    • system bypass
    • system central-management
    • system cluster-sync
    • system console
    • system csf
    • system custom-language
    • system ddns
    • system dedicated-mgmt
    • system {dhcp server | dhcp6 server}
    • system dnp3-proxy
    • system dns
    • system dns-database
    • system dns-server
    • system dscp-based-priority
    • system email-server
    • system external-resource
    • system fips-cc
    • system fm
    • system fortiguard
    • system fortimanager
    • system fortisandbox
    • system fsso-polling
    • system ftm-push
    • system geoip-override
    • system global
    • system gre-tunnel
    • system ha
    • system ha-monitor
    • system interface
    • system ipip-tunnel
    • system {ips-urlfilter-dns | ips-urlfilter-dns6}
    • system ipv6-neighbor-cache
    • system ipv6-tunnel
    • system link-monitor
    • system lte-modem
    • system mac-address-table
    • system management-tunnel
    • system mobile-tunnel
    • system modem
    • system nat64
    • system nd-proxy
    • system netflow
    • system network-visibility
    • system np6
    • system npu
    • system ntp
    • system object-tagging
    • system password-policy
    • system password-policy-guest-admin
    • system physical-switch
    • system pppoe-interface
    • system probe-response
    • system proxy-arp
    • system replacemsg admin
    • system replacemsg alertmail
    • system replacemsg auth
    • system replacemsg device-detection-portal
    • system replacemsg ec
    • system replacemsg fortiguard-wf
    • system replacemsg ftp
    • system replacemsg http
    • system replacemsg mail
    • system replacemsg nac-quar
    • system replacemsg nntp
    • system replacemsg spam
    • system replacemsg sslvpn
    • system replacemsg traffic-quota
    • system replacemsg utm
    • system replacemsg webproxy
    • system replacemsg-group
    • system replacemsg-image
    • system resource-limits
    • system sdn-connector
    • system session-helper
    • system session-ttl
    • system settings
    • system sflow
    • system sit-tunnel
    • system sms-server
    • system snmp community
    • system snmp sysinfo
    • system snmp user
    • system storage
    • system stp
    • system switch-interface
    • system tos-based-priority
    • system vdom
    • system vdom-dns
    • system vdom-exception
    • system vdom-link
    • system vdom-netflow
    • system vdom-property
    • system vdom-radius-server
    • system vdom-sflow
    • system virtual-switch
    • system virtual-wan-link
    • system virtual-wire-pair
    • system vxlan
    • system wccp
    • system wireless ap-status
    • system wireless settings
    • system zone
  • user
    • user adgrp
    • user device
    • user device-access-list
    • user device-category
    • user device-group
    • user domain-controller
    • user fortitoken
    • user fsso
    • user fsso-polling
    • user group
    • user krb-keytab
    • user ldap
    • user local
    • user password-policy
    • user peer
    • user peergrp
    • user pop3
    • user quarantine
    • user radius
    • user security-exempt-list
    • user setting
    • user tacacs+
  • voip
    • voip profile
  • vpn
    • vpn certificate ca
    • vpn certificate crl
    • vpn certificate local
    • vpn certificate ocsp-server
    • vpn certificate remote
    • vpn certificate setting
    • vpn ipsec concentrator
    • vpn ipsec forticlient
    • vpn ipsec {manualkey-interface | manualkey}
    • vpn ipsec {phase1-interface | phase1}
    • vpn ipsec {phase2-interface | phase2}
    • vpn l2tp
    • vpn ocvpn
    • vpn pptp
    • vpn ssl settings
    • vpn ssl web host-check-software
    • vpn ssl web portal
    • vpn ssl web realm
    • vpn ssl web user-bookmark
    • vpn ssl web user-group-bookmark
  • waf
    • waf main-class
    • waf profile
    • waf signature
    • waf sub-class
  • wanopt
    • wanopt auth-group
    • wanopt cache-service
    • wanopt content-delivery-network-rule
    • wanopt peer
    • wanopt profile
    • wanopt remote-storage
    • wanopt settings
    • wanopt webcache
  • webfilter
    • webfilter content
    • webfilter content-header
    • webfilter fortiguard
    • webfilter ftgd-local-cat
    • webfilter ftgd-local-rating
    • webfilter ips-urlfilter-cache-setting
    • webfilter {ips-urlfilter-setting | ips-urlfilter-setting6}
    • webfilter override
    • webfilter profile
    • webfilter search-engine
    • webfilter urlfilter
  • web-proxy
    • web-proxy debug-url
    • web-proxy explicit
    • web-proxy forward-server
    • web-proxy forward-server-group
    • web-proxy global
    • web-proxy profile
    • web-proxy url-match
    • web-proxy wisp
  • wireless-controller
    • wireless-controller ap-status
    • wireless-controller ble-profile
    • wireless-controller bonjour-profile
    • wireless-controller global
    • wireless-controller hotspot20 anqp-3gpp-cellular
    • wireless-controller hotspot20 anqp-ip-address-type
    • wireless-controller hotspot20 anqp-nai-realm
    • wireless-controller hotspot20 anqp-network-auth-type
    • wireless-controller hotspot20 anqp-roaming-consortium
    • wireless-controller hotspot20 anqp-venue-name
    • wireless-controller hotspot20 h2qp-conn-capability
    • wireless-controller hotspot20 h2qp-operator-name
    • wireless-controller hotspot20 h2qp-osu-provider
    • wireless-controller hotspot20 h2qp-wan-metric
    • wireless-controller hotspot20 hs-profile
    • wireless-controller hotspot20 icon
    • wireless-controller hotspot20 qos-map
    • wireless-controller inter-controller
    • wireless-controller qos-profile
    • wireless-controller setting
    • wireless-controller timers
    • wireless-controller utm-profile
    • wireless-controller vap
    • wireless-controller vap-group
    • wireless-controller wids-profile
    • wireless-controller wtp
    • wireless-controller wtp-group
    • wireless-controller wtp-profile
• execute
  • api-user
  • auto-script
  • backup
  • batch
  • bypass-mode
  • carrier-license
  • central-mgmt
  • cfg reload
  • cfg save
  • clear system arp table
  • cli check-template-status
  • cli status-msg-only
  • client-reputation
  • date
  • dhcp lease-clear
  • dhcp lease-list
  • dhcp6 lease-clear
  • dhcp6 lease-list
  • disk
  • disk raid
  • disconnect-admin-session
  • dsscc
  • enter
  • erase-disk
  • extender
  • factoryreset
  • factoryreset2
  • firewall ssh generate local-ca
  • firewall ssh generate local-key
  • formatlogdisk
  • forticarrier-license
  • forticlient
  • FortiClient-NAC
  • fortiguard-log
  • fortitoken
  • fortitoken-mobile
  • fsso refresh
  • ha disconnect
  • ha ignore-hardware-revision
  • ha manage
  • ha set-priority
  • ha synchronize
  • interface dhcp6client-renew
  • interface dhcpclient-renew
  • interface pppoe-reconnect
  • log backup
  • log client-reputation-report
  • log convert-oldlogs
  • log delete
  • log delete-all
  • log delete-oldlogs
  • log detail
  • log display
  • log downgrade-log
  • log filter
  • log flush-cache
  • log flush-cache-all
  • log fortianalyzer test-connectivity
  • log fortiguard test-connectivity
  • log list
  • log rebuild-sqldb
  • log recreate-sqldb
  • log-report reset
  • log restore
  • log roll
  • log shift-time
  • log upload
  • log upload-progress
  • lte-modem
  • modem dial
  • modem hangup
  • modem trigger
  • mrouter clear
  • nsx
  • pbx
  • ping
  • ping6
  • ping-options, ping6-options
  • policy-packet-capture delete-all
  • reboot
  • replace device
  • report
  • restore
  • revision
  • router clear bfd session
  • router clear bgp
  • router clear ospf process
  • router restart
  • sdn tag nsx
  • send-fds-statistics
  • sensor detail
  • sensor list
  • set system session filter
  • set-next-reboot
  • sfp-mode-sgmii
  • shutdown
  • ssh
  • switch-controller
  • sync-session
  • system custom-language import
  • system fortisandbox test-connectivity
  • tac report
  • telnet
  • time
  • traceroute
  • tracert6
  • update-av
  • update-geo-ip
  • update-ips
  • update-list
  • update-now
  • update-src-vis
  • upd-vd-license
  • upload
  • usb-device
  • usb-disk
  • vpn certificate ca
  • vpn certificate crl
  • vpn certificate local export
  • vpn certificate local generate
  • vpn certificate local import
  • vpn certificate remote
  • vpn ipsec tunnel down
  • vpn ipsec tunnel up
  • vpn sslvpn del-all
  • vpn sslvpn del-tunnel
  • vpn sslvpn del-web
  • vpn sslvpn list
  • webcache
  • webfilter quota-reset
  • wireless-controller delete‑wtp‑image
  • wireless-controller hs20-icon
  • wireless-controller led-blink
  • wireless-controller restart-stad
  • wireless-controller reset‑wtp
  • wireless-controller restart‑acd
  • wireless-controller restart‑stad
  • wireless-controller restart‑wtpd
  • wireless-controller upload‑wtp‑image
• get
  • application internet-service status
  • application internet-service-summary
  • certificate
  • extender modem-status
  • extender sys-info
  • firewall dnstranslation
  • firewall iprope appctrl
  • firewall iprope list
  • firewall proute, proute6
  • firewall service custom
  • firewall shaper
  • grep
  • gui console status
  • hardware cpu
  • hardware memory
  • hardware nic
  • hardware npu
  • hardware status
  • ips decoder status
  • ips rule status
  • ips session
  • ips view-map
  • ipsec tunnel
  • mgmt-data status
  • pbx branch-office
  • pbx dialplan
  • pbx did
  • pbx extension
  • pbx ftgd-voice-pkg
  • pbx global
  • pbx ringgrp
  • pbx sip-trunk
  • pbx voice-menu
  • router info bfd neighbor
  • router info bgp
  • router info isis
  • router info kernel
  • router info multicast
  • router info ospf
  • router info protocols
  • router info rip
  • router info routing-table
  • router info vrrp
  • router info6 bgp
  • router info6 interface
  • router info6 kernel
  • router info6 ospf
  • router info6 protocols
  • router info6 rip
  • router info6 routing-table
  • switch-controller poe
  • system admin list
  • system admin status
  • system arp
  • system auto-update
  • system central-management
  • system checksum
  • system cmdb status
  • system fortianalyzer-connectivity
  • system fortiguard-log-service status
  • system fortiguard-service status
  • system ha-nonsync-csum
  • system ha status
  • system info admin status
  • system info admin ssh
  • system interface physical
  • system ip-conflict status
  • system mgmt-csum
  • system performance firewall
  • system performance status
  • system performance top
  • system session list
  • system session status
  • system session-helper-info list
  • system session-info
  • system source-ip
  • system startup-error-log
  • system stp list
  • system status
  • test
  • user adgrp
  • vpn certificate
  • vpn ike gateway
  • vpn ipsec tunnel details
  • vpn ipsec tunnel name
  • vpn ipsec tunnel summary
  • vpn ipsec stats crypto
  • vpn ipsec stats tunnel
  • vpn ssl monitor
  • vpn status l2tp
  • vpn status pptp
  • vpn status ssl
  • webfilter categories
  • webfilter ftgd-statistics
  • webfilter status
  • wireless-controller client-info
  • wireless-controller rf-analysis
  • wireless-controller scan
  • wireless-controller spectral-info
  • wireless-controller status
  • wireless-controller vap-status
  • wireless-controller wlchanlistlic
  • wireless-controller wtp-status
• tree