system admin

6.2.1

Copy Link

Copy Doc ID 0c36d07f-a40c-11e9-81a4-00505692583a:15620

Configure admin users.

  config system admin
      Description: Configure admin users.
      edit <name>
          set wildcard [enable|disable]
          set remote-auth [enable|disable]
          set remote-group {string}
          set password {password-2}
          set peer-auth [enable|disable]
          set peer-group {string}
          set trusthost1 {ipv4-classnet}
          set trusthost2 {ipv4-classnet}
          set trusthost3 {ipv4-classnet}
          set trusthost4 {ipv4-classnet}
          set trusthost5 {ipv4-classnet}
          set trusthost6 {ipv4-classnet}
          set trusthost7 {ipv4-classnet}
          set trusthost8 {ipv4-classnet}
          set trusthost9 {ipv4-classnet}
          set trusthost10 {ipv4-classnet}
          set ip6-trusthost1 {ipv6-prefix}
          set ip6-trusthost2 {ipv6-prefix}
          set ip6-trusthost3 {ipv6-prefix}
          set ip6-trusthost4 {ipv6-prefix}
          set ip6-trusthost5 {ipv6-prefix}
          set ip6-trusthost6 {ipv6-prefix}
          set ip6-trusthost7 {ipv6-prefix}
          set ip6-trusthost8 {ipv6-prefix}
          set ip6-trusthost9 {ipv6-prefix}
          set ip6-trusthost10 {ipv6-prefix}
          set accprofile {string}
          set allow-remove-admin-session [enable|disable]
          set comments {var-string}
          set hidden {integer}
          set vdom <name1>, <name2>, ...
          set ssh-public-key1 {user}
          set ssh-public-key2 {user}
          set ssh-public-key3 {user}
          set ssh-certificate {string}
          set schedule {string}
          set accprofile-override [enable|disable]
          set radius-vdom-override [enable|disable]
          set password-expire {user}
          set force-password-change [enable|disable]
          config gui-dashboard
              Description: GUI dashboards.
              edit <id>
                  set name {string}
                  set vdom {string}
                  set layout-type [responsive|fixed]
                  set permanent [disable|enable]
                  set columns {integer}
                  config widget
                      Description: Dashboard widgets.
                      edit <id>
                          set type [sysinfo|licinfo|...]
                          set x-pos {integer}
                          set y-pos {integer}
                          set width {integer}
                          set height {integer}
                          set interface {string}
                          set region [default|custom]
                          set industry [default|custom]
                          set fabric-device {string}
                          set fabric-device-widget-name {string}
                          set fabric-device-widget-visualization-type {string}
                          set title {string}
                          set fortiview-type {string}
                          set fortiview-sort-by {string}
                          set fortiview-timeframe {string}
                          set fortiview-visualization {string}
                          set fortiview-device {string}
                          config fortiview-filters
                              Description: FortiView filters.
                              edit <id>
                                  set key {string}
                                  set value {string}
                              next
                          end
                      next
                  end
              next
          end
          set two-factor [disable|fortitoken|...]
          set fortitoken {string}
          set email-to {string}
          set sms-server [fortiguard|custom]
          set sms-custom-server {string}
          set sms-phone {string}
          set guest-auth [disable|enable]
          set guest-usergroups <name1>, <name2>, ...
          set guest-lang {string}
          set history0 {password-2}
          set history1 {password-2}
          config login-time
              Description: Record user login time.
              edit <usr-name>
                  set last-login {datetime}
                  set last-failed-login {datetime}
              next
          end
          set gui-global-menu-favorites <id1>, <id2>, ...
          set gui-vdom-menu-favorites <id1>, <id2>, ...
          set gui-new-feature-acknowledge <id1>, <id2>, ...
      next
  end

config system admin

Parameter Name	Description	Type	Size
wildcard	Enable/disable wildcard RADIUS authentication. enable: Enable username wildcard. disable: Disable username wildcard.	option	-
remote-auth	Enable/disable authentication using a remote RADIUS, LDAP, or TACACS+ server. enable: Enable remote authentication. disable: Disable remote authentication.	option	-
remote-group	User group name used for remote auth.	string	Maximum length: 35
password	Admin user password.	password-2	Not Specified
peer-auth	Set to enable peer certificate authentication (for HTTPS admin access). enable: Enable peer. disable: Disable peer.	option	-
peer-group	Name of peer group defined under config user group which has PKI members. Used for peer certificate authentication (for HTTPS admin access).	string	Maximum length: 35
trusthost1	Any IPv4 address or subnet address and netmask from which the administrator can connect to the FortiGate unit. Default allows access from any IPv4 address.	ipv4-classnet	Not Specified
trusthost2	Any IPv4 address or subnet address and netmask from which the administrator can connect to the FortiGate unit. Default allows access from any IPv4 address.	ipv4-classnet	Not Specified
trusthost3	Any IPv4 address or subnet address and netmask from which the administrator can connect to the FortiGate unit. Default allows access from any IPv4 address.	ipv4-classnet	Not Specified
trusthost4	Any IPv4 address or subnet address and netmask from which the administrator can connect to the FortiGate unit. Default allows access from any IPv4 address.	ipv4-classnet	Not Specified
trusthost5	Any IPv4 address or subnet address and netmask from which the administrator can connect to the FortiGate unit. Default allows access from any IPv4 address.	ipv4-classnet	Not Specified
trusthost6	Any IPv4 address or subnet address and netmask from which the administrator can connect to the FortiGate unit. Default allows access from any IPv4 address.	ipv4-classnet	Not Specified
trusthost7	Any IPv4 address or subnet address and netmask from which the administrator can connect to the FortiGate unit. Default allows access from any IPv4 address.	ipv4-classnet	Not Specified
trusthost8	Any IPv4 address or subnet address and netmask from which the administrator can connect to the FortiGate unit. Default allows access from any IPv4 address.	ipv4-classnet	Not Specified
trusthost9	Any IPv4 address or subnet address and netmask from which the administrator can connect to the FortiGate unit. Default allows access from any IPv4 address.	ipv4-classnet	Not Specified
trusthost10	Any IPv4 address or subnet address and netmask from which the administrator can connect to the FortiGate unit. Default allows access from any IPv4 address.	ipv4-classnet	Not Specified
ip6-trusthost1	Any IPv6 address from which the administrator can connect to the FortiGate unit. Default allows access from any IPv6 address.	ipv6-prefix	Not Specified
ip6-trusthost2	Any IPv6 address from which the administrator can connect to the FortiGate unit. Default allows access from any IPv6 address.	ipv6-prefix	Not Specified
ip6-trusthost3	Any IPv6 address from which the administrator can connect to the FortiGate unit. Default allows access from any IPv6 address.	ipv6-prefix	Not Specified
ip6-trusthost4	Any IPv6 address from which the administrator can connect to the FortiGate unit. Default allows access from any IPv6 address.	ipv6-prefix	Not Specified
ip6-trusthost5	Any IPv6 address from which the administrator can connect to the FortiGate unit. Default allows access from any IPv6 address.	ipv6-prefix	Not Specified
ip6-trusthost6	Any IPv6 address from which the administrator can connect to the FortiGate unit. Default allows access from any IPv6 address.	ipv6-prefix	Not Specified
ip6-trusthost7	Any IPv6 address from which the administrator can connect to the FortiGate unit. Default allows access from any IPv6 address.	ipv6-prefix	Not Specified
ip6-trusthost8	Any IPv6 address from which the administrator can connect to the FortiGate unit. Default allows access from any IPv6 address.	ipv6-prefix	Not Specified
ip6-trusthost9	Any IPv6 address from which the administrator can connect to the FortiGate unit. Default allows access from any IPv6 address.	ipv6-prefix	Not Specified
ip6-trusthost10	Any IPv6 address from which the administrator can connect to the FortiGate unit. Default allows access from any IPv6 address.	ipv6-prefix	Not Specified
accprofile	Access profile for this administrator. Access profiles control administrator access to FortiGate features.	string	Maximum length: 35
allow-remove-admin-session	Enable/disable allow admin session to be removed by privileged admin users. enable: Enable allow-remove option. disable: Disable allow-remove option.	option	-
comments	Comment.	var-string	Maximum length: 255
hidden	Admin user hidden attribute.	integer	Minimum value: 0 Maximum value: 255
vdom `<name>`	Virtual domain(s) that the administrator can access. Virtual domain name.	string	Maximum length: 79
ssh-public-key1	Public key of an SSH client. The client is authenticated without being asked for credentials. Create the public-private key pair in the SSH client application.	user	Not Specified
ssh-public-key2	Public key of an SSH client. The client is authenticated without being asked for credentials. Create the public-private key pair in the SSH client application.	user	Not Specified
ssh-public-key3	Public key of an SSH client. The client is authenticated without being asked for credentials. Create the public-private key pair in the SSH client application.	user	Not Specified
ssh-certificate	Select the certificate to be used by the FortiGate for authentication with an SSH client.	string	Maximum length: 35
schedule	Firewall schedule used to restrict when the administrator can log in. No schedule means no restrictions.	string	Maximum length: 35
accprofile-override	Enable to use the name of an access profile provided by the remote authentication server to control the FortiGate features that this administrator can access. enable: Enable access profile override. disable: Disable access profile override.	option	-
radius-vdom-override	Enable to use the names of VDOMs provided by the remote authentication server to control the VDOMs that this administrator can access. enable: Enable VDOM override. disable: Disable VDOM override.	option	-
password-expire	Password expire time.	user	Not Specified
force-password-change	Enable/disable force password change on next login. enable: Enable force password change on next login. disable: Disable force password change on next login.	option	-
two-factor	Enable/disable two-factor authentication. disable: Disable two-factor authentication. fortitoken: Use FortiToken or FortiToken mobile two-factor authentication. email: Send a two-factor authentication code to the configured email-to email address. sms: Send a two-factor authentication code to the configured sms-server and sms-phone. fortitoken-cloud: FortiToken Cloud Service.	option	-
fortitoken	This administrator's FortiToken serial number.	string	Maximum length: 16
email-to	This administrator's email address.	string	Maximum length: 63
sms-server	Send SMS messages using the FortiGuard SMS server or a custom server. fortiguard: Send SMS by FortiGuard. custom: Send SMS by custom server.	option	-
sms-custom-server	Custom SMS server to send SMS messages to.	string	Maximum length: 35
sms-phone	Phone number on which the administrator receives SMS messages.	string	Maximum length: 15
guest-auth	Enable/disable guest authentication. disable: Disable guest authentication. enable: Enable guest authentication.	option	-
guest-usergroups `<name>`	Select guest user groups. Select guest user groups.	string	Maximum length: 79
guest-lang	Guest management portal language.	string	Maximum length: 35
history0	history0	password-2	Not Specified
history1	history1	password-2	Not Specified
gui-global-menu-favorites `<id>`	Favorite GUI menu IDs for the global VDOM. Select menu ID.	string	Maximum length: 79
gui-vdom-menu-favorites `<id>`	Favorite GUI menu IDs for VDOMs. Select menu ID.	string	Maximum length: 79
gui-new-feature-acknowledge `<id>`	Acknowledgement of new features. Select menu ID.	string	Maximum length: 79

config gui-dashboard

Parameter Name	Description	Type	Size
name	Dashboard name.	string	Maximum length: 35
vdom	Virtual domain.	string	Maximum length: 31
layout-type	Layout type. responsive: Responsive. fixed: Fixed grid.	option	-
permanent	Permanent dashboard (can't be removed via the GUI). disable: Dashboard is not permanent. enable: Dashboard is permanent (can't be removed).	option	-
columns	Number of columns.	integer	Minimum value: 5 Maximum value: 20

config widget

Parameter Name	Description	Type	Size
type	Widget type. sysinfo: System Information. licinfo: License Information. forticloud: FortiCloud Licenses. cpu-usage: CPU Usage. memory-usage: Memory Usage. disk-usage: Disk Usage. log-rate: Session Rate. sessions: Sessions. session-rate: Session Rate. tr-history: Traffic History. analytics: FortiGuard Analytics. usb-modem: USB Modem. admins: Administrators. security-fabric: Security Fabric. security-fabric-ranking: Security Fabric Ranking. ha-status: HA Status. vulnerability-summary: Vulnerability Summary. host-scan-summary: Host Scan Summary. fortiview: FortiView. botnet-activity: Botnet Activity. fabric-device: Fabric Device.	option	-
x-pos	X position.	integer	Minimum value: 0 Maximum value: 1000
y-pos	Y position.	integer	Minimum value: 0 Maximum value: 1000
width	Width.	integer	Minimum value: 1 Maximum value: 50
height	Height.	integer	Minimum value: 1 Maximum value: 50
interface	Interface to monitor.	string	Maximum length: 15
region	Security Audit Rating region. default: All regions. custom: FortiGate region.	option	-
industry	Security Audit Rating industry. default: All industries. custom: FortiCare industry.	option	-
fabric-device	Fabric device to monitor.	string	Maximum length: 127
fabric-device-widget-name	Fabric device widget name.	string	Maximum length: 127
fabric-device-widget-visualization-type	Visualization type for fabric device widget.	string	Maximum length: 35
title	Widget title.	string	Maximum length: 127
fortiview-type	FortiView type.	string	Maximum length: 35
fortiview-sort-by	FortiView sort by.	string	Maximum length: 35
fortiview-timeframe	FortiView timeframe.	string	Maximum length: 35
fortiview-visualization	FortiView visualization.	string	Maximum length: 35
fortiview-device	FortiView device.	string	Maximum length: 35

config fortiview-filters

Parameter Name	Description	Type	Size
key	Filter key.	string	Maximum length: 127
value	Filter value.	string	Maximum length: 127

config login-time

Parameter Name	Description	Type	Size
last-login	Last successful login time.	datetime	Not Specified
last-failed-login	Last failed login time.	datetime	Not Specified

Configure admin users.

config system admin Description: Configure admin users. edit <name> set wildcard [enable|disable] set remote-auth [enable|disable] set remote-group {string} set password {password-2} set peer-auth [enable|disable] set peer-group {string} set trusthost1 {ipv4-classnet} set trusthost2 {ipv4-classnet} set trusthost3 {ipv4-classnet} set trusthost4 {ipv4-classnet} set trusthost5 {ipv4-classnet} set trusthost6 {ipv4-classnet} set trusthost7 {ipv4-classnet} set trusthost8 {ipv4-classnet} set trusthost9 {ipv4-classnet} set trusthost10 {ipv4-classnet} set ip6-trusthost1 {ipv6-prefix} set ip6-trusthost2 {ipv6-prefix} set ip6-trusthost3 {ipv6-prefix} set ip6-trusthost4 {ipv6-prefix} set ip6-trusthost5 {ipv6-prefix} set ip6-trusthost6 {ipv6-prefix} set ip6-trusthost7 {ipv6-prefix} set ip6-trusthost8 {ipv6-prefix} set ip6-trusthost9 {ipv6-prefix} set ip6-trusthost10 {ipv6-prefix} set accprofile {string} set allow-remove-admin-session [enable|disable] set comments {var-string} set hidden {integer} set vdom <name1>, <name2>, ... set ssh-public-key1 {user} set ssh-public-key2 {user} set ssh-public-key3 {user} set ssh-certificate {string} set schedule {string} set accprofile-override [enable|disable] set radius-vdom-override [enable|disable] set password-expire {user} set force-password-change [enable|disable] config gui-dashboard Description: GUI dashboards. edit <id> set name {string} set vdom {string} set layout-type [responsive|fixed] set permanent [disable|enable] set columns {integer} config widget Description: Dashboard widgets. edit <id> set type [sysinfo|licinfo|...] set x-pos {integer} set y-pos {integer} set width {integer} set height {integer} set interface {string} set region [default|custom] set industry [default|custom] set fabric-device {string} set fabric-device-widget-name {string} set fabric-device-widget-visualization-type {string} set title {string} set fortiview-type {string} set fortiview-sort-by {string} set fortiview-timeframe {string} set fortiview-visualization {string} set fortiview-device {string} config fortiview-filters Description: FortiView filters. edit <id> set key {string} set value {string} next end next end next end set two-factor [disable|fortitoken|...] set fortitoken {string} set email-to {string} set sms-server [fortiguard|custom] set sms-custom-server {string} set sms-phone {string} set guest-auth [disable|enable] set guest-usergroups <name1>, <name2>, ... set guest-lang {string} set history0 {password-2} set history1 {password-2} config login-time Description: Record user login time. edit <usr-name> set last-login {datetime} set last-failed-login {datetime} next end set gui-global-menu-favorites <id1>, <id2>, ... set gui-vdom-menu-favorites <id1>, <id2>, ... set gui-new-feature-acknowledge <id1>, <id2>, ... next end

config system admin

Parameter Name

Description

Type

Size

wildcard

Enable/disable wildcard RADIUS authentication.
enable: Enable username wildcard.
disable: Disable username wildcard.

option

remote-auth

Enable/disable authentication using a remote RADIUS, LDAP, or TACACS+ server.
enable: Enable remote authentication.
disable: Disable remote authentication.

option

remote-group

User group name used for remote auth.

string

Maximum length: 35

password

Admin user password.

password-2

Not Specified

peer-auth

Set to enable peer certificate authentication (for HTTPS admin access).
enable: Enable peer.
disable: Disable peer.

option

peer-group

Name of peer group defined under config user group which has PKI members. Used for peer certificate authentication (for HTTPS admin access).

string

Maximum length: 35

trusthost1