Fortinet white logo
Fortinet docs logo DOCUMENT LIBRARY
Fortinet white logo
Fortinet docs logo DOCUMENT LIBRARY
Products Best Practices Hardware Guides Products A-Z
Summary
By Solution
By 4D Pillars
By Cloud
Secure Networking
Unified SASE
Security Operations
Secure SD-WAN
Secure Access Service Edge (SASE)
ZTNA
LAN Edge
Identity and Access Management
Next Generation Firewall
Public Cloud
Private Cloud
FortiCloud
Secure Networking
  • Hybrid Mesh Firewall
  • NOC Management
  • LAN
  • WAN
    • More >>
    Unified SASE
  • Single Vendor SASE
  • Cloud Network Security
  • Secure Endpoint Connectivity
  • Web Application / API Protection
    • More >>
    Security Operations
  • Security Operations Automation
  • Identity
  • Early Detection & Prevention
    • More >>
    Secure Networking
  • Hybrid Mesh Firewall
  • NOC Management
  • LAN
  • WAN
  • Communication & Surveillance
    • Unified SASE
  • Single Vendor SASE
  • Secure Endpoint Connectivity
  • Cloud Network Security
  • Cloud-Native Security
  • Web Application / API Protection
    • Security Operations
  • Security Operations Automation
  • Endpoint
  • Data Protection
  • Identity
  • Email
  • Early Detection & Prevention
  • Expert Services
  • Edge Firewall
  • Orchestration & management
  • SD Branch
  • Application Delivery
  • Single Vendor SASE
  • Secure Endpoint Connectivity
  • Secure Private Access
  • Thin Edge
  • Identity
  • Application Gateway
  • Enterprise Asset Management
  • Endpoint Agent
  • Agentless Security Posture
  • Identity
  • Wireless
  • Switching
  • Identity
  • Privilege Acccess Management
  • Next Generation Firewall
  • Orchestration & management
  • Expert Services
  • All
  • All
  • Account Management
  • SAAS Management
  • SAAS Application Security
  • Managed Services
  • Platform as a service (PAAS)
  • Other SAAS Services
    • 4D Resources
    Solution Hubs
  • 4D Pillars
  • Cloud
  • Popular Solutions

    • CLI Reference

    6.4.0
    7.6.0
    7.4.5
    7.4.4
    7.4.3
    7.4.2
    7.4.1
    7.4.0
    7.2.10
    7.2.9
    7.2.8
    7.2.7
    7.2.6
    7.2.5
    7.2.4
    7.2.3
    7.2.2
    7.2.1
    7.2.0
    7.0.16
    7.0.15
    7.0.14
    7.0.13
    7.0.12
    7.0.11
    7.0.10
    7.0.9
    7.0.8
    7.0.7
    7.0.6
    7.0.5
    7.0.4
    7.0.3
    7.0.2
    7.0.1
    7.0.0
    6.4.15
    6.4.14
    6.4.13
    6.4.12
    6.4.11
    6.4.10
    6.4.9
    6.4.8
    6.4.7
    6.4.6
    6.4.5
    6.4.4
    6.4.3
    6.4.2
    6.4.1
    6.4.0
    6.2.16
    6.2.15
    6.2.14
    6.2.13
    6.2.12
    6.2.11
    6.2.10
    6.2.9
    6.2.8
    6.2.7
    6.2.6
    6.2.5
    6.2.4
    6.2.3
    6.2.2
    6.2.1
    6.0.0
    5.6.0
    5.4.0
    5.2.0
    5.0.0

    router policy

    Configure IPv4 routing policies.

      config router policy
      Description: Configure IPv4 routing policies.
      edit <seq-num>
          set input-device <name1>, <name2>, ...
          set input-device-negate [enable|disable]
          set src <subnet1>, <subnet2>, ...
          set srcaddr <name1>, <name2>, ...
          set src-negate [enable|disable]
          set dst <subnet1>, <subnet2>, ...
          set dstaddr <name1>, <name2>, ...
          set dst-negate [enable|disable]
          set action [deny|permit]
          set protocol {integer}
          set start-port {integer}
          set end-port {integer}
          set start-source-port {integer}
          set end-source-port {integer}
          set gateway {ipv4-address}
          set output-device {string}
          set tos {user}
          set tos-mask {user}
          set status [enable|disable]
          set comments {var-string}
          set internet-service-id <id1>, <id2>, ...
          set internet-service-custom <name1>, <name2>, ...
      next
  end

    config router policy

    Parameter Name Description Type Size
    input-device <name> Incoming interface name.
    Interface name.    		 string Maximum length: 79
    input-device-negate Enable/disable negation of input device match.
    enable: Enable negation of input device match.
    disable: Disable negation of input device match.
    		 option -
    src <subnet> Source IP and mask (x.x.x.x/x).
    IP and mask.    		 string Maximum length: 79
    srcaddr <name> Source address name.
    Address/group name.    		 string Maximum length: 79
    src-negate Enable/disable negating source address match.
    enable: Enable source address negation.
    disable: Disable source address negation.
    		 option -
    dst <subnet> Destination IP and mask (x.x.x.x/x).
    IP and mask.    		 string Maximum length: 79
    dstaddr <name> Destination address name.
    Address/group name.    		 string Maximum length: 79
    dst-negate Enable/disable negating destination address match.
    enable: Enable destination address negation.
    disable: Disable destination address negation.
    		 option -
    action Action of the policy route.
    deny: Do not search policy route table.
    permit: Use this policy route for forwarding.
    		 option -
    protocol Protocol number (0 - 255). integer Minimum value: 0 Maximum value: 255
    start-port Start destination port number (0 - 65535). integer Minimum value: 0 Maximum value: 65535
    end-port End destination port number (0 - 65535). integer Minimum value: 0 Maximum value: 65535
    start-source-port Start source port number (0 - 65535). integer Minimum value: 0 Maximum value: 65535
    end-source-port End source port number (0 - 65535). integer Minimum value: 0 Maximum value: 65535
    gateway IP address of the gateway. ipv4-address Not Specified
    output-device Outgoing interface name. string Maximum length: 35
    tos Type of service bit pattern. user Not Specified
    tos-mask Type of service evaluated bits. user Not Specified
    status Enable/disable this policy route.
    enable: Enable this policy route.
    disable: Disable this policy route.
    		 option -
    comments Optional comments. var-string Maximum length: 255
    internet-service-id <id> Destination Internet Service ID.
    Destination Internet Service ID.    		 integer Minimum value: 0 Maximum value: 4294967295
    internet-service-custom <name> Custom Destination Internet Service name.
    Custom Destination Internet Service name.    		 string Maximum length: 79
    Previous
    Next

    router policy

    Configure IPv4 routing policies.

      config router policy
      Description: Configure IPv4 routing policies.
      edit <seq-num>
          set input-device <name1>, <name2>, ...
          set input-device-negate [enable|disable]
          set src <subnet1>, <subnet2>, ...
          set srcaddr <name1>, <name2>, ...
          set src-negate [enable|disable]
          set dst <subnet1>, <subnet2>, ...
          set dstaddr <name1>, <name2>, ...
          set dst-negate [enable|disable]
          set action [deny|permit]
          set protocol {integer}
          set start-port {integer}
          set end-port {integer}
          set start-source-port {integer}
          set end-source-port {integer}
          set gateway {ipv4-address}
          set output-device {string}
          set tos {user}
          set tos-mask {user}
          set status [enable|disable]
          set comments {var-string}
          set internet-service-id <id1>, <id2>, ...
          set internet-service-custom <name1>, <name2>, ...
      next
  end

    config router policy

    Parameter Name Description Type Size
    input-device <name> Incoming interface name.
    Interface name.    		 string Maximum length: 79
    input-device-negate Enable/disable negation of input device match.
    enable: Enable negation of input device match.
    disable: Disable negation of input device match.
    		 option -
    src <subnet> Source IP and mask (x.x.x.x/x).
    IP and mask.    		 string Maximum length: 79
    srcaddr <name> Source address name.
    Address/group name.    		 string Maximum length: 79
    src-negate Enable/disable negating source address match.
    enable: Enable source address negation.
    disable: Disable source address negation.
    		 option -
    dst <subnet> Destination IP and mask (x.x.x.x/x).
    IP and mask.    		 string Maximum length: 79
    dstaddr <name> Destination address name.
    Address/group name.    		 string Maximum length: 79
    dst-negate Enable/disable negating destination address match.
    enable: Enable destination address negation.
    disable: Disable destination address negation.
    		 option -
    action Action of the policy route.
    deny: Do not search policy route table.
    permit: Use this policy route for forwarding.
    		 option -
    protocol Protocol number (0 - 255). integer Minimum value: 0 Maximum value: 255
    start-port Start destination port number (0 - 65535). integer Minimum value: 0 Maximum value: 65535
    end-port End destination port number (0 - 65535). integer Minimum value: 0 Maximum value: 65535
    start-source-port Start source port number (0 - 65535). integer Minimum value: 0 Maximum value: 65535
    end-source-port End source port number (0 - 65535). integer Minimum value: 0 Maximum value: 65535
    gateway IP address of the gateway. ipv4-address Not Specified
    output-device Outgoing interface name. string Maximum length: 35
    tos Type of service bit pattern. user Not Specified
    tos-mask Type of service evaluated bits. user Not Specified
    status Enable/disable this policy route.
    enable: Enable this policy route.
    disable: Disable this policy route.
    		 option -
    comments Optional comments. var-string Maximum length: 255
    internet-service-id <id> Destination Internet Service ID.
    Destination Internet Service ID.    		 integer Minimum value: 0 Maximum value: 4294967295
    internet-service-custom <name> Custom Destination Internet Service name.
    Custom Destination Internet Service name.    		 string Maximum length: 79
    Previous
    Next