Fortinet black logo

CLI Reference

config firewall sniffer

config firewall sniffer

Configure sniffer.

config firewall sniffer
    Description: Configure sniffer.
    edit <id>
        config anomaly
            Description: Configuration method to edit Denial of Service (DoS) anomaly settings.
            edit <name>
                set name {string}
                set status [disable|enable]
                set log [enable|disable]
                set action [pass|block]
                set quarantine [none|attacker]
                set quarantine-expiry {user}
                set quarantine-log [disable|enable]
                set threshold {integer}
                set threshold(default) {integer}
            next
        end
        set application-list {string}
        set application-list-status [enable|disable]
        set av-profile {string}
        set av-profile-status [enable|disable]
        set dlp-sensor {string}
        set dlp-sensor-status [enable|disable]
        set dsri [enable|disable]
        set emailfilter-profile {string}
        set emailfilter-profile-status [enable|disable]
        set file-filter-profile {string}
        set file-filter-profile-status [enable|disable]
        set host {string}
        set id {integer}
        set interface {string}
        set ip-threatfeed <name1>, <name2>, ...
        set ip-threatfeed-status [enable|disable]
        set ips-dos-status [enable|disable]
        set ips-sensor {string}
        set ips-sensor-status [enable|disable]
        set ipv6 [enable|disable]
        set logtraffic [all|utm|...]
        set max-packet-count {integer}
        set non-ip [enable|disable]
        set port {string}
        set protocol {string}
        set status [enable|disable]
        set vlan {string}
        set webfilter-profile {string}
        set webfilter-profile-status [enable|disable]
    next
end

config firewall sniffer

Parameter

Description

Type

Size

Default

application-list

Name of an existing application list.

string

Not Specified

application-list-status

Enable/disable application control profile.

option

-

disable

Option

Description

enable

Enable setting.

disable

Disable setting.

av-profile

Name of an existing antivirus profile.

string

Not Specified

av-profile-status

Enable/disable antivirus profile.

option

-

disable

Option

Description

enable

Enable setting.

disable

Disable setting.

dlp-sensor

Name of an existing DLP sensor.

string

Not Specified

dlp-sensor-status

Enable/disable DLP sensor.

option

-

disable

Option

Description

enable

Enable setting.

disable

Disable setting.

dsri

Enable/disable DSRI.

option

-

disable

Option

Description

enable

Enable DSRI.

disable

Disable DSRI.

emailfilter-profile

Name of an existing email filter profile.

string

Not Specified

emailfilter-profile-status

Enable/disable emailfilter.

option

-

disable

Option

Description

enable

Enable setting.

disable

Disable setting.

file-filter-profile

Name of an existing file-filter profile.

string

Not Specified

file-filter-profile-status

Enable/disable file filter.

option

-

disable

Option

Description

enable

Enable setting.

disable

Disable setting.

host

Hosts to filter for in sniffer traffic.

string

Not Specified

id

Sniffer ID.

integer

Minimum value: 0 Maximum value: 9999

0

interface

Interface name that traffic sniffing will take place on.

string

Not Specified

ip-threatfeed <name>

Name of an existing IP threat feed.

Threat feed name.

string

Maximum length: 79

ip-threatfeed-status

Enable/disable IP threat feed.

option

-

disable

Option

Description

enable

Enable setting.

disable

Disable setting.

ips-dos-status

Enable/disable IPS DoS anomaly detection.

option

-

disable

Option

Description

enable

Enable setting.

disable

Disable setting.

ips-sensor

Name of an existing IPS sensor.

string

Not Specified

ips-sensor-status

Enable/disable IPS sensor.

option

-

disable

Option

Description

enable

Enable setting.

disable

Disable setting.

ipv6

Enable/disable sniffing IPv6 packets.

option

-

disable

Option

Description

enable

Enable sniffer for IPv6 packets.

disable

Disable sniffer for IPv6 packets.

logtraffic

Either log all sessions, only sessions that have a security profile applied, or disable all logging for this policy.

option

-

utm

Option

Description

all

Log all sessions accepted or denied by this policy.

utm

Log traffic that has a security profile applied to it.

disable

Disable all logging for this policy.

max-packet-count

Maximum packet count.

integer

Minimum value: 1 Maximum value: 1000000 **

4000

non-ip

Enable/disable sniffing non-IP packets.

option

-

disable

Option

Description

enable

Enable sniffer for non-IP packets.

disable

Disable sniffer for non-IP packets.

port

Ports to sniff.

string

Not Specified

protocol

Integer value for the protocol type as defined by IANA.

string

Not Specified

status

Enable/disable the active status of the sniffer.

option

-

enable

Option

Description

enable

Enable sniffer status.

disable

Disable sniffer status.

vlan

List of VLANs to sniff.

string

Not Specified

webfilter-profile

Name of an existing web filter profile.

string

Not Specified

webfilter-profile-status

Enable/disable web filter profile.

option

-

disable

Option

Description

enable

Enable setting.

disable

Disable setting.

** Values may differ between models.

config anomaly

Parameter

Description

Type

Size

Default

name

Anomaly name.

string

Not Specified

status

Enable/disable this anomaly.

option

-

disable

Option

Description

disable

Disable this status.

enable

Enable this status.

log

Enable/disable anomaly logging.

option

-

disable

Option

Description

enable

Enable anomaly logging.

disable

Disable anomaly logging.

action

Action taken when the threshold is reached.

option

-

pass

Option

Description

pass

Allow traffic but record a log message if logging is enabled.

block

Block traffic if this anomaly is found.

quarantine

Quarantine method.

option

-

none

Option

Description

none

Quarantine is disabled.

attacker

Block all traffic sent from attacker's IP address. The attacker's IP address is also added to the banned user list. The target's address is not affected.

quarantine-expiry

Duration of quarantine.. Requires quarantine set to attacker.

user

Not Specified

5m

quarantine-log

Enable/disable quarantine logging.

option

-

enable

Option

Description

disable

Disable quarantine logging.

enable

Enable quarantine logging.

threshold

Anomaly threshold. Number of detected instances (packets per second or concurrent session number) that triggers the anomaly action.

integer

Minimum value: 1 Maximum value: 2147483647

0

threshold(default)

Number of detected instances. Note that each anomaly has a different threshold value assigned to it.

integer

Minimum value: 0 Maximum value: 4294967295

0

config firewall sniffer

Configure sniffer.

config firewall sniffer
    Description: Configure sniffer.
    edit <id>
        config anomaly
            Description: Configuration method to edit Denial of Service (DoS) anomaly settings.
            edit <name>
                set name {string}
                set status [disable|enable]
                set log [enable|disable]
                set action [pass|block]
                set quarantine [none|attacker]
                set quarantine-expiry {user}
                set quarantine-log [disable|enable]
                set threshold {integer}
                set threshold(default) {integer}
            next
        end
        set application-list {string}
        set application-list-status [enable|disable]
        set av-profile {string}
        set av-profile-status [enable|disable]
        set dlp-sensor {string}
        set dlp-sensor-status [enable|disable]
        set dsri [enable|disable]
        set emailfilter-profile {string}
        set emailfilter-profile-status [enable|disable]
        set file-filter-profile {string}
        set file-filter-profile-status [enable|disable]
        set host {string}
        set id {integer}
        set interface {string}
        set ip-threatfeed <name1>, <name2>, ...
        set ip-threatfeed-status [enable|disable]
        set ips-dos-status [enable|disable]
        set ips-sensor {string}
        set ips-sensor-status [enable|disable]
        set ipv6 [enable|disable]
        set logtraffic [all|utm|...]
        set max-packet-count {integer}
        set non-ip [enable|disable]
        set port {string}
        set protocol {string}
        set status [enable|disable]
        set vlan {string}
        set webfilter-profile {string}
        set webfilter-profile-status [enable|disable]
    next
end

config firewall sniffer

Parameter

Description

Type

Size

Default

application-list

Name of an existing application list.

string

Not Specified

application-list-status

Enable/disable application control profile.

option

-

disable

Option

Description

enable

Enable setting.

disable

Disable setting.

av-profile

Name of an existing antivirus profile.

string

Not Specified

av-profile-status

Enable/disable antivirus profile.

option

-

disable

Option

Description

enable

Enable setting.

disable

Disable setting.

dlp-sensor

Name of an existing DLP sensor.

string

Not Specified

dlp-sensor-status

Enable/disable DLP sensor.

option

-

disable

Option

Description

enable

Enable setting.

disable

Disable setting.

dsri

Enable/disable DSRI.

option

-

disable

Option

Description

enable

Enable DSRI.

disable

Disable DSRI.

emailfilter-profile

Name of an existing email filter profile.

string

Not Specified

emailfilter-profile-status

Enable/disable emailfilter.

option

-

disable

Option

Description

enable

Enable setting.

disable

Disable setting.

file-filter-profile

Name of an existing file-filter profile.

string

Not Specified

file-filter-profile-status

Enable/disable file filter.

option

-

disable

Option

Description

enable

Enable setting.

disable

Disable setting.

host

Hosts to filter for in sniffer traffic.

string

Not Specified

id

Sniffer ID.

integer

Minimum value: 0 Maximum value: 9999

0

interface

Interface name that traffic sniffing will take place on.

string

Not Specified

ip-threatfeed <name>

Name of an existing IP threat feed.

Threat feed name.

string

Maximum length: 79

ip-threatfeed-status

Enable/disable IP threat feed.

option

-

disable

Option

Description

enable

Enable setting.

disable

Disable setting.

ips-dos-status

Enable/disable IPS DoS anomaly detection.

option

-

disable

Option

Description

enable

Enable setting.

disable

Disable setting.

ips-sensor

Name of an existing IPS sensor.

string

Not Specified

ips-sensor-status

Enable/disable IPS sensor.

option

-

disable

Option

Description

enable

Enable setting.

disable

Disable setting.

ipv6

Enable/disable sniffing IPv6 packets.

option

-

disable

Option

Description

enable

Enable sniffer for IPv6 packets.

disable

Disable sniffer for IPv6 packets.

logtraffic

Either log all sessions, only sessions that have a security profile applied, or disable all logging for this policy.

option

-

utm

Option

Description

all

Log all sessions accepted or denied by this policy.

utm

Log traffic that has a security profile applied to it.

disable

Disable all logging for this policy.

max-packet-count

Maximum packet count.

integer

Minimum value: 1 Maximum value: 1000000 **

4000

non-ip

Enable/disable sniffing non-IP packets.

option

-

disable

Option

Description

enable

Enable sniffer for non-IP packets.

disable

Disable sniffer for non-IP packets.

port

Ports to sniff.

string

Not Specified

protocol

Integer value for the protocol type as defined by IANA.

string

Not Specified

status

Enable/disable the active status of the sniffer.

option

-

enable

Option

Description

enable

Enable sniffer status.

disable

Disable sniffer status.

vlan

List of VLANs to sniff.

string

Not Specified

webfilter-profile

Name of an existing web filter profile.

string

Not Specified

webfilter-profile-status

Enable/disable web filter profile.

option

-

disable

Option

Description

enable

Enable setting.

disable

Disable setting.

** Values may differ between models.

config anomaly

Parameter

Description

Type

Size

Default

name

Anomaly name.

string

Not Specified

status

Enable/disable this anomaly.

option

-

disable

Option

Description

disable

Disable this status.

enable

Enable this status.

log

Enable/disable anomaly logging.

option

-

disable

Option

Description

enable

Enable anomaly logging.

disable

Disable anomaly logging.

action

Action taken when the threshold is reached.

option

-

pass

Option

Description

pass

Allow traffic but record a log message if logging is enabled.

block

Block traffic if this anomaly is found.

quarantine

Quarantine method.

option

-

none

Option

Description

none

Quarantine is disabled.

attacker

Block all traffic sent from attacker's IP address. The attacker's IP address is also added to the banned user list. The target's address is not affected.

quarantine-expiry

Duration of quarantine.. Requires quarantine set to attacker.

user

Not Specified

5m

quarantine-log

Enable/disable quarantine logging.

option

-

enable

Option

Description

disable

Disable quarantine logging.

enable

Enable quarantine logging.

threshold

Anomaly threshold. Number of detected instances (packets per second or concurrent session number) that triggers the anomaly action.

integer

Minimum value: 1 Maximum value: 2147483647

0

threshold(default)

Number of detected instances. Note that each anomaly has a different threshold value assigned to it.

integer

Minimum value: 0 Maximum value: 4294967295

0