CLI Reference

• FortiOS CLI reference
• CLI configuration commands
  • alertemail
    • config alertemail setting
  • antivirus
    • config antivirus exempt-list
    • config antivirus profile
    • config antivirus quarantine
    • config antivirus settings
  • application
    • config application custom
    • config application group
    • config application list
    • config application name
    • config application rule-settings
  • authentication
    • config authentication rule
    • config authentication scheme
    • config authentication setting
  • automation
    • config automation setting
  • aws
    • config aws vpce
  • certificate
    • config certificate ca
    • config certificate crl
    • config certificate local
    • config certificate remote
  • dlp
    • config dlp data-type
    • config dlp dictionary
    • config dlp filepattern
    • config dlp fp-doc-source
    • config dlp profile
    • config dlp sensitivity
    • config dlp sensor
    • config dlp settings
  • dnsfilter
    • config dnsfilter domain-filter
    • config dnsfilter profile
  • dpdk
    • config dpdk cpus
    • config dpdk global
  • emailfilter
    • config emailfilter block-allow-list
    • config emailfilter bword
    • config emailfilter dnsbl
    • config emailfilter fortishield
    • config emailfilter iptrust
    • config emailfilter mheader
    • config emailfilter options
    • config emailfilter profile
  • endpoint-control
    • config endpoint-control fctems
  • extension-controller
    • config extension-controller dataplan
    • config extension-controller extender
    • config extension-controller extender-profile
    • config extension-controller fortigate
    • config extension-controller fortigate-profile
  • file-filter
    • config file-filter profile
  • firewall
    • config firewall DoS-policy
    • config firewall DoS-policy6
    • config firewall access-proxy
    • config firewall access-proxy6
    • config firewall access-proxy-ssh-client-cert
    • config firewall access-proxy-virtual-host
    • config firewall acl
    • config firewall acl6
    • config firewall address
    • config firewall address6
    • config firewall address6-template
    • config firewall addrgrp
    • config firewall addrgrp6
    • config firewall auth-portal
    • config firewall central-snat-map
    • config firewall city
    • config firewall country
    • config firewall decrypted-traffic-mirror
    • config firewall dnstranslation
    • config firewall global
    • config firewall identity-based-route
    • config firewall interface-policy
    • config firewall interface-policy6
    • config firewall internet-service
    • config firewall internet-service-addition
    • config firewall internet-service-append
    • config firewall internet-service-botnet
    • config firewall internet-service-custom
    • config firewall internet-service-custom-group
    • config firewall internet-service-definition
    • config firewall internet-service-extension
    • config firewall internet-service-group
    • config firewall internet-service-ipbl-reason
    • config firewall internet-service-ipbl-vendor
    • config firewall internet-service-list
    • config firewall internet-service-name
    • config firewall internet-service-owner
    • config firewall internet-service-reputation
    • config firewall internet-service-sld
    • config firewall internet-service-subapp
    • config firewall ipmacbinding setting
    • config firewall ipmacbinding table
    • config firewall ippool
    • config firewall ippool6
    • config firewall ipv6-eh-filter
    • config firewall ip-translation
    • config firewall ldb-monitor
    • config firewall local-in-policy
    • config firewall local-in-policy6
    • config firewall multicast-address
    • config firewall multicast-address6
    • config firewall multicast-policy
    • config firewall multicast-policy6
    • config firewall network-service-dynamic
    • config firewall policy
    • config firewall profile-group
    • config firewall profile-protocol-options
    • config firewall proxy-address
    • config firewall proxy-addrgrp
    • config firewall proxy-policy
    • config firewall region
    • config firewall schedule group
    • config firewall schedule onetime
    • config firewall schedule recurring
    • config firewall security-policy
    • config firewall service category
    • config firewall service custom
    • config firewall service group
    • config firewall shaper per-ip-shaper
    • config firewall shaper traffic-shaper
    • config firewall shaping-policy
    • config firewall shaping-profile
    • config firewall sniffer
    • config firewall ssh host-key
    • config firewall ssh local-ca
    • config firewall ssh local-key
    • config firewall ssh setting
    • config firewall ssl setting
    • config firewall ssl-server
    • config firewall ssl-ssh-profile
    • config firewall traffic-class
    • config firewall ttl-policy
    • config firewall vendor-mac
    • config firewall vip
    • config firewall vip6
    • config firewall vipgrp
    • config firewall vipgrp6
    • config firewall wildcard-fqdn custom
    • config firewall wildcard-fqdn group
  • ftp-proxy
    • config ftp-proxy explicit
  • icap
    • config icap profile
    • config icap server
    • config icap server-group
  • ips
    • config ips custom
    • config ips decoder
    • config ips global
    • config ips rule
    • config ips rule-settings
    • config ips sensor
    • config ips settings
    • config ips view-map
  • log
    • config log azure-security-center filter
    • config log azure-security-center setting
    • config log azure-security-center2 filter
    • config log azure-security-center2 setting
    • config log custom-field
    • config log disk filter
    • config log disk setting
    • config log eventfilter
    • config log fortianalyzer filter
    • config log fortianalyzer override-filter
    • config log fortianalyzer override-setting
    • config log fortianalyzer setting
    • config log fortianalyzer2 filter
    • config log fortianalyzer2 override-filter
    • config log fortianalyzer2 override-setting
    • config log fortianalyzer2 setting
    • config log fortianalyzer3 filter
    • config log fortianalyzer3 override-filter
    • config log fortianalyzer3 override-setting
    • config log fortianalyzer3 setting
    • config log fortianalyzer-cloud filter
    • config log fortianalyzer-cloud override-filter
    • config log fortianalyzer-cloud override-setting
    • config log fortianalyzer-cloud setting
    • config log fortiguard filter
    • config log fortiguard override-filter
    • config log fortiguard override-setting
    • config log fortiguard setting
    • config log gui-display
    • config log memory filter
    • config log memory global-setting
    • config log memory setting
    • config log null-device filter
    • config log null-device setting
    • config log setting
    • config log syslogd filter
    • config log syslogd override-filter
    • config log syslogd override-setting
    • config log syslogd setting
    • config log syslogd2 filter
    • config log syslogd2 override-filter
    • config log syslogd2 override-setting
    • config log syslogd2 setting
    • config log syslogd3 filter
    • config log syslogd3 override-filter
    • config log syslogd3 override-setting
    • config log syslogd3 setting
    • config log syslogd4 filter
    • config log syslogd4 override-filter
    • config log syslogd4 override-setting
    • config log syslogd4 setting
    • config log tacacs+accounting filter
    • config log tacacs+accounting setting
    • config log tacacs+accounting2 filter
    • config log tacacs+accounting2 setting
    • config log tacacs+accounting3 filter
    • config log tacacs+accounting3 setting
    • config log threat-weight
    • config log webtrends filter
    • config log webtrends setting
  • monitoring
    • config monitoring np6-ipsec-engine
    • config monitoring npu-hpe
  • nsxt
    • config nsxt service-chain
    • config nsxt setting
  • report
    • config report layout
    • config report setting
  • router
    • config router access-list
    • config router access-list6
    • config router aspath-list
    • config router auth-path
    • config router bfd
    • config router bfd6
    • config router bgp
    • config router community-list
    • config router extcommunity-list
    • config router isis
    • config router key-chain
    • config router multicast
    • config router multicast6
    • config router multicast-flow
    • config router ospf
    • config router ospf6
    • config router policy
    • config router policy6
    • config router prefix-list
    • config router prefix-list6
    • config router rip
    • config router ripng
    • config router route-map
    • config router setting
    • config router static
    • config router static6
  • rule
    • config rule fmwp
  • sctp-filter
    • config sctp-filter profile
  • ssh-filter
    • config ssh-filter profile
  • switch-controller
    • config switch-controller 802-1X-settings
    • config switch-controller auto-config custom
    • config switch-controller auto-config default
    • config switch-controller auto-config policy
    • config switch-controller custom-command
    • config switch-controller dsl policy
    • config switch-controller dynamic-port-policy
    • config switch-controller flow-tracking
    • config switch-controller fortilink-settings
    • config switch-controller global
    • config switch-controller igmp-snooping
    • config switch-controller initial-config template
    • config switch-controller initial-config vlans
    • config switch-controller lldp-profile
    • config switch-controller lldp-settings
    • config switch-controller location
    • config switch-controller mac-policy
    • config switch-controller managed-switch
    • config switch-controller network-monitor-settings
    • config switch-controller ptp policy
    • config switch-controller ptp settings
    • config switch-controller qos dot1p-map
    • config switch-controller qos ip-dscp-map
    • config switch-controller qos qos-policy
    • config switch-controller qos queue-policy
    • config switch-controller quarantine
    • config switch-controller remote-log
    • config switch-controller security-policy 802-1X
    • config switch-controller security-policy local-access
    • config switch-controller sflow
    • config switch-controller snmp-community
    • config switch-controller snmp-sysinfo
    • config switch-controller snmp-trap-threshold
    • config switch-controller snmp-user
    • config switch-controller storm-control
    • config switch-controller storm-control-policy
    • config switch-controller stp-instance
    • config switch-controller stp-settings
    • config switch-controller switch-group
    • config switch-controller switch-interface-tag
    • config switch-controller switch-log
    • config switch-controller switch-profile
    • config switch-controller system
    • config switch-controller traffic-policy
    • config switch-controller traffic-sniffer
    • config switch-controller virtual-port-pool
    • config switch-controller vlan-policy
  • system
    • config system 3g-modem custom
    • config system accprofile
    • config system acme
    • config system admin
    • config system affinity-interrupt
    • config system affinity-packet-redistribution
    • config system alarm
    • config system alias
    • config system api-user
    • config system arp-table
    • config system automation-action
    • config system automation-destination
    • config system automation-stitch
    • config system automation-trigger
    • config system autoupdate schedule
    • config system autoupdate tunneling
    • config system auto-install
    • config system auto-scale
    • config system auto-script
    • config system bypass
    • config system central-management
    • config system console
    • config system csf
    • config system custom-language
    • config system ddns
    • config system dedicated-mgmt
    • config system device-upgrade
    • config system dhcp server
    • config system dhcp6 server
    • config system dnp3-proxy
    • config system dns
    • config system dns64
    • config system dns-database
    • config system dns-server
    • config system dscp-based-priority
    • config system elbc
    • config system email-server
    • config system external-resource
    • config system fabric-vpn
    • config system federated-upgrade
    • config system fips-cc
    • config system fortiguard
    • config system fortindr
    • config system fortisandbox
    • config system fsso-polling
    • config system ftm-push
    • config system geneve
    • config system geoip-override
    • config system global
    • config system gre-tunnel
    • config system ha
    • config system ha-monitor
    • config system ike
    • config system interface
    • config system ipam
    • config system ipip-tunnel
    • config system ips
    • config system ipsec-aggregate
    • config system ips-urlfilter-dns
    • config system ips-urlfilter-dns6
    • config system ipv6-neighbor-cache
    • config system ipv6-tunnel
    • config system iscsi
    • config system isf-queue-profile
    • config system link-monitor
    • config system lldp network-policy
    • config system lte-modem
    • config system mac-address-table
    • config system management-tunnel
    • config system mobile-tunnel
    • config system modem
    • config system nd-proxy
    • config system netflow
    • config system network-visibility
    • config system np6
    • config system np6xlite
    • config system npu
    • config system npu-setting prp
    • config system npu-vlink
    • config system ntp
    • config system object-tagging
    • config system password-policy
    • config system password-policy-guest-admin
    • config system physical-switch
    • config system pppoe-interface
    • config system probe-response
    • config system proxy-arp
    • config system ptp
    • config system replacemsg admin
    • config system replacemsg alertmail
    • config system replacemsg auth
    • config system replacemsg automation
    • config system replacemsg custom-message
    • config system replacemsg fortiguard-wf
    • config system replacemsg ftp
    • config system replacemsg http
    • config system replacemsg icap
    • config system replacemsg mail
    • config system replacemsg nac-quar
    • config system replacemsg spam
    • config system replacemsg sslvpn
    • config system replacemsg traffic-quota
    • config system replacemsg utm
    • config system replacemsg webproxy
    • config system replacemsg-group
    • config system replacemsg-image
    • config system resource-limits
    • config system saml
    • config system sdn-connector
    • config system sdwan
    • config system session-helper
    • config system session-ttl
    • config system settings
    • config system sflow
    • config system sit-tunnel
    • config system smc-ntp
    • config system sms-server
    • config system snmp community
    • config system snmp mib-view
    • config system snmp sysinfo
    • config system snmp user
    • config system speed-test-schedule
    • config system speed-test-server
    • config system speed-test-setting
    • config system sso-admin
    • config system sso-forticloud-admin
    • config system sso-fortigate-cloud-admin
    • config system standalone-cluster
    • config system storage
    • config system stp
    • config system switch-interface
    • config system tos-based-priority
    • config system vdom
    • config system vdom-dns
    • config system vdom-exception
    • config system vdom-link
    • config system vdom-netflow
    • config system vdom-property
    • config system vdom-radius-server
    • config system vdom-sflow
    • config system vin-alarm
    • config system virtual-switch
    • config system virtual-wire-pair
    • config system vne-tunnel
    • config system vxlan
    • config system wccp
    • config system wireless ap-status
    • config system wireless settings
    • config system zone
  • user
    • config user adgrp
    • config user certificate
    • config user domain-controller
    • config user exchange
    • config user external-identity-provider
    • config user fortitoken
    • config user fsso
    • config user fsso-polling
    • config user group
    • config user krb-keytab
    • config user ldap
    • config user local
    • config user nac-policy
    • config user password-policy
    • config user peer
    • config user peergrp
    • config user pop3
    • config user quarantine
    • config user radius
    • config user saml
    • config user security-exempt-list
    • config user setting
    • config user tacacs+
  • videofilter
    • config videofilter profile
    • config videofilter youtube-channel-filter
    • config videofilter youtube-key
  • voip
    • config voip profile
  • vpn
    • config vpn certificate ca
    • config vpn certificate crl
    • config vpn certificate local
    • config vpn certificate ocsp-server
    • config vpn certificate remote
    • config vpn certificate setting
    • config vpn ipsec concentrator
    • config vpn ipsec fec
    • config vpn ipsec forticlient
    • config vpn ipsec manualkey
    • config vpn ipsec manualkey-interface
    • config vpn ipsec phase1
    • config vpn ipsec phase1-interface
    • config vpn ipsec phase2
    • config vpn ipsec phase2-interface
    • config vpn l2tp
    • config vpn ocvpn
    • config vpn pptp
    • config vpn ssl client
    • config vpn ssl settings
    • config vpn ssl web host-check-software
    • config vpn ssl web portal
    • config vpn ssl web realm
    • config vpn ssl web user-bookmark
    • config vpn ssl web user-group-bookmark
  • waf
    • config waf main-class
    • config waf profile
    • config waf signature
    • config waf sub-class
  • wanopt
    • config wanopt auth-group
    • config wanopt cache-service
    • config wanopt content-delivery-network-rule
    • config wanopt peer
    • config wanopt profile
    • config wanopt remote-storage
    • config wanopt settings
    • config wanopt webcache
  • web-proxy
    • config web-proxy debug-url
    • config web-proxy explicit
    • config web-proxy forward-server
    • config web-proxy forward-server-group
    • config web-proxy global
    • config web-proxy profile
    • config web-proxy url-match
    • config web-proxy wisp
  • webfilter
    • config webfilter content
    • config webfilter content-header
    • config webfilter fortiguard
    • config webfilter ftgd-local-cat
    • config webfilter ftgd-local-rating
    • config webfilter ips-urlfilter-cache-setting
    • config webfilter ips-urlfilter-setting
    • config webfilter ips-urlfilter-setting6
    • config webfilter override
    • config webfilter profile
    • config webfilter search-engine
    • config webfilter urlfilter
  • wireless-controller
    • config wireless-controller access-control-list
    • config wireless-controller apcfg-profile
    • config wireless-controller ap-status
    • config wireless-controller arrp-profile
    • config wireless-controller ble-profile
    • config wireless-controller bonjour-profile
    • config wireless-controller global
    • config wireless-controller hotspot20 anqp-3gpp-cellular
    • config wireless-controller hotspot20 anqp-ip-address-type
    • config wireless-controller hotspot20 anqp-nai-realm
    • config wireless-controller hotspot20 anqp-network-auth-type
    • config wireless-controller hotspot20 anqp-roaming-consortium
    • config wireless-controller hotspot20 anqp-venue-name
    • config wireless-controller hotspot20 anqp-venue-url
    • config wireless-controller hotspot20 h2qp-advice-of-charge
    • config wireless-controller hotspot20 h2qp-conn-capability
    • config wireless-controller hotspot20 h2qp-operator-name
    • config wireless-controller hotspot20 h2qp-osu-provider
    • config wireless-controller hotspot20 h2qp-osu-provider-nai
    • config wireless-controller hotspot20 h2qp-terms-and-conditions
    • config wireless-controller hotspot20 h2qp-wan-metric
    • config wireless-controller hotspot20 hs-profile
    • config wireless-controller hotspot20 icon
    • config wireless-controller hotspot20 qos-map
    • config wireless-controller inter-controller
    • config wireless-controller log
    • config wireless-controller mpsk-profile
    • config wireless-controller nac-profile
    • config wireless-controller qos-profile
    • config wireless-controller region
    • config wireless-controller setting
    • config wireless-controller snmp
    • config wireless-controller ssid-policy
    • config wireless-controller syslog-profile
    • config wireless-controller timers
    • config wireless-controller vap
    • config wireless-controller vap-group
    • config wireless-controller wag-profile
    • config wireless-controller wids-profile
    • config wireless-controller wtp
    • config wireless-controller wtp-group
    • config wireless-controller wtp-profile
• CLI diagnose commands
  • diagnose alertconsole
  • diagnose antivirus
  • diagnose automation
  • diagnose autoupdate
  • diagnose central-mgmt
  • diagnose cid
  • diagnose clearpass
  • diagnose debug
  • diagnose disktest
  • diagnose dpdk config
  • diagnose dpdk log clear
  • diagnose dpdk log show
  • diagnose dpdk performance
  • diagnose dpdk statistics clear
  • diagnose dpdk statistics show
  • diagnose emailfilter
  • diagnose endpoint
  • diagnose extender
  • diagnose fdsm
  • diagnose firewall
  • diagnose forticare
  • diagnose forticlient
  • diagnose fortiguard-resources
  • diagnose fortitoken
  • diagnose fortitoken-cloud
  • diagnose fortiview
  • diagnose geoip
  • diagnose hardware
  • diagnose internet-service
  • diagnose internet-service6
  • diagnose internet-service-name
  • diagnose ip address
  • diagnose ip arp
  • diagnose ip gre-tunnel
  • diagnose ip ipip-tunnel
  • diagnose ip multicast
  • diagnose ip proute
  • diagnose ip route
  • diagnose ip router bfd
  • diagnose ip router bgp
  • diagnose ip router command
  • diagnose ip router igmp
  • diagnose ip router isis
  • diagnose ip router ospf
  • diagnose ip router pim-dm
  • diagnose ip router pim-sm
  • diagnose ip router rip
  • diagnose ip router zl
  • diagnose ip tcp
  • diagnose ip udp
  • diagnose ips anomaly
  • diagnose ips anomaly6
  • diagnose ips av avengine
  • diagnose ips av cache
  • diagnose ips av mode
  • diagnose ips av stats
  • diagnose ips av timeout
  • diagnose ips config disable
  • diagnose ips config enable
  • diagnose ips dac
  • diagnose ips debug disable
  • diagnose ips debug enable
  • diagnose ips debug level
  • diagnose ips debug status
  • diagnose ips dissector
  • diagnose ips filter
  • diagnose ips global rule
  • diagnose ips gtp
  • diagnose ips ipsa
  • diagnose ips l2ips
  • diagnose ips memory
  • diagnose ips packet
  • diagnose ips pme debug
  • diagnose ips pme detail
  • diagnose ips pme policy
  • diagnose ips raw
  • diagnose ips session
  • diagnose ips share
  • diagnose ips shmopts
  • diagnose ips signature
  • diagnose ips ssl
  • diagnose ips test
  • diagnose ips urlfilter
  • diagnose ips vpatch
  • diagnose ipv6 address
  • diagnose ipv6 devconf
  • diagnose ipv6 gre-tunnel
  • diagnose ipv6 ipv6-tunnel
  • diagnose ipv6 multicast
  • diagnose ipv6 neighbor-cache
  • diagnose ipv6 proute
  • diagnose ipv6 route
  • diagnose ipv6 router ospf
  • diagnose ipv6 router rip
  • diagnose ipv6 router zl6
  • diagnose ipv6 sit-tunnel
  • diagnose lldprx
  • diagnose lldptx
  • diagnose log
  • diagnose netlink aggregate
  • diagnose netlink backlog
  • diagnose netlink brctl
  • diagnose netlink device
  • diagnose netlink dstmac
  • diagnose netlink interface
  • diagnose netlink intf-class
  • diagnose netlink intf-qdisc
  • diagnose netlink qlen
  • diagnose netlink redundant
  • diagnose nodejs
  • diagnose oci
  • diagnose radiusd
  • diagnose report
  • diagnose report-runner
  • diagnose rsso
  • diagnose saas
  • diagnose settings
  • diagnose sniffer
  • diagnose snmp ip
  • diagnose snmp ip6
  • diagnose snmp net
  • diagnose snmp trap
  • diagnose switch-controller
  • diagnose sys
  • diagnose test analytics-pdf-report
  • diagnose test analytics-report
  • diagnose test application
  • diagnose test authserver
  • diagnose test guest
  • diagnose test security
  • diagnose test update
  • diagnose traffictest
  • diagnose user
  • diagnose user-device-store
  • diagnose vendor-mac
  • diagnose vpn ike
  • diagnose vpn ikecrypt
  • diagnose vpn ipsec
  • diagnose vpn l2tp
  • diagnose vpn mr
  • diagnose vpn mr6
  • diagnose vpn ocvpn
  • diagnose vpn pptp
  • diagnose vpn ssl
  • diagnose vpn tunnel
  • diagnose wacs
  • diagnose wad
  • diagnose wadbd
  • diagnose waf
  • diagnose webfilter bword
  • diagnose webfilter fortiguard
  • diagnose webfilter quota
  • diagnose webfilter stats
  • diagnose web-ui
  • diagnose wireless-controller
  • diagnose wpa
• CLI execute commands
  • execute api-user
  • execute auto-script
  • execute backup
  • execute batch
  • execute central-mgmt
  • execute cfg
  • execute clear
  • execute cli
  • execute config-transaction
  • execute cpu
  • execute date
  • execute device-upgrade
  • execute dhcp
  • execute dhcp6
  • execute disconnect-admin-session
  • execute disk
  • execute enter
  • execute erase-disk
  • execute extender
  • execute fabric-vpn
  • execute factoryreset
  • execute factoryreset2
  • execute factoryreset-for-central-management
  • execute factoryreset-shutdown
  • execute fctems
  • execute federated-upgrade
  • execute fips
  • execute firewall
  • execute formatlogdisk
  • execute forticarrier-license
  • execute forticloud-sandbox
  • execute fortiguard-log
  • execute fortiguard-message
  • execute fortitoken
  • execute fortitoken-cloud
  • execute fortitoken-mobile
  • execute fsso
  • execute ha
  • execute interface
  • execute internet-service4
  • execute internet-service6
  • execute ipam
  • execute iscsi
  • execute log
  • execute mem
  • execute mrouter
  • execute nsx
  • execute ping
  • execute ping6
  • execute ping6-options
  • execute ping-options
  • execute policy-packet-capture
  • execute private-encryption-key
  • execute reboot
  • execute replace-device
  • execute report
  • execute report-config
  • execute restore
  • execute revision
  • execute router
  • execute sdn
  • execute send-fds-statistics
  • execute send-fmg-list
  • execute set
  • execute shutdown
  • execute speed-test
  • execute speed-test-dbg
  • execute speed-test-dynamic
  • execute speed-test-server
  • execute ssh
  • execute ssh6
  • execute ssh6-options
  • execute ssh-options
  • execute ssh-regen-keys
  • execute switch-controller
  • execute sync-IPSec
  • execute sync-session
  • execute system
  • execute tac
  • execute telnet
  • execute telnet-options
  • execute test
  • execute time
  • execute traceroute
  • execute traceroute-options
  • execute tracert6
  • execute update-av
  • execute update-eip
  • execute update-external-resource
  • execute update-ffdb-on-demand
  • execute update-geo-ip
  • execute update-ips
  • execute update-list
  • execute update-now
  • execute update-src-vis
  • execute upd-vd-license
  • execute upload
  • execute vm-license
  • execute vm-license-options
  • execute vpn
  • execute wake-on-lan
  • execute webcache
  • execute webfilter
  • execute wireless-controller
• Included devices
• Change Log