config system csf
Add this FortiGate to a Security Fabric or set up a new Security Fabric on this FortiGate.
config system csf
Description: Add this FortiGate to a Security Fabric or set up a new Security Fabric on this FortiGate.
set accept-auth-by-cert [disable|enable]
set authorization-request-type [serial|certificate]
set autoclear-removed-shared-objects [enable|disable]
set certificate {string}
set configuration-sync [default|local]
set downstream-access [enable|disable]
set downstream-accprofile {string}
config fabric-connector
Description: Fabric connector configuration.
edit <serial>
set accprofile {string}
set configuration-write-access [enable|disable]
set vdom <name1>, <name2>, ...
next
end
config fabric-datasource-exemption
Description: Disable the fabric datasource check on the tables when synchronizing them.
edit <name>
set status [enable|disable]
next
end
set fabric-object-change-auto-cascade [enable|disable]
set fabric-object-unification [default|local]
set fabric-workers {integer}
set file-mgmt [enable|disable]
set file-quota {integer}
set file-quota-warning {integer}
set forticloud-account-enforcement [enable|disable]
set group-name {string}
set group-password {password}
set legacy-authentication [disable|enable]
set log-unification [disable|enable]
set saml-configuration-sync [default|local]
config shared-objects
Description: Fabric-wide objects shared by non-root nodes.
edit <name>
config objects
Description: CMDB table entries.
edit <pathname>
config keys
Description: Keys of CMDB table entries.
edit <name>
next
end
next
end
set trusted-list-entry {string}
next
end
set source-ip {ipv4-address}
set status [enable|disable]
config trusted-list
Description: Pre-authorized and blocked security fabric nodes.
edit <name>
set action [accept|deny]
set ca {string}
set ca-fingerprint {string}
set cn {string}
set index {integer}
set role [downstream|upstream]
next
end
set uid {string}
set upload-shared-objects [enable|disable]
set upstream {string}
set upstream-interface {string}
set upstream-interface-select-method [auto|sdwan|...]
set upstream-port {integer}
end
config system csf
|
Parameter |
Description |
Type |
Size |
Default |
||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
accept-auth-by-cert |
Accept connections with unknown certificates and ask admin for approval. |
option |
- |
enable |
||||||||
|
|
|
|||||||||||
|
authorization-request-type |
Authorization request type. |
option |
- |
certificate ** |
||||||||
|
|
|
|||||||||||
|
autoclear-removed-shared-objects * |
Control system behavior for deleted shared objects. |
option |
- |
enable |
||||||||
|
|
|
|||||||||||
|
certificate |
Certificate. |
string |
Maximum length: 35 |
Fortinet_Factory ** |
||||||||
|
configuration-sync |
Configuration sync mode. |
option |
- |
default |
||||||||
|
|
|
|||||||||||
|
downstream-access |
Enable/disable downstream device access to this device's configuration and data. |
option |
- |
disable |
||||||||
|
|
|
|||||||||||
|
downstream-accprofile |
Default access profile for requests from downstream devices. |
string |
Maximum length: 35 |
|
||||||||
|
fabric-object-change-auto-cascade * |
Enable/disable the cascade mode for fabric objects datasource check. |
option |
- |
disable |
||||||||
|
|
|
|||||||||||
|
fabric-object-unification |
Fabric CMDB Object Unification. |
option |
- |
default |
||||||||
|
|
|
|||||||||||
|
fabric-workers |
Number of worker processes for Security Fabric daemon. |
integer |
Minimum value: 1 Maximum value: 4 |
2 |
||||||||
|
file-mgmt |
Enable/disable Security Fabric daemon file management. |
option |
- |
enable |
||||||||
|
|
|
|||||||||||
|
file-quota |
Maximum amount of memory that can be used by the daemon files (in bytes). |
integer |
Minimum value: 0 Maximum value: 4294967295 |
0 |
||||||||
|
file-quota-warning |
Warn when the set percentage of quota has been used. |
integer |
Minimum value: 1 Maximum value: 99 |
90 |
||||||||
|
forticloud-account-enforcement |
Fabric FortiCloud account unification. |
option |
- |
enable |
||||||||
|
|
|
|||||||||||
|
group-name |
Security Fabric group name. All FortiGates in a Security Fabric must have the same group name. |
string |
Maximum length: 35 |
|
||||||||
|
group-password |
Security Fabric group password. For legacy authentication, fabric members must have the same group password. |
password |
Not Specified |
|
||||||||
|
legacy-authentication |
Enable/disable legacy authentication. |
option |
- |
disable |
||||||||
|
|
|
|||||||||||
|
log-unification |
Enable/disable broadcast of discovery messages for log unification. |
option |
- |
enable |
||||||||
|
|
|
|||||||||||
|
saml-configuration-sync |
SAML setting configuration synchronization. |
option |
- |
default |
||||||||
|
|
|
|||||||||||
|
source-ip |
Source IP address for communication with the upstream FortiGate. |
ipv4-address |
Not Specified |
0.0.0.0 |
||||||||
|
status |
Enable/disable Security Fabric. |
option |
- |
disable |
||||||||
|
|
|
|||||||||||
|
uid |
Unique ID of the current CSF node |
string |
Maximum length: 35 |
|
||||||||
|
upload-shared-objects * |
Configure uploading shared objects entries to the tree. |
option |
- |
enable |
||||||||
|
|
|
|||||||||||
|
upstream |
IP/FQDN of the FortiGate upstream from this FortiGate in the Security Fabric. |
string |
Maximum length: 255 |
|
||||||||
|
upstream-interface |
Specify outgoing interface to reach server. |
string |
Maximum length: 15 |
|
||||||||
|
upstream-interface-select-method |
Specify how to select outgoing interface to reach server. |
option |
- |
auto |
||||||||
|
|
|
|||||||||||
|
upstream-port |
The port number to use to communicate with the FortiGate upstream from this FortiGate in the Security Fabric (default = 8013). |
integer |
Minimum value: 1 Maximum value: 65535 |
8013 |
||||||||
* This parameter may not exist in some models.
** Values may differ between models.
config fabric-connector
|
Parameter |
Description |
Type |
Size |
Default |
||||||
|---|---|---|---|---|---|---|---|---|---|---|
|
accprofile |
Override access profile. |
string |
Maximum length: 35 |
|
||||||
|
configuration-write-access |
Enable/disable downstream device write access to configuration. |
option |
- |
disable |
||||||
|
|
|
|||||||||
|
serial |
Serial. |
string |
Maximum length: 19 |
|
||||||
|
vdom |
Virtual domains that the connector has access to. If none are set, the connector will only have access to the VDOM that it joins the Security Fabric through. Virtual domain name. |
string |
Maximum length: 79 |
|
||||||
config fabric-datasource-exemption
|
Parameter |
Description |
Type |
Size |
Default |
||||||
|---|---|---|---|---|---|---|---|---|---|---|
|
name |
Name. |
string |
Maximum length: 255 |
|
||||||
|
status |
Enable/disable the fabric datasource check on the target table. |
option |
- |
disable |
||||||
|
|
|
|||||||||
config shared-objects
|
Parameter |
Description |
Type |
Size |
Default |
|---|---|---|---|---|
|
name |
UID of the source device. |
string |
Maximum length: 35 |
|
|
trusted-list-entry |
Trusted list entry name. |
string |
Maximum length: 35 |
|
config objects
|
Parameter |
Description |
Type |
Size |
Default |
|---|---|---|---|---|
|
pathname |
CMDB path and object name. |
string |
Maximum length: 192 |
|
config keys
|
Parameter |
Description |
Type |
Size |
Default |
|---|---|---|---|---|
|
name |
key. |
string |
Maximum length: 79 |
|
config trusted-list
|
Parameter |
Description |
Type |
Size |
Default |
||||||
|---|---|---|---|---|---|---|---|---|---|---|
|
action |
Security fabric authorization action. |
option |
- |
accept |
||||||
|
|
|
|||||||||
|
ca * |
Name of a CA on the downstream's certificat chain. |
string |
Maximum length: 79 |
|
||||||
|
ca-fingerprint * |
SHA512 fingerprint of a CA on the downstream's certificate chain. |
string |
Maximum length: 191 |
|
||||||
|
cn * |
Certificate CNs used by HA members. |
string |
Maximum length: 64 |
|
||||||
|
index |
Index of the downstream in tree. |
integer |
Minimum value: 1 Maximum value: 1025 ** |
0 |
||||||
|
name |
Name. |
string |
Maximum length: 35 |
|
||||||
|
role * |
Device role to this member. |
option |
- |
downstream |
||||||
|
|
|
|||||||||
* This parameter may not exist in some models.
** Values may differ between models.