Scripts

FortiManager scripts enable you to create, execute, and view the results of scripts executed on FortiGate devices, policy packages, the ADOM database, the global policy package, or the device database. Scripts can also be filtered based on different device information, such as OS type and platform.

At least one FortiGate device must be configured in the FortiManager system before you can use scripts.

Additional configuration options and short-cuts are available using the right-click menu. Right-click the mouse on different navigation panes in the GUI page to access these options.

Any scripts that are run on the global database must use complete commands. For example, if the full command is config system global, do not use conf sys glob.

Scripts can be written in one of the following formats:

• CLI Script: A sequence of FortiGate CLI commands, as you would type them at the command line. A comment line starts with the number sign (#). A comment line will not be executed.

• TCL Script: Tcl scripting commands to provide more functionality to your scripts including global variables and decision structures.

• Jinja Script: Jinja scripts can be used to create scalable, dynamic scripts which can be applied to the FortiManager ADOM database.

When writing your scripts, it is generally easier to write them in a context-sensitive editor, and then cut and paste them into the script editor on your FortiManager system. This can help avoid syntax errors and can reduce the amount of troubleshooting required for your scripts.

CLI scripts can be grouped together, allowing multiple scripts to be run on a target at the same time. See CLI script group for information.

Go to Device Manager > Scripts to view the Script and Script Group entries.

For information about scripting commands, see the FortiGate CLI reference.

Before using scripts, ensure the console-output function has been set to standard in the FortiGate CLI. Otherwise, scripts and other output longer than a screen in length will not execute or display correctly.

When pushing a script from the FortiManager to the FortiGate with workspace enabled, you must save the changes in the Policy & Objects tab.

By design, the following FortiOS settings under system central-management cannot be modified using FortiManager database scripts or CLI templates: fmg, fmg-source-ip, fmg-source-ip6, serial-number, type, and vdom. Attempting to commit changes to these fields will result in the following error: not allowed to change. If you need to apply changes to these fields using FortiManager, a CLI Script can be used and run against the Remote FortiGate Directly (via CLI).

After running a script with configuration changes directly on a FortiGate, you can import the configuration from the FortiGate to FortiManager in order to bring the script's changes into the FortiManager database.