Connecting to the CLI

You can access the CLI in two ways:

• Locally—Connect your computer, terminal server, or console directly to the FortiWeb appliance’s console port.
• Through the network—Connect your computer through any network attached to one of the FortiWeb appliance’s network ports. To connect using a Secure Shell (SSH) or Telnet client, enable the network interface for Telnet or SSH administrative access. Enable HTTP/HTTPS administrative access to connect using the CLI Console widget in the web UI.

Local access is required in some cases, including when you're:

• Installing FortiWeb for the first time and it's not yet configured to connect to your network, unless you reconfigure your computer’s network settings for a peer connection, you may only be able to connect to the CLI using a local console connection. For details, see the FortiWeb Administration Guide:

  http://docs.fortinet.com/fortiweb/admin-guides

• Restoring the firmware and FortiWeb utilizes a boot interrupt. Network access to the CLI is not available until after the boot process completes, and therefore local CLI access is the only viable option.

Before you can access the CLI through the network, you must enable SSH, HTTP/HTTPS, and/or Telnet on the network interface through which you will access the CLI.

Connecting to the CLI using a local console

Local console connections to the CLI are formed by directly connecting your management computer or console to the FortiWeb appliance, using its DB-9 console port.

Requirements

• A computer with an available serial communications (COM) port
• The RJ-45-to-DB-9 or null modem cable included in your FortiWeb package
• Terminal emulation software such as PuTTY (http://www.chiark.greenend.org.uk/~sgtatham/putty/download.html)

The following instructions describe connecting to the CLI using PuTTY; steps may vary with other terminal emulators.

To connect to the CLI using a local console connection

Using the null modem or RJ-45-to-DB-9 cable, connect the FortiWeb appliance’s console port to the serial communications (COM) port on your management computer.

On your management computer, start PuTTY.

In the Category tree on the left, go to Session (not the sub-node, Logging).

From Connection type, select Serial.

Click Open.

Press the Enter key to initiate a connection.

Enter a valid administrator account name (such as admin) then press Enter.

Enter the password for that administrator account and press Enter. By default, there is no password for the admin account.

The CLI displays the following text, followed by a command line prompt:

Welcome!

You can now enter CLI commands, and configure access to the CLI through SSH or Telnet. For details, see Enabling access to the CLI through the network (SSH or Telnet or CLI Console widget).

Enabling access to the CLI through the network
(SSH or Telnet or CLI Console widget)

SSH, Telnet, or CLI Console widget (via the web UI) access to the CLI requires connecting your computer to the FortiWeb appliance using one of its RJ-45 network ports. You can either connect directly, using a peer connection between the two, or through any intermediary network.

If you do not want to use an SSH/Telnet client and you have access to the web UI, you can alternatively access the CLI through the network using the CLI Console widget in the web UI. For details, see the FortiWeb Administration Guide: http://docs.fortinet.com/fortiweb/admin-guides

You must enable SSH and/or Telnet on the network interface associated with that physical network port. If your computer is not connected directly or through a switch, you must also configure the FortiWeb appliance with a static route to a router that can forward packets from the FortiWeb appliance to your computer. For details, see router static.

You can do this using either:

• A local console connection (see the following procedure)
• The web UI (see the FortiWeb Administration Guide; http://docs.fortinet.com/fortiweb/admin-guides)

Requirements

• A computer with an available serial communications (COM) port and RJ-45 port
• Terminal emulation software such as PuTTY (http://www.chiark.greenend.org.uk/~sgtatham/putty/download.html)
• The RJ-45-to-DB-9 or null modem cable included in your FortiWeb package
• A crossover Ethernet cable (if connecting directly) or straight-through Ethernet cable (if connecting through a switch or router)
• Prior configuration of the operating mode, network interface, and static route

To enable SSH or Telnet access to the CLI using a local console connection

Using the network cable, connect the FortiWeb appliance’s network port either directly to your computer’s network port, or to a network through which your computer can reach the FortiWeb appliance.

Note the number of the physical network port.

Using a local console connection, connect and log into the CLI. For details, see Connecting to the CLI using a local console.

Enter the following commands:

config system interface

edit <interface_name>

set allowaccess {HTTP HTTPS ping snmp ssh telnet}

end

where:

• <interface_name> is the name of the network interface associated with the physical network port, such as port1
• {HTTP HTTPS ping snmp ssh telnet} is the complete, space-delimited list of permitted administrative access protocols, such as HTTPS ssh telnet; omit protocols that you do not want to permit

For example, to exclude HTTP, SNMP, and Telnet, and allow only HTTPS, ICMP ECHO (ping), and SSH administrative access on port1:

config system interface

edit "port1"

set allowaccess ping HTTPS ssh

next

end

Telnet is not a secure access method. SSH should be used to access the CLI from the Internet or any other untrusted network.

To confirm the configuration, enter the command to view the access settings for the interface.

show system interface <interface_name>

The CLI displays the settings, including the management access settings, for the interface.

If you will be connecting indirectly, through one or more routers or firewalls, configure the appliance with at least one static route so that replies from the CLI can reach your client. See router static.

To connect to the CLI through the network interface, see Connecting to the CLI using SSH or Connecting to the CLI using Telnet.

Connecting to the CLI using SSH

Once you configure the FortiWeb appliance to accept SSH connections, you can use an SSH client on your management computer to connect to the CLI.

Secure Shell (SSH) provides both secure authentication and secure communications to the CLI. Supported SSH protocol versions, ciphers, and bit strengths vary by whether or not you have enabled FIPS-CC mode or are using a low encryption (LENC) version, but generally include SSH version 2 with AES-128, 3DES, Blowfish, and SHA-1.

Requirements

• A computer with an RJ-45 Ethernet port
• a crossover Ethernet cable
• a FortiWeb network interface configured to accept SSH connections (see Enabling access to the CLI through the network (SSH or Telnet or CLI Console widget))
• an SSH client such as PuTTY (http://www.chiark.greenend.org.uk/~sgtatham/putty/download.html)

The following procedure describes connection using PuTTY software; steps may vary with other terminal emulators.

To connect to the CLI using SSH

On your management computer, start PuTTY.

Initially, the Session category of settings is displayed.

In Host Name (or IP Address), enter the IP address of a network interface on which you have enabled SSH administrative access.

In Port, enter 22.

For Connection type, select SSH.

Click Open.

The SSH client connects to the FortiWeb appliance.

The SSH client may display a warning if this is the first time you are connecting to the FortiWeb appliance and its SSH key is not yet recognized by your SSH client, or if you have previously connected to the FortiWeb appliance but it used a different IP address or SSH key. If your management computer is directly connected to the FortiWeb appliance with no network hosts between them, this is normal.

Click Yes to verify the fingerprint and accept the FortiWeb appliance’s SSH key. You will not be able to log in until you have accepted the key.

Enter a valid administrator account name (such as admin) and press Enter.

Alternatively, you can log in using an SSH key. For details, see system admin.

Enter the password for this administrator account and press Enter.

If three incorrect login or password attempts occur in a row, you will be disconnected. Wait one minute, then reconnect to attempt the login again.

The FortiWeb appliance displays a command prompt—its host name followed by a #. You can now enter CLI commands.

Connecting to the CLI using Telnet

Once the FortiWeb appliance is configured to accept Telnet connections, you can use a Telnet client on your management computer to connect to the CLI.

Telnet is not a secure access method. SSH should be used to access the CLI from the Internet or any other untrusted network.

Requirements

• A computer with an RJ-45 Ethernet port
• A crossover Ethernet cable
• A FortiWeb network interface configured to accept Telnet connections (see Enabling access to the CLI through the network (SSH or Telnet or CLI Console widget))
• Terminal emulation software such as PuTTY (http://www.chiark.greenend.org.uk/~sgtatham/putty/download.html)

The following procedure describes connection using PuTTY software; steps may vary with other terminal emulators.

To connect to the CLI using Telnet

On your management computer, start PuTTY.

In Host Name (or IP Address), type the IP address of a network interface on which you have enabled Telnet administrative access.

In Port, enter 23.

For Connection type, select Telnet.

Click Open.

Type a valid administrator account name (such as admin) and press Enter.

Type the password for this administrator account and press Enter.

The FortiWeb appliance displays a command prompt—its host name followed by a #. You can now enter CLI commands.

If three incorrect login or password attempts occur in a row, you will be disconnected. Wait one minute, then reconnect to attempt the login again.