CLI system permissions

Starting in FortiOS 7.4.2, the usage of CLI diagnostic commands (cli-diagnose), previously named system-diagnostics, is disabled by default, with the exception of super_admin profile users. Users can now exercise more granular control over the CLI commands. See CLI system permissions for more information.

When the user upgrades to FortiOS 7.4.2 or later, the following settings for CLI options will be applied, irrespective of whether system-diagnostics was enabled or disabled in FortiOS 7.4.1 or earlier.

CLI option	Status
cli-diagnose	Disabled
cli-get	Enabled
cli-show	Enabled
cli-exec	Enabled
cli-config	Enabled

To enable permission to run CLI diagnostic commands after upgrading:

config system accprofile
    edit <name>
        set cli-diagnose enable
    next
end

Many diagnostic commands have privileged access. As a result, using them could unintentionally grant unexpected access or cause serious problems, so understanding the risks involved is crucial.