Execute commands

Execute commands

Execute commands are used for the tasks listed below. These commands are run from the base context.

Backup
Factory Reset
License
Ping and traceroute
SSH
Reboot and shutdown
Restore image
Restore config
- Important: Any configuration that isn’t explicitly defined in the backup configuration will be removed upon restore. The one exception is admin user settings (which are left untouched). All other config (interface, route, etc) will be reset to default and then have the configuration present in the provided config applied.
- All methods of restore will first create a back-up configuration prior to applying the new config.

Available commands

Command

Description

execute enter-shell

Enters a shell to interact with the appliance more directly. See shell commands for details.

execute ha failover

Force a failover to the other member of this HA pair

execute help

Lists the available commands under execute

execute db-shell

Enters the database shell

execute sensors list

Show sensor information.

execute time <time>

Set the system system time (hh:mm:ss format, hh: 0-23 mm: 0-59 ss: 0-59).

execute date <date>

Set the system date (yyyy-mm-dd format, yyyy: 2023, mm: 1-12, dd: 1-31).

execute reset

Reset configuration and disk partition to factory default

execute factoryreset all-shutdown

Reset to factory default and shutdown

execute restore database local <filename>

Restore database using a local database backup

execute restore database scp <host> <username> <password> <backup-path>

Restore database using a remote database backup downloaded via scp

Argument descriptions:

<host> Remote host

<username> Remote username

<password> Remote password

<backup> Path to database backup on remote host (.gz)

execute factoryreset all-settings

Reset to factory default and reboot.

execute tcpdump [-v] [-c=<count>] [-G=<seconds>] [-i=<port>] [-Q=<direction>] [-s=<snaplen>] [-w=<file>] [-x | -xx | -X | -XX] [<filter>...]

Sniff packets on the specified interface.

Available options:

`[<filter>...]`	Sniffer filter
`-c=<count>`	Maximum number of packets to capture
`-G=<seconds>`	Maximum duration in seconds to capture
`-i=<port>`	Port to sniff packets on
`-Q=<direction>`	Packet direction(s) to capture [in\|out\|inout]
`-s=<snaplen>`	Number of bytes to snarf from each packet
`-v, --verbose`	Enable verbose output
`-w=<file>`	Write captured packets to specified file
`-x`	Display packet data (minus link level header) in hex
`-X`	Display packet data (minus link level header) in hex and ASCII
`-xx`	Display packet data (including link level header) in hex
`-XX`	Display packet data (including link level header) in hex and ASCII
`help`	Display usage

Execute a tcpdump. All options correspond with their tcpdump equivalents. Additionally, file specified via –w only uses the filename portion (all files are stored in the user’s home directory).

Backup

execute backup config local

Backs up the current system configuration locally to disk (/bsc/backups/).

execute backup config ftp [<remote filename>] [<ftp server:port>] [<username>] [<password>]

Backs up the current system configuration via FTP to the remote destination using the provided username and password.

The port option may be omitted if the destination uses the default FTP port (21)

execute backup config scp [<remote filename>] [<scp server:port>] [<username>] [<password>]

Backs up the current system configuration remotely via SCP to the destination provided.

The port option may be omitted if the destination uses the default SSH port (22)

execute backup config tftp [<remote filename>] [<tftp server>]

Backs up the current system configuration to the specified TFTP destination

License

execute license add [<license>]

Add the raw license string to the system

execute license import tftp [<remote host>] [<remote file>]

Import the specified remote license file on the specified tftp host

execute license import scp [<remote file>] [<remote host>] [<username>] [<password>]

Import the specified remote license file from the specified host via SCP

PING & Traceroute

execute ping [<host>]

PING the specified host

execute ping6 [<host>]

PING the specified IPv6 host

execute traceroute [<host>]

Trace the route between this system and the specified host

Shutdown & Reboot

execute reboot

Reboots the system

execute shutdown

Shuts down the system

Restore

execute restore image scp [<remote out file>] [<host>] [<username>] [<password>]

Install the .out image located on the specified remote host. Image is downloaded via SCP.

Note: This command is used for upgrading the software on the system.

execute restore image ftp [<remote out file>] [<host>] [<username>] [<password>]

Install the .out image located on the specified remote host. Image is downloaded via FTP.

Note: This command is used for upgrading the software on the system.

execute restore image tftp [<remote out file>] [<host>]

Install the .out image located on the specified remote host. Image is downloaded via TFTP.

Note: This command is used for upgrading the software on the system.

execute restore backup local <hostname> <date>

Restore a local configuration backup

Arguments

Backup to restore

<date>

Date of backup. Format is yyyy-mm-dd (2023-12-31)

execute restore backup scp <host> <user> <path> <date>

Restore a remote backup via scp

Arguments

<host>

Remote host

<user>

Remote user

<path>

Remote directory containing back-up files

<date>

Date of backup. Format is yyyy-mm-dd (2023-12-31)

execute restore config local [<local config backup>]

Restore the configuration stored locally. Tab completion can be used to list the available configuration backups

execute restore config scp [<remote file>] [<host>] [<username>] [<password>]

Restore the configuration stored on the remote host at the specified location. Configuration downloaded via SCP

execute restore config ftp [<remote file>] [<host>] [<username>] [<password>]

Restore the configuration stored on the remote host at the specified location. Configuration downloaded via FTP

execute restore config tftp [<remote file>] [<host>]

Restore the configuration stored on the remote host at the specified location. Configuration downloaded via TFTP

execute restore legacy-migrate [COMMAND]

Used for migrating CentOS configurations to new FortiNAC-OS platform. Important: Do not use without first reviewing the CentOS to FortiNAC-OS Migration documentation in the Documentation Library.

Available options:

local	Import legacy config from a local bundle
remote	Import legacy config from a remote system

Service

execute service restart <service>...

Restart a specified service

<service>...

Service =

nac: nac.service - NAC Management Process

naccontrol: NAC Control Service

nacapplication: NAC Application Service

nacprobe: NAC Probe Service

p0f: Passive OS fingerprinting service

dhcpd: DHCPv4 Server Daemon

mysqld: MariaDB database server

apache2: Apache HTTP Server

named: DNS

execute service start <service>...

Start a specified service

<service>...

Service =

nac: nac.service - NAC Management Process

naccontrol: NAC Control Service

nacapplication: NAC Application Service

nacprobe: NAC Probe Service

p0f: Passive OS fingerprinting service

dhcpd: DHCPv4 Server Daemon

mysqld: MariaDB database server

apache2: Apache HTTP Server

named: DNS

execute service status <service>...

Retrieve status of a specified service

<service>...

Service =

nac: nac.service - NAC Management Process

naccontrol: NAC Control Service

nacapplication: NAC Application Service

nacprobe: NAC Probe Service

p0f: Passive OS fingerprinting service

dhcpd: DHCPv4 Server Daemon

mysqld: MariaDB database server

apache2: Apache HTTP Server

named: DNS

execute service stop <service>...

Stop a specified service

<service>...

Service =

nac: nac.service - NAC Management Process

naccontrol: NAC Control Service

nacapplication: NAC Application Service

nacprobe: NAC Probe Service

p0f: Passive OS fingerprinting service

dhcpd: DHCPv4 Server Daemon

mysqld: MariaDB database server

apache2: Apache HTTP Server

named: DNS

SQL

execute sql initialize

Initializes the FortiNAC database. WARNING: All data written to the database will be erased. Consult Fortinet support before running this command.

SSH

execute ssh [<user@host>]

SSH to the specified host as the specified user

execute ssh-known-hosts remove-host [<host>]

Remove the specified known host fingerprint

execute ssh-known-hosts remove-all

Removes all the SSH host fingerprints from the known hosts

execute ssh-authorized-keys add <type> <hash> <comment>

Add the specified public key string to the authorized hosts

<type>

Key type: ssh-ed25519, ssh-rsa, ssh-dss, ecdsa-sha2-nistp256, ecdsa-sha2-nistp384, ecdsa-sha2-nistp521

<hash>

Base64 hash

Comment

execute ssh-authorized-keys import scp <file path> <host> <username> <password>

Import the specified public key from a specified host, using the specified credentials, into the user's authorized hosts via scp

execute ssh-authorized-keys list

Displays the user's authorized hosts

execute ssh-authorized-keys remove <host>

Removes any authorized host keys that match the specified host. Tab completion of the <host> is supported.

execute ssh-known-hosts add [current-user|nac] <user> <ip>

Add a ssh host fingerprint to known hosts

[current-user|nac]

"current-user" for your known hosts, or "nac" for the FortiNAC system's known hosts

<user>

Remote host user

<ip>

Remote host ip / hostname

execute ssh-known-hosts remove-all [current-user|nac]

Remove all ssh host fingerprints from known hosts

[current-user|nac]

"current-user" for your known hosts, or "nac" for the FortiNAC system's known hosts

execute ssh-known-hosts remove-host [current-user|nac] <host>

Remove the specified host fingerprint from known hosts

[current-user|nac]

"current-user" for your known hosts, or "nac" for the FortiNAC system's known hosts

<host>

Host to remove

execute ssh-known-hosts show [current-user|nac]

Display fingerprints from known hosts

[current-user|nac]

"current-user" for your known hosts, or "nac" for the FortiNAC system's known hosts

Disk

execute disk checkhealth <partition>

Perform a read-only filesystem check for errors on the specified partition

execute disk list

List partitions and mountpoints

execute disk scan <partition>

Perform a (fsck) filesystem check on the specified partition

Execute commands

Execute commands are used for the tasks listed below. These commands are run from the base context.

Backup

Factory Reset

License

Ping and traceroute

SSH

Reboot and shutdown

Restore image

Restore config

Important: Any configuration that isn’t explicitly defined in the backup configuration will be removed upon restore. The one exception is admin user settings (which are left untouched). All other config (interface, route, etc) will be reset to default and then have the configuration present in the provided config applied.
All methods of restore will first create a back-up configuration prior to applying the new config.

Available commands

Command

Description

execute enter-shell

Enters a shell to interact with the appliance more directly. See shell commands for details.

execute ha failover

Force a failover to the other member of this HA pair

execute help

Lists the available commands under execute

execute db-shell

Enters the database shell

execute sensors list

Show sensor information.

execute time <time>

Set the system system time (hh:mm:ss format, hh: 0-23 mm: 0-59 ss: 0-59).

execute date <date>

Set the system date (yyyy-mm-dd format, yyyy: 2023, mm: 1-12, dd: 1-31).

execute reset

Reset configuration and disk partition to factory default

execute factoryreset all-shutdown

Reset to factory default and shutdown

execute restore database local <filename>

Restore database using a local database backup

execute restore database scp <host> <username> <password> <backup-path>

Restore database using a remote database backup downloaded via scp

Argument descriptions:

<host> Remote host

<username> Remote username

<password> Remote password

<backup> Path to database backup on remote host (.gz)

execute factoryreset all-settings

Reset to factory default and reboot.

execute tcpdump [-v] [-c=<count>] [-G=<seconds>] [-i=<port>] [-Q=<direction>] [-s=<snaplen>] [-w=<file>] [-x | -xx | -X | -XX] [<filter>...]

Sniff packets on the specified interface.

Available options:

`[<filter>...]`	Sniffer filter
`-c=<count>`	Maximum number of packets to capture
`-G=<seconds>`	Maximum duration in seconds to capture
`-i=<port>`	Port to sniff packets on
`-Q=<direction>`	Packet direction(s) to capture [in\|out\|inout]
`-s=<snaplen>`	Number of bytes to snarf from each packet
`-v, --verbose`	Enable verbose output
`-w=<file>`	Write captured packets to specified file
`-x`	Display packet data (minus link level header) in hex
`-X`	Display packet data (minus link level header) in hex and ASCII
`-xx`	Display packet data (including link level header) in hex
`-XX`	Display packet data (including link level header) in hex and ASCII
`help`	Display usage