FortiGate CLI provides powerful troubleshooting and operational capabilities that are often faster and more detailed than the GUI. This guide covers the most important commands used by network and security administrators.
get system status get system performance status get system interface get system ha status get system admin get system global show full-configurationUsage:
show system interface diagnose ip address list get system arp diagnose ip arp list get system route get router info routing-table all get router info routing-table details execute ping 8.8.8.8 execute ping-options source port1 execute traceroute 8.8.8.8 diagnose sys tcpsock diagnose sys udpsoxkUsage:
get router info routing-table all get router info routing-table details get router info routing-table database get router info bgp summary get router info bgp neighbor get router info ospf neighbor get router info ospf database get router info rip databaseUsage:
get firewall policy diagnose firewall iprope list diagnose firewall iprope lookup \ src-ip 10.10.10.10 \ dst-ip 8.8.8.8 \ proto 6 \ dport 443 get firewall address get firewall service get firewall address-group get firewall service-group diagnose user group list diagnose user listUsage:
diagnose sys session list diagnose sys session filter src 10.0.0.10 diagnose sys session filter dst 8.8.8.8 diagnose sys session filter dport 443 diagnose sys session filter proto 6 diagnose sys session clear diagnose sys session clear src 10.0.0.10Usage:
get firewall vip get firewall vipgrp get firewall nat diagnose firewall nat list diagnose firewall nat list 192.168.1.10 diagnose firewall iprope listUsage:
get vpn ipsec tunnel summary get vpn ipsec tunnel list diagnose vpn tunnel list diagnose vpn ike gateway list diagnose vpn ipsec sa list diagnose vpn ike log-filter diagnose debug reset diagnose debug application ike -1 diagnose debug enable diagnose debug disableUsage:
get vpn ssl settings get vpn ssl monitor diagnose vpn ssl list diagnose sniffer packet ssl.root "port 443" 4 diagnose test sslvpn listUsage:
get webfilter profile get webfilter fortiguard-category diagnose webfilter test url google.com get ips sensor diagnose ips packet list diagnose test application ipsmonitor 1 get application list diagnose app filter listUsage:
execute reboot execute shutdown execute restore config execute factoryreset update-now diagnose autoupdate versions diagnose hardware sysinfo memory diagnose hardware sysinfo cpu diagnose hardware sysinfo disk diagnose hardware deviceinfo diagnose sys top diagnose sys watchdogUsage:
execute log display execute log filter category execute log filter level execute log filter srcip execute log filter dstip execute log filter service execute log filter action execute log display diagnose log test 8 diagnose log disk freeUsage:
get system performance status get router info routing-table all diagnose sys session list execute ping 8.8.8.8 execute traceroute 8.8.8.8 diagnose vpn tunnel list diagnose firewall iprope lookup diagnose sys top diagnose sniffer packet any "host 8.8.8.8" 4
FortiGate CLI remains the fastest method to troubleshoot routing, VPN, NAT, firewall policies, user authentication, IPS, and performance-related issues. Mastering these commands significantly reduces troubleshooting time and improves operational efficiency.
Author: Nageshwar Rao
Network Security Engineer | Cyber Security Consultant