- 命令結構
#config 對策略，對象等進行配置
#get 查看相關對象的參數
#show 查看配置文件
#diagnose 診斷命令
#execute 常用的工具命令，如ping treacert,執行某條命令。
#exit 退出
#end 保存退出
2.常用命令
1、配置接口地址
FortiGate # config system interface
FortiGate (interface) # edit port1
FortiGate (port1) # set ip 192.168.8.99/24
FortiGate (port1) # end
2.配置靜態路由
FortiGate (static) # edit 1
FortiGate (1) # set device wan1
FortiGate (1) # set dst 10.0.0.0 255.0.0.0
FortiGate (1) # set gateway 192.168.57.1
FortiGate (1) # end
3.配置默認路由
FortiGate (1) # set gateway 192.168.57.1
FortiGate (1) # set device wan1
FortiGate (1) # end
4.添加地址
FortiGate # config firewall address
FortiGate (address) # edit clientnet
new entry 'clientnet' added
FortiGate (clientnet) # set subnet 192.168.1.0 255.255.255.0
FortiGate (clientnet) # end
5.添加ip池
FortiGate (ippool) # edit nat-pool
new entry 'nat-pool' added
FortiGate (nat-pool) # set startip 100.100.100.1
FortiGate (nat-pool) # set endip 100.100.100.100
FortiGate (nat-pool) # end
6.添加虛擬ip
FortiGate # config firewall vip
FortiGate (vip) # edit webserver
new entry 'webserver' added
FortiGate (webserver) # set extip 202.0.0.167
FortiGate (webserver) # set extintf wan1
FortiGate (webserver) # set mappedip 192.168.0.168
FortiGate (webserver) # end
7、配置上網策略
FortiGate # config firewall policy
FortiGate (policy) # edit 1
FortiGate (1)#set srcintf internal //源接口
FortiGate (1)#set dstintf wan1 //目的接口
FortiGate (1)#set srcaddr all //源地址
FortiGate (1)#set dstaddr all //目的地址
FortiGate (1)#set action accept //動作
FortiGate (1)#set schedule always //時間
FortiGate (1)#set service ALL //服務
FortiGate (1)#set logtraffic disable //日志開關
FortiGate (1)#set nat enable //開啟nat
end
8、配置映射策略
FortiGate # config firewall policy
FortiGate (policy) #edit 2
FortiGate (2)#set srcintf wan1 //源接口
FortiGate (2)#set dstintf internal //目的接口
FortiGate (2)#set srcaddr all //源地址
FortiGate (2)#set dstaddr FortiGate1 //目的地址，虛擬ip映射，事先添加好的
FortiGate (2)#set action accept //動作
FortiGate (2)#set schedule always //時間
FortiGate (2)#set service ALL //服務
FortiGate (2)#set logtraffic all //日志開關
end
9、把internal交換接口修改為路由口
確保關於internal口的路由、dhcp、防火牆策略都刪除
FortiGate # config system global
FortiGate (global) # set internal-switch-mode interface
FortiGate (global) #end
重啟
--------------------------------------
1、查看主機名，管理端口
FortiGate # show system global
2、查看系統狀態信息，當前資源信息
FortiGate # get system performance status
3、查看應用流量統計
FortiGate # get system performance firewall statistics
4、查看arp表
FortiGate # get system arp
5、查看arp豐富信息
FortiGate # diagnose ip arp list
6、清楚arp緩存
FortiGate # execute clear system arp table
7、 查看當前會話表
FortiGate # diagnose sys session stat 或 FortiGate # diagnose sys session full-stat；
8、 查看會話列表
FortiGate # diagnose sys session list
9、查看物理接口狀態
FortiGate # get system interface physical
10、查看默認路由配置
FortiGate # show router static
11、查看路由表中的靜態路由
FortiGate # get router info routing-table static
12、查看ospf相關配置
FortiGate # show router ospf
13、查看全局路由表
FortiGate # get router info routing-table all
-----------------------------------------------
1、查看HA狀態
FortiGate # get system ha status
2、查看主備機是否同步
FortiGate # diagnose sys ha showcsum
---------------------------------------------------
3.診斷命令：
FortiGate # diagnose debug application ike -1
---------------------------------------------------
execute 命令：
FortiGate #execute ping 8.8.8.8 //常規ping操作
FortiGate #execute ping-options source 192.168.1.200 //指定ping數據包的源地址 192.168.1.200
FortiGate #execute ping 8.8.8.8 //繼續輸入ping的目標地址，即可通過192.168.1.200的源地址執行ping操作
FortiGate #execute traceroute 8.8.8.8
FortiGate #execute telnet 2.2.2.2 //進行telnet訪問
FortiGate #execute ssh 2.2.2.2 //進行ssh 訪問
FortiGate #execute factoryreset //恢復出廠設置
FortiGate #execute reboot //重啟設備
FortiGate #execute shutdown //關閉設備