Technical Tip: How to grant read-only Administrators ping commands

Description

This article describes how to permit read-only Administrators to execute ping commands.

Scope

FortiGate v7.4.0 or above.

Solution

Read-only administrators do not have enough rights to run ping commands for basic network connectivity troubleshooting.

FortiGate-100F (Read_only_access) # show
FortiGate-100F (Read_only_access) # show
 config system accprofile
	edit "Read_only_access"
		set secfabgrp read
		set ftviewgrp read
		set authgrp read
		set sysgrp custom
		set netgrp read
		set loggrp read
		set fwgrp read
		set vpngrp read
		set utmgrp read
		set wifi read
		set system-diagnostics disable
          config sysgrp-permission
           set admin read
           set upd read
           set cfg read
          end
    next
 end

FortiGate-100F (read_admin) # show system admin
config system admin
  edit "read_admin"
  set accprofile "Read_only_access"
  set vdom "root"
  set password ENC PB2nQFXXXX
next
end

After logging in to FortiGate GUI using the read-only admin, the following permissions are shown:

FortiGate-100F $
config      Configure object.
get         Get dynamic and system information.
show        Show configuration.
execute     Execute static commands.
alias       Execute alias commands.
exit        Exit the CLI.

FortiGate-100F $ execute
dhcp               dhcp
dhcp6              dhcp6
extender           extender
fsso               Fortinet Single Sign-On.
log                log
speed-test         A bandwidth measuring tool.
speed-test-dynamic A bandwidth measuring tool for ipsec tunnel.
speed-test-server  speed-test-server
ssh                Simple SSH client.
ssh6               Simple IPv6 SSH client.
tac                tac
telnet             Simple telnet client.
vpn                vpn

However, in some cases, the read-only admin should test network connectivity using the ping commands. To accomplish this, the following permissions need to be configured under the system accprofile:

"set mnt read" 

FortiGate-100F (Read_only_access) # show
 config system accprofile
    edit "Read_only_access"
      set sysgrp custom
      config sysgrp-permission
        set mnt read < ---
      end
    next
  end

Now, using this profile, the administrator has the following options:

FortiGate-100F $ execute
backup            backup
dhcp              dhcp
dhcp6             dhcp6
extender          extender
fsso              Fortinet Single Sign-On.
log               log
ping              PING command.  < ---
ping-options      ping-options   < ---
ping6             PINGv6 command. [Take 0-100 arg(s)] < ---
ping6-options     ping6-options  < ---
speed-test        A bandwidth measuring tool.
speed-test-dynamic A bandwidth measuring tool for ipsec tunnel.
speed-test-server speed-test-server
ssh               Simple SSH client.
ssh-options       SSH options.
ssh6              Simple IPv6 SSH client.
ssh6-options      IPv6 SSH options.
tac               tac
telnet            Simple telnet client.
telnet-options    telnet-options
traceroute        Traceroute {IP|hostname}.
traceroute-options traceroute-options
tracert6          Traceroute for IPv6. [Take 0-32 arg(s)]
usb-device        usb-device
usb-disk          usb-disk
vpn               vpn

FortiGate-100F $ execute ping < ---
ping            PING command.
ping-options    ping-options
ping6           PINGv6 command. [Take 0-100 arg(s)]
ping6-options   ping6-options

FortiGate-100F $ execute ping 8.8.8.8
PING 8.8.8.8 (8.8.8.8): 56 data bytes

64 bytes from 8.8.8.8: icmp_seq=0 ttl=116 time=4.6 ms
64 bytes from 8.8.8.8: icmp_seq=1 ttl=116 time=4.5 ms
64 bytes from 8.8.8.8: icmp_seq=2 ttl=116 time=4.5 ms
64 bytes from 8.8.8.8: icmp_seq=3 ttl=116 time=4.5 ms
64 bytes from 8.8.8.8: icmp_seq=4 ttl=116 time=4.6 ms

--- 8.8.8.8 ping statistics ---

5 packets transmitted, 5 packets received, 0% packet loss
round-trip min/avg/max = 4.5/4.5/4.6 ms