Technical Tip: How to verify if FortiGate SSH access is enabled
Description
This article describes that in FortiOS, the internal SSH client can be used from the command line.
This allows the testing of the functionality of FortiGate SSH access to itself.
This allows the testing of the functionality of FortiGate SSH access to itself.
Scope
FortiGate.
Solution
To use this feature, type the following command from the serial console or from Telnet:
execute ssh <admin_username@FGT_IPaddress> <port
In the above command, the SSH port number can be specified if it differs from the default value (#22).
The listening/open TCP port can be checked with the following command output:
diagnose sys tcpsock | grep -n :22 (if '22' is the listening port)
Output:
diagnose sys tcpsock | grep -n :2
57:0.0.0.0:22->0.0.0.0:0->state=listen err=0 socktype=2 rma=0 wma=0 fma=0 tma=0 inode=55331 process=277/wad
60:0.0.0.0:22->0.0.0.0:0->state=listen err=0 socktype=1 rma=0 wma=0 fma=0 tma=0 inode=47307 process=193/sshd
81:10.109.48.252:22->10.109.63.254:58554->state=established err=0 socktype=1 rma=0 wma=4928 fma=3264 tma=0 inode=4291015 process=1992/sshd
82:10.109.48.252:22->10.109.63.254:58555->state=established err=0 socktype=1 rma=0 wma=0 fma=0 tma=0 inode=4291051 process=1993/sshd
57:0.0.0.0:22->0.0.0.0:0->state=listen err=0 socktype=2 rma=0 wma=0 fma=0 tma=0 inode=55331 process=277/wad
60:0.0.0.0:22->0.0.0.0:0->state=listen err=0 socktype=1 rma=0 wma=0 fma=0 tma=0 inode=47307 process=193/sshd
81:10.109.48.252:22->10.109.63.254:58554->state=established err=0 socktype=1 rma=0 wma=4928 fma=3264 tma=0 inode=4291015 process=1992/sshd
82:10.109.48.252:22->10.109.63.254:58555->state=established err=0 socktype=1 rma=0 wma=0 fma=0 tma=0 inode=4291051 process=1993/sshd
Use the following command to check if SSH is enabled:
FGT # get system info admin ssh
SSH v2 is enabled on port 22
SSH is enabled on the following 3 interfaces:
lag1.admin
lag2-interne
mgmt
SSH hostkey DSA fingerprint = MD5:51:c7:58:3b:9e:bd:1b:a6:d0:6b:fe:62:0e:51:c3:a0
SSH hostkey RSA fingerprint = MD5:30:c1:60:63:41:71:21:0f:27:a2:81:98:0a:f0:d5:bd
SSH v2 is enabled on port 22
SSH is enabled on the following 3 interfaces:
lag1.admin
lag2-interne
mgmt
SSH hostkey DSA fingerprint = MD5:51:c7:58:3b:9e:bd:1b:a6:d0:6b:fe:62:0e:51:c3:a0
SSH hostkey RSA fingerprint = MD5:30:c1:60:63:41:71:21:0f:27:a2:81:98:0a:f0:d5:bd
Global settings verification for the admin port:
FGT # get system global
admin-concurrent : enable
admin-console-timeout: 0
admin-port : 80
admin-sport : 443
admin-ssh-grace-time: 120
admin-ssh-port : 22
admin-telnet-port : 23
admin-port : 80
admin-sport : 443
admin-ssh-grace-time: 120
admin-ssh-port : 22
admin-telnet-port : 23
Example of a 'self' SSH access:
Using remote Telnet or the ‘serial console’ (as below) to access FortiGate:
Using remote Telnet or the ‘serial console’ (as below) to access FortiGate:
FGT # get system admin status
username: admin
login local: console <----- Indicate from where the user is logged in.
login device: N/A
login remote: :0
login vdom: root
login access profile: super_admin
login started: 2017-01-18 13:27:07
current time: 2017-01-18 13:27:19
login local: console <----- Indicate from where the user is logged in.
login device: N/A
login remote: :0
login vdom: root
login access profile: super_admin
login started: 2017-01-18 13:27:07
current time: 2017-01-18 13:27:19
Then perform an SSH access and log in with another Admin username (with a prof_admin profile, if any):
FGT # execute ssh test@7.7.7.7
test@7.7.7.7's password:
Note that the '$' prompt replaced the '#' because the 'test' user belongs to the 'prof_admin' profile.
FGT $ get system admin status
username: test
login local: ssh
login device: internal:7.7.7.7:22
login remote: 7.7.7.7:1379
login vdom: root
login access profile: prof_admin
login started: 2026-04-02 09:44:46
current time: 2026-04-02 09:47:08
username: test
login local: ssh
login device: internal:7.7.7.7:22
login remote: 7.7.7.7:1379
login vdom: root
login access profile: prof_admin
login started: 2026-04-02 09:44:46
current time: 2026-04-02 09:47:08
