Skip to main content
Shagma
Shagma
New Member
September 30, 2015
Solved

Limited CLI commands available

  • September 30, 2015
  • 2 replies
  • 6413 views

Yesterday I was at a customer who had a transparent setup for UTM filtering.

I am not very familiar with transparent configurations, but the FGTs only had a few commands available to be run. For instance, 'diagnose' and 'get test' amongst others, were not available.

 

What could be the cause of this? They were running FW 5.2.4 on two 310Bs in HA. The admin account had super_admin rights.

 

Another question: A previous administrator had activated Web-Filtering on an inbound rule. What can be achieved from this? I don't understand how that would work.

    Best answer by Jupiter_FTNT

    you need to go inside vdom  or  global to access the full CLI if the FGT has vdom enable.

    2 replies

    Jupiter_FTNT
    Staff
    Jupiter_FTNTAnswer
    Staff
    October 1, 2015

    you need to go inside vdom  or  global to access the full CLI if the FGT has vdom enable.

    Shagma
    ShagmaAuthor
    New Member
    October 2, 2015

    Jupiter_FTNT wrote:

    you need to go inside vdom  or  global to access the full CLI if the FGT has vdom enable.

    I am unfamiliar with VDOM operation.

     

    Is this accomplished by:

    config vdom

    edit vdom_name

     

    Or is there a separate root vdom management IP?

    emnoc
    emnoc
    New Member
    October 2, 2015

    1st you need to determine if your running vdoms to begin with, but a get system statsus should full-fill that purpose.

     

    (e.g  abbr output )

     

    Virtual domains status: 2 in NAT mode, 4 in TP mode Virtual domain configuration: enable

     

     

    2nd,

     

    What could be the cause of this? They were running FW 5.2.4 on two 310Bs in HA. The admin account had super_admin rights.  

     

    That doesn't mean to  much, what rigths permissions does the  "super_admin"  profile have? Was it changed to remove Read/Write access? ( basically look at the permissions in that account )

     

    3rd

     

    Another question: A previous administrator had activated Web-Filtering on an inbound rule. What can be achieved from this? I don't understand how that would work.

     

    Maybe it's a typo or incorrect policy or traffic is indeed using this rule in another direction. You can enable logging and monitor the rule for activity over the course of 1-2 weeks and see if anything matches it.

     

    IMHO: If your taking over an existing network, it's probably best to re-audit ALL rules for dupes, and poor rules or sequences.

     

    Terms & ConditionsAccessibility statement