Description
This article describes how to use the automated scripting on FortiGate.
Solution
In FortiOS it is possible to configure auto-scripts and this feature can be used for various purposes.
Important note:
The auto-script output is stored in the RAM, so if you run multiple scripts with a maximum of default 10MB (set output-size), please calculate and monitor the RAM usage. !!! Improper use of the auto-script may trigger a conserve mode !!!
Note:
If the output-size is exceeded, the script will stop. Consider the auto-script as a temporary installation only, it is good for time based troubleshooting.
CLI example to send a backup to a TFTP server:
#config system auto-script
edit "backup"
set interval 120 <----- Interval of time in seconds to execute the task.
set repeat 0 <----- Time of repeats, 0 means always. Default is 1.
set start auto
set script "execute backup config ftp backup.conf 10.10.10.2 test test"
next
end
whereas in this example:
- 10.10.10.2 is the IP of the FTP server.
- backup.conf is the name of the file.
- test/test is the user and password of the FTP.
CLI example to send a backup to FTP server in FortiGates with VDOMs:
# config system auto-script
edit "backup"
set interval 120
set repeat 0
set start auto
set script "
# config global
# execute backup config ftp backup.conf 10.10.10.2 test test"
next
end
where:
- 10.10.10.2 is the IP of the FTP server.
- backup.conf is the name of the file.
- test/test is the user and password of the FTP.
Add multiple CLI commands in the CLI script.
For example if you want to check the generic status output from the CLI like
#get system status
#get system performance status
FGT # config system auto-script
FGT (auto-script) # edit "status"
FGT (status) # set interval 300
FGT (status) # set repeat 0
FGT (status) # set start auto
FGT (status) # set script " <----- Press enter key here add first command.
> get system status <----- Press enter key here and add second command in next line.
> get system performance status" <----- Make sure that the last command ends with double quotation mark. Once double quotation mark is added, it will redirect to the command prompt.
FGT (status) # sh
# config system auto-script
edit "status"
set interval 120
set repeat 0
set start auto
set script "
# get system status
# get system performance status
"
next
end
To check the script output stored in the file.
From GUI:
Go to System -> Advanced -> Scheduled Script.
Select the 'Download' button from the 'Status' field for the selected script and Open the file to read the output.
Note: from FortiOS 6.2.2 the System > Advanced is removed, you can only see the script scheduled via CLI. From 6.2.0 automation action is introduced as an alternative for auto-script
From CLI.
To view results of the script named 'status' (with no VDOMs)
To control the auto-scripts in other ways, if a restart is needed for example:
To get an FSSO user list every 5 seconds for a maximum size of 100MB, filtered for the IP 172.16.17.132
From CLI.
To view results of the script named 'status' (with no VDOMs)
# exec auto-script result status
Script status output:
########## script name: status ##########
========== #1, 2019-10-01 14:24:04 ==========
FGT $ get system status
Version: FortiGate-100D v6.2.1,build0932,190716 (GA)
Virus-DB: 72.00005(2019-10-01 03:19)
Extended DB: 1.00000(2018-04-09 18:07)
... output continues ...
To view results of the script named “status” (with VDOMs - enter it in global)
# config global
# exec auto-script result status
To control the auto-scripts in other ways, if a restart is needed for example:
# exec auto-script start “name”Other examples:
# exec auto-script stop “name” or stopall
To get an FSSO user list every 5 seconds for a maximum size of 100MB, filtered for the IP 172.16.17.132
# config system auto-scriptTo get a session list every 10 seconds for the IP 10.10.10.48
edit "firewall-user-list"
set interval 5
set repeat 0
set script "diag firewall auth list | grep 172.16.17.132 -A 7"
set output-size 100
next
edit "auth-user-list"
set interval 5
set repeat 0
set script "diag debug auth fsso list | grep 172.16.17.132"
set output-size 100
next
end
# exec auto-script start firewall-user-list
# exec auto-script start auth-user-list
# config system auto-script
edit "session-list"
set interval 5
set repeat 0
set script "diag sys session filter src 10.10.10.48
# diag sys session list"
set output-size 100
next
end
