|
When a TCL script is run from the FortiManager on a FortiGate, some commands send a query from the FortiGate. These queries mostly need a reply y/n, for example:
This operation will reboot the system !
Do you want to continue? (y/n)
In this case, the script needs to reply to this query to continue. To show what happens, the command execute reboot was used as it is a command that will reply with a query, and it is easy to verify.
In the following script example, the first reply to the query is 'n', and the script continues, and then the reply is 'y', where the device will reboot. The example script was used on the FortiGate with vdoms enabled.
To enable Scripting, configure the following CLI settings on the FortiManager:
FMG # config system admin setting
(setting) set show_schedule_script enable
(setting) set show_automatic_script enable
(setting) set show_tcl_script enable
(setting) end
In the GUI, navigate to Device manager -> Scripts -> CLI/TCL script and select 'Create new'
Create a TCL script using the following text:
#!
proc do_cmd {cmd} {
puts [exec "$cmd\n" "# " 20]
}
######
do_cmd "config vdom"
do_cmd "edit root"
do_cmd "config sys interface"
do_cmd "edit port2"
do_cmd "set vdom root"
do_cmd "set ip 3.2.2.2/32"
do_cmd "set allowaccess ping"
do_cmd "next"
do_cmd "end"
do_cmd "end"
do_cmd "config global"
do_cmd "get system status"
do_cmd "execute reboot"
do_cmd "n"
## First reply n to the query
## This operation will reboot the system
## Do you want to continue? (y/n)
## The script continues to configure the device to show the response has taken affect ie no reboot
do_cmd "end"
do_cmd "config vdom"
do_cmd "edit root"
do_cmd {config system interface}
do_cmd {edit "Mytest"}
do_cmd {set vdom "root"}
do_cmd {set ip 192.168.7.1 255.255.255.0}
do_cmd {set allowaccess ping}
do_cmd "set interface port3"
do_cmd "set vlanid 111"
do_cmd "next"
do_cmd "end"
do_cmd "end"
do_cmd "config global"
do_cmd "get system status"
do_cmd "execute reboot"
do_cmd "y"
## when the reply is yes the FGT reboots
## This time the response on the query is y
##This operation will reboot the system
##Do you want to continue? (y/n)
To verify the outcome of this script, navigate in the GUI to System Settings -> Task Monitor, find the script, and View Script Execution History:
-------Executing time: Fri Oct 24 14:25:56 2025-----------
Starting log (Run on device)
config vdom
FGVM02TM22000891 (vdom) #
edit root
current vf=root:0
FGVM02TM22000891 (root) #
config sys interface
FGVM02TM22000891 (interface) #
edit port2
FGVM02TM22000891 (port2) #
set vdom root
FGVM02TM22000891 (port2) #
set ip 3.2.2.2/32
FGVM02TM22000891 (port2) #
set allowaccess ping
FGVM02TM22000891 (port2) #
next
FGVM02TM22000891 (interface) #
end
FGVM02TM22000891 (root) #
end
FGVM02TM22000891 #
config global
FGVM02TM22000891 (global) #
get system status
Version: FortiGate-VM64-KVM v7.2.10,build1706,240918 (GA.M)
.... Output was cut
Last reboot reason: warm reboot
FGVM02TM22000891 (global) #
execute reboot
This operation will reboot the system !
Do you want to continue? (y/n)
n^J
FGVM02TM22000891 (global) #
FGVM02TM22000891 (global) #
end
FGVM02TM22000891 #
config vdom
FGVM02TM22000891 (vdom) #
edit root
current vf=root:0
FGVM02TM22000891 (root) #
config system interface
FGVM02TM22000891 (interface) #
edit "Mytest"
FGVM02TM22000891 (Mytest) #
set vdom "root"
FGVM02TM22000891 (Mytest) #
set ip 192.168.7.1 255.255.255.0
FGVM02TM22000891 (Mytest) #
set allowaccess ping
FGVM02TM22000891 (Mytest) #
set interface port3
FGVM02TM22000891 (Mytest) #
set vlanid 111
FGVM02TM22000891 (Mytest) #
next
FGVM02TM22000891 (interface) #
end
FGVM02TM22000891 (root) #
end
FGVM02TM22000891 #
config global
FGVM02TM22000891 (global) #
get system status
Version: FortiGate-VM64-KVM v7.2.10,build1706,240918 (GA.M)
....... Output was cut
System time: Fri Oct 24 05:26:19 2025
Last reboot reason: warm reboot
FGVM02TM22000891 (global) #
execute reboot
This operation will reboot the system !
Do you want to continue? (y/n)
y^J
Possible debugs to take.
On FortiGate:
diagnose debug cli 8
diagnose debug application fgfm 255
diagnose debug console timestamp enable
diagnose debug enable
On FortiManager:
diagnose debug application depmanager 255
diagnose debug application fgfm 255 <device name>
diagnose debug timestamp enable
diagnose debug enable
|
