FortiGate cheatsheet FortiOS 7.4

[prageethmk]

Here you can find all important FortiGate CLI commands for the operation and troubleshooting of FortiGates with FortiOS 7.4. 

System

General System Commands
get system status	General system information
exec tac report	Generates report for support
config, get, show, tree set, unset, append, unselec	Configuration commands
<command> ? or tab	Use ? or tab in CLI for help
<command> | grep [-f]	Grep command to filter outputs
diag debug cli 7	Shows webGUI changes in CLI
Process Information
get system performance status	General performance infos
diag sys top [sec] [number] Control + C to stop command	Process list  Sort with P (CPU) / M (Memory)
diag debug crashlog read	Crash log

Network Network Interface Information
diag ip address list	List of IPs on FGT interfaces
diag firewall iplist list	List of IPs on VIP
diag firewall ippool list	List of IP on pools
diag netlink interface list	List IF with MTU & device ID

Network Troubleshooting
get hardware nic <interface>	Interface Information
diag ip arp list / get system arp	ARP table
exec clear system arp table	Clears ARP table
exec ping x.x.x.x exec ping-options <option>	Ping utility
exec traceroute x.x.x.x  exec traceroute-options <option>	Traceroute utility
exec telnet x.x.x.x <port> exec telnet-options <option>	Telnet utility

Integrated Iperf Utility

diag traffictest server-intf                                                      Iperf test directly run from FortiGate  diag traffictest client-intf  diag traffictest port [port]  diag traffictest run -c [public_iperf_server_ip]  General Routing Troubleshooting  get router info routing-table all  Routing table  get router info routing-table details x.x.x.x  Shows Routing decision for specified Destination-IP  get router info routing-table database  Routing table with inactive routes  get router info kernel  Forwarding information base  diag firewall proute list  List of policy-based routes  diag ip rtcache list  List of route cache  get router info protocols  Overview of dynamic routing protocol configuration  exec router restart  Restart of routing process  diag sys link-monitor status/interface/launch  Shows link monitor status / per interface / for WAN LLB   High Availability HA General  exec ha manage [index] [admin]  Jump to cluster member  get sys ha status  Information about HA status  diag sys ha history read  Details about past HA events  diag sys ha dump-by vcluster  Show cluster member uptime  diag sys ha reset-uptime  Reset cluster member uptime  diag debug appl hatalk -1 diag debug appl hasync -1  Debugging of HA-Talk/-Sync protocol  exec ha ignore-hardware-revision status / enable / disable  Set ignore status for different HW revisions  exec ha failover status  View failover status  exec ha failover set <cluster_id>  Device stays in failover state regardless of condition. Triggers a HA failover on master device  Cluster Synchronisation diag sys ha checksum cluster  Show config checksums of all cluster member  diag sys ha checksum show [vdom]  Detailed config checksum for a VDOM  diag sys ha checksum recalculate  Recalculation of config checksums  Traffic Processing General Debugging diag debug appl [appl] [level]  Realtime debugger for different applications  diag test appl [appl] [test_level]  Monitor proxy operations  diag debug console timestamp enable  Enables timestamp in console  diag debug [enable/disable]  Enables/disables output for “diag debug” command  diag debug reset  Reset debug levels  Firewall Session Troubleshooting diag sys session filter  Filter for session list  diag sys session list (expect)  Lists all (or expected) sessions  diag sys session clear  Clear all / filtered sessions  diag sys session stat  Session and memory statistics, drops, clashes  diag firewall iprope clear 100004 [<id>]  Resets counter for all  Packet Sniffer diag sniffer packet any/<if> ‘<filter>’<verbose]><count> <timestamp>  Packet sniffer. Use filters! Verbose levels 1-6 for different output  GUI: Network > Diagnostics > Packet Capture  Packet Capture in WebUI.  Flow Trace diag debug flow filter <ilter>  Use filters to narrow down trace results  diag debug flow show iprop en diag debug flow show fun en diag debug flow trace start [count]  Debug command for traffic flow  GUI: Network > Diangostics > Debug Flow  Flow tracis newly available in WebUI.

[Mrinmoy · Accepted solution]

Also, it is always better to refer to docs.fortinet.com for OS-specific commands

https://docs.fortinet.com/document/fortigate/7.4.0/cli-troubleshooting-cheat-sheet/420966/cli-troubl...