Fortimanager script syntax for multi vdom devices

[dtopoats]

Hello all... 

New to Fortinet and wanted to run some script syntax by the community. Need to implement some global settings on our Fgates via a FortManager script. Some of our gates are multi-vdom. So far I have this, below - have not tried it yet - just to see if I have it right before tripping over the syntax.  Thanks in advance! 

This would be for the multi vdom devices - l

config global
  config system global
    set admin-console-timeout 300
    set pre-login-banner enable
    set post-login-banner enable
    set admin-ssh-grace-time 60
    set admin-lockout-duration 300
    set admintimeout 5
    set admin-lockout-threshold 3
  next
  config system auto-install
    set auto-install-config disable
    set auto-install-image disable
  next

end

[smkml]

Hello @dtopoats ,

The configuration is good as long it able to install to FortiGate locally, it should be the same when using the scripts. Any typos or syntax error will cause it fail.

You may check below document for various example for the CLI scripts:

https://docs.fortinet.com/document/fortimanager/7.2.4/administration-guide/71780/cli-scripts 

[dtopoats]

Thanks smkml - actually took the "nexts" out - as those are not needed and will fail the script. Tested on a non multi-vdom unit - without the "config global" and it's fine. Will test a multi-vdom unit soon with what I have below

config global

  config system global
    set admin-console-timeout 300
    set pre-login-banner enable
    set post-login-banner enable
    set admin-ssh-grace-time 60
    set admin-lockout-duration 300
    set admintimeout 5
    set admin-lockout-threshold 3

end

config global
  config system auto-install
    set auto-install-config disable
    set auto-install-image disable

end

[dingjerry_FTNT]

Hi @dtopoats ,

Something incorrect or not appropriate:

1) We need "config | end" as a pair.  So for "config system global", we need "end", not "next".  The same for "config system auto-install".

2) There are some commands are using default values, no need to put them in the script:

    set admintimeout 5
    set admin-lockout-threshold 3

    set auto-install-config disable
    set auto-install-image disable

[Katoomba]

I want to use the same CLI script on both non VDOM (disabled) and VDOM (enabled) Fortigates.

On a VDOM disabled Fortigate, the command would be:

diagnose autoupdate versions

On a VDOM enabled Fortigate, the commands would be:

config global
diagnose autoupdate versions

Is there any way to write a CLI script that can run commands on both types of Fortigates where some have VDOMs enabled and some have VDOMs disabled? How? Or, does this mean that we have to have two separate CLI scripts, one for each VDOM type of VDOM setup?

PS: I already know I can write a TCL script that will handle both types of VDOM configurations. I don't want to use TCL. I want to know if I can do it with a plain vanilla CLI script.

[dingjerry_FTNT]

Hi @Katoomba ,

You may need to use 2 CLI scripts for non-VDOM and multi-VDOM FGTs.