admin User only with Reboot/Shutdown

[salsero_gallego]

Hi all We have around 100 remote offices where we have basic local IT stuff. The Firiewall Management is central in my office. This admins need access to there local Firewall for reboot or shutdown the Firewall. NOT MORE. NO System changes, NO policy changes ... Only reboot/shutdown This regarding local work in different timezones. I don' t like to rest in my office and do middle in the night to shutdown of the Fortigate regarding a power work in a remote office. The local stuff must be able to shutdown the box local, without config possibility. Where I can configure/add a Admin profile ONLY with the possibility to reboot or shutdown a Fortigate. Thanks for your help.

[ede_pfau]

That' s not possible with a restricted admin profile. You need the " System Configuration" category set as Read-Write and that opens up a lot of menu items (e.g. switching from NAT/routing mode into transparent mode). Probably you can shutdown the FGTs via FortiManager but I don' t have experience with FM - I only assume it' s a basic requirement included.

[rwpatterson]

Have them pull the power cords.

[salsero_gallego]

Have them pull the power cords.

Sorry, no way !! Here a comment from the Fortinet Support after I have two time lost the configuration in two different Fortigates. This after power off without shutdown. ######### The flash file system of FWF60C is sensitive as they use nand flash. It is likely to get corrupted in cases where a graceful shutdown is not performed before switching off the units. Over a period of time, there are chances of development of bad blocks. Then the flash needs to be scanned from the BIOS. After scan flash, please remember to format flash before load OS. ######### => Shutdown is recommended !!

[FortiRack_Eric]

the alternative is to create a batch job with plink (ssh command line) and encrypt the batch job.

[rwpatterson]

Schedule a daily reboot and remove after a day?

[salsero_gallego]

Schedule a daily reboot and remove after a day?

Sorry, I don' t understand your respond ... The local IT people need to shutdown the Firewall, without more access to the Config in the Fortigate and with the possibility to do this direct locally. Only shutdown before they start works on the power line. This here is now the first time in our new Fortinet infrastructure where we need this. But we will have a lot of Fortigates in the world and in every site the need the possibility to shutdown the Fortigate, without have troubles after the power is back (See post above from me, regarding NAND and power off without priories a " good" shutdown). Again => access to restricted admin GUI / SSH with only shutdown access.

[rwpatterson]

Never mind. My suggestion would not work in your case.

[ede_pfau]

Bob, why? We can safely assume that a scheduled reboot will do a graceful shutdown first as not to corrupt the config. The point is that in order to set the daily reboot option you need admin privileges just like for an ' exec reboot' . So no gain this way but I thought of that option as well. But yes, OP would gain the liberty to set it during his working hours, and not at local realtime. But bit clumsy albeit as he' s got to disable the option again a day later. @OP: why don' t you consider running a FortiManager? Central management, no sharing to local admins (as this option clearly does not (yet) exist) and independence of local time schedule (?). You' d have to fast-read through the operating manual of a FM to explore this.

[rwpatterson]

I' m thinking that he doesn' t want to get involved when a remote site needs to shut down. With the FM option, he would still need to get busy. He wants the remote admins to have only the ability to gracefully shut down their firewalls.