How To Show Configuration On Fortigate CLI: Comprehensive Administrative Guide
Mastering the Fortigate Command Line Interface enables granular control and rapid verification of firewall policies, interface settings, and routing tables. This guide outlines the precise syntax required to export, view, and audit your Fortinet security appliance configuration to ensure network integrity and compliance.
Pre-Procedure Requirements and Access Standards
Before initiating a configuration review on a Fortigate device, you must ensure that your administrative environment meets the security and connectivity standards required for CLI management. Direct access to the Fortigate CLI requires an understanding of hierarchical data structures, as Fortinet systems utilize a tree-based configuration architecture.
- Essential Gear and Prerequisites:
- A stable workstation equipped with a terminal emulator such as PuTTY, Tera Term, or SecureCRT.
- Valid administrative credentials with at least read-access permissions (Super_Admin is recommended for full visibility).
- A physical console cable (RJ45 to DB9 or USB-Serial adapter) if network-based management (SSH or Telnet) is unreachable due to misconfiguration.
- Knowledge of the specific firmware version running on your unit, as command syntax can vary slightly between FortiOS versions.
- Estimated Duration: 5 to 10 minutes for basic configuration review; 30+ minutes for comprehensive security auditing.
Mastering Configuration Retrieval and Verification
The Fortigate CLI utilizes a show-based command logic that allows you to inspect specific parts of the configuration tree. Navigating this tree requires the use of the config, edit, and show commands in sequence.
Step 1: Initiating the Management Session
Establish a connection to your Fortigate firewall using SSH or the physical console port. Once the command prompt appears, you are at the root level of the CLI hierarchy. Type the show full-configuration command to view the entire runtime environment, although this is often overwhelming for large enterprise configurations. Instead, focus on specific modules by moving through the hierarchy using the config command. For example, to view firewall policies, enter config firewall policy, followed by show.
Step 2: Viewing Specific Functional Objects
To avoid parsing through thousands of lines of code, use targeted show commands to isolate specific parameters. If you need to view the configuration of a specific interface, type show system interface. To inspect the routing table, use the get router info routing-table all command. Note that get commands are typically used for monitoring live status, while show commands are used for verifying the saved configuration state.
Pro-Tip: Use the pipe character followed by the grep command to filter output for specific strings. For example, typing show firewall policy | grep 192.168.1.1 will immediately isolate any policy containing that specific IP address, significantly reducing your manual review time.
Step 3: Navigating and Modifying the Configuration Hierarchy
To view detailed settings for a specific object, such as a firewall address object, you must enter the specific context of that object. Use the command config firewall address, then use show to list all defined addresses. If you wish to see the details of a single entry, use the edit command followed by the object name, then type show. This depth of navigation ensures you do not inadvertently alter the global configuration while merely attempting to read it.
Step 4: Exporting Configuration for External Auditing
For comprehensive audits or offline backup, you should export the full configuration file. Within the CLI, use the execute backup config command. You will be prompted to select a transfer method, such as TFTP or FTP. Ensure that your TFTP server is reachable from the Fortigate management interface before executing the command to prevent a timeout error.
Warning: Never share raw configuration files exported from the CLI without first masking sensitive information such as pre-shared keys (PSKs), encrypted passwords, and public-facing IP addresses, as these files contain the entire security blueprint of your network.
Hub And Spoke Configuration Fortigate at Jeffery Thompson blog
Comparison of CLI Inspection Commands
| Command Category | Command Syntax | Primary Objective |
|---|---|---|
| Global Review | show full-configuration | Displays every active setting on the device. |
| Object-Specific | show [module] [name] | Displays configuration of a specific policy or object. |
| Live Status | get [monitor-module] | Retrieves real-time data like active sessions or routes. |
| Diagnostic | diagnose [module] | Triggers debugging logs and real-time traffic analysis. |
| Filtering | show [command] | grep [string] |
Common Configuration Failures and Field Fixes
Even experienced administrators encounter hurdles when navigating the Fortigate CLI. Addressing these issues systematically prevents downtime and misconfiguration.
- Command Not Found Error:
- Root Cause: You are at the incorrect level of the configuration hierarchy or using a command deprecated in your current firmware version.
- Actionable Fix: Return to the root level by typing end or exit repeatedly until the prompt changes. Verify your firmware version using the get system status command and check the Fortinet CLI Reference guide for your specific version.
- Excessive Output Truncation:
- Root Cause: The terminal emulator window has a buffer limit or is not configured to handle the volume of data output by the show full-configuration command.
- Actionable Fix: Increase the scrollback buffer settings in your terminal emulator software, or output the configuration to an external file using a log-to-file feature within your SSH client.
- Permission Denied During Review:
- Root Cause: The administrator account currently logged in lacks sufficient read permissions to view specific sensitive objects like VPN tunnels or authentication settings.
- Actionable Fix: Re-authenticate with an account assigned to the super_admin profile or contact the network administrator to elevate your privilege level.
Frequently Asked Questions
What is the difference between show and get commands?
The show command displays the static configuration settings saved in the device's configuration file. Conversely, the get command displays real-time, dynamic information, such as current session counts, routing table entries, or interface statistics that change as traffic traverses the firewall.
How do I see the full configuration for a specific firewall policy?
Navigate to the policy section by entering config firewall policy and then type show. If you have many policies, use edit [policy-id] followed by show to view only the configuration of that specific policy, which provides a cleaner and more readable output.
Can I change configuration settings directly from the show view?
No, the show view is read-only. To modify settings, you must enter the configuration context using the config command, identify the specific object using edit, make your changes, and then finalize the transaction by typing next or end.
How can I search for a specific configuration object globally?
While the CLI does not have a global find command, you can use the show full-configuration | grep [string] command to search the entire device database for any mention of a specific IP address, object name, or service port across all modules.
Optimize Your Network Security Posture
Regularly auditing your Fortigate configuration through the CLI is essential for maintaining a hardened security perimeter and ensuring optimal firewall performance. Contact our engineering team today to schedule a comprehensive security audit and configuration hardening session tailored to your infrastructure requirements.
