How to Access CLI on Fortigate: The Definitive Technical Walkthrough

Published

Fortigate’s command-line interface (CLI) remains the most direct way to manage complex configurations, debug issues, or execute bulk commands—far beyond what the GUI can handle. While newer administrators often default to the web portal, bypassing the CLI risks overlooking critical optimizations or missing real-time diagnostics. The ability to how to access CLI on Fortigate is non-negotiable for network engineers, especially when dealing with high-availability clusters, custom scripts, or legacy system integrations.

The CLI’s power lies in its granularity. Need to parse firewall logs in bulk? The CLI does it faster. Struggling with a misconfigured VPN tunnel? The CLI exposes root causes the GUI obscures. Yet, many administrators treat CLI access as a secondary skill—until they hit a wall during a critical outage. The truth is, how to access CLI on Fortigate isn’t just about typing commands; it’s about understanding when to bypass the GUI entirely.

###
how to access cli on fortigate

The Complete Overview of Fortigate CLI Access

Fortigate’s CLI operates on a hierarchical structure rooted in FortiOS, Fortinet’s proprietary operating system. Unlike traditional Linux shells, it’s designed for network-specific tasks, with commands categorized under execute, config, diagnose, and get modes. The interface supports both serial console and remote access (SSH/HTTPS), but permissions are tightly controlled—administrators must configure user roles to grant CLI privileges explicitly.

The CLI’s efficiency becomes apparent during large-scale deployments. For instance, deploying a policy package across 50 firewalls via CLI is orders of magnitude faster than manual GUI navigation. Even Fortinet’s own documentation emphasizes that how to access CLI on Fortigate is essential for advanced use cases, such as custom scripting with FortiOS APIs or integrating with third-party tools like Ansible. The trade-off? A steeper learning curve, but one that pays dividends in automation and troubleshooting.

###

Historical Background and Evolution

Fortinet introduced CLI access in early FortiOS versions as a necessity for enterprise-grade network devices. Before the web portal became standard, administrators relied solely on serial console connections—requiring physical access to the appliance. This limitation spurred the development of SSH support in FortiOS 4.0 (2009), aligning with industry trends toward remote management.

The evolution didn’t stop there. FortiOS 5.0 (2012) introduced the execute command mode, allowing administrators to run diagnostics without entering full configuration mode. Later versions added diagnose commands for deep packet inspection and script support for automation. Today, how to access CLI on Fortigate has expanded to include HTTPS-based CLI (via the web portal) and even cloud-based CLI access for FortiCloud-managed devices, reflecting Fortinet’s shift toward hybrid networking.

Table of Contents

###

Core Mechanisms: How It Works

Under the hood, Fortigate’s CLI operates as a stateful shell that interacts with FortiOS’s kernel. Commands are parsed by the cli daemon, which validates syntax against a command tree stored in `/var/cli`. The system maintains two primary modes:
1. Configuration Mode (`config`): Used to modify the running configuration (e.g., `config firewall policy`).
2. Execute Mode (`execute`): For read-only operations (e.g., `execute ping`).

Permissions are enforced via the user database, where roles like `super_admin`, `admin`, or `operator` dictate CLI access levels. For example, an `operator` role might allow `diagnose` commands but block `config` changes. This granularity is why how to access CLI on Fortigate often begins with auditing user permissions before attempting any command.

###

Key Benefits and Crucial Impact

The CLI’s value proposition lies in its precision and speed. While the GUI excels at visual policy mapping, the CLI shines in scenarios requiring bulk operations or real-time debugging. For example, during a DDoS attack, administrators might use `diagnose debug flow` to trace malicious traffic—something the GUI cannot replicate. Similarly, how to access CLI on Fortigate is critical for restoring configurations from backups (`execute backup config`) or resetting forgotten passwords (`execute password-recovery`).

The CLI also bridges gaps in Fortinet’s ecosystem. Need to integrate Fortigate with a SIEM tool? The CLI provides the raw data feeds the GUI cannot expose. Planning a firmware upgrade? The `execute backup config` command ensures no configuration is lost during the process. These use cases underscore why CLI access is non-negotiable for mission-critical environments.

> "The CLI is where Fortigate’s true power resides—not as a replacement for the GUI, but as the tool for what the GUI cannot do." > — Fortinet Technical Support, 2023

###

Major Advantages

  • Speed and Efficiency: Bulk commands (e.g., `config firewall address`) execute in seconds, compared to minutes via GUI.
  • Advanced Diagnostics: Commands like `diagnose debug flow filter` provide granular traffic analysis unavailable in the GUI.
  • Automation Support: CLI scripts can be integrated with CI/CD pipelines or orchestration tools like Ansible.
  • Legacy Compatibility: Older Fortigate models (e.g., FG-300D) often lack full GUI support, requiring CLI for basic management.
  • Security Hardening: Direct CLI access can enforce stricter audit trails via `execute log filter`.

how to access cli on fortigate - Ilustrasi 2

Comparative Analysis

Method Use Case
Serial Console Initial setup, password recovery, or when SSH is disabled. Requires physical access.
SSH Remote administration, scripting, and real-time diagnostics. Preferred for most tasks.
Web Portal (HTTPS CLI) Quick access for administrators already logged into the GUI. Limited to basic commands.
FortiCloud CLI Cloud-managed devices with centralized CLI access via Fortinet’s portal.

Future Trends and Innovations

Fortinet is gradually integrating AI into CLI workflows, with features like predictive command suggestions in newer FortiOS versions. This trend aligns with the industry’s move toward intent-based networking, where CLI commands might soon auto-generate based on high-level policies. Additionally, how to access CLI on Fortigate is evolving to support zero-trust architectures, with CLI-based micro-segmentation becoming a standard practice.

The rise of edge computing will also impact CLI access. As Fortigate devices deploy closer to data sources (e.g., IoT sensors), remote CLI management will need to support low-latency, high-bandwidth connections—potentially via 5G or dedicated private networks. Administrators must prepare for these shifts by mastering CLI fundamentals today.

###
how to access cli on fortigate - Ilustrasi 3

Conclusion

Mastering how to access CLI on Fortigate is not optional—it’s a prerequisite for modern network administration. The CLI remains the backbone of Fortinet’s ecosystem, offering capabilities the GUI simply cannot match. Whether you’re troubleshooting a misrouted VPN or automating firewall policies, the CLI provides the control and flexibility required in dynamic environments.

The key takeaway? Treat CLI access as a foundational skill, not an afterthought. Start with serial console basics, then transition to SSH for remote work, and finally explore automation scripts. The more you leverage the CLI, the more Fortigate’s full potential will unfold.

###

Comprehensive FAQs

Q: What’s the fastest way to access CLI on Fortigate?

The fastest method depends on your environment:

  • For local devices: Use SSH (`execute ssh enable1` followed by `execute ssh user `).
  • For remote access: Configure SSH in the GUI under System > Admin > Administrators, then connect via PuTTY/Terminal.
  • For emergency access: Use the serial console (requires physical access and a USB-to-serial adapter).

    • Q: Can I enable CLI access via the web portal?

    Yes, but with limitations. Navigate to System > Admin > Administrators, select a user, and check CLI Access. This grants HTTPS-based CLI access (via the web portal’s CLI tab), but full SSH/serial access still requires additional configuration.

    Q: How do I recover a forgotten CLI password?

    Use the password recovery mode:
    1. Power-cycle the Fortigate.
    2. Hold Reset (or OK) during boot to enter recovery mode.
    3. Follow on-screen prompts to reset the password via serial console.

    Q: Are there security risks with CLI access?

    Yes. Unrestricted CLI access can expose the device to brute-force attacks or misconfigurations. Mitigate risks by:

  • Enforcing SSH key authentication (disable password login).
  • Restricting CLI roles (e.g., `operator` instead of `super_admin`).
  • Using FortiGate’s built-in audit logs (`execute log filter`).

    • Q: How can I automate CLI commands?

    Use FortiOS scripts or integrate with tools like:

  • Ansible: Use the `fortios_cli` module to execute commands.
  • Python: Leverage `paramiko` for SSH-based automation.
  • FortiManager: Centralize CLI commands across multiple devices.
    • Example script (Bash):
    ```bash
    #!/bin/bash
    ssh admin@192.168.1.99 "config firewall policy\nedit 1\nset action accept\nend"
    ```

    Q: What’s the difference between `execute` and `config` modes?

  • `execute` mode: Read-only operations (e.g., `execute ping`, `execute get system performance`).
  • `config` mode: Modifies the running configuration (e.g., `config firewall address`, `config system interface`).
    • Always use `end` or `exit` to return to the previous mode.

    Q: Can I use the CLI on FortiGate cloud models?

    Yes, via FortiCloud’s CLI portal:
    1. Log in to FortiCloud.
    2. Select your managed Fortigate device.
    3. Use the CLI Console tab for remote access.
    Note: Some features may require FortiManager integration.