FortiGate防火墻常用配置命令

1、FortiGate常用配命令對策略,對象等進(jìn)行配查看相關(guān)關(guān)對象的參數(shù)信息查看配置文件診斷命令常用的工具命令,如ping退出一、命令結(jié)構(gòu)configConfigureobject.置getGetdynamicandsysteminformation.showShowconfiguration.diagnoseDiagnosefacility.executeExecutestaticcommands.exitExittheCLI.二、常用命令1、配置接口地址：FortiGate#configsysteminterfaceFortiGate(interface)#editlanFortiGate(l

2、an)#setip192.168.100.99/24FortiGate(lan)#end2、配置靜態(tài)路由FortiGate(static)#edit1FortiGate(1)#setdst10.0.0,0255.0.0.0FortiGate(1)#setgateway192.168.57.1FortiGate(1)#end3、配置默認(rèn)路由FortiGate(1)#setgateway192.168.57.1FortiGate(1)#setdevicewan1FortiGate(1)#end4、添加地址FortiGate#configfirewalladdressFortiGate(addres

3、s)#editclientnetnewentryclientnetaddedFortiGate(clientnet)#setsubnet192.168.1.0255.255.255.0FortiGate(clientnet)#end5、添加ip池FortiGate(ippool)#editnat-poolnewentrynat-pooladdedFortiGate(nat-pool)#setstartip100.100.100.1FortiGate(nat-pool)#setendip100.100.100.1006、添加虛擬ipFortiGate#configfirewallvipForti

4、Gate(vip)#editwebservernewentrywebserveraddedFortiGate(webserver)#setextip202.0.0.167FortiGate(webserver)#setextintfwan1FortiGate(webserver)#setmappedip192.168.0.168FortiGate(webserver)#end7、配置上網(wǎng)策略FortiGate#configfirewallpolicyFortiGate(policy)#edit1FortiGate(1)#setsrcintfinternal/源接口FortiGate(1)#se

5、tdstintfwan1/目的接口FortiGate(1)#setsrcaddrall/源地址FortiGate(1)#setdstaddrall/目的地址FortiGate(1)#setactionaccept/動作FortiGate(1)#setschedulealways/時間FortiGate(1)#setserviceALL/效勞FortiGate(1)#setlogtrafficdisable/日志開關(guān)end8、配置映射策略FortiGate#configfirewallpolicyFortiGate(policy)#edit2FortiGate(2)#setsrcintfwan1

6、FortiGate(2)#setdstintfinternal/源接口FortiGate(2)#setsrcaddrallFortiGate(2)#setdstaddrFortiGate1FortiGate(2)#setactionacceptFortiGate(2)#setschedulealways/FortiGate(2)#setserviceALLFortiGate(2)#setlogtrafficall目的接口/源地址/目的地址,虛擬ip映射,事先添加好的/動作時間/效勞/日志開關(guān)end9、把internal交換接口修改為路由口保證關(guān)于internal口的路由、dhcp、防火墻策略都

7、刪除FortiGate#configsystemglobalFortiGate(global)#setinternal-switch-modeinterfaceFortiGate(global)#end重啟1、查看主機(jī)名,治理端口FortiGate#showsystemglobal2、查看系統(tǒng)狀態(tài)信息,當(dāng)前資源信息FortiGate#getsystemperformancestatus3、查看應(yīng)用流量統(tǒng)計FortiGate#getsystemperformancefirewallstatistics4、查看arp表FortiGate#getsystemarp5、查看arp豐富信息FortiGa

8、te#diagnoseiparplist6、清楚arp緩存FortiGate#executeclearsystemarptable7、查看當(dāng)前會話表full-statFortiGate#diagnosesyssessionstat或FortiGate#diagnosesyssession8、查看會話列表FortiGate#diagnosesyssessionlist9、查看物理接口狀態(tài)FortiGate#getsysteminterfacephysical10、查看默認(rèn)路由配置FortiGate#getrouterinforouting-tablestatic12、查看ospf相關(guān)配置Fort

9、iGate#showrouterospf13、查看全局路由表FortiGate#getrouterinforouting-tableall1、查看HA狀態(tài)FortiGate#getsystemhastatus2、查看主備機(jī)是否同步FortiGate#diagnosesyshashowcsum3.診斷命令：FortiGate#diagnosedebugapplicationike-1execute命令:FortiGate#executeping8.8.8.8/常規(guī)ping操作/指定ping數(shù)據(jù)包的源FortiGate#executeping-optionssource192.168.1.200地址192.168.1.200FortiGate#executeping8.8.8.8繼續(xù)輸入ping的目標(biāo)地址,即可通過192.168.1.200的源地址執(zhí)行ping操作FortiGate#executetraceroute8.8.8.8FortiGate#executeteln