Scribd
Upload
127 views

Comando Fortigate

This document provides commands to verify network traffic, firewall policies, routing tables, interface dependencies, and SSL/TLS settings on a FortiGate device. Some key commands include "diagnose sniffer packet" to check traffic, "show firewall policy" to view policy configurations, "get router info routing-table" to check routes, and "diagnose debug flow" to debug traffic matching policies. The document also includes commands for enabling and disabling VPN debugging, checking VPN tunnels, and disabling SSL/TLS protocols.

Uploaded by

Niverson Vivinha
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as TXT, PDF, TXT or read online on Scribd
127 views

Comando Fortigate

This document provides commands to verify network traffic, firewall policies, routing tables, interface dependencies, and SSL/TLS settings on a FortiGate device. Some key commands include "diagnose sniffer packet" to check traffic, "show firewall policy" to view policy configurations, "get router info routing-table" to check routes, and "diagnose debug flow" to debug traffic matching policies. The document also includes commands for enabling and disabling VPN debugging, checking VPN tunnels, and disabling SSL/TLS protocols.

Uploaded by

Niverson Vivinha
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as TXT, PDF, TXT or read online on Scribd
You are on page 1/ 3

Verificar tr�fego do IP

diag sniffer packet any 'host 189.4.130.244' 4


-----------------------------------------
Verificar trafego da policy

diagnose firewall iprope show 100004 9 [ID_Policy]


---------------------------------------------
Saber todas as origens que est�o batendo na pol�tica x

diagnose sys session filter policy (Numero da policy)


Depois digita: diagnose sys session list
---------------------------------------------

Verificar configura��es da policy

show firewall policy <ID>

------------------------------------------------

Verificar as rotas
get router info routing-table all
ou
get router info routing-table detail

rotas index da interface

diag ip address list


----------------------------------------

Verificar dependencias de uma interface


show | grep -f "nomedainterface"

show | grep -f vLAN_<ID>


--------------------------------------------

Comando para ver policy que a m�quina est� saindo para internet

diagnose debug flow filter saddr x.x.xx. (ip de origem)

voce pode usar no comando acima:


saddr
/ daddr /
sport /
dport
diagnose debug flow filter dport 80 (porta destino)

diagnose debug flow show console enable

diagnose debug flow trace start 100

diag debug enable

Deve aparecer algo como

"allowed by policy XX"

ou
diagnose debug flow filter (com os filtros que precisa)

diagnose debug flow show iprope enable

diagnose debug enable

Deve aparecer algo como

"allowed by policy XX"

ou

diag sys session filter src 192.168.1.1

diagnose sys session list | grep policy_id


-----------------------------------------

diagnose debug disable

diagnose debug flow trace stop

diagnose debug flow filter clear

diagnose debug reset

diagnose debug flow filter addr x.x.x.x

diagnose debug flow show console enable

diagnose debug flow show function-name enable

diagnose debug console timestamp enable

diagnose debug flow trace start 999

diagnose debug enable

-----------------------------------------------------

Habilitando o debug VPN Ipsec

diagnose vpn ike log-filter dst-addr4 200.200.200.1


diag debug application ike -1
diagnose debug enable

Desabilitando o debug

diagnose debug disable

Informa��es dos tuneis VPNs

get vpn ipsec tunnel details

Informa��o do tunel vpn especifico

get vpn ipsec tunnel name "NOME DO TUNEL" details


----------------------------------------------

derrubar o processo vpnssl

get system performance top ou diagnose system performance (pega a id do processo


sslvpn)

diag sys kill 11 (ID do processo sslvpn)

ou

fnsysctl cat /var/run/sslvpnd.pid

-------------------------------------

Horario de ver�o
config system global

set dst disable (enable)

end

-------------------------------------
Deletar IP DHCP MONITOR
exec dhcp lease-list �> show current list on DHCP lease
execute dhcp lease-clear �> clear the DHCP lease of a specific ip
execute dhcp lease-clear all

------------------------------------
Trafego Policy Route

diagnose firewall proute list

---------------------------------------

# show vpn ssl settings


config vpn ssl settings
set sslv3 disable
set tunnel-ip-pools "SSLVPN_TUNNEL_ADDR1"
set tunnel-ipv6-pools "SSLVPN_TUNNEL_IPv6_ADDR1"
set port 10443
set source-interface "wifi"
set source-address "all"
set source-address6 "all"
set default-portal "default"
end

-------------------------------------------------
Desabilitar servi�o ssl e tls

config vpn ssl settings


set sslv3 {enable | disable} sslv3
set tlsv1-0 {enable | disable} Enable/disable TLSv1.0.
set tlsv1-1 {enable | disable} Enable/disable TLSv1.1.
set tlsv1-2 {enable | disable} Enable/disable TLSv1.2

You might also like