FortiNAC-OS - CLI Reference Guide

Version F 7.2.4
FORTINET DOCUMENT LIBRARY
https://docs.fortinet.com

FORTINET VIDEO GUIDE

https://video.fortinet.com

FORTINET BLOG
https://blog.fortinet.com

CUSTOMER SERVICE & SUPPORT

https://support.fortinet.com

FORTINET TRAINING & CERTIFICATION PROGRAM

https://www.fortinet.com/training-certification

NSE INSTITUTE
https://training.fortinet.com

FORTIGUARD CENTER
https://www.fortiguard.com

END USER LICENSE AGREEMENT

https://www.fortinet.com/doc/legal/EULA.pdf

FEEDBACK
Email: [email protected]

October 24, 2023

FortiNAC-OS F 7.2.4 CLI Reference Guide
49-922-769106-20211216
 TABLE OF CONTENTS

Overview 4
CLI basics 5
Pipe options for displaying content 6
Show commands 7
Get commands 8
Execute commands 10
Diagnose commands 17
Configuration commands 22
Global 22
DNS 22
Admin user 23
High Availability 24
Interface 25
NTP 27
Route 28
Shell Commands 30

FortiNAC-OS F 7.2.4 CLI Reference Guide 3

Fortinet Inc.
Overview

Overview

This document describes FortiNAC-OS CLI commands used to configure and manage a FortiNAC unit from the
command line interface (CLI).
Important: Any commands should be executed under guidance from Fortinet.

FortiNAC-OS F 7.2.4 CLI Reference Guide 4

Fortinet Inc.
CLI basics

CLI basics

Basic features and characteristics of the CLI environment provide support and ease of use for many CLI tasks.
l At any point, the tab key can be used to list possibilities for the next command or auto-complete partially
filled in commands
l The CLI will restrict which commands are shown based on the current context the user is in. When first
launched, the user is in the base context, but running certain commands (such as config system interface)
will switch the user to the appropriate context, with a completely new set of commands available.
l When inside a context, hitting ctrl-c will ‘abort’ any unsaved changes and exit the context.
l Attempting to run an incomplete command (e.g. config system) will show the usage info for the next
available possible parameters for that command.
Top Level Commands

Command Description
help Display usage
diagnose Diagnostic Tools
get Get system information
config Configure object
execute Execute static commands
show Show configuration
exit Exit

FortiNAC-OS F 7.2.4 CLI Reference Guide 5

Fortinet Inc.
Pipe options for displaying content

Pipe options for displaying content

The options in the table below are available for many commands that display content, such as “get”, “show” and
“diagnose” commands.

Grep usage: Available options:

<pattern> Pattern to grep for

show system interface |
grep [-cinv] [-
-A=<trailingCount> Print NUM lines of trailing context
A=<trailingCount>] -B=<leadingCount> Print NUM lines of leading context
-c Display only count of matching lines
[-B=<leadingCount>]
-C=<outputContextCount> Print NUM lines of output context

[- -i Ignore case
C=<outputContextCount>] -n Print line number with output lines
<pattern>
-v Display non-matching lines

Less usage:
show system interface |
less

FortiNAC-OS F 7.2.4 CLI Reference Guide 6

Fortinet Inc.
Show commands

Show commands

These commands are run from the base context.

Available commands

Command Description
show system Show the currently active configuration for the specified subsystem

Available options:

admin Display admin configuration

dns Display DNS configuration

global Display global configuration

ha Display High-Availability configuration

interface Display interface configuration
ntp Display NTP configuration

route Display route configuration

show full- Shows the currently active configuration across all subsystems
configuration

FortiNAC-OS F 7.2.4 CLI Reference Guide 7

Fortinet Inc.
Get commands

Get commands

These commands are run from the base context.

Available commands

Command Description
get hardware memory Get information about the system memory
get hardware nic List the available interfaces on the system (port 1, port 2, etc)
get hardware status Retrieve an overview of the system:
l Model Name

l UUID
l MAC
l CPU
l Number of CPU cores
l RAM
l Hard disk (partition information)
get system public-key Retrieve the root user’s public key, which can then be used for configuring
HA on other systems. If multiple keys are present, it will prioritize the
ed25519 key
get system status Retrieve an overview of the FortiNAC status:
l FortiNAC Version

l Serial-Number
l License Status (Valid or expired)
l License Expiration Date
l Hostname
l Release Version Information (GA or interim)
l System time
get system license Print License Information

Available options:

-check Check if each license key is valid for this

appliance.
TEXT Format only

-file=<fileName> The filename to be used in conjunction with -

key FILE

-fmt=<fmt> Format to display. JSON can be useful

programmatically

FortiNAC-OS F 7.2.4 CLI Reference Guide 8

Fortinet Inc.
Get commands

Command Description

TEXT, JSON

-key=<keys> Add a License Key to display. If none

specified, this list will contain EFFECTIVE,
which means what is
used by this appliance.

Use FILE in combination with the

-file option to specify a file to read from
EFFECTIVE, APPLIANCE, WPRIMARY,
MANAGER, HARDWARE, FILE

get hardware cpu Display detailed information for all installed CPU(s).
get system interface Get interface configuration.
<portName>

FortiNAC-OS F 7.2.4 CLI Reference Guide 9

Fortinet Inc.
Execute commands

Execute commands

Execute commands are used for the tasks listed below. These commands are run from the base context.
l Backup
l Factory Reset
l License
l Ping and traceroute
l SSH
l Reboot and shutdown
l Restore image
l Restore config
l Important: Any configuration that isn’t explicitly defined in the backup configuration will be removed
upon restore. The one exception is admin user settings (which are left untouched). All other config
(interface, route, etc) will be reset to default and then have the configuration present in the provided
config applied.
l All methods of restore will first create a back-up configuration prior to applying the new config.
Available commands

Command Description
execute enter-shell Enters a shell to interact with the appliance more directly. See shell
commands for details.
execute help Lists the available commands under execute
execute db-shell Enters the database shell
execute sensors list Show sensor information.
execute time <time> Set the system system time (hh:mm:ss format, hh: 0-23 mm: 0-59 ss: 0-59).
execute date <date> Set the system date (yyyy-mm-dd format, yyyy: 2023, mm: 1-12, dd: 1-31).
execute reset Reset configuration and disk partition to factory default
execute factoryreset Reset to factory default and shutdown
all-shutdown

execute factoryreset Reset to factory default and reboot.

all-settings

FortiNAC-OS F 7.2.4 CLI Reference Guide 10

Fortinet Inc.
Execute commands

Command Description
execute tcpdump [-v] Sniff packets on the specified interface.
[-c=<count>] [-
G=<seconds>] [- Available options:
i=<port>] [-
Q=<direction>] [- [<filter>...] Sniffer filter
s=<snaplen>] [-
-c=<count> Maximum number of packets to capture
w=<file>] [-x | -xx |
-X | -XX] -G=<seconds> Maximum duration in seconds to capture
[<filter>...]
-i=<port> Port to sniff packets on
-Q=<direction> Packet direction(s) to capture [in|out|inout]
-s=<snaplen> Number of bytes to snarf from each packet
-v, --verbose Enable verbose output
-w=<file> Write captured packets to specified file
-x Display packet data (minus link level header) in
hex
-X Display packet data (minus link level header) in
hex and ASCII
-xx Display packet data (including link level header)
in hex
-XX Display packet data (including link level header)
in hex and ASCII
help Display usage

Execute a tcpdump. All options correspond with their tcpdump

equivalents. Additionally, file specified via –w only uses the filename
portion (all files are stored in the user’s home directory).

FortiNAC-OS F 7.2.4 CLI Reference Guide 11

Fortinet Inc.
Execute commands

FortiNAC-OS F 7.2.4 CLI Reference Guide 12

Fortinet Inc.
Execute commands

Backup
execute backup config Backs up the current "config system" CLI configuration locally to disk
local (/bsc/backups/). See Configuration commands.
execute backup config ftp Backs up the current system configuration via FTP to the remote
[<remote filename>] [<ftp destination using the provided username and password.
server:port>] [<username>] The port option may be omitted if the destination uses the default FTP
[<password>] port (21)
execute backup config scp Backs up the current system configuration remotely via SCP to the
[<remote filename>] [<scp destination provided.
server:port>] [<username>] The port option may be omitted if the destination uses the default SSH
[<password>] port (22)

execute backup config tftp Backs up the current system configuration to the specified TFTP
[<remote filename>] [<tftp destination
server>]

License
execute license add Add the raw license string to the system
[<license>]

execute license import Import the specified remote license file on the specified tftp host
tftp [<remote host>]
[<remote file>]

execute license import scp Import the specified remote license file from the specified host via
[<remote file>] [<remote SCP
host>] [<username>]
[<password>]

PING & Traceroute

execute ping [<host>] PING the specified host
execute ping6 [<host>] PING the specified IPv6 host
execute traceroute Trace the route between this system and the specified host
[<host>]

Shutdown & Reboot

execute reboot Reboots the system
execute shutdown Shuts down the system

Restore
execute restore image scp Install the .out image located on the specified remote host. Image is
[<remote out file>] downloaded via SCP
[<host>] [<username>] Note: This command is used for upgrading the software on the
[<password>] system.

FortiNAC-OS F 7.2.4 CLI Reference Guide 13

Fortinet Inc.
Execute commands

execute restore image ftp Install the .out image located on the specified remote host. Image is
[<remote out file>] downloaded via FTP.
[<host>] [<username>]
[<password>]
Note: This command is used for upgrading the software on the
system.

execute restore image tftp Install the .out image located on the specified remote host. Image is
[<remote out file>] downloaded via TFTP
[<host>]
Note: This command is used for upgrading the software on the
system.
execute restore config Restore the "config system" CLI configuration stored locally. Tab
local [<local config completion can be used to list the available configuration backups.
backup>] See Configuration commands.

execute restore config scp Restore the "config system" CLI configuration stored on the remote
[<remote file>] [<host>] host at the specified location. Configuration downloaded via SCP.
[<username>] [<password>] See Configuration commands.
execute restore config ftp Restore the "config system" CLI configuration stored on the remote
[<remote file>] [<host>] host at the specified location. Configuration downloaded via FTP. See
[<username>] [<password>] Configuration commands.
execute restore config Restore the "config system" CLI configuration stored on the remote
tftp [<remote file>] host at the specified location. Configuration downloaded via TFTP.
[<host>] See Configuration commands.
execute restore legacy- Used for migrating CentOS configurations to new FortiNAC-OS
migrate [COMMAND] platform. Important: Do not use without first reviewing the CentOS to
FortiNAC-OS Migration documentation in the Documentation Library.
Available options:

local Import legacy config from a local bundle

remote Import legacy config from a remote system

execute restore database Restore database using a local database backup

local <filename>

execute restore database Restore database using a remote database backup downloaded via
scp <host> <username> scp
<password> <backup-path> Argument descriptions:
<host> Remote host
<username> Remote username
<password> Remote password
<backup> Path to database backup on remote host (.gz)

SSH

FortiNAC-OS F 7.2.4 CLI Reference Guide 14

Fortinet Inc.
Execute commands

execute ssh [<user@host>] SSH to the specified host as the specified user
execute ssh-known-hosts Remove the specified known host fingerprint
remove-host [<host>]

execute ssh-known-hosts Removes all the SSH host fingerprints from the known hosts
remove-all

execute ssh-authorized- Adds the specified public key to the user's authorized hosts
keys add <public key
string>

execute ssh-authorized- Import the specified public key from a specified host, using the
keys import scp <file specified credentials, into the user's authorized hosts via scp
path> <host> <username>
<password>

execute ssh-authorized- Displays the user's authorized hosts

keys list

execute ssh-authorized- Removes any authorized host keys that match the specified host. Tab
keys remove <host> completion of the <host> is supported.

Disk
execute disk checkhealth Perform a read-only filesystem check for errors on the specified
<partition> partition
execute disk list List partitions and mountpoints
execute disk scan Perform a (fsck) filesystem check on the specified partition
<partition>

Service
execute service is-active Display if a specified service is active
<service>... Arguments
<service>...
Service = nac, naccontrol, nacapplication, nacprobe, p0f, dhcpd,
mysqld, apache2, named
execute service restart Restart a specified service
<service>... Arguments
<service>...
Service = nac, naccontrol, nacapplication, nacprobe, p0f, dhcpd,
mysqld, apache2, named
execute service start Start a specified service
<service>... Arguments
<service>...
Service = nac, naccontrol, nacapplication, nacprobe, p0f, dhcpd,
mysqld, apache2, named

FortiNAC-OS F 7.2.4 CLI Reference Guide 15

Fortinet Inc.
Execute commands

execute service status Retrieve status of a specified service

<service>... Arguments
<service>...
Service = nac, naccontrol, nacapplication, nacprobe, p0f, dhcpd,
mysqld, apache2, named
execute service stop Stop a specified service
<service>... Arguments
<service>...
Service = nac, naccontrol, nacapplication, nacprobe, p0f, dhcpd,
mysqld, apache2, named
execute ssh-known-hosts Add a ssh host fingerprint to known hosts
add [current-user|nac] Arguments
<user> <ip>
[current-user|nac]
"current-user" for your known hosts, or "nac" for the FortiNAC
system's known hosts
<user>
Remote host user
<ip>
Remote host ip / hostname
execute ssh-known-hosts Remove all ssh host fingerprints from known hosts
remove-all [current- Arguments
user|nac]
[current-user|nac]
"current-user" for your known hosts, or "nac" for the FortiNAC
system's known hosts
execute ssh-known-hosts Remove the specified host fingerprint from known hosts
remove-host [current- Arguments
user|nac] <host>
[current-user|nac]
"current-user" for your known hosts, or "nac" for the FortiNAC
system's known hosts
<host>
Host to remove
execute ssh-known-hosts show Display fingerprints from known hosts
[current-user|nac]
Arguments
[current-user|nac]
"current-user" for your known hosts, or "nac" for the FortiNAC
system's known hosts

FortiNAC-OS F 7.2.4 CLI Reference Guide 16

Fortinet Inc.
Diagnose commands

Diagnose commands

Diagnose commands are used for debugging/troubleshooting purposes. These commands are executed from
the base context.
Tail: Run this command to display the entries of a specific log file as they are printed in real time. Plugins
and/or loggers may need to be enabled prior to running this command for more in-depth data gathering.
Debug Plugin: Debug plugin commands are used for listing, enabling, disabling, and getting performance
metrics for the running FortiNAC plugins.
Debug Logger: Debug logger commands are used for listing loggers and setting their log levels.
Available commands

Command Description

diagnose tail (-F|-f|-k <numKB>) [<file>] Tails the specified logfile.

Example:
diagnose tail -F output.master

Tab completion can be used to list the

files available to tail.
Ctrl-C stops tail.
Available options:

-F Follow the file changes

as it is updated. Follow
through the file being
replaced
-f Follow the file changes
as it is updated. Does
not follow if the file is
replaced
-k Display only the last
<numKB> numKB kibibytes of the
file

diagnose debug logger list Lists all the loggers available

diagnose debug logger set Sets the log level for the specified logger
[config|fine|finer|finest|info|severe|warning] to the chosen log level (eg info, severe,
[<logger>] etc)
diagnose debug logger unset [<logger>] Unset the specified loggers log level
back to INHERIT

FortiNAC-OS F 7.2.4 CLI Reference Guide 17

Fortinet Inc.
Diagnose commands

Command Description
diagnose debug plugin list Lists all the plugins, their associated
loader, and their debug status. Type “q”
to return to prompt
diagnose debug plugin list-debug-enabled Lists all the debug-enabled plugins
along with their associated loader

diagnose debug plugin perf [<plugin>] Display the performance metrics for the
specified plugin
diagnose debug plugin [enable|disable] Enable or disable debug for the
[<plugin>] specified plugin
diagnose send-test-email [-file=<fileName>] - Send a Test email to verify Email server
message=<message> -subject=<subject> - configuration.
to=<mailTo>

diagnose entitlements [-debug] [-poll] Print out entitlements information.

diagnose dump-dpc-rules [COMMAND] Displays and manipulates Device
Profiling rule information.

Available options:

display- Display all Device

all Profiling Rules
display- Display a DPC Rule
by-id by ID
display- Dump DPC Rule by
by-name name
size Display the scan
queue size
export Export Device
Profiling rules to
specified file
import Import Device
Profiling rules from
specified file
flush Flush scan queue
scan-all Scan all rogues
scan Scan a specified
MAC address
help Display usage

FortiNAC-OS F 7.2.4 CLI Reference Guide 18

Fortinet Inc.
Diagnose commands

Command Description
diagnose dump-dpc-hosts [COMMAND] Displays Host Device Profiling
information

Available options:

display- Display all Device

all Profiling host
information
display- Display Device
by-rule- Profiling host
id information for
Display specified rule id
display- Display Device
by-rule- Profiling host
name information for
specified rule name
display- Display Device
by- Profiling host
sponsor- information with
username matching sponsor
username
display- Display Device
by- Profiling host
sponsor- information with
id matching sponsor id
display- Display host device
by- profiling information
profile- by profile name
name

display- Display host device

by- profiling information
profile- by profile id
id

help help Display usage

diagnose dump-admin-profile [COMMAND] Displays Admin Profile information

Available options:

display- Display all Admin

all Profiles

FortiNAC-OS F 7.2.4 CLI Reference Guide 19

Fortinet Inc.
Diagnose commands

Command Description

display- Display a specified

by-name Admin Profile by
name
display- Display a specified
by-id Admin Profile by ID
help Display usage

diagnose group [COMMAND] Display and manipulate group model

information
Available options:

display- Display all groups

all
display- Display group
group-by- information and/or
name elements by group
name
display- Display group
group-by- information and/or
id elements using group
ID
delete- Delete the selected
group-by- group using database
id ID
delete- Delete the selected
group-by- group
name

clear- Clear valid/inactive

time-by- times for elements in
name the the Host group
clear- Clear valid/inactive
time-by- times for elements in
id the the Host group
delete- Delete an element
from- referenced by name
group-by- from the selected
name group

FortiNAC-OS F 7.2.4 CLI Reference Guide 20

Fortinet Inc.
Diagnose commands

Command Description

add- Add an element to the

element- selected group
to-group

help Display usage

diagnose hardware deviceinfo disk Display information of all disks.

diagnose hardware deviceinfo tpm Display TPM information.
diagnose hardware info Show hardware info.
diagnose hardware lspci [-v] List PCI parameters.
Option
-v : Display verbose output
diagnose hardware psu Show power supply info
diagnose system disk info Show the SMART information.
diagnose system disk health Show the SMART health status.
diagnose system disk errors Show the SMART error logs.
diagnose system disk attributes Show vendor specific SMART attributes.
diagnose system raid status Show RAID status.

FortiNAC-OS F 7.2.4 CLI Reference Guide 21

Fortinet Inc.
Configuration commands

Configuration commands

Global

Global configuration is handled within the global context. This is for settings that apply to the system as a whole
(such as hostname) that otherwise do not fit in other contexts.
To enter the global context, from the base context run:
config system global

Available commands

Command Description
abort Cancels any edits made since entering the context, and
returns to the base context

end Saves changes made since entering the context, and

returns to the base context

help Shows the available commands

show Show the current configuration, including uncommitted
edits

set admin-idle-timeout [1-480] Sets the administrator idle timeout to the specified
minutes, between 1 and 480

set hostname [<hostname>] Sets the hostname to the specified value

set timezone [<time zone id>] Sets the time zone to the specified time zone id. To see a
list of time zones and their ids, leave time zone id blank

set timezone help Alternative method to get the list of timezone ids and their
corresponding timezone

set strong-crypto [disable|enable] Enables or disables strong-crypto mode, which will ensure
running services utilize only secure cryptographic
configurations
unset [admin-idle- Resets the specified configuration to the default value
timeout|hostname|timezone|strong-
crypto]

DNS

DNS configuration is handled within the DNS context.

FortiNAC-OS F 7.2.4 CLI Reference Guide 22

Fortinet Inc.
Configuration commands

To enter the DNS configuration, from the base context run:

config system dns

Available commands

Command Description
abort Cancels any edits made since entering the context, and returns to the base
context

end Saves changes made since entering the context, and returns to the base
context

help Shows the available commands

show Show the current configuration, including uncommitted edits

set primary [<primary Sets the primary DNS address (ip or hostname)
address>]

set secondary Sets the secondary DNS address(ip or hostname)

[<secondary address>]

unset Unsets the primary or secondary address

[primary|secondary]

Admin user

Administrator user configuration is handled in the admin context

To enter the admin context, from the base context run:
config system admin

Available commands

Command Description
abort Cancels any edits made since entering the context, and returns to the base
context

end Saves changes made since entering the context, and returns to the base
context

help Shows the available commands

show Show the current configuration, including uncommitted edits
delete [<admin name>] Delete the specified administrator
edit [<admin name>] Brings up the admin user context for the specified user. If admin name
doesn’t match an existing user, a new user will be created when the
changes are committed

FortiNAC-OS F 7.2.4 CLI Reference Guide 23

Fortinet Inc.
Configuration commands

Admin User Context

Available commands

Command Description
abort Cancels any edits made since entering the context, and returns to the base
context

end Saves changes made since entering the context, and returns to the base
context

next Readies the changes for commit, but does not push them until end is called
on the admin context. Returns to the admin context.

show Show the current configuration, including uncommitted edits

set password Sets the user’s password to the specified value. Must be between 8 and
[<password>] 128 characters long

High Availability

High Availability configuration is handled inside the ha context

To enter the ha context, from the base context run:
config system ha

Available commands

Command Description
abort Cancels any edits made since entering the context, and returns to the base
context

end Saves changes made since entering the context, and returns to the base
context

help Shows the available commands

show Show the current configuration, including uncommitted edits

set public-key add Add the specified SSH public key for use with high-availability connectivity
[<key contents>]

FortiNAC-OS F 7.2.4 CLI Reference Guide 24

Fortinet Inc.
Configuration commands

Command Description
set public-key import Import the specified remote SSH public key for use with high-availability
[<remote key path>] connectivity by copying it from the specified remotely accessible SSH host
[<remote host>]
[<remote username>]
[<remote password>]

Interface

Interface configuration is handled in the global interface context. To enter the global interface context, from the
base context run:
config system interface

Available commands

Command Description
abort Cancels any edits made since entering the context, and returns to the base
context

end Saves changes made since entering the context, and returns to the base
context

help Shows the available commands

show Show the current configuration, including uncommitted edits

edit [<interface>] Enter the specified interface’s context, in order to edit that interface’s
configuration

port1 Management
port2 Portal/Isolation interface
port3 Available network port
port4 Available network port
port5 Available network port
port6 Available network port

FortiNAC-OS F 7.2.4 CLI Reference Guide 25

Fortinet Inc.
Configuration commands

Specific Interface Context

Inside a specific interface’s context, the following commands are available:

Command Description
abort Cancels any edits made since entering the context, and returns to the
base context

end Saves changes made since entering the context, and returns to the
base context

help Shows the available commands

next Readies the changes for commit, but does not push them until end is
called on the global interface context. Returns to the global interface
context
show Show the current configuration, including uncommitted edits

set allowaccess [[protocol Enables access to this interface via the specified protocol. Multiple
list]] options must be specified at once to enable both.
Example: Enable both http and https:
set allowaccess http https

Available options:

dhcp DHCP (UDP ports 67, 68, 546, 547) [Portal

and Management]

dns DNS (TCP/UDP port 53) [Portal]

fsso FSSO (TCP port 8000) [Management]

http HTTP (TCP port 80) [Portal]
http-adminui Admin UI HTTP (TCP port 8080)
[Management]
https HTTPS (TCP port 443) [Portal]
https-adminui Admin UI HTTPS (TCP port 8443)
[Management]
netflow NetFlow (UDP port 2055) [Management]
nac-agent FortiNAC Agent (TCP port 4568) [Portal]
nac-ipc NAC IPC (TCP ports 1050, 5555, 30000-
64000) [Management]

FortiNAC-OS F 7.2.4 CLI Reference Guide 26

Fortinet Inc.
Configuration commands

Command Description

ping Ping (ICMP) [Management]

radius RADIUS (TCP/UDP port 1812) [Management]
radius-acct RADIUS Accounting (TCP/UDP port 1813)
[Management]
radius-local Local RADIUS (TCP/UDP port 1645)
[Management]
radius-local- Local RADIUS RadSec (TCP/UDP port 2083)
radsec [Management]
snmp SNMP (UDP ports 161 and 162)
[Management]
ssh SSH (TCP port 22) [Management]
syslog Syslog (UDP port 53) [Management]

set allowaccess help Alternative method to get the help for all the options available for
allowaccess

set ip [<ip/cidr>] Specifies the interface’s IPv4 address and subnet mask. For
example:
set ip 192.0.2.5/24

set ip6 [<ip6/cidr>] Specifies the interface’s IPv6 address and subnet mask

set mode [static|dhcp] Sets the interface’s IP mode to be either static or dynamically
allocated

unset Unset the specified configuration back to the default value

[allowaccess|ip|ip6|mode]

NTP

NTP configuration is handled inside the ntp context

To enter the ntp context, from the base context run:
config system ntp

Available commands

FortiNAC-OS F 7.2.4 CLI Reference Guide 27

Fortinet Inc.
Configuration commands

Command Description
abort Cancels any edits made since entering the context, and
returns to the base context

end Saves changes made since entering the context, and

returns to the base context

help Shows the available commands

show Show the current configuration, including uncommitted edits

set ntpserver [<ntp address>] Sets the NTP server address list. You may specify up to 10
addresses, space separated. All addresses must be
reachable
set ntpsync [disable|enable] Enable or disable syncing time with specified ntp servers

set syncinterval [1-1440] Set the interval to sync in minutes, between 1 and 1440

unset Unset the configured value for the specified property, and
[ntpserver|ntpsync|syncinterval] reset it to default

Route

Route configuration is handled inside the global route context

To enter the global route context, from the base context run:
config system route

Available commands

Command Description
abort Cancels any edits made since entering the context, and returns to the base
context

end Saves changes made since entering the context, and returns to the base
context

help Shows the available commands

show Show the current configuration, including uncommitted edits

delete [<route id>] Deletes the specified route

FortiNAC-OS F 7.2.4 CLI Reference Guide 28

Fortinet Inc.
Configuration commands

Command Description
purge Deletes all configured routes
rename [<route id>] to Rename a route id to the specified new id
[<new route id>]

edit [<route id>] Opens the specific route context for the specified route id

Specific Route Context

Inside a specific route context, the following commands are available:

Command Description
abort Cancels any edits made since entering the context, and returns to the base
context

end Saves changes made since entering the context, and returns to the base
context

next Readies the changes for commit, but does not push them until end is called
on the global interface context. Returns to the global interface context
show Show the current configuration, including uncommitted edits

set device [<interface Set the interface for this route to the specified interface
name>]

set dst [<ipv4/cidr>] Set the destination subnet for this route to the specified IPv4 Address and
CIDR mask.

Example:
set dst 192.0.2.0/24

set gateway [<gateway Set the gateway IP used for this route
ip>]

unset Unset the specified configuration and reset it to the default value
[device|dst|gateway]

FortiNAC-OS F 7.2.4 CLI Reference Guide 29

Fortinet Inc.
Shell Commands

Shell Commands

Enters a shell to interact with the appliance more directly. Once in this mode, many of the commands used in
CentOS are the same.
It is handled inside the shell context
To enter the shell context, from the base context run:
execute enter-shell

The following commands are available:

Command Description
DeviceImport Imports (create) devices based on the contents of the input CSV file. This
tool only supports importing SNMP devices that are managed using
SNMPv1
For usage details see CLI import tool in the Administration Guide.
All entries in the file should be for devices of the same type.
EntitlementsTool The poll function uses the serial number to look up entitlements
getDefaultGW Displays port1 default gateway

getIPAddr Displays port1 IP address

device -ip <device ip> To support per-device SSH authentication customizations.

-setAttr -name <name> Available options:
-value <value>
Name Value
SSH_KEX A quoted string containing names of key
exchange algorithms separated by a space.
(Order is preserved)
SSH_CIPHERS A quoted string containing names of ciphers
separated by a space
SSH_MACS A quoted string containing names macs separated
by a space
SSH_KBD_ A string containing true or false. Enables/Disables
ENABLED keyboard-interactive. Disabled by default

Example 1 - Override the default kex list:

device -ip 10.12.228.126 -setAttr -name SSH_KEX -value
"diffie-hellman-group1-sha1 diffie-hellman--sha1"

Example 2 - Eable keyboard-interactive:

FortiNAC-OS F 7.2.4 CLI Reference Guide 30

Fortinet Inc.
Shell Commands

Command Description
device -ip 10.12.228.126 -setAttr -name SSH_KBD_ENABLED -
value true

Example 3 - Remove or restore default settings (remove the

attribute):
device -ip 10.12.228.126 -delAttr -name SSH_KBD_ENABLED

sudo grab-log-snapshot Creates a one-time snapshot of the logs available on the appliance. For
details see KB article 190755
For Admin UI instructions see Download logs in the Administration Guide
SendCoA This program will exercise the Radius rfc5176 functionality
Selection Options:
-ip <NAS device IP>

-mac <Mac address of client to impact>

-dis <disconnect command>

-policy <VLAN/Role/etc to change for the client

using CoA command>

If no operation is specified, then this message is displayed

Example 1 - To issue a disconnect command to a device.
SendCoA -ip 10.1.0.25 -mac 00:1B:77:11:CE:2F -dis

Example 2 - To change the policy on a client.

SendCoA -ip 10.1.0.25 -mac 00:1B:77:11:CE:2F -
policy Production

shutdownNAC Shuts down FortiNAC processes

No option: Stops Yams process & idles system (if HA system, will not
failover)
-kill: Stops Yams and CampusManager processes
(If done without idling system first, will force failover on HA systems)
startupNAC Starts up FortiNAC processes (Yams & CampusManager)
sudo systemctl status Confirm running state of the DHCP service. Type “q” to return to prompt
dhcpd

sudo ydb_dated_backup Database backup with timestamp included in filename. Backs up locally to
disk (/bsc/backups/).

For Admin UI instructions see Database backup/restore in the

Administration Guide
sudo systemctl status Confirm running state of the named service. Type “q” to return to prompt
named

FortiNAC-OS F 7.2.4 CLI Reference Guide 31

Fortinet Inc.
Shell Commands

Command Description
uptime The number of days/min/sec since last power up or reboot.
sudo ydb_restore_full_ Load a previously saved database backup. For Admin UI instructions see
backup Database backup/restore in the Administration Guide

FortiNAC-OS F 7.2.4 CLI Reference Guide 32

Fortinet Inc.
Copyright© 2023 Fortinet, Inc. All rights reserved. Fortinet®, FortiGate®, FortiCare® and FortiGuard®, and certain other marks are registered trademarks of Fortinet, Inc., in the
U.S. and other jurisdictions, and other Fortinet names herein may also be registered and/or common law trademarks of Fortinet. All other product or company names may be
trademarks of their respective owners. Performance and other metrics contained herein were attained in internal lab tests under ideal conditions, and actual performance and
other results may vary. Network variables, different network environments and other conditions may affect performance results. Nothing herein represents any binding
commitment by Fortinet, and Fortinet disclaims all warranties, whether express or implied, except to the extent Fortinet enters a binding written contract, signed by Fortinet’s
General Counsel, with a purchaser that expressly warrants that the identified product will perform according to certain expressly-identified performance metrics and, in such
event, only the specific performance metrics expressly identified in such binding written contract shall be binding on Fortinet. For absolute clarity, any such warranty will be
limited to performance in the same ideal conditions as in Fortinet’s internal lab tests. In no event does Fortinet make any commitment related to future deliverables, features or
development, and circumstances may change such that any forward-looking statements herein are not accurate. Fortinet disclaims in full any covenants, representations, and
guarantees pursuant hereto, whether express or implied. Fortinet reserves the right to change, modify, transfer, or otherwise revise this publication without notice, and the most
current version of the publication shall be applicable.