FortiGate命令行

最新推荐文章于 2024-04-27 15:05:51 发布

阿木木的枸杞生活

最新推荐文章于 2024-04-27 15:05:51 发布

阅读量1.4k

点赞数

分类专栏：安全文章标签：网络

本文链接：https://blog.csdn.net/w13711790476/article/details/127824316

版权

安全专栏收录该内容

1 篇文章 0 订阅

订阅专栏

主要是介绍FortiGate命令行

一，命令结构

config      Configure object.                                      对策略，对象等进行配置 

get         Get dynamic and system information.         查看相关关对象的参数信息 

show        Show configuration.                                  查看配置文件 

diagnose    Diagnose facility.                                      诊断命令 

execute     Execute static commands.                        常用的工具命令，如 ping 

exit        Exit the CLI.                                                  退出

二，常用命令

常用配置命令：

1、配置接口地址:

FortiGate # config system interface 

FortiGate (interface) # edit lan 

FortiGate (lan) # set ip 192.168.100.99/24 

FortiGate (lan) # end

2、配置静态路由

FortiGate # config router static 

FortiGate (static) # edit 0    //    “ 0 ”系统自动分配路由条目的序号 

FortiGate (0) # set device wan1    // 出接口 

FortiGate (0) # set dst 10.0.0.0 255.0.0.0    // 目的网段 

FortiGate (0) # set gateway 192.168.57.1    // 网关IP 

FortiGate (0) # end

3、添加默认路由

FortiGate # config router static 

FortiGate (static) # edit 0  

FortiGate (0) # set gateway 192.168.57.1 

FortiGate (0) # set device wan1 

FortiGate (0) # end

4、添加IP地址对象

FortiGate # config firewall address 

FortiGate (address) # edit clientnet 

new entry 'clientnet' added 

FortiGate (clientnet) # set subnet 192.168.1.0 255.255.255.0 

FortiGate (clientnet) # end

5、添加DHCP地址池

FortiGate# config firewall ippool 

FortiGate (ippool) # edit nat-pool 

new entry 'nat-pool' added 

FortiGate (nat-pool) # set startip 100.100.100.1 

FortiGate (nat-pool) # set endip 100.100.100.100 

FortiGate (nat-pool) # end

6、添加虚拟ip

FortiGate # config firewall vip 

FortiGate (vip) # edit webserver 

new entry 'webserver' added 

FortiGate (webserver) # set extip 202.0.0.167 

FortiGate (webserver) # set extintf wan1 

FortiGate (webserver) # set mappedip 192.168.0.168 

FortiGate (webserver) # end

7、配置访问控制策略

FortiGate # config firewall policy 

FortiGate (policy) # edit 1         

FortiGate (1)#set srcintf internal  //源接口 

FortiGate (1)#set dstintf wan1    //目的接口 

FortiGate (1)#set srcaddr all        //源地址 

FortiGate (1)#set dstaddr all       //目的地址 

FortiGate (1)#set action accept      //动作 

FortiGate (1)#set schedule always    //时间 

FortiGate (1)#set service ALL          //服务 

FortiGate (1)#set logtraffic disable     //日志开关 

FortiGate (1)#set nat enable        //开启nat 

FortiGate (1)#end

8、配置VIP映射策略

FortiGate # config firewall policy 

FortiGate (policy) #edit 2 

FortiGate (2)#set srcintf wan1  //源接口 

FortiGate (2)#set dstintf internal //目的接口 

FortiGate (2)#set srcaddr all          //源地址 

FortiGate (2)#set dstaddr ngfw1  //目的地址，虚拟VIP映射，需要先配置好VIP条目才可以被调用 

FortiGate (2)#set action accept     //动作 

FortiGate (2)#set schedule always //时间 

FortiGate (2)#set service ALL     //服务 

FortiGate (2)#set logtraffic all   //日志开关 

end