Fortinet black logo

Version:

7.4.1
7.4.0
7.2.3

Version:

7.2.2
7.2.1
7.2.0

Version:

7.0.8
7.0.7
7.0.6

Version:

7.0.5
7.0.4
7.0.3

Version:

7.0.2
7.0.1
7.0.0

Version:

6.4.12
6.4.11
6.4.10

Version:

6.4.9
6.4.8
6.4.7

Version:

6.4.6
6.4.5
6.4.4

Version:

6.4.3
6.4.2
6.4.1

Version:

6.4.0
6.2.11
6.2.10

Version:

6.2.9
6.2.8
6.2.7

Version:

6.2.6
6.2.5
6.2.3

Version:

6.2.2
6.2.1
6.2.0

Version:

6.0.12
6.0.11
6.0.10

Version:

6.0.9
6.0.8
6.0.7

Version:

6.0.6
6.0.5
6.0.4

Version:

6.0.3
6.0.2
6.0.1

Version:

6.0.0
5.6.11
5.6.10

Version:

5.6.9
5.6.8
5.6.8

Version:

5.6.7
5.6.7
5.6.6

Version:

5.6.6
5.6.5
5.6.5

Version:

5.6.4
5.6.4
5.6.3

Version:

5.6.3
5.6.2
5.6.2

Version:

5.6.1
5.6.1
5.6.0

Version:

5.6.0
5.4.7
5.4.6

Version:

5.4.5
5.4.5
5.4.4

Version:

5.4.4
5.4.3
5.4.3

Version:

5.4.2
5.4.2
5.4.1

Version:

5.4.1
5.4.0
5.4.0

Version:

5.2.10
5.2.9
5.2.9

Version:

5.2.7
5.2.7
5.2.6

Version:

5.2.6
5.2.5
5.2.5

Version:

5.2.4
5.2.4
5.2.3

Version:

5.2.3
5.2.2
5.2.1

Version:

5.2.0
5.0.13
5.0.13

Version:

5.0.11
5.0.11
5.0.10

Version:

5.0.9
5.0.8
5.0.7

Version:

5.0.6
5.0.5
5.0.4

Version:

5.0.3
5.0.2
5.0.1

Version:

4.3.0
4.2.0
4.1.0

Version:

4.0.0

Table of Contents

CLI Reference

6.0.1
7.4.1
7.4.0
7.2.3
7.2.2
7.2.1
7.2.0
7.0.8
7.0.7
7.0.6
7.0.5
7.0.4
7.0.3
7.0.2
7.0.1
7.0.0
6.4.12
6.4.11
6.4.10
6.4.9
6.4.8
6.4.7
6.4.6
6.4.5
6.4.4
6.4.3
6.4.2
6.4.1
6.4.0
6.2.11
6.2.10
6.2.9
6.2.8
6.2.7
6.2.6
6.2.5
6.2.3
6.2.2
6.2.1
6.2.0
6.0.12
6.0.11
6.0.10
6.0.9
6.0.8
6.0.7
6.0.6
6.0.5
6.0.4
6.0.3
6.0.2
6.0.1
6.0.0
5.6.11
5.6.10
5.6.9
5.6.8
5.6.8
5.6.7
5.6.7
5.6.6
5.6.6
5.6.5
5.6.5
5.6.4
5.6.4
5.6.3
5.6.3
5.6.2
5.6.2
5.6.1
5.6.1
5.6.0
5.6.0
5.4.7
5.4.6
5.4.5
5.4.5
5.4.4
5.4.4
5.4.3
5.4.3
5.4.2
5.4.2
5.4.1
5.4.1
5.4.0
5.4.0
5.2.10
5.2.9
5.2.9
5.2.7
5.2.7
5.2.6
5.2.6
5.2.5
5.2.5
5.2.4
5.2.4
5.2.3
5.2.3
5.2.2
5.2.1
5.2.0
5.0.13
5.0.13
5.0.11
5.0.11
5.0.10
5.0.9
5.0.8
5.0.7
5.0.6
5.0.5
5.0.4
5.0.3
5.0.2
5.0.1
4.3.0
4.2.0
4.1.0
4.0.0
Download PDF
Copy Doc ID c495e632-91d2-11e8-a49a-00505692583a:199491
Copy Link

admin

Use the following commands to configure admin related settings.

admin group

Use this command to add, edit, and delete admin user groups.

Syntax

config system admin group

edit <name>

set <member>

end

Variable

Description

<name>

Enter the name of the group you are editing or enter a new name to create an entry. Character limit: 63

<member>

Add group members.

admin ldap

Use this command to add, edit, and delete Lightweight Directory Access Protocol (LDAP) users.

Syntax

config system admin ldap

edit <name>

set server <string>

set secondary-server <string>

set tertiary-server <string>

set cnid <string>

set dn <string>

set port <integer>

set type {anonymous | regular | simple}

set username <string>

set password <passwd>

set memberof-attr <string>

set profile-attr <string>

set adom-attr <string>

set group <string>

set filter <string>

set attributes <filter>

set secure {disable | ldaps | starttls}

set ca-cert <string>

set connect-timeout <integer>

set adom <adom-name>

end

Variable

Description

<name>

Enter the name of the LDAP server or enter a new name to create an entry. Character limit: 63

server <string>

Enter the LDAP server domain name or IPv4 address. Enter a new name to create a new entry.

secondary-server <string>

Enter the secondary LDAP server domain name or IPv4 address. Enter a new name to create a new entry.

tertiary-server <string>

Enter the tertiary LDAP server domain name or IPv4 address. Enter a new name to create a new entry.

cnid <string>

Enter the common name identifier. Default: cn. Character limit: 20

dn <string>

Enter the distinguished name.

port <integer>

Enter the port number for LDAP server communication. Default: 389. Range: 1 to 65535

type {anonymous | regular | simple}

Set a binding type. The following options are available:

  • anonymous: Bind using anonymous user search
  • regular: Bind using username/password and then search
  • simple: Simple password authentication without search (default)

username <string>

Enter a username. This variable appears only when type is set to regular.

password <passwd>

Enter a password for the username above. This variable appears only when type is set to regular.

memberof-attr <string>

The attribute used to retrieve memeberof.

profile-attr <string>

The attribute used to retrieve admin profile.
adom-attr <string>

The attribute used to retrieve ADOM.

group <string>

Enter an authorization group. The authentication user must be a member of this group (full DN) on the server.

filter <string>

Enter content for group searching. For example:

(&(objectcategory=group)(member=*))

(&(objectclass=groupofnames)(member=*))

(&(objectclass=groupofuniquenames)(uniquemember=*))

(&(objectclass=posixgroup)(memberuid=*))

attributes <filter>

Attributes used for group searching (for multi-attributes, a use comma as a separator). For example:

  • member
  • uniquemember
  • member,uniquemember

secure {disable | ldaps | starttls}

Set the SSL connection type.

ca-cert <string>

CA certificate name. This variable appears only when secure is set to ldaps or starttls.

connect-timeout <integer>

Set the LDAP connection timeout (msec).

adom <adom-name>

Set the ADOM name to link to the LDAP configuration.

Example

This example shows how to add the LDAP user user1 at the IPv4 address 206.205.204.203.

config system admin ldap

edit user1

set server 206.205.204.203

set dn techdoc

set type regular

set username auth1

set password auth1_pwd

set group techdoc

end

admin profile

Use this command to configure access profiles. In a newly-created access profile, no access is enabled.

Syntax

config system admin profile

edit <profile_name>

set adom-switch {none | read | read-write}

set change-password {enable | disable}

set datamask {enable | disable}

set datamask-fields <fields>

set datamask-key <passwd>

set description <text>

set device-ap {none | read | read-write}

set device-forticlient {none | read | read-write}

set device-fortiswitch {none | read | read-write}

set device-manager {none | read | read-write}

set device-op {none | read | read-write}

set device-wan-link-load-balance {none | read | read-write}

set event-management {none | read | read-write}

set log-viewer {none | read | read-write}

set realtime-monitor {none | read | read-write}

set report-viewer {none | read | read-write}

set scope {adom | global}

set system-setting {none | read | read-write}

config datamask-custom-fields

edit <field>

set field-category {alert | all | fortiview | log | euba}

set field-type {email | ip | mac | string}

next

end

Variable

Description

<profile>

Edit the access profile. Enter a new name to create a new profile. The pre-defined access profiles are Super_User, Standard_User, Restricted_User, and Package_User. Character limit: 35

adom-switch {none | read | read-write}

Configure administrative domain (ADOM) permissions for this profile. Select none to hide this option from the administrator in the GUI. The following options are available:

  • none: No permission.
  • read: Read permission.
  • read-write: Read-write permission.

Controlled functions: ADOM settings in DVM, ADOM settings in All ADOMs page (under System Settings tab)

Dependencies: If system-setting is none, the All ADOMs page is not accessible, type must be set to system

change-password {enable | disable}

Enable/disable allowing restricted users to change their password.

datamask {enable | disable}

Enable/disable data masking (default = disable).

datamask-fields <fields>

Enter that data masking fields, separated by spaces.

  • dstip: Destination IP
  • dstname: Destination name
  • email: Email
  • message: Message
  • srcip: Source IP
  • srcmac: Source MAC
  • srcname: Source name
  • user: User name

datamask-key <passwd>

Enter the data masking encryption key.

description <string>

Enter a description for this access profile. Enclose the description in quotes if it contains spaces. Character limit: 1023

device-ap {none | read | read-write}

Set the AP Manager permission:

  • none: No permission.
  • read: Read permission.
  • read-write: Read-write permission.

device-forticlient {none | read | read-write}

Set the FortiClient Manager permission:

  • none: No permission.
  • read: Read permission.
  • read-write: Read-write permission.

device-fortiswitch {none | read | read-write}

 Set the FortiSwitch Manager permission:
  • none: No permission.
  • read: Read permission.
  • read-write: Read-write permission.

device-manager {none | read | read-write}

Enter the level of access to Device Manager settings for this profile. Select none to hide this option from the administrator in the GUI. The following options are available:

  • none: No permission.
  • read: Read permission.
  • read-write: Read-write permission.

This command corresponds to the Device Manager option in the GUI administrator profile.

Controlled functions: Device Manager

Dependencies: type must be set to system

device-op {none | read | read-write}

Add the capability to add, delete, and edit devices to this profile. Select none to hide this option from the administrator in the GUI. The following options are available:

  • none: No permission.
  • read: Read permission.
  • read-write: Read-write permission.

This command corresponds to the Add/Delete Devices/Groups option in the GUI administrator profile. This is a sub-setting of device-manager.

Controlled functions: Add or delete devices or groups

Dependencies: type must be set to system

device-wan-link-load-balance {none | read | read-write}

Set the WAN Link Load Balance permission:

  • none: No permission.
  • read: Read permission.
  • read-write: Read-write permission.

event-management {none | read | read-write}

Set the Event Management permission. Select none to hide this option from the administrator in the GUI. The following options are available:

  • none: No permission.
  • read: Read permission.
  • read-write: Read-write permission.

This command corresponds to the Event Management option in the GUI administrator profile.

Controlled functions: Event Management tab and all its operations

Dependencies: faz-status must be set to enable in system global, type must be set to system

log-viewer {none | read | read-write}

Set the Log View permission. Select none to hide this option from the administrator in the GUI. Enter one of the following settings:

  • none: No permission.
  • read: Read permission.
  • read-write: Read-write permission.

This command corresponds to the Log View option in the GUI administrator profile.

Controlled functions: Log View and all its operations

Dependencies: faz-status must be set to enable in system global, type must be set to system

realtime-monitor {none | read | read-write}

Enter the level of access to the Drill Down configuration settings for this profile. Select none to hide this option from the administrator in the GUI. Enter one of the following settings: 

  • none: No permission.
  • read: Read permission.
  • read-write: Read-write permission.

This command corresponds to the Drill Down option in the GUI administrator profile.

Controlled functions: Drill Down tab and all its operations

Dependencies: faz-status must be set to enable in system global, type must be set to system

report-viewer {none | read | read-write}

Set the Reports permission. Select none to hide this option from the administrator in the GUI. Enter one of the following settings:

  • none: No permission.
  • read: Read permission.
  • read-write: Read-write permission.

This command corresponds to the Reports option in the GUI administrator profile.

Controlled functions: Reports tab and all its operations

Dependencies: faz-status must be set to enable in system global, type must be set to system

scope (Not Applicable)

CLI command is not in use.

system-setting {none | read | read-write}

Configure System Settings permissions for this profile. Select none to hide this option from the administrator in the GUI. Enter one of the following settings:

  • none: No permission.
  • read: Read permission.
  • read-write: Read-write permission.

This command corresponds to the System Settings option in the GUI administrator profile.

Controlled functions: System Settings tab, All the settings under System setting

Dependencies: type must be set to system

Variables for config datamask-custom-fields subcommand:

<field>

Enter the custom field name.

field-category {alert | all | fortiview | log | euba}

Enter the field category.

field-type {email | ip | mac | string}

Enter the field type.

admin radius

Use this command to add, edit, and delete administration RADIUS servers.

Syntax

config system admin radius

edit <server>

set auth-type {any | chap | mschap2 | pap}

set nas-ip <ipv4_address>

set port <integer>

set secondary-secret <passwd>

set secondary-server <string>

set secret <passwd>

set server <string>

end

Variable

Description

<server>

Enter the name of the RADIUS server or enter a new name to create an entry. Character limit: 63

auth-type {any | chap | mschap2 | pap}

Enter the authentication protocol the RADIUS server will use.

  • any: Use any supported authentication protocol.
  • mschap2: Microsoft Challenge Handshake Authentication Protocol version 2(MS-CHAPv2).
  • chap: Challenge Handshake Authentication Protocol (CHAP)
  • pap: Password Authentication Protocol (PAP).

nas-ip <ipv4_address>

Enter the network access server (NAS) IPv4 address and called station ID.

port <integer>

Enter the RADIUS server port number. Default: 1812. Range: 1 to 65535

secondary-secret <passwd>

Enter the password to access the RADIUS secondary-server. Character limit: 64

secondary-server <string>

Enter the RADIUS secondary-server DNS resolvable domain name or IPv4 address.

secret <passwd>

Enter the password to access the RADIUS server.  Character limit: 64

server <string>

Enter the RADIUS server DNS resolvable domain name or IPv4 address.

Example

This example shows how to add the RADIUS server RAID1 at the IPv4 address 206.205.204.203 and set the shared secret as R1a2D3i4U5s.

config system admin radius

edit RAID1

set server 206.205.204.203

set secret R1a2D3i4U5s

end

admin setting

Use this command to configure system administration settings, including web administration ports, timeout, and language.

Syntax

config system admin setting

set access-banner {enable | disable}

set admin-https-redirect {enable | disable}

set admin-login-max <integer>

set admin_server_cert <admin_server_certificate>

set banner-message <string>

set gui-them {aquarium | autumn | blue | city | diving | dreamy | galaxy | green | honey-bee | landscape | melongene | mountain | northern-light | purple-ink | red | skyline | snow | spring | structure-3d | succulents | summer | sunset | tree-ring | winter}

set http_port <integer>

set https_port <integer>

set idle_timeout <integer>

set objects-force-deletion {enable | disable}

set shell-access {enable | disable}

set shell-password <passwd>

set show-add-multiple {enable | disable}

set show-checkbox-in-table {enable | disable}

set show-device-import-export {enable | disable}

set show_hostname {enable | disable}

set show-log-forwarding {enable | disable}

set unreg_dev_opt {add_allow_service | add_no_service}

set webadmin_language {auto_detect | english | japanese | korean | simplified_chinese | traditional_chinese}

end

Variable

Description

access-banner {enable | disable}

Enable/disable the access banner. Default: disable

admin-https-redirect {enable | disable}

Enable/disable the redirection of HTTP admin traffic to HTTPS.

admin-login-max <integer>

Set the maximum number of admin users that be logged in at one time. Range: 1 to 256 (users)

admin_server_cert <admin_server_certificate>

Enter the name of an HTTPS server certificate to use for secure connections. FortiAnalyzer has the following certificates pre-loaded: server.crt and Fortinet_Local.

banner-message <string>

Enter a banner message. Character limit: 255

gui-theme {aquarium | autumn | blue | city | diving | dreamy | galaxy | green | honey-bee | landscape | melongene | mountain | northern-light | purple-ink | red | skyline | snow | spring | structure-3d | succulents | summer | sunset | tree-ring | winter}

Set the color scheme or imagery to use for the administration GUI. Options include: Aquarium, Autumn, Blueberry, City, Diving, Dreamy, Galaxy, Kiwi, Honey Bee, Landscape, Plum, Mountain, Northern Light, Purple Ink, Cherry, Skyline, Snow, Spring, 3D Structure, Succulents, Summer, Sunset, Tree Ring, and Winter

http_port <integer>

Enter the HTTP port number for web administration. Default: 80Range: 1 to 65535

https_port <integer>

Enter the HTTPS port number for web administration.Default: 443. Range: 1 to 65535

idle_timeout <integer>

Enter the idle timeout value. Default: 5. Range: 1 to 480 (minutes)

objects-force-deletion {enable | disable}

Enable/disable forced deletion of used objects.

shell-access {enable | disable}

Enable/disable shell access.

shell-password <passwd>

Enter the password to use for shell access.

show-add-multiple {enable | disable}

Enable/disable show the add multiple button in the GUI.

show-checkbox-in-table {enable | disable}

Show checkboxes in tables in the GUI.

show-device-import-export {enable | disable}

Enable/disable import/export of ADOM, device, and group lists.

show_hostname {enable | disable}

Enable/disable showing the hostname on the GUI login page (default = disable).

show-log-forwarding {enable | disable}

Enable/disable show log forwarding tab in analyzer mode.

unreg_dev_opt {add_allow_service | add_no_service}

Select action to take when an unregistered device connects to FortiAnalyzer. The following options are available:

  • add_allow_service: Add unregistered devices and allow service requests (default).
  • add_no_service: Add unregistered devices and deny service requests.

webadmin_language {auto_detect | english | japanese | korean | simplified_chinese | traditional_chinese}

Enter the language to be used for web administration. The following options are available:

  • auto_detect: Automatically detect language (default).
  • english: English.
  • japanese: Japanese.
  • korean: Korean.
  • simplified_chinese: Simplified Chinese.
  • traditional_chinese: Traditional Chinese.

Use the show command to display the current configuration if it has been changed from its default value:

show system admin setting

admin tacacs

Use this command to add, edit, and delete administration TACACS+ servers.

Syntax

config system admin tacacs

edit <name>

set authen-type {ascii | auto |chap | mschap | pap}

set authorization {enable | disable}

set key <passwd>

set port <integer>

set secondary-key <passwd>

set secondary-server <string>

set server <string>

set tertiary-key <passwd>

set tertiary-server <string>

end

Variable

Description

<name>

Enter the name of the TACACS+ server or enter a new name to create an entry. Character limit: 63

authen-type {ascii | auto |chap | mschap | pap}

Choose which authentication type to use. The following options are available: 

  • ascii: ASCII
  • auto: Uses PAP, MSCHAP, and CHAP (in that order) (default).
  • chap: Challenge Handshake Authentication Protocol (CHAP)
  • mschap: Microsoft Challenge Handshake Authentication Protocol (MS-CHAP)
  • pap: Password Authentication Protocol (PAP).

authorization {enable | disable}

Enable/disable TACACS+ authorization. The following options are available: 

  • disable: Disable TACACS+ authorization.
  • enable: Enable TACACS+ authorization (service = FortiGate).

key <passwd>

Key to access the server. Character limit: 128

port <integer>

Port number of the TACACS+ server. Range: 1 to 65535

secondary-key <passwd>

Key to access the secondary server. Character limit: 128

secondary-server <string>

Secondary server domain name or IPv4 address.

server <string>

The server domain name or IPv4 address.

tertiary-key <passwd>

Key to access the tertiary server. Character limit: 128

tertiary-server <string>

Tertiary server domain name or IPv4 address.

Example

This example shows how to add the TACACS+ server TAC1 at the IPv4 address 206.205.204.203 and set the key as R1a2D3i4U5s.

config system admin tacacs

edit TAC1

set server 206.205.204.203

set key R1a2D3i4U5s

end

admin user

Use this command to add, edit, and delete administrator accounts.

Use the admin account or an account with System Settings read and write privileges to add new administrator accounts and control their permission levels. Each administrator account must include a minimum of an access profile. The access profile list is ordered alphabetically, capitals first. If custom profiles are defined, it may change the default profile from Restricted_User. You cannot delete the admin administrator account. You cannot delete an administrator account if that user is logged on.

You can create meta-data fields for administrator accounts. These objects must be created using the FortiAnalyzer GUI. The only information you can add to the object is the value of the field (pre-determined text/numbers). For more information, see System Settings in the FortiAnalyzer Administration Guide.

Syntax

config system admin user

edit <name_str>

set password <passwd>

set change-password {enable | disable}

set trusthost1 <ipv4_mask>

set trusthost2 <ipv4_mask>

set trusthost3 <ipv4_mask>

...

set trusthost10 <ipv4_mask>

set ipv6_trusthost1 <ipv6_mask>

set ipv6_trusthost2 <ipv6_mask>

set ipv6_trusthost3 <ipv6_mask>

...

set ipv6_trusthost10 <ipv6_mask>

set profileid <profile-name>

set adom <adom_name(s)>

set dev-group <group-name>

set adom-exclude <adom_name(s)>

set policy-package <policy-package-name>

set restrict-access {enable | disable}

set description <string>

set user_type {group | ldap | local | pki-auth | radius | tacacs-plus}

set ldap-server <string>

set radius_server <string>

set tacacs-plus-server <string>

set ssh-public-key1 <key-type> <key-value>

set ssh-public-key2 <key-type>, <key-value>

set ssh-public-key3 <key-type> <key-value>

set wildcard <enable | disable>

set radius-accprofile-override <enable | disable>

set radius-adom-override <enable | disable>

set radius-group-match <string>

set password-expire <yyyy-mm-dd>

set force-password-change {enable | disable}

set subject <string>

set ca <string>

set two-factor-auth {enable | disable}

set rpc-permit {enable | disable}

set last-name <string>

set first-name <string>

set email-address <string>

set phone-number <string>

set mobile-number <string>

set pager-number <string>

set avatar <string>

end

config meta-data

edit <fieldname>

set fieldlength

set fieldvalue <string>

set importance

set status

end

end

config dashboard-tabs

edit tabid <integer>

set name <string>

end

end

config dashboard

edit moduleid

set name <string>

set column <column_pos>

set diskio-content-type

set diskio-period {1hour | 24hour | 8hour}

set refresh-inverval <integer>

set status {close | open}

set tabid <integer>

set widget-type <string>

set log-rate-type {device | log}

set log-rate-topn {1 | 2 | 3 | 4 | 5}

set log-rate-period {1hour | 2min | 6hours}

set res-view-type {history | real-time}

set res-period {10min | day | hour}

set res-cpu-display {average | each}

set num-entries <integer>

set time-period {1hour | 24hour | 8hour}

end

end

config restrict-dev-vdom

edit dev-vdom <string>

end

end

Variable

Description

<name_string>

Enter the name of the admin user or enter a new name to create a new user. Character limit: 35

password <passwd>

Enter a password for the administrator account. For improved security, the password should be at least 6 characters long. This variable is available only if user_type is local. Character limit: 128

change-password {enable | disable}

Enable/disable allowing restricted users to change their password.

trusthost1 <ipv4_mask>

trusthost2 <ipv4_mask>

...

trusthost10 <ipv4_mask>

Optionally, type the trusted host IPv4 address and network mask from which the administrator can log in to the FortiAnalyzer system. You can specify up to ten trusted hosts.

Setting trusted hosts for all of your administrators can enhance the security of your system.

Defaults:

trusthost1: 0.0.0.0 0.0.0.0 for all

others: 255.255.255.255 255.255.255.255 for none

ipv6_trusthost1 <ipv6_mask>

ipv6_trusthost2 <ipv6_mask>

...

ipv6_trusthost10 <ipv6_mask>

Optionally, type the trusted host IPv6 address from which the administrator can log in to the FortiAnalyzer system. You can specify up to ten trusted hosts.

Setting trusted hosts for all of your administrators can enhance the security of your system.

Defaults:

ipv6_trusthost1: ::/0 for all

others: ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff/128 for none

profileid <profile-name>

Enter the name of the access profile to assign to this administrator account. Access profiles control administrator access to FortiAnalyzer features. Default: Restricted_User. Character limit: 35

adom <adom_name(s)>

Enter the name(s) of the ADOM(s) the administrator belongs to. Any configuration of ADOMs takes place via the FortiAnalyzer GUI.

dev-group <group-name>

Enter the device group that the admin use can access. This option can only be used for administrators with access to only one ADOM.

adom-exclude <adom_name(s)>

Enter the name(s) of the excluding ADOM(s).

policy-package<policy-packagename>

Policy package access

restrict-access {enable | disable}

Enable/disable restricted access to the development VDOM (dev-vdom). Default: disable

description <string>

Enter a description for this administrator account. When using spaces, enclose description in quotes. Character limit: 127

user_type {group | ldap | local | pki-auth | radius | tacacs-plus}

Enter local if the FortiAnalyzer system verifies the administrator’s password. Enter radius if a RADIUS server verifies the administrator’s password. Enter of the following: 

  • group: Group user.
  • ldap: LDAP user.
  • local: Local user (default).
  • pki-auth: PKI user.
  • radius: RADIUS user.
  • tacacs-plus: TACACS+ user.

ldap-server <string>

Enter the LDAP server name if the user type is set to LDAP.

radius_server <string>

Enter the RADIUS server name if the user type is set t o RADIUS.

tacacs-plus-server <string>

Enter the TACACS+ server name if the user type is set to TACACS+.

ssh-public-key1 <key-type> <key-value>

ssh-public-key2 <key-type>, <key-value>

ssh-public-key3 <key-type> <key-value>

You can specify the public keys of up to three SSH clients. These clients are authenticated without being asked for the administrator password. You must create the public-private key pair in the SSH client application.

<key type> is ssh-dss for a DSA key, ssh-rsa for an RSA key.

<key-value> is the public key string of the SSH client.

wildcard <enable | disable>

Enable/disable wildcard remote authentication.

radius-accprofile-override <enable | disable>

Allow access profile to be overridden from RADIUS.

radius-adom-override <enable | disable>

Enable/disable the ADOM to be overridden from RADIUS.

In order to support vendor specific attributes (VSA), the RADIUS server requires a dictionary to define which VSAs to support. The Fortinet RADIUS vendor ID is 12365. The Fortinet-Vdom-Name attribute is used by this command.

radius-group-match <string>

Only admin that belong to this group are allowed to login.

password-expire <yyyy-mm-dd>

When enforcing the password policy, enter the date that the current password will expire.

force-password-change {enable | disable}

Enable/disable force password change on next login.

subject <string>

PKI user certificate name constraints. This command is available when a PKI administrator account is configured.

ca <string>

PKI user certificate CA (CA name in local). This command is available when a PKI administrator account is configured.

two-factor-auth {enable | disable}

Enable/disable two-factor authentication (certificate + password).

This command is available when a PKI administrator account is configured.

rpc-permit {enable | disable}

Set the permission level for log in via Remote Procedure Call (RPC). The following options are available: 

  • none: No permission (default).
  • read-only: Read-only permission.
  • read-write: Read-write permission.

last-name <string>

Administrators last name. Character limit: 63

first-name <string>

Administrators first name. Character limit: 63

email-address <string>

Administrators email address.

phone-number <string>

Administrators phone number.

mobile-number <string>

Administrators mobile phone number.

pager-number <string>

Administrators pager number.

avatar <string>

Image file for the administrator's avatar (maximum 4K base64 encode).

Variables for config meta-data subcommand:

This subcommand can only change the value of an existing field.

To create a new metadata field, use the config system metadata command.

fieldname

The label/name of the field. Read-only.  Default: 50

fieldlength

The maximum number of characters allowed for this field. Read-only.

fieldvalue <string>

Enter a pre-determined value for the field. This is the only value that can be changed with the config metadata subcommand.  Character limit: 255

importance

Indicates whether the field is compulsory (required) or optional (optional). Read-only. Default: optional

status

For display only. Value cannot be changed.  Default: enable

Variables for config dashboard-tabs subcommand:

tabid <integer>

Tab ID.

name <string>

Tab name.

Variables for config dashboard subcommand:

moduleid

Widget ID. 

  • 1: System Information
  • 2: System Resources
  • 3: License Information
  • 4: Unit Operation
  • 5: Log Receive Monitor
  • 6: Logs/Data Received
  • 7: Statistics
  • 8: Insert Rate vs Receive Rate
  • 9: Log Insert Lag Time
  • 10: Alert Message Console
  • 11: CLI Console
  • 12: Disk I/O

name <string>

Widget name. Character limit: 63

column <column_pos>

Widget’s column ID.

diskio-content-type {blks | iops | util}

Set the Disk I/O Monitor widget's chart type.

  • blks: the amount of data of I/O requests.
  • iops: the number of I/O requests.
  • util: bandwidth utilization.

diskio-period {1hour | 24hour | 8hour}

Set the Disk I/O Monitor widget's data period.

refresh-inverval <integer>

Widget’s refresh interval. Default: 300

status {close | open}

Widget’s opened/closed status. Default: open

tabid <integer>

ID of the tab where the widget is displayed. Default: 0

widget-type <string>

Widget type. The following options are available: 

  • alert: Alert Message Console.
  • devsummary: Device Summary.
  • jsconsole: CLI Console.
  • licinfo: License Information.
  • logdb-lag: Log Database Lag Time.
  • logdb-perf: Log Database Performance Monitor.
  • logrecv: Logs/Data Received.
  • raid: Disk Monitor.
  • rpteng: Report Engine.
  • statistics: Statistics.
  • sysinfo: System Information.
  • sysop: Unit Operation.
  • sysres: System resources.
  • top-lograte: Log Receive Monitor.

log-rate-type {device | log}

Log receive monitor widget’s statistics breakdown options.

log-rate-topn {1 | 2 | 3 | 4 | 5}

Log receive monitor widgets’s number of top items to display.

log-rate-period {1hour | 2min | 6hours}

Log receive monitor widget’s data period.

res-view-type {history | real-time}

Widget’s data view type. The following options are available: 

  • history: History view.
  • real-time: Real-time view.

res-period {10min | day | hour}

Widget’s data period. The following options are available: 

  • 10min: Last 10 minutes.
  • day: Last day.
  • hour: Last hour.

res-cpu-display {average | each}

Widget’s CPU display type. The following options are available: 

  • average: Average usage of CPU.
  • each: Each usage of CPU.

num-entries <integer>

Number of entries.

time-period {1hour | 24hour | 8hour}

Set the Log Database Monitor widget's data period. One of 1 hour, 8 hours, or 24 hours.

Variable for config restrict-dev-vdom subcommand:

dev-vdom <string>

Enter device or VDOM to edit.

Using trusted hosts

Setting trusted hosts for all of your administrators increases the security of your network by further restricting administrative access. In addition to knowing the password, an administrator must connect only through the subnet or subnets you specify. You can even restrict an administrator to a single IPv4 address if you define only one trusted host IPv4 address with a netmask of 255.255.255.255.

When you set trusted hosts for all administrators, the FortiAnalyzer system does not respond to administrative access attempts from any other hosts. This provides the highest security. If you leave even one administrator unrestricted, the unit accepts administrative access attempts on any interface that has administrative access enabled, potentially exposing the unit to attempts to gain unauthorized access.

The trusted hosts you define apply both to the GUI and to the CLI when accessed through SSH. CLI access through the console connector is not affected.

Example

Use the following commands to add a new administrator account named admin_2 with the password set to p8ssw0rd and the Super_User access profile. Administrators that log in to this account will have administrator access to the FortiAnalyzer system from any IPv4 address.

config system admin user

edit admin_2

set description "Backup administrator"

set password p8ssw0rd

set profileid Super_User

end

Previous
Next

admin

Use the following commands to configure admin related settings.

admin group

Use this command to add, edit, and delete admin user groups.

Syntax

config system admin group

edit <name>

set <member>

end

Variable

Description

<name>

Enter the name of the group you are editing or enter a new name to create an entry. Character limit: 63

<member>

Add group members.

admin ldap

Use this command to add, edit, and delete Lightweight Directory Access Protocol (LDAP) users.

Syntax

config system admin ldap

edit <name>

set server <string>

set secondary-server <string>

set tertiary-server <string>

set cnid <string>

set dn <string>

set port <integer>

set type {anonymous | regular | simple}

set username <string>

set password <passwd>

set memberof-attr <string>

set profile-attr <string>

set adom-attr <string>

set group <string>

set filter <string>

set attributes <filter>

set secure {disable | ldaps | starttls}

set ca-cert <string>

set connect-timeout <integer>

set adom <adom-name>

end

Variable

Description

<name>

Enter the name of the LDAP server or enter a new name to create an entry. Character limit: 63

server <string>

Enter the LDAP server domain name or IPv4 address. Enter a new name to create a new entry.

secondary-server <string>

Enter the secondary LDAP server domain name or IPv4 address. Enter a new name to create a new entry.

tertiary-server <string>

Enter the tertiary LDAP server domain name or IPv4 address. Enter a new name to create a new entry.

cnid <string>

Enter the common name identifier. Default: cn. Character limit: 20

dn <string>

Enter the distinguished name.

port <integer>

Enter the port number for LDAP server communication. Default: 389. Range: 1 to 65535

type {anonymous | regular | simple}

Set a binding type. The following options are available:

  • anonymous: Bind using anonymous user search
  • regular: Bind using username/password and then search
  • simple: Simple password authentication without search (default)

username <string>

Enter a username. This variable appears only when type is set to regular.

password <passwd>

Enter a password for the username above. This variable appears only when type is set to regular.

memberof-attr <string>

The attribute used to retrieve memeberof.

profile-attr <string>

The attribute used to retrieve admin profile.
adom-attr <string>

The attribute used to retrieve ADOM.

group <string>

Enter an authorization group. The authentication user must be a member of this group (full DN) on the server.

filter <string>

Enter content for group searching. For example:

(&(objectcategory=group)(member=*))

(&(objectclass=groupofnames)(member=*))

(&(objectclass=groupofuniquenames)(uniquemember=*))

(&(objectclass=posixgroup)(memberuid=*))

attributes <filter>

Attributes used for group searching (for multi-attributes, a use comma as a separator). For example:

  • member
  • uniquemember
  • member,uniquemember

secure {disable | ldaps | starttls}

Set the SSL connection type.

ca-cert <string>

CA certificate name. This variable appears only when secure is set to ldaps or starttls.

connect-timeout <integer>

Set the LDAP connection timeout (msec).

adom <adom-name>

Set the ADOM name to link to the LDAP configuration.

Example

This example shows how to add the LDAP user user1 at the IPv4 address 206.205.204.203.

config system admin ldap

edit user1

set server 206.205.204.203

set dn techdoc

set type regular

set username auth1

set password auth1_pwd

set group techdoc

end

admin profile

Use this command to configure access profiles. In a newly-created access profile, no access is enabled.

Syntax

config system admin profile

edit <profile_name>

set adom-switch {none | read | read-write}

set change-password {enable | disable}

set datamask {enable | disable}

set datamask-fields <fields>

set datamask-key <passwd>

set description <text>

set device-ap {none | read | read-write}

set device-forticlient {none | read | read-write}

set device-fortiswitch {none | read | read-write}

set device-manager {none | read | read-write}

set device-op {none | read | read-write}

set device-wan-link-load-balance {none | read | read-write}

set event-management {none | read | read-write}

set log-viewer {none | read | read-write}

set realtime-monitor {none | read | read-write}

set report-viewer {none | read | read-write}

set scope {adom | global}

set system-setting {none | read | read-write}

config datamask-custom-fields

edit <field>

set field-category {alert | all | fortiview | log | euba}

set field-type {email | ip | mac | string}

next

end

Variable

Description

<profile>

Edit the access profile. Enter a new name to create a new profile. The pre-defined access profiles are Super_User, Standard_User, Restricted_User, and Package_User. Character limit: 35

adom-switch {none | read | read-write}

Configure administrative domain (ADOM) permissions for this profile. Select none to hide this option from the administrator in the GUI. The following options are available:

  • none: No permission.
  • read: Read permission.
  • read-write: Read-write permission.

Controlled functions: ADOM settings in DVM, ADOM settings in All ADOMs page (under System Settings tab)

Dependencies: If system-setting is none, the All ADOMs page is not accessible, type must be set to system

change-password {enable | disable}

Enable/disable allowing restricted users to change their password.

datamask {enable | disable}

Enable/disable data masking (default = disable).

datamask-fields <fields>

Enter that data masking fields, separated by spaces.

  • dstip: Destination IP
  • dstname: Destination name
  • email: Email
  • message: Message
  • srcip: Source IP
  • srcmac: Source MAC
  • srcname: Source name
  • user: User name

datamask-key <passwd>

Enter the data masking encryption key.

description <string>

Enter a description for this access profile. Enclose the description in quotes if it contains spaces. Character limit: 1023

device-ap {none | read | read-write}

Set the AP Manager permission:

  • none: No permission.
  • read: Read permission.
  • read-write: Read-write permission.

device-forticlient {none | read | read-write}

Set the FortiClient Manager permission:

  • none: No permission.
  • read: Read permission.
  • read-write: Read-write permission.

device-fortiswitch {none | read | read-write}

 Set the FortiSwitch Manager permission:
  • none: No permission.
  • read: Read permission.
  • read-write: Read-write permission.

device-manager {none | read | read-write}

Enter the level of access to Device Manager settings for this profile. Select none to hide this option from the administrator in the GUI. The following options are available:

  • none: No permission.
  • read: Read permission.
  • read-write: Read-write permission.

This command corresponds to the Device Manager option in the GUI administrator profile.

Controlled functions: Device Manager

Dependencies: type must be set to system

device-op {none | read | read-write}

Add the capability to add, delete, and edit devices to this profile. Select none to hide this option from the administrator in the GUI. The following options are available:

  • none: No permission.
  • read: Read permission.
  • read-write: Read-write permission.

This command corresponds to the Add/Delete Devices/Groups option in the GUI administrator profile. This is a sub-setting of device-manager.

Controlled functions: Add or delete devices or groups

Dependencies: type must be set to system

device-wan-link-load-balance {none | read | read-write}

Set the WAN Link Load Balance permission:

  • none: No permission.
  • read: Read permission.
  • read-write: Read-write permission.

event-management {none | read | read-write}

Set the Event Management permission. Select none to hide this option from the administrator in the GUI. The following options are available:

  • none: No permission.
  • read: Read permission.
  • read-write: Read-write permission.

This command corresponds to the Event Management option in the GUI administrator profile.

Controlled functions: Event Management tab and all its operations

Dependencies: faz-status must be set to enable in system global, type must be set to system

log-viewer {none | read | read-write}

Set the Log View permission. Select none to hide this option from the administrator in the GUI. Enter one of the following settings:

  • none: No permission.
  • read: Read permission.
  • read-write: Read-write permission.

This command corresponds to the Log View option in the GUI administrator profile.

Controlled functions: Log View and all its operations

Dependencies: faz-status must be set to enable in system global, type must be set to system

realtime-monitor {none | read | read-write}

Enter the level of access to the Drill Down configuration settings for this profile. Select none to hide this option from the administrator in the GUI. Enter one of the following settings: 

  • none: No permission.
  • read: Read permission.
  • read-write: Read-write permission.

This command corresponds to the Drill Down option in the GUI administrator profile.

Controlled functions: Drill Down tab and all its operations

Dependencies: faz-status must be set to enable in system global, type must be set to system

report-viewer {none | read | read-write}

Set the Reports permission. Select none to hide this option from the administrator in the GUI. Enter one of the following settings:

  • none: No permission.
  • read: Read permission.
  • read-write: Read-write permission.

This command corresponds to the Reports option in the GUI administrator profile.

Controlled functions: Reports tab and all its operations

Dependencies: faz-status must be set to enable in system global, type must be set to system

scope (Not Applicable)

CLI command is not in use.

system-setting {none | read | read-write}

Configure System Settings permissions for this profile. Select none to hide this option from the administrator in the GUI. Enter one of the following settings:

  • none: No permission.
  • read: Read permission.
  • read-write: Read-write permission.

This command corresponds to the System Settings option in the GUI administrator profile.

Controlled functions: System Settings tab, All the settings under System setting

Dependencies: type must be set to system

Variables for config datamask-custom-fields subcommand:

<field>

Enter the custom field name.

field-category {alert | all | fortiview | log | euba}

Enter the field category.

field-type {email | ip | mac | string}

Enter the field type.

admin radius

Use this command to add, edit, and delete administration RADIUS servers.

Syntax

config system admin radius

edit <server>

set auth-type {any | chap | mschap2 | pap}

set nas-ip <ipv4_address>

set port <integer>

set secondary-secret <passwd>

set secondary-server <string>

set secret <passwd>

set server <string>

end

Variable

Description

<server>

Enter the name of the RADIUS server or enter a new name to create an entry. Character limit: 63

auth-type {any | chap | mschap2 | pap}

Enter the authentication protocol the RADIUS server will use.

  • any: Use any supported authentication protocol.
  • mschap2: Microsoft Challenge Handshake Authentication Protocol version 2(MS-CHAPv2).
  • chap: Challenge Handshake Authentication Protocol (CHAP)
  • pap: Password Authentication Protocol (PAP).

nas-ip <ipv4_address>

Enter the network access server (NAS) IPv4 address and called station ID.

port <integer>

Enter the RADIUS server port number. Default: 1812. Range: 1 to 65535

secondary-secret <passwd>

Enter the password to access the RADIUS secondary-server. Character limit: 64

secondary-server <string>

Enter the RADIUS secondary-server DNS resolvable domain name or IPv4 address.

secret <passwd>

Enter the password to access the RADIUS server.  Character limit: 64

server <string>

Enter the RADIUS server DNS resolvable domain name or IPv4 address.

Example

This example shows how to add the RADIUS server RAID1 at the IPv4 address 206.205.204.203 and set the shared secret as R1a2D3i4U5s.

config system admin radius

edit RAID1

set server 206.205.204.203

set secret R1a2D3i4U5s

end

admin setting

Use this command to configure system administration settings, including web administration ports, timeout, and language.

Syntax

config system admin setting

set access-banner {enable | disable}

set admin-https-redirect {enable | disable}

set admin-login-max <integer>

set admin_server_cert <admin_server_certificate>

set banner-message <string>

set gui-them {aquarium | autumn | blue | city | diving | dreamy | galaxy | green | honey-bee | landscape | melongene | mountain | northern-light | purple-ink | red | skyline | snow | spring | structure-3d | succulents | summer | sunset | tree-ring | winter}

set http_port <integer>

set https_port <integer>

set idle_timeout <integer>

set objects-force-deletion {enable | disable}

set shell-access {enable | disable}

set shell-password <passwd>

set show-add-multiple {enable | disable}

set show-checkbox-in-table {enable | disable}

set show-device-import-export {enable | disable}

set show_hostname {enable | disable}

set show-log-forwarding {enable | disable}

set unreg_dev_opt {add_allow_service | add_no_service}

set webadmin_language {auto_detect | english | japanese | korean | simplified_chinese | traditional_chinese}

end

Variable

Description

access-banner {enable | disable}

Enable/disable the access banner. Default: disable

admin-https-redirect {enable | disable}

Enable/disable the redirection of HTTP admin traffic to HTTPS.

admin-login-max <integer>

Set the maximum number of admin users that be logged in at one time. Range: 1 to 256 (users)

admin_server_cert <admin_server_certificate>

Enter the name of an HTTPS server certificate to use for secure connections. FortiAnalyzer has the following certificates pre-loaded: server.crt and Fortinet_Local.

banner-message <string>

Enter a banner message. Character limit: 255

gui-theme {aquarium | autumn | blue | city | diving | dreamy | galaxy | green | honey-bee | landscape | melongene | mountain | northern-light | purple-ink | red | skyline | snow | spring | structure-3d | succulents | summer | sunset | tree-ring | winter}

Set the color scheme or imagery to use for the administration GUI. Options include: Aquarium, Autumn, Blueberry, City, Diving, Dreamy, Galaxy, Kiwi, Honey Bee, Landscape, Plum, Mountain, Northern Light, Purple Ink, Cherry, Skyline, Snow, Spring, 3D Structure, Succulents, Summer, Sunset, Tree Ring, and Winter

http_port <integer>

Enter the HTTP port number for web administration. Default: 80Range: 1 to 65535

https_port <integer>

Enter the HTTPS port number for web administration.Default: 443. Range: 1 to 65535

idle_timeout <integer>

Enter the idle timeout value. Default: 5. Range: 1 to 480 (minutes)

objects-force-deletion {enable | disable}

Enable/disable forced deletion of used objects.

shell-access {enable | disable}

Enable/disable shell access.

shell-password <passwd>

Enter the password to use for shell access.

show-add-multiple {enable | disable}

Enable/disable show the add multiple button in the GUI.

show-checkbox-in-table {enable | disable}

Show checkboxes in tables in the GUI.

show-device-import-export {enable | disable}

Enable/disable import/export of ADOM, device, and group lists.

show_hostname {enable | disable}

Enable/disable showing the hostname on the GUI login page (default = disable).

show-log-forwarding {enable | disable}

Enable/disable show log forwarding tab in analyzer mode.

unreg_dev_opt {add_allow_service | add_no_service}

Select action to take when an unregistered device connects to FortiAnalyzer. The following options are available:

  • add_allow_service: Add unregistered devices and allow service requests (default).
  • add_no_service: Add unregistered devices and deny service requests.

webadmin_language {auto_detect | english | japanese | korean | simplified_chinese | traditional_chinese}

Enter the language to be used for web administration. The following options are available:

  • auto_detect: Automatically detect language (default).
  • english: English.
  • japanese: Japanese.
  • korean: Korean.
  • simplified_chinese: Simplified Chinese.
  • traditional_chinese: Traditional Chinese.

Use the show command to display the current configuration if it has been changed from its default value:

show system admin setting

admin tacacs

Use this command to add, edit, and delete administration TACACS+ servers.

Syntax

config system admin tacacs

edit <name>

set authen-type {ascii | auto |chap | mschap | pap}

set authorization {enable | disable}

set key <passwd>

set port <integer>

set secondary-key <passwd>

set secondary-server <string>

set server <string>

set tertiary-key <passwd>

set tertiary-server <string>

end

Variable

Description

<name>

Enter the name of the TACACS+ server or enter a new name to create an entry. Character limit: 63

authen-type {ascii | auto |chap | mschap | pap}

Choose which authentication type to use. The following options are available: 

  • ascii: ASCII
  • auto: Uses PAP, MSCHAP, and CHAP (in that order) (default).
  • chap: Challenge Handshake Authentication Protocol (CHAP)
  • mschap: Microsoft Challenge Handshake Authentication Protocol (MS-CHAP)
  • pap: Password Authentication Protocol (PAP).

authorization {enable | disable}

Enable/disable TACACS+ authorization. The following options are available: 

  • disable: Disable TACACS+ authorization.
  • enable: Enable TACACS+ authorization (service = FortiGate).

key <passwd>

Key to access the server. Character limit: 128

port <integer>

Port number of the TACACS+ server. Range: 1 to 65535

secondary-key <passwd>

Key to access the secondary server. Character limit: 128

secondary-server <string>

Secondary server domain name or IPv4 address.

server <string>

The server domain name or IPv4 address.

tertiary-key <passwd>

Key to access the tertiary server. Character limit: 128

tertiary-server <string>

Tertiary server domain name or IPv4 address.

Example

This example shows how to add the TACACS+ server TAC1 at the IPv4 address 206.205.204.203 and set the key as R1a2D3i4U5s.

config system admin tacacs

edit TAC1

set server 206.205.204.203

set key R1a2D3i4U5s

end

admin user

Use this command to add, edit, and delete administrator accounts.

Use the admin account or an account with System Settings read and write privileges to add new administrator accounts and control their permission levels. Each administrator account must include a minimum of an access profile. The access profile list is ordered alphabetically, capitals first. If custom profiles are defined, it may change the default profile from Restricted_User. You cannot delete the admin administrator account. You cannot delete an administrator account if that user is logged on.

You can create meta-data fields for administrator accounts. These objects must be created using the FortiAnalyzer GUI. The only information you can add to the object is the value of the field (pre-determined text/numbers). For more information, see System Settings in the FortiAnalyzer Administration Guide.

Syntax

config system admin user

edit <name_str>

set password <passwd>

set change-password {enable | disable}

set trusthost1 <ipv4_mask>

set trusthost2 <ipv4_mask>

set trusthost3 <ipv4_mask>

...

set trusthost10 <ipv4_mask>

set ipv6_trusthost1 <ipv6_mask>

set ipv6_trusthost2 <ipv6_mask>

set ipv6_trusthost3 <ipv6_mask>

...

set ipv6_trusthost10 <ipv6_mask>

set profileid <profile-name>

set adom <adom_name(s)>

set dev-group <group-name>

set adom-exclude <adom_name(s)>

set policy-package <policy-package-name>

set restrict-access {enable | disable}

set description <string>

set user_type {group | ldap | local | pki-auth | radius | tacacs-plus}

set ldap-server <string>

set radius_server <string>

set tacacs-plus-server <string>

set ssh-public-key1 <key-type> <key-value>

set ssh-public-key2 <key-type>, <key-value>

set ssh-public-key3 <key-type> <key-value>

set wildcard <enable | disable>

set radius-accprofile-override <enable | disable>

set radius-adom-override <enable | disable>

set radius-group-match <string>

set password-expire <yyyy-mm-dd>

set force-password-change {enable | disable}

set subject <string>

set ca <string>

set two-factor-auth {enable | disable}

set rpc-permit {enable | disable}

set last-name <string>

set first-name <string>

set email-address <string>

set phone-number <string>

set mobile-number <string>

set pager-number <string>

set avatar <string>

end

config meta-data

edit <fieldname>

set fieldlength

set fieldvalue <string>

set importance

set status

end

end

config dashboard-tabs

edit tabid <integer>

set name <string>

end

end

config dashboard

edit moduleid

set name <string>

set column <column_pos>

set diskio-content-type

set diskio-period {1hour | 24hour | 8hour}

set refresh-inverval <integer>

set status {close | open}

set tabid <integer>

set widget-type <string>

set log-rate-type {device | log}

set log-rate-topn {1 | 2 | 3 | 4 | 5}

set log-rate-period {1hour | 2min | 6hours}

set res-view-type {history | real-time}

set res-period {10min | day | hour}

set res-cpu-display {average | each}

set num-entries <integer>

set time-period {1hour | 24hour | 8hour}

end

end

config restrict-dev-vdom

edit dev-vdom <string>

end

end

Variable

Description

<name_string>

Enter the name of the admin user or enter a new name to create a new user. Character limit: 35

password <passwd>

Enter a password for the administrator account. For improved security, the password should be at least 6 characters long. This variable is available only if user_type is local. Character limit: 128

change-password {enable | disable}

Enable/disable allowing restricted users to change their password.

trusthost1 <ipv4_mask>

trusthost2 <ipv4_mask>

...

trusthost10 <ipv4_mask>

Optionally, type the trusted host IPv4 address and network mask from which the administrator can log in to the FortiAnalyzer system. You can specify up to ten trusted hosts.

Setting trusted hosts for all of your administrators can enhance the security of your system.

Defaults:

trusthost1: 0.0.0.0 0.0.0.0 for all

others: 255.255.255.255 255.255.255.255 for none

ipv6_trusthost1 <ipv6_mask>

ipv6_trusthost2 <ipv6_mask>

...

ipv6_trusthost10 <ipv6_mask>

Optionally, type the trusted host IPv6 address from which the administrator can log in to the FortiAnalyzer system. You can specify up to ten trusted hosts.

Setting trusted hosts for all of your administrators can enhance the security of your system.

Defaults:

ipv6_trusthost1: ::/0 for all

others: ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff/128 for none

profileid <profile-name>

Enter the name of the access profile to assign to this administrator account. Access profiles control administrator access to FortiAnalyzer features. Default: Restricted_User. Character limit: 35

adom <adom_name(s)>

Enter the name(s) of the ADOM(s) the administrator belongs to. Any configuration of ADOMs takes place via the FortiAnalyzer GUI.

dev-group <group-name>

Enter the device group that the admin use can access. This option can only be used for administrators with access to only one ADOM.

adom-exclude <adom_name(s)>

Enter the name(s) of the excluding ADOM(s).

policy-package<policy-packagename>

Policy package access

restrict-access {enable | disable}

Enable/disable restricted access to the development VDOM (dev-vdom). Default: disable

description <string>

Enter a description for this administrator account. When using spaces, enclose description in quotes. Character limit: 127

user_type {group | ldap | local | pki-auth | radius | tacacs-plus}

Enter local if the FortiAnalyzer system verifies the administrator’s password. Enter radius if a RADIUS server verifies the administrator’s password. Enter of the following: 

  • group: Group user.
  • ldap: LDAP user.
  • local: Local user (default).
  • pki-auth: PKI user.
  • radius: RADIUS user.
  • tacacs-plus: TACACS+ user.

ldap-server <string>

Enter the LDAP server name if the user type is set to LDAP.

radius_server <string>

Enter the RADIUS server name if the user type is set t o RADIUS.

tacacs-plus-server <string>

Enter the TACACS+ server name if the user type is set to TACACS+.

ssh-public-key1 <key-type> <key-value>

ssh-public-key2 <key-type>, <key-value>

ssh-public-key3 <key-type> <key-value>

You can specify the public keys of up to three SSH clients. These clients are authenticated without being asked for the administrator password. You must create the public-private key pair in the SSH client application.

<key type> is ssh-dss for a DSA key, ssh-rsa for an RSA key.

<key-value> is the public key string of the SSH client.

wildcard <enable | disable>

Enable/disable wildcard remote authentication.

radius-accprofile-override <enable | disable>

Allow access profile to be overridden from RADIUS.

radius-adom-override <enable | disable>

Enable/disable the ADOM to be overridden from RADIUS.

In order to support vendor specific attributes (VSA), the RADIUS server requires a dictionary to define which VSAs to support. The Fortinet RADIUS vendor ID is 12365. The Fortinet-Vdom-Name attribute is used by this command.

radius-group-match <string>

Only admin that belong to this group are allowed to login.

password-expire <yyyy-mm-dd>

When enforcing the password policy, enter the date that the current password will expire.

force-password-change {enable | disable}

Enable/disable force password change on next login.

subject <string>

PKI user certificate name constraints. This command is available when a PKI administrator account is configured.

ca <string>

PKI user certificate CA (CA name in local). This command is available when a PKI administrator account is configured.

two-factor-auth {enable | disable}

Enable/disable two-factor authentication (certificate + password).

This command is available when a PKI administrator account is configured.

rpc-permit {enable | disable}

Set the permission level for log in via Remote Procedure Call (RPC). The following options are available: 

  • none: No permission (default).
  • read-only: Read-only permission.
  • read-write: Read-write permission.

last-name <string>

Administrators last name. Character limit: 63

first-name <string>

Administrators first name. Character limit: 63

email-address <string>

Administrators email address.

phone-number <string>

Administrators phone number.

mobile-number <string>

Administrators mobile phone number.

pager-number <string>

Administrators pager number.

avatar <string>

Image file for the administrator's avatar (maximum 4K base64 encode).

Variables for config meta-data subcommand:

This subcommand can only change the value of an existing field.

To create a new metadata field, use the config system metadata command.

fieldname

The label/name of the field. Read-only.  Default: 50

fieldlength

The maximum number of characters allowed for this field. Read-only.

fieldvalue <string>

Enter a pre-determined value for the field. This is the only value that can be changed with the config metadata subcommand.  Character limit: 255

importance

Indicates whether the field is compulsory (required) or optional (optional). Read-only. Default: optional

status

For display only. Value cannot be changed.  Default: enable

Variables for config dashboard-tabs subcommand:

tabid <integer>

Tab ID.

name <string>

Tab name.

Variables for config dashboard subcommand:

moduleid

Widget ID. 

  • 1: System Information
  • 2: System Resources
  • 3: License Information
  • 4: Unit Operation
  • 5: Log Receive Monitor
  • 6: Logs/Data Received
  • 7: Statistics
  • 8: Insert Rate vs Receive Rate
  • 9: Log Insert Lag Time
  • 10: Alert Message Console
  • 11: CLI Console
  • 12: Disk I/O

name <string>

Widget name. Character limit: 63

column <column_pos>

Widget’s column ID.

diskio-content-type {blks | iops | util}

Set the Disk I/O Monitor widget's chart type.

  • blks: the amount of data of I/O requests.
  • iops: the number of I/O requests.
  • util: bandwidth utilization.

diskio-period {1hour | 24hour | 8hour}

Set the Disk I/O Monitor widget's data period.

refresh-inverval <integer>

Widget’s refresh interval. Default: 300

status {close | open}

Widget’s opened/closed status. Default: open

tabid <integer>

ID of the tab where the widget is displayed. Default: 0

widget-type <string>

Widget type. The following options are available: 

  • alert: Alert Message Console.
  • devsummary: Device Summary.
  • jsconsole: CLI Console.
  • licinfo: License Information.
  • logdb-lag: Log Database Lag Time.
  • logdb-perf: Log Database Performance Monitor.
  • logrecv: Logs/Data Received.
  • raid: Disk Monitor.
  • rpteng: Report Engine.
  • statistics: Statistics.
  • sysinfo: System Information.
  • sysop: Unit Operation.
  • sysres: System resources.
  • top-lograte: Log Receive Monitor.

log-rate-type {device | log}

Log receive monitor widget’s statistics breakdown options.

log-rate-topn {1 | 2 | 3 | 4 | 5}

Log receive monitor widgets’s number of top items to display.

log-rate-period {1hour | 2min | 6hours}

Log receive monitor widget’s data period.

res-view-type {history | real-time}

Widget’s data view type. The following options are available: 

  • history: History view.
  • real-time: Real-time view.

res-period {10min | day | hour}

Widget’s data period. The following options are available: 

  • 10min: Last 10 minutes.
  • day: Last day.
  • hour: Last hour.

res-cpu-display {average | each}

Widget’s CPU display type. The following options are available: 

  • average: Average usage of CPU.
  • each: Each usage of CPU.

num-entries <integer>

Number of entries.

time-period {1hour | 24hour | 8hour}

Set the Log Database Monitor widget's data period. One of 1 hour, 8 hours, or 24 hours.

Variable for config restrict-dev-vdom subcommand:

dev-vdom <string>

Enter device or VDOM to edit.

Using trusted hosts

Setting trusted hosts for all of your administrators increases the security of your network by further restricting administrative access. In addition to knowing the password, an administrator must connect only through the subnet or subnets you specify. You can even restrict an administrator to a single IPv4 address if you define only one trusted host IPv4 address with a netmask of 255.255.255.255.

When you set trusted hosts for all administrators, the FortiAnalyzer system does not respond to administrative access attempts from any other hosts. This provides the highest security. If you leave even one administrator unrestricted, the unit accepts administrative access attempts on any interface that has administrative access enabled, potentially exposing the unit to attempts to gain unauthorized access.

The trusted hosts you define apply both to the GUI and to the CLI when accessed through SSH. CLI access through the console connector is not affected.

Example

Use the following commands to add a new administrator account named admin_2 with the password set to p8ssw0rd and the Super_User access profile. Administrators that log in to this account will have administrator access to the FortiAnalyzer system from any IPv4 address.

config system admin user

edit admin_2

set description "Backup administrator"

set password p8ssw0rd

set profileid Super_User

end

Previous
Next