global
Use this command to configure global settings that affect miscellaneous FortiManager features.
Syntax
config system global
set admin-lockout-duration <integer>
set admin-lockout-threshold <integer>
set adom-mode {advanced | normal}sh
set adom-rev-auto-delete {by-days | by-revisions | disable}
set adom-rev-max-backup-revisions <integer>
set adom-rev-max-days <integer>
set adom-rev-max-revisions <integer>
set adom-select {enable | disable}
set adom-status {enable | disable}
set clone-name-option {default | keep}
set clt-cert-req {enable | disable}
set console-output {more | standard}
set country-flag {enable | disable}
set create-revision {enable | disable}
set daylightsavetime {enable | disable}
set detect-unregistred-log-device {enable | disable}
set device-view-mode {regular | tree}
set dh-params <integer>
set disable-module {fortiview-noc}
set enc-algorithm {custom | high | medium | low}
set faz-status {enable | disable}
set fgfm-ca-cert <certificate>
set fgfm-local-cert <certificate>
set fgfm-ssl-protocol {sslv3 | tlsv1.0 | tlsv1.1 | tlsv1.2 | tlsv1.3}
set gui-polling-interval <integer>
set ha-member-auto-grouping {enable | disable}
set hostname <string>
set import-ignore-addr-cmt {enable | disable}
set language {english | japanese | simch | spanish | trach}
set latitude <string>
set ldap-cache-timeout <integer>
set ldapconntimeout <integer>
set lock-preempt {enable | disable}
set log-checksum {md5 | md5-auth | none}
set log-forward-cache-size <integer>
set longitude <string>
set max-log-forward <integer>
set max-running-reports <integer>
set mc-policy-disabled-adoms <adom-name>
set multiple-steps-upgrade-in-autolink {enable | disable}
set normalized-intf-zone-only {enable | disable}
set object-revision-db-max <integer>
set object-revision-mandatory-note {enable | disable}
set object-revision-object-max <integer>
set object-revision-status {enable | disable}
set oftp-ssl-protocol {sslv3 | tlsv1.0 | tlsv1.1 | tlsv1.2 | tlsv1.3}
set partial-install {enable | disable}
set partial-install-force {enable | disable}
set partial-install-rev {enable | disable}
set perform-improve-by-ha {enable | disable}
set per-policy-lock {enable | disable}
set policy-object-icon {enable | disable}
set policy-object-in-dual-pane {enable | disable}
set pre-login-banner {enable | disable}
set pre-login-banner-message <string>
set private-data-encryption {enable | disable}
set remoteauthtimeout <integer>
set search-all-adoms {enable | disable}
config ssl-cipher-suites
edit <priority>
set cipher <string>
set version {tls1.2-or-below | tls1.3}
end
set ssl-low-encryption {enable | disable}
set ssl-protocol {tlsv1.3 | tlsv1.2 | tlsv1.1 | tlsv1.0 | sslv3}
set ssl-static-key-ciphers {enable | disable}
set swapmem {enable | disable}
set table-entry-blink {enable | disable}
set task-list-size <integer>
set timezone <integer>
set tunnel-mtu <integer>
set usg {enable | disable}
set vdom-mirror {enable | disable}
set webservice-proto {tlsv1.3 | tlsv1.2 | tlsv1.1 | tlsv1.0 | sslv3 | sslv2}
set workspace-mode {disabled | normal | per-adom | workflow}
end
Variable |
Description |
---|---|
admin-lockout-duration <integer> |
Set the lockout duration for FortiManager administration, in seconds (default = 60). |
admin-lockout-threshold <integer> |
Set the lockout threshold for FortiManager administration (1 - 10, default = 3). |
adom-mode {advanced | normal} |
Set the ADOM mode (default = normal). |
adom-rev-auto-delete {by-days | by-revisions | disable} |
Auto delete features for old ADOM revisions:
|
adom-rev-max-backup-revisions <integer> |
The maximum number of ADOM revisions to be included in the system configuration backup (default = 5). |
adom-rev-max-days <integer> |
The maximum number of days to keep old ADOM revisions (default = 30). |
adom-rev-max-revisions <integer> |
The maximum number of ADOM revisions to keep (default = 120). |
adom-select {enable | disable} |
Enable/disable a pop-up window that allows administrators to select an ADOM after logging in (default = enable). |
adom-status {enable | disable} |
Enable/disable administrative domains (default = disable). |
clone-name-option {default | keep} |
Set the cloned object name option:
|
clt-cert-req {enable | disable} |
Enable/disable requiring a client certificate for GUI login (default = disable). When both |
console-output {more | standard} |
Select how the output is displayed on the console (default = standard). Select |
country-flag {enable | disable} |
Enable/disable a country flag icon beside an IP address (default = enable). |
create-revision {enable | disable} |
Enable/disable create revision by default (default = disable). |
daylightsavetime {enable | disable} |
Enable/disable daylight saving time (default = enable). If you enable daylight saving time, the FortiManager unit automatically adjusts the system time when daylight saving time begins or ends. |
detect-unregistered-log-device {enable | disable} |
Enable/disable unregistered log device detection (default = enable). |
device-view-mode {regular | tree} |
Set the devices/groups view mode (default = regular). |
dh-params <integer> |
Set the minimum size of the Diffie-Hellman prime for SSH/HTTPS, in bits (default = 2048). |
disable-module {fortiview-noc} |
Disable module list. |
enc-algorithm {custom | high | medium | low} |
Set SSL communication encryption algorithms:
|
faz-status {enable | disable} |
Enable/disable FortiAnalyzer features in FortiManager (default = disable). This command is not available on the FMG-100C. Note: With FortiManager 7.0.0, you can enable FortiAnalyzer features, or you can have FortiManager HA, but not both at the same time. |
fgfm-ca-cert <certificate> |
Set the extra FGFM CA certificates ("" = default certificate will be used). |
fgfm-local-cert <certificate> |
Set the FGFM local certificate ("" = default certificate will be used). |
fgfm-ssl-protocol {sslv3 | tlsv1.0 | tlsv1.1 | tlsv1.2 | tlsv1.3} |
Set the lowest SSL protocols for fgfmsd (default = tlsv1.2). |
gui-polling-interval <integer> |
Set the GUI polling interval in seconds (1-288000, default = 5). |
ha-member-auto-grouping {enable | disable} |
Enable/disable automatically grouping HA members when the group name is unique in your network (default = enable). |
hostname <string> |
FortiManager host name. |
import-ignore-addr-cmt {enable | disable} |
Enable/disable import ignore of address comments (default = disable). |
language {english | japanese | simch | spanish | trach} |
GUI language:
|
latitude <string> |
Set the FortiManager device's latitude. |
ldap-cache-timeout <integer> |
LDAP cache timeout, in seconds (default =86400). |
ldapconntimeout <integer> |
LDAP connection timeout, in milliseconds (default = 60000). |
lock-preempt {enable | disable} |
Enable/disable the ADOM lock override (default = disable). |
log-checksum {md5 | md5-auth | none} |
Record log file hash value, timestamp, and authentication code at transmission or rolling:
|
log-forward-cache-size <integer> |
Set the log forwarding disk cache size, in gigabytes (default = 0). |
longitude <string> |
Set the FortiManager device's longitude. |
max-log-forward <integer> |
Set the maximum log forwarding and aggregation number (5 - 20). |
max-running-reports <integer> |
Maximum running reports number (1 - 10, default = 1). |
mc-policy-disabled-adoms <adom-name> |
Set the multicast policy disabled ADOMs, separated by spaces. Only ADOMs below version 6.0 can be included. |
multiple-steps-upgrade-in-autolink {enable | disable} |
Enable/disable multiple steps upgrade in an autolink process (default = disable). |
normalized-intf-zone-only {enable | disable} |
Allow the normalized interface to be zone only (default = disable). |
object-revision-db-max <integer> |
Maximum revisions for a single database (10000 - 1000000, default = 100000). |
object-revision-mandatory-note {enable | disable} |
Enable/disable mandatory note when creating a revision (default = enable). |
object-revision-object-max <integer> |
Set the maximum revisions for a single object (10 - 1000, default = 100). |
object-revision-status {enable | disable} |
Enable/disable creating revisions when modifying objects (default = enable). |
oftp-ssl-protocol {sslv3 | tlsv1.0 | tlsv1.1 | tlsv1.2 | tlsv1.3} |
Set the lowest SSL protocols for oftpd (default = tlsv1.2). |
partial-install {enable | disable} |
Enable/disable partial install (install only some objects) (default= disable). Use this command to enable pushing individual objects of the policy package down to all FortiGates in the Policy Package. Once enabled, in the GUI you can right-click an object and choose to install it. |
partial-install-force {enable | disable} |
Enable/disable partial install when the Dev database is modified (default= disable). This option is only available when partial-install is enabled. |
partial-install-rev {enable | disable} |
Enable/disable partial install revision (default= disable). This option is only available when partial-install is enabled. |
perform-improve-by-ha {enable | disable} |
Enable/disable performance improvement by distributing tasks to secondary HA units (default= disable). |
per-policy-lock {enable | disable} |
Enable/disable per policy lock (default= disable). This option is only available in workspace lock mode. |
policy-object-icon {enable | disable} |
Enable/disable show icons of policy objects (default= disable). |
policy-object-in-dual-pane {enable | disable} |
Enable/disable show policies and objects in dual pane (default= disable). |
pre-login-banner {enable | disable} |
Enable/disable pre-login banner (default= disable). |
pre-login-banner-message <string> |
Set the pre-login banner message. |
private-data-encryption {enable | disable} |
Enable/disable private data encryption using an AES 128 bit key (default = disable). |
remoteauthtimeout <integer> |
Remote authentication (RADIUS/LDAP) timeout, in seconds (default = 10). |
search-all-adoms {enable | disable} |
Enable/disable search all ADOMs for where-used queries (default= disable). |
ssl-low-encryption {enable | disable} |
Enable/disable SSL low-grade (40-bit) encryption (default= disable). |
ssl-protocol {tlsv1.3 | tlsv1.2 | tlsv1.1 | tlsv1.0 | sslv3} |
Set the SSL protocols (default = tlsv1.3 tlsv1.2). |
ssl-static-key-ciphers {enable | disable} |
Enable/disable SSL static key ciphers (default = enable). |
swapmem {enable | disable} |
Enable/disable virtual memory. |
table-entry-blink {enable | disable} |
Enable/disable table entry blink in GUI (default = enable). |
task-list-size <integer> |
Set the maximum number of completed tasks to keep (default = 2000). |
timezone <integer> |
The time zone for the FortiManager unit (default = Pacific Time). See Time zones |
tunnel-mtu <integer> |
Set the maximum transportation unit (68 - 9000, default = 1500). |
usg {enable | disable} |
Enable/disable contacting only FortiGuard servers in the USA (default = enable). |
vdom-mirror {enable | disable} |
Enable/disable VDOM mirror (default = disable). Once enabled in the CLI, you can select to enable VDOM Mirror when editing a virtual domain in the When changes are made to the primary device’s VDOM database, a copy is applied to the mirror device’s VDOM database. A revision is created and then installed to the devices. VDOM mirror is intended to be used by MSSP or enterprise companies who need to provide a backup VDOM for their customers. |
webservice-proto {tlsv1.3 | tlsv1.2 | tlsv1.1 | tlsv1.0 | sslv3 | sslv2} |
Web Service connection (default = tlsv1.3 tlsv1.2). |
workspace-mode {disabled | normal | per-adom | workflow} |
Enable/disable Workspace and Workflow (ADOM locking):
|
ssl-cipher-suites |
Configure the ssl-cipher-suites table to enforce the user specified preferred cipher order in the incoming SSL connections. Note: This command is only available if |
Variables for |
|
<priority> |
Set the order of the ciphers in the ssl-cipher-suites table. |
cipher <string> |
Enter the SSL cipher name from the list. |
version {tls1.2-or-below | tls1.3} |
Set the SSL/TLS version the cipher suite can be used with (default = tls1.2-or-below). |
Example
The following command turns on daylight saving time, sets the FortiManager unit name to FMG3k, and chooses the Eastern time zone for US & Canada.
config system global
set daylightsavetime enable
set hostname FMG3k
set timezone 12
end
Time zones
Integer |
Time zone |
Integer |
Time zone |
---|---|---|---|
00 |
(GMT-12:00) Eniwetak, Kwajalein |
40 |
(GMT+3:00) Nairobi |
01 |
(GMT-11:00) Midway Island, Samoa |
41 |
(GMT+3:30) Tehran |
02 |
(GMT-10:00) Hawaii |
42 |
(GMT+4:00) Abu Dhabi, Muscat |
03 |
(GMT-9:00) Alaska |
43 |
(GMT+4:00) Baku |
04 |
(GMT-8:00) Pacific Time (US & Canada) |
44 |
(GMT+4:30) Kabul |
05 |
(GMT-7:00) Arizona |
45 |
(GMT+5:00) Ekaterinburg |
06 |
(GMT-7:00) Mountain Time (US & Canada) |
46 |
(GMT+5:00) Islamabad, Karachi,Tashkent |
07 |
(GMT-6:00) Central America |
47 |
(GMT+5:30) Calcutta, Chennai, Mumbai, New Delhi |
08 |
(GMT-6:00) Central Time (US & Canada) |
48 |
(GMT+5:45) Kathmandu |
09 |
(GMT-6:00) Mexico City |
49 |
(GMT+6:00) Almaty, Novosibirsk |
10 |
(GMT-6:00) Saskatchewan |
50 |
(GMT+6:00) Astana, Dhaka |
11 |
(GMT-5:00) Bogota, Lima, Quito |
51 |
(GMT+6:00) Sri Jayawardenapura |
12 |
(GMT-5:00) Eastern Time (US & Canada) |
52 |
(GMT+6:30) Rangoon |
13 |
(GMT-5:00) Indiana (East) |
53 |
(GMT+7:00) Bangkok, Hanoi, Jakarta |
14 |
(GMT-4:00) Atlantic Time (Canada) |
54 |
(GMT+7:00) Krasnoyarsk |
15 |
(GMT-4:00) La Paz |
55 |
(GMT+8:00) Beijing,ChongQing, HongKong,Urumqi |
16 |
(GMT-4:00) Santiago |
56 |
(GMT+8:00) Irkutsk, Ulaanbaatar |
17 |
(GMT-3:30) Newfoundland |
57 |
(GMT+8:00) Kuala Lumpur, Singapore |
18 |
(GMT-3:00) Brasilia |
58 |
(GMT+8:00) Perth |
19 |
(GMT-3:00) Buenos Aires, Georgetown |
59 |
(GMT+8:00) Taipei |
20 |
(GMT-3:00) Nuuk (Greenland) |
60 |
(GMT+9:00) Osaka, Sapporo, Tokyo, Seoul |
21 |
(GMT-2:00) Mid-Atlantic |
61 |
(GMT+9:00) Yakutsk |
22 |
(GMT-1:00) Azores |
62 |
(GMT+9:30) Adelaide |
23 |
(GMT-1:00) Cape Verde Is |
63 |
(GMT+9:30) Darwin |
24 |
(GMT) Casablanca, Monrovia |
64 |
(GMT+10:00) Brisbane |
25 |
(GMT) Greenwich Mean Time:Dublin, Edinburgh, Lisbon, London |
65 |
(GMT+10:00) Canberra, Melbourne, Sydney |
26 |
(GMT+1:00) Amsterdam, Berlin, Bern, Rome, Stockholm, Vienna |
66 |
(GMT+10:00) Guam, Port Moresby |
27 |
(GMT+1:00) Belgrade, Bratislava, Budapest, Ljubljana, Prague |
67 |
(GMT+10:00) Hobart |
28 |
(GMT+1:00) Brussels, Copenhagen, Madrid, Paris |
68 |
(GMT+10:00) Vladivostok |
29 |
(GMT+1:00) Sarajevo, Skopje, Sofija, Vilnius, Warsaw, Zagreb |
69 |
(GMT+11:00) Magadan |
30 |
(GMT+1:00) West Central Africa |
70 |
(GMT+11:00) Solomon Is., New Caledonia |
31 |
(GMT+2:00) Athens, Istanbul, Minsk |
71 |
(GMT+12:00) Auckland, Wellington |
32 |
(GMT+2:00) Bucharest |
72 |
(GMT+12:00) Fiji, Kamchatka, Marshall Is |
33 |
(GMT+2:00) Cairo |
73 |
(GMT+13:00) Nuku'alofa |
34 |
(GMT+2:00) Harare, Pretoria |
74 |
(GMT-4:30) Caracas |
35 |
(GMT+2:00) Helsinki, Riga,Tallinn |
75 |
(GMT+1:00) Namibia |
36 |
(GMT+2:00) Jerusalem |
76 |
(GMT-5:00) Brazil-Acre) |
37 |
(GMT+3:00) Baghdad |
77 |
(GMT-4:00) Brazil-West |
38 |
(GMT+3:00) Kuwait, Riyadh |
78 |
(GMT-3:00) Brazil-East |
39 |
(GMT+3:00) Moscow, St.Petersburg, Volgograd |
79 |
(GMT-2:00) Brazil-DeNoronha |