Network command reference

show version

show version

show version

show version

show version

show version
show system uptime

display version

/system resource print

get system status

execute switch-controller get-conn-status

get system status

show version

show system info

show running-config

show running-config

show running-config

show running-config

show running-config

show configuration
show configuration | display set

display current-configuration

/export
/export verbose

show full-configuration

config switch-controller managed-switch
  edit <SN>
    show full-configuration

show full-configuration
show system interface   (one section)

show running-config

show config running
(configure mode: show)

show startup-config

show startup-config

show startup-config

show startup-config

show config

(the committed configuration is the active one; see "Save the configuration")

display saved-configuration

show startup-config

show config saved <file>

write memory
(or copy running-config startup-config)

copy running-config startup-config

write memory
(or copy running-config startup-config)

write memory
(or copy running-config startup-config)

write memory

commit
commit confirmed 5

save

(automatic, nothing to save)

(automatic, nothing to save)

(automatic, nothing to save)

(automatic, nothing to save)

write memory

commit

reload

reload

reload

boot system

reload

request system reboot

reboot

/system reboot

execute reboot

execute switch-controller reset <SN>

execute reboot

reload

request restart system

hostname SW1

hostname SW1

hostname SW1

hostname SW1

hostname SW1

set system host-name SW1

sysname SW1

/system identity set name=SW1

config system global
  set hostname SW1
end

config switch-controller managed-switch
  edit <SN>
    set name SW1
  next
end

config system global
  set hostname FW1
end

hostname FW1

set deviceconfig system hostname FW1

configure terminal

configure terminal

configure terminal

configure terminal

configure

configure

system-view

(no mode: commands start with a menu path such as /ip address)

config <section>   (no global config mode)

config <section>   (no global config mode)

config <section>

configure terminal

configure

no <command>

no <command>

no <command>

no <command>

no <command>

delete <path>
deactivate <path>

undo <command>

/ip address remove numbers=0
/ip address remove [find address=10.0.0.1/24]

unset <parameter>
(delete <entry> to remove a table entry)

unset <parameter>
(delete <entry> to remove a table entry)

unset <parameter>
delete <entry>

no <command>

delete <path>

show clock

show clock

show clock

show clock

show time

show system uptime

display clock

/system clock print

execute date

execute date

execute time
execute date

show clock

show clock

show processes cpu sorted

show processes cpu sort

show processes top once

show system resource-utilization

show cpu

show chassis routing-engine

display cpu-usage

/system resource print
/tool profile

get system performance status

get system performance status
diagnose sys top 2 30

show cpu usage

show system resources

show processes memory sorted

show system resources

show version
show processes top once

show system resource-utilization

show system information

show chassis routing-engine

display memory-usage

/system resource print

get system performance status

get system performance status
diagnose sys top-mem

show memory

show system resources

show inventory

show inventory

show inventory

show system

show modules
show system

show chassis hardware

display device
display esn

/system routerboard print

get system status

execute switch-controller get-conn-status

get system status

show inventory

show system info

show environment all

show environment

show environment all

show environment fan
show environment power-supply
show environment temperature

show system fans
show system power-supply
show system temperature

show chassis environment

display environment
display fan
display power

/system health print

copy running-config flash:before.cfg
show archive config differences flash:before.cfg system:running-config
configure replace flash:before.cfg force

checkpoint BEFORE-CHANGE
show diff rollback-patch checkpoint BEFORE-CHANGE running-config
rollback running-config checkpoint BEFORE-CHANGE

configure session CHANGE
 ...
 show session-config diffs
 commit timer 00:05:00

copy running-config checkpoint BEFORE-CHANGE
checkpoint diff BEFORE-CHANGE running-config
checkpoint rollback BEFORE-CHANGE

show | compare
commit confirmed 5
rollback 1

/system backup save name=pre-change
/system backup load name=pre-change

show running-config | section interface
show ... | include <text>
show ... | begin <text>

show running-config | section interface
show ... | include <text>
show ... | begin <text>

show running-config | section interface
show ... | include <text>
show ... | grep <text>

show running-config | include <text>
show ... | exclude <text>

show running-config | include <text>

show configuration | display set | match <text>
show ... | find <text>

display current-configuration | include <text>
display ... | begin <text>

/ip address print where address~"10.0"

show full-configuration | grep <text>

show full-configuration | grep <text>

show full-configuration | grep <text>
show full-configuration | grep -f <text>

show running-config | include <text>

show config running | match <text>

terminal length 0

terminal length 0

terminal length 0

no page

no page

set cli screen-length 0

screen-length 0 temporary

print without-paging

config system console
  set output standard
end

config system console
  set output standard
end

config system console
  set output standard
end

terminal pager 0

set cli pager off

show interfaces status
show ip interface brief

show interface status
show interface brief

show interfaces status

show interface brief

show interfaces brief

show interfaces terse
show interfaces brief

display interface brief

/interface print
/interface ethernet print

diagnose switch physical-ports summary

diagnose switch-controller switch-info port-properties <SN> <port>

get system interface physical
diagnose hardware deviceinfo nic port1

show interface ip brief

show interface all

show interfaces GigabitEthernet1/0/1

show interface Ethernet1/1

show interfaces Ethernet1

show interface 1/1/1

show interfaces 1

show interfaces ge-0/0/1 extensive

display interface GigabitEthernet0/0/1

/interface ethernet print stats
/interface monitor-traffic ether1

diagnose switch physical-ports list port1
diagnose switch physical-ports stats port1

diagnose switch-controller switch-info port-stats <SN> <port>

diagnose hardware deviceinfo nic port1
diagnose netlink interface list port1

show interface GigabitEthernet0/0

show interface ethernet1/1
show counter interface ethernet1/1

interface GigabitEthernet1/0/1

interface Ethernet1/1

interface Ethernet1

interface 1/1/1

interface 1

edit interfaces ge-0/0/1

interface GigabitEthernet0/0/1

/interface ethernet

config switch physical-port
  edit port1
(L2 settings: config switch interface / edit port1)

config switch-controller managed-switch
  edit <SN>
    config ports
      edit port1

interface range GigabitEthernet1/0/1-24

interface Ethernet1/1-24

interface Ethernet1-24

interface 1/1/1-1/1/24

interface 1-24

set interfaces interface-range ACCESS member-range ge-0/0/0 to ge-0/0/23

port-group GROUP1
 group-member GigabitEthernet0/0/1 to GigabitEthernet0/0/24

/interface ethernet set [find where name~"ether"] ...

(no range: edit each port)

(no range: edit each port)

description Uplink to CORE

description Uplink to CORE

description Uplink to CORE

description Uplink to CORE

name Uplink to CORE

set interfaces ge-0/0/1 description "Uplink to CORE"

description Uplink to CORE

/interface ethernet set ether1 comment="Uplink to CORE"

config switch physical-port
  edit port1
    set description "Uplink to CORE"

config ports
  edit port1
    set description "Uplink to CORE"

shutdown
no shutdown

shutdown
no shutdown

shutdown
no shutdown

shutdown
no shutdown

disable
enable

set interfaces ge-0/0/1 disable
delete interfaces ge-0/0/1 disable

shutdown
undo shutdown

/interface ethernet set ether1 disabled=yes

config switch physical-port
  edit port1
    set status down   (or up)

config ports
  edit port1
    set status down   (or up)

speed 1000
duplex full

speed 1000
duplex full

speed forced 1000full

speed 1000-full

speed-duplex 1000-full

set interfaces ge-0/0/1 speed 1g
set interfaces ge-0/0/1 link-mode full-duplex

undo negotiation auto
speed 1000
duplex full

/interface ethernet set ether1 auto-negotiation=no speed=1G-baseT-full

set speed 1000full

set speed 1000full

switchport mode access
switchport access vlan 10

switchport mode access
switchport access vlan 10

switchport mode access
switchport access vlan 10

no routing
vlan access 10

vlan 10 untagged 1

set interfaces ge-0/0/1 unit 0 family ethernet-switching interface-mode access vlan members v10

port link-type access
port default vlan 10

/interface bridge port add bridge=bridge1 interface=ether2 pvid=10

config switch interface
  edit port1
    set native-vlan 10

config ports
  edit port1
    set vlan "v10"

switchport mode trunk
switchport trunk allowed vlan 10,20
switchport trunk native vlan 99

switchport mode trunk
switchport trunk allowed vlan 10,20
switchport trunk native vlan 99

switchport mode trunk
switchport trunk allowed vlan 10,20
switchport trunk native vlan 99

no routing
vlan trunk native 99
vlan trunk allowed 10,20

vlan 10 tagged 24
vlan 20 tagged 24
vlan 99 untagged 24

set interfaces xe-0/0/1 native-vlan-id 99
set interfaces xe-0/0/1 unit 0 family ethernet-switching interface-mode trunk vlan members [ v10 v20 ]

port link-type trunk
port trunk allow-pass vlan 10 20
port trunk pvid vlan 99

/interface bridge vlan add bridge=bridge1 vlan-ids=10,20 tagged=ether1

config switch interface
  edit port1
    set native-vlan 99
    set allowed-vlans 10,20

config ports
  edit port1
    set vlan "native99"
    set allowed-vlans "v10" "v20"

no switchport
ip address 10.0.0.1 255.255.255.0

no switchport
ip address 10.0.0.1/24

no switchport
ip address 10.0.0.1/24

routing
ip address 10.0.0.1/24

(use a VLAN with an IP address)

set interfaces ge-0/0/1 unit 0 family inet address 10.0.0.1/24

undo portswitch
ip address 10.0.0.1 24

/ip address add address=10.0.0.1/24 interface=ether3

(use a VLAN interface, see "Layer 3 VLAN interface")

(not applicable; routing is on the FortiGate)

interface vlan 10
 ip address 10.0.10.1 255.255.255.0

feature interface-vlan
interface vlan 10
 ip address 10.0.10.1/24

interface Vlan10
 ip address 10.0.10.1/24

interface vlan 10
 ip address 10.0.10.1/24

vlan 10
 ip address 10.0.10.1/24

set vlans v10 vlan-id 10 l3-interface irb.10
set interfaces irb unit 10 family inet address 10.0.10.1/24

interface Vlanif10
 ip address 10.0.10.1 255.255.255.0

/interface vlan add name=vlan10 vlan-id=10 interface=bridge1
/ip address add address=10.0.10.1/24 interface=vlan10

config system interface
  edit vlan10
    set vlanid 10
    set interface internal
    set ip 10.0.10.1 255.255.255.0

(the FortiGate holds the gateway address of the VLAN interface)

show interfaces status err-disabled

show interface status err-disabled

show interfaces status errdisabled

show interface brief

display error-down recovery

show ip interface brief

show ip interface brief

show ip interface brief

show ip interface brief

show ip

show interfaces terse | match inet

display ip interface brief

/ip address print

get system interface

show interface ip brief

show interface all

show running-config interface Gi1/0/1

show running-config interface Eth1/1

show running-config interfaces Ethernet1

show running-config interface 1/1/1

show running-config interface 1

show configuration interfaces ge-0/0/1

display current-configuration interface GigabitEthernet0/0/1

/interface ethernet print detail where name=ether1

show switch interface port1

show system interface port1

show running-config interface GigabitEthernet0/0

show interfaces counters errors

show interface counters errors

show interfaces counters errors

show interface 1/1/1

show interfaces 1

show interfaces ge-0/0/1 extensive | match error

display interface GigabitEthernet0/0/1 | include error

/interface ethernet print stats

diagnose switch physical-ports stats port1

diagnose hardware deviceinfo nic port1

show interface GigabitEthernet0/0 | include error

show counter interface ethernet1/1

clear counters Gi1/0/1

clear counters interface Eth1/1

clear counters Ethernet1

clear interface 1/1/1 statistics

clear interfaces statistics ge-0/0/1

reset counters interface GigabitEthernet0/0/1

/interface reset-counters ether1

clear interface GigabitEthernet0/0

show interfaces description

show interface description

show interfaces description

show name

show interfaces descriptions

display interface description

/interface print where comment!=""

system mtu 9198
(interface: mtu 9198)

interface Eth1/1
 mtu 9216

interface Ethernet1
 mtu 9214

interface 1/1/1
 mtu 9198

set interfaces xe-0/0/1 mtu 9216

jumboframe enable 9216

/interface ethernet set ether1 l2mtu=9216 mtu=9000

config system interface
  edit "port1"
    set mtu-override enable
    set mtu 9000

set network interface ethernet ethernet1/1 layer3 mtu 9000

config system interface
  edit "port2"
    set mode static
    set ip 192.168.10.1 255.255.255.0
    set allowaccess ping
    set alias "LAN"
    set role lan

interface GigabitEthernet0/1
 nameif inside
 security-level 100
 ip address 192.168.10.1 255.255.255.0
 no shutdown

set network interface ethernet ethernet1/2 layer3 ip 192.168.10.1/24
set zone trust network layer3 ethernet1/2
set network virtual-router default interface ethernet1/2

show vlan brief

show vlan brief

show vlan

show vlan

show vlans

show vlans

display vlan

/interface bridge vlan print

show switch vlan

show system interface   (look for vlanid on the fortilink)

vlan 10
 name USERS

vlan 10
 name USERS

vlan 10
 name USERS

vlan 10
 name USERS

vlan 10
 name USERS

set vlans v10 vlan-id 10
set vlans v10 description USERS

vlan 10
 name USERS

/interface bridge set bridge1 vlan-filtering=yes
/interface bridge vlan add bridge=bridge1 vlan-ids=10 untagged=ether2

config switch vlan
  edit 10
    set description "USERS"

config system interface
  edit "v10"
    set vlanid 10
    set interface "fortilink"
    set ip 10.0.10.1 255.255.255.0

show interfaces trunk

show interface trunk

show interfaces trunk

show vlan port <port>

show vlans ports 24 detail

show ethernet-switching interface

display port vlan

/interface bridge vlan print

switchport voice vlan 20

(no voice VLAN feature; tag the voice VLAN on a trunk)

show mac address-table

show mac address-table

show mac address-table

show mac-address-table

show mac-address

show ethernet-switching table

display mac-address

/interface bridge host print

diagnose switch mac-address list

diagnose switch-controller switch-info mac-table <SN>

show mac address-table address aaaa.bbbb.cccc

show mac address-table address aaaa.bbbb.cccc

show mac address-table address aaaa.bbbb.cccc

show mac-address-table | include aa:bb:cc:dd:ee:ff

show mac-address aabbcc-ddeeff

show ethernet-switching table | match aa:bb:cc:dd:ee:ff

display mac-address aaaa-bbbb-cccc

/interface bridge host print where mac-address=AA:BB:CC:DD:EE:FF

diagnose switch mac-address list | grep aa:bb:cc:dd:ee:ff

diagnose switch-controller switch-info mac-table <SN> | grep aa:bb:cc:dd:ee:ff

clear mac address-table dynamic

clear mac address-table dynamic

clear mac address-table dynamic

clear mac-address-table dynamic

clear ethernet-switching table

undo mac-address dynamic

spanning-tree mode rapid-pvst

spanning-tree mode rapid-pvst

spanning-tree mode mstp
(or rapid-pvst)

spanning-tree mode rpvst
spanning-tree

spanning-tree
spanning-tree mode mstp

set protocols rstp
(or mstp / vstp)

stp mode rstp
(or mstp)

/interface bridge set bridge1 protocol-mode=rstp

config switch stp settings
  set status enable

(spanning tree is a FortiSwitch setting pushed from the FortiGate)

show spanning-tree

show spanning-tree

show spanning-tree

show spanning-tree

show spanning-tree

show spanning-tree bridge
show spanning-tree interface

display stp brief

/interface bridge monitor bridge1

diagnose stp instance list

diagnose switch-controller switch-info stp <SN> <instance>

spanning-tree vlan 10 priority 4096

spanning-tree vlan 10 priority 4096

spanning-tree vlan-id 10 priority 4096
(MSTP: spanning-tree mst 0 priority 4096)

spanning-tree vlan 10 priority 1

spanning-tree priority 1

set protocols rstp bridge-priority 4k

stp root primary
(or stp priority 4096)

/interface bridge set bridge1 priority=0x1000

config switch stp instance
  edit 0
    set priority 4096

config switch-controller managed-switch
  edit <SN>
    config stp-instance
      edit 0
        set priority 4096

spanning-tree portfast

spanning-tree port type edge

spanning-tree portfast

spanning-tree port-type admin-edge

spanning-tree 1 admin-edge-port

set protocols rstp interface ge-0/0/1 edge

stp edged-port enable

/interface bridge port set [find interface=ether2] edge=yes

config switch interface
  edit port1
    set edge-port enabled

config ports
  edit port1
    set edge-port enabled

spanning-tree bpduguard enable

spanning-tree bpduguard enable

spanning-tree bpduguard enable

spanning-tree bpdu-guard

spanning-tree 1 bpdu-protection

set protocols rstp bpdu-block-on-edge

stp bpdu-protection

/interface bridge port set [find interface=ether2] bpdu-guard=yes

config switch interface
  edit port1
    set stp-bpdu-guard enabled

config ports
  edit port1
    set stp-bpdu-guard enabled

interface range Gi1/0/1-2
 channel-group 1 mode active
interface Port-channel1

feature lacp
interface Eth1/1-2
 channel-group 1 mode active
interface port-channel1

interface Ethernet1-2
 channel-group 1 mode active
interface Port-Channel1

interface lag 1
 lacp mode active
interface 1/1/1
 lag 1

trunk 1-2 trk1 lacp

set chassis aggregated-devices ethernet device-count 2
set interfaces ge-0/0/1 ether-options 802.3ad ae0
set interfaces ae0 aggregated-ether-options lacp active

interface Eth-Trunk1
 mode lacp-static
interface GigabitEthernet0/0/1
 eth-trunk 1

/interface bonding add name=bond1 slaves=ether1,ether2 mode=802.3ad transmit-hash-policy=layer-2-and-3

config switch trunk
  edit LAG1
    set mode lacp-active
    set members port1 port2

config ports
  edit LAG1
    set type trunk
    set mode lacp-active
    set members port1 port2

show etherchannel summary

show port-channel summary

show port-channel summary

show lacp aggregates

show lacp

show lacp interfaces
show interfaces ae0 terse

display eth-trunk 1

/interface bonding print

diagnose switch trunk list

diagnose switch-controller switch-info trunk summary <SN>

stackwise-virtual
 domain 1

feature vpc
vpc domain 10
 peer-keepalive destination 10.0.0.2
interface port-channel10
 vpc peer-link

mlag configuration
 domain-id MLAG1
 local-interface Vlan4094
 peer-address 10.0.0.2
 peer-link Port-Channel10
interface Port-Channel20
 mlag 20

vsx
 inter-switch-link lag 256
 role primary
 keepalive peer 10.0.0.2 source 10.0.0.1

(VSF: vsf enable domain 1)

(Virtual Chassis, or MC-LAG / ESI-LAG on QFX)

dfs-group 1
 source ip 10.0.0.1
interface Eth-Trunk10
 peer-link 1

config switch trunk
  edit ICL
    set mclag-icl enable

config ports
  edit LAG-ICL
    set mclag-icl enable

show stackwise-virtual

show vpc

show mlag

show vsx status

show vsf

show virtual-chassis status

display dfs-group 1 m-lag

diagnose switch mclag peer-info

diagnose switch-controller switch-info mclag-icl <SN>

switchport port-security
switchport port-security maximum 2
switchport port-security violation restrict

switchport port-security
switchport port-security maximum 2
switchport port-security violation restrict

switchport port-security
switchport port-security mac-address maximum 2

port-security 1 learn-mode limited-continuous address-limit 2

set switch-options interface ge-0/0/1.0 interface-mac-limit 2 packet-action drop

port-security enable
port-security max-mac-num 2

config switch interface
  edit port1
    set learning-limit 2

config ports
  edit port1
    set learning-limit 2

show mac address-table interface GigabitEthernet1/0/1

show mac address-table interface Ethernet1/1

show mac address-table interface Ethernet1

show mac-address-table port 1/1/1

show mac-address 1

show ethernet-switching table interface ge-0/0/1

display mac-address GigabitEthernet0/0/1

/interface bridge host print where on-interface=ether1

diagnose switch mac-address list | grep port1

diagnose switch-controller switch-info mac-table <SN> port1

errdisable recovery cause bpduguard
errdisable recovery interval 300

errdisable recovery cause bpduguard
errdisable recovery interval 300

errdisable recovery cause bpduguard
errdisable recovery interval 300

spanning-tree bpdu-protection-timeout 300

set protocols layer2-control bpdu-block disable-timeout 300

error-down auto-recovery cause bpdu-protection interval 300

port-channel load-balance src-dst-ip

port-channel load-balance src-dst ip-l4port

set forwarding-options hash-key family inet layer-3

load-balance src-dst-ip

/interface bonding set bond1 transmit-hash-policy=layer-3-and-4

show ip dhcp snooping binding

show ip dhcp snooping binding

show dhcpv4-snooping binding

show dhcp-snooping binding

show dhcp-security binding

display dhcp snooping user-bind all

ip arp inspection vlan 10
interface Gi1/0/48
 ip arp inspection trust

ip arp inspection vlan 10
interface Eth1/48
 ip arp inspection trust

vlan 10
 arp inspection
interface 1/1/48
 arp inspection trust

arp-protect
arp-protect vlan 10
arp-protect trust 24

set vlans v10 forwarding-options dhcp-security arp-inspection

arp anti-attack check user-bind enable

show ip igmp snooping groups

show ip igmp snooping groups

show ip igmp snooping groups

show igmp group

show ip igmp

show igmp snooping membership

display igmp-snooping group

show lldp neighbors detail

show lldp neighbors detail

show lldp neighbors detail

show lldp neighbor-info

show lldp info remote-device

show lldp neighbors

display lldp neighbor brief

/ip neighbor print

get switch lldp neighbors-summary
get switch lldp neighbors-detail <port>

diagnose switch-controller switch-info lldp neighbors-summary <SN>

lldp run

feature lldp

(on by default)

(on by default)

(on by default)

set protocols lldp interface all

lldp enable

/ip neighbor discovery-settings set discover-interface-list=LAN

(on by default; profile per port: config switch lldp profile)

config switch-controller lldp-profile

show cdp neighbors detail

show cdp neighbors detail

show cdp neighbors

/ip neighbor print

show ip arp

show ip arp

show ip arp

show arp

show arp

show arp

display arp

/ip arp print

diagnose ip arp list

get system arp

get system arp

show arp

show arp all

show ip route

show ip route

show ip route

show ip route

show ip route

show route

display ip routing-table

/ip route print

get router info routing-table all

get router info routing-table all

get router info routing-table all

show route

show routing route

ip route 10.1.0.0 255.255.0.0 192.168.1.1

ip route 10.1.0.0/16 192.168.1.1

ip route 10.1.0.0/16 192.168.1.1

ip route 10.1.0.0/16 192.168.1.1

ip route 10.1.0.0 255.255.0.0 192.168.1.1

set routing-options static route 10.1.0.0/16 next-hop 192.168.1.1

ip route-static 10.1.0.0 16 192.168.1.1

/ip route add dst-address=10.1.0.0/16 gateway=192.168.1.1

config router static
  edit 1
    set dst 10.1.0.0/16
    set gateway 192.168.1.1

config router static
  edit 1
    set dst 10.1.0.0 255.255.0.0
    set gateway 192.168.1.1
    set device "port1"

config router static
  edit 1
    set dst 10.1.0.0 255.255.0.0
    set gateway 192.168.1.1
    set device "port1"

route inside 10.1.0.0 255.255.0.0 192.168.1.1

set network virtual-router default routing-table ip static-route R1 destination 10.1.0.0/16 nexthop ip-address 192.168.1.1

ip route 0.0.0.0 0.0.0.0 192.168.1.1

ip route 0.0.0.0/0 192.168.1.1

ip route 0.0.0.0/0 192.168.1.1

ip route 0.0.0.0/0 192.168.1.1

ip route 0.0.0.0 0.0.0.0 192.168.1.1

set routing-options static route 0.0.0.0/0 next-hop 192.168.1.1

ip route-static 0.0.0.0 0 192.168.1.1

/ip route add dst-address=0.0.0.0/0 gateway=192.168.1.1

config router static
  edit 1
    set gateway 192.168.1.1

config router static
  edit 1
    set gateway 192.168.1.1
    set device "wan1"

config router static
  edit 1
    set gateway 203.0.113.1
    set device "wan1"

route outside 0.0.0.0 0.0.0.0 203.0.113.1

set network virtual-router default routing-table ip static-route DEFAULT destination 0.0.0.0/0 nexthop ip-address 203.0.113.1

show ip ospf neighbor

show ip ospf neighbors

show ip ospf neighbor

show ip ospf neighbors

show ip ospf neighbor

show ospf neighbor

display ospf peer

/routing ospf neighbor print

get router info ospf neighbor

get router info ospf neighbor

get router info ospf neighbor

show ospf neighbor

show routing protocol ospf neighbor

router ospf 1
 network 10.0.0.0 0.0.0.255 area 0

feature ospf
router ospf 1
interface vlan10
 ip router ospf 1 area 0

router ospf 1
 network 10.0.0.0/24 area 0

router ospf 1
 area 0
interface vlan10
 ip ospf 1 area 0

router ospf
 area 0
vlan 10
 ip ospf area 0

set protocols ospf area 0.0.0.0 interface irb.10

ospf 1
 area 0
  network 10.0.0.0 0.0.0.255

/routing ospf instance add name=o1 router-id=1.1.1.1
/routing ospf area add name=a0 area-id=0.0.0.0 instance=o1
/routing ospf interface-template add area=a0 networks=10.0.0.0/24

config router ospf
  set router-id 10.0.0.2
  config area
    edit 0.0.0.0
    next
  end
  config network
    edit 1
      set area 0.0.0.0
      set prefix 10.0.0.0 255.255.255.0
    next
  end
end

config router ospf
  set router-id 10.0.0.1
  config area
    edit 0.0.0.0
    next
  end
  config network
    edit 1
      set area 0.0.0.0
      set prefix 10.0.0.0 255.255.255.0
    next
  end
end

show ip bgp summary

show bgp ipv4 unicast summary

show ip bgp summary

show bgp ipv4 unicast summary

show ip bgp summary

show bgp summary

display bgp peer

/routing bgp session print

get router info bgp summary

get router info bgp summary

get router info bgp summary

show bgp summary

show routing protocol bgp summary

interface vlan 10
 ip helper-address 10.0.0.5

feature dhcp
ip dhcp relay
interface vlan10
 ip dhcp relay address 10.0.0.5

interface Vlan10
 ip helper-address 10.0.0.5

interface vlan 10
 ip helper-address 10.0.0.5

vlan 10
 ip helper-address 10.0.0.5

set forwarding-options dhcp-relay server-group DHCP 10.0.0.5
set forwarding-options dhcp-relay group G1 active-server-group DHCP
set forwarding-options dhcp-relay group G1 interface irb.10

dhcp enable
interface Vlanif10
 dhcp select relay
 dhcp relay server-ip 10.0.0.5

/ip dhcp-relay add name=r1 interface=vlan10 dhcp-server=10.0.0.5 local-address=10.0.10.1

config system interface
  edit "port2"
    set dhcp-relay-service enable
    set dhcp-relay-ip 10.0.0.5

dhcprelay server 10.0.0.5 inside
dhcprelay enable inside

set network dhcp interface ethernet1/2 relay ip server 10.0.0.5

ip dhcp snooping
ip dhcp snooping vlan 10
interface Gi1/0/48
 ip dhcp snooping trust

feature dhcp
ip dhcp snooping
ip dhcp snooping vlan 10
interface Eth1/48
 ip dhcp snooping trust

dhcpv4-snooping
vlan 10
 dhcpv4-snooping
interface 1/1/48
 dhcpv4-snooping trust

dhcp-snooping
dhcp-snooping vlan 10
dhcp-snooping trust 24

set vlans v10 forwarding-options dhcp-security
set vlans v10 forwarding-options dhcp-security group UPLINK overrides trusted
set vlans v10 forwarding-options dhcp-security group UPLINK interface ge-0/0/48.0

dhcp snooping enable
dhcp snooping enable vlan 10
interface GigabitEthernet0/0/48
 dhcp snooping trusted

/interface bridge set bridge1 dhcp-snooping=yes
/interface bridge port set [find interface=ether48] trusted=yes

config switch vlan
  edit 10
    set dhcp-snooping enable
config switch interface
  edit port48
    set dhcp-snooping trusted

config ports
  edit port48
    set dhcp-snooping trusted

ping 10.0.0.1
traceroute 10.0.0.1

ping 10.0.0.1 vrf management
traceroute 10.0.0.1 vrf management

ping 10.0.0.1
traceroute 10.0.0.1

ping 10.0.0.1
traceroute 10.0.0.1

ping 10.0.0.1
traceroute 10.0.0.1

ping 10.0.0.1
traceroute 10.0.0.1

ping 10.0.0.1
tracert 10.0.0.1

/ping 10.0.0.1
/tool traceroute 10.0.0.1

execute ping 10.0.0.1
execute traceroute 10.0.0.1

execute ping 10.0.0.1
execute traceroute 10.0.0.1

execute ping 10.0.0.1
execute traceroute 10.0.0.1

ping 10.0.0.1
traceroute 10.0.0.1

ping host 10.0.0.1
traceroute host 10.0.0.1

show ipv6 neighbors
show ipv6 route

show ipv6 neighbor
show ipv6 route

show ipv6 neighbors
show ipv6 route

show ipv6 neighbors
show ipv6 route

show ipv6 neighbors
show route table inet6.0

display ipv6 neighbors
display ipv6 routing-table

/ipv6 neighbor print
/ipv6 route print

diagnose ipv6 neighbor-cache list
get router info6 routing-table

show ipv6 neighbor
show ipv6 route

show ip ospf interface brief
show ip ospf database

show ip ospf interface brief
show ip ospf database

show ip ospf interface brief
show ip ospf database

show ip ospf interface
show ip ospf lsdb

show ip ospf interface
show ip ospf link-state

show ospf interface
show ospf database

display ospf interface
display ospf lsdb

/routing ospf interface print
/routing ospf lsa print

get router info ospf interface
get router info ospf database brief

show ospf interface
show ospf database

router bgp 65001
 neighbor 10.0.0.2 remote-as 65000
 address-family ipv4
  neighbor 10.0.0.2 activate
  network 10.0.0.0 mask 255.255.0.0

feature bgp
router bgp 65001
 address-family ipv4 unicast
  network 10.0.0.0/16
 neighbor 10.0.0.2
  remote-as 65000
  address-family ipv4 unicast

router bgp 65001
 neighbor 10.0.0.2 remote-as 65000
 network 10.0.0.0/16

router bgp 65001
 neighbor 10.0.0.2 remote-as 65000
 address-family ipv4 unicast
  neighbor 10.0.0.2 activate
  network 10.0.0.0/16

set routing-options autonomous-system 65001
set protocols bgp group EXT type external
set protocols bgp group EXT neighbor 10.0.0.2 peer-as 65000

bgp 65001
 peer 10.0.0.2 as-number 65000
 ipv4-family unicast
  network 10.0.0.0 255.255.0.0

/routing bgp connection add name=ISP as=65001 remote.address=10.0.0.2 remote.as=65000 local.role=ebgp

config router bgp
  set as 65001
  set router-id 1.1.1.1
  config neighbor
    edit "10.0.0.2"
      set remote-as 65000
    next
  end
  config network
    edit 1
      set prefix 10.0.0.0 255.255.0.0
    next
  end
end

router bgp 65001
 address-family ipv4 unicast
  neighbor 10.0.0.2 remote-as 65000
  neighbor 10.0.0.2 activate
  network 10.0.0.0 mask 255.255.0.0

set network virtual-router default protocol bgp enable yes local-as 65001 router-id 1.1.1.1
set network virtual-router default protocol bgp peer-group EXT peer ISP peer-as 65000 local-address interface ethernet1/1 peer-address ip 10.0.0.2

show ip bgp neighbors 10.0.0.2 advertised-routes
show ip bgp neighbors 10.0.0.2 received-routes

show bgp ipv4 unicast neighbors 10.0.0.2 advertised-routes

show ip bgp neighbors 10.0.0.2 advertised-routes
show ip bgp neighbors 10.0.0.2 received-routes

show bgp ipv4 unicast neighbors 10.0.0.2 advertised-routes

show route advertising-protocol bgp 10.0.0.2
show route receive-protocol bgp 10.0.0.2

display bgp routing-table peer 10.0.0.2 advertised-routes
display bgp routing-table peer 10.0.0.2 received-routes

/routing bgp advertisements print

get router info bgp neighbors 10.0.0.2 advertised-routes
get router info bgp neighbors 10.0.0.2 received-routes

show bgp neighbors 10.0.0.2 advertised-routes

clear ip bgp 10.0.0.2 soft

clear ip bgp 10.0.0.2 soft

clear ip bgp 10.0.0.2 soft

clear bgp 10.0.0.2 soft

clear bgp neighbor 10.0.0.2 soft

refresh bgp 10.0.0.2 import

execute router clear bgp ip 10.0.0.2 soft

clear bgp 10.0.0.2 soft

ip prefix-list PL seq 5 permit 10.0.0.0/8 le 24

ip prefix-list PL seq 5 permit 10.0.0.0/8 le 24

ip prefix-list PL seq 5 permit 10.0.0.0/8 le 24

ip prefix-list PL seq 5 permit 10.0.0.0/8 le 24

ip prefix-list PL seq 5 permit 10.0.0.0/8 le 24

set policy-options policy-statement P term 1 from route-filter 10.0.0.0/8 upto /24

ip ip-prefix PL index 10 permit 10.0.0.0 8 less-equal 24

/routing filter rule add chain=in rule="if (dst in 10.0.0.0/8 && dst-len in 8-24) { accept }"

config router prefix-list
  edit "PL"
    config rule
      edit 1
        set prefix 10.0.0.0 255.0.0.0
        set le 24

prefix-list PL seq 5 permit 10.0.0.0/8 le 24

interface Vlan10
 bfd interval 300 min_rx 300 multiplier 3
router ospf 1
 bfd all-interfaces

feature bfd
interface Vlan10
 bfd interval 300 min_rx 300 multiplier 3
 ip ospf bfd

router ospf 1
 bfd default
bfd interval 300 min-rx 300 multiplier 3

set protocols ospf area 0 interface irb.10 bfd-liveness-detection minimum-interval 300

config router ospf
  config ospf-interface
    edit "LAN"
      set bfd enable

show ip route 8.8.8.8

show ip route 8.8.8.8

show ip route 8.8.8.8

show ip route 8.8.8.8

show route 8.8.8.8

display ip routing-table 8.8.8.8

/ip route check 8.8.8.8

get router info routing-table details 8.8.8.8

show route 8.8.8.8

test routing fib-lookup virtual-router default ip 8.8.8.8

interface Vlan10
 standby 10 ip 10.0.10.1
 standby 10 priority 110
 standby 10 preempt

feature hsrp
interface Vlan10
 hsrp 10
  ip 10.0.10.1
  priority 110
  preempt

interface Vlan10
 vrrp 10 ipv4 10.0.10.1
 vrrp 10 priority-level 110

interface vlan 10
 vrrp 10 address-family ipv4
  address 10.0.10.1
  priority 110
  enable

vlan 10
 vrrp vrid 10
  virtual-ip-address 10.0.10.1
  priority 110
  enable

set interfaces irb unit 10 family inet address 10.0.10.2/24 vrrp-group 10 virtual-address 10.0.10.1 priority 110

interface Vlanif10
 vrrp vrid 10 virtual-ip 10.0.10.1
 vrrp vrid 10 priority 110

/interface vrrp add name=vrrp10 interface=vlan10 vrid=10 priority=110
/ip address add address=10.0.10.1/32 interface=vrrp10

config system interface
  edit "port2"
    set vrrp-virtual-mac enable
    config vrrp
      edit 10
        set vrip 10.0.10.1
        set priority 110

show standby brief

show hsrp brief

show vrrp

show vrrp

show vrrp

show vrrp summary

display vrrp brief

/interface vrrp print

get router info vrrp

show policy-map interface Gi1/0/1

show policy-map interface Eth1/1

show qos interfaces Ethernet1

show qos trust
show qos queue-profile

show class-of-service interface ge-0/0/1

display qos queue statistics interface GigabitEthernet0/0/1

diagnose netlink interface list port1

show ip pim neighbor
show ip mroute

show ip pim neighbor
show ip mroute

show ip pim neighbor
show ip mroute

show ip pim neighbor
show ip mroute

show pim neighbors
show multicast route

display pim neighbor
display multicast routing-table

get router info multicast pim sparse-mode neighbour
get router info multicast table

vrf definition RED
 address-family ipv4
interface Vlan10
 vrf forwarding RED

vrf context RED
interface Vlan10
 vrf member RED

vrf instance RED
ip routing vrf RED
interface Vlan10
 vrf RED

vrf RED
interface vlan 10
 vrf attach RED

set routing-instances RED instance-type virtual-router
set routing-instances RED interface irb.10

ip vpn-instance RED
 route-distinguisher 65001:1
interface Vlanif10
 ip binding vpn-instance RED

/ip vrf add name=RED interfaces=vlan10

config system interface
  edit "port3"
    set vrf 5

set network virtual-router RED interface ethernet1/3

show ip route vrf RED
show ip arp vrf RED

show ip route vrf RED

show ip route vrf RED

show ip route vrf RED

show route table RED.inet.0

display ip routing-table vpn-instance RED

/ip route print where routing-table=RED

show routing route virtual-router RED

mpls ip   (on the interface)
show mpls ldp neighbor
show mpls forwarding-table

feature mpls ldp
show mpls ldp neighbor

mpls ldp router-id 1.1.1.1
show mpls ldp neighbor

set protocols ldp interface ge-0/0/1
show ldp neighbor

mpls
mpls ldp
display mpls ldp session

/mpls ldp interface add interface=ether1
/mpls ldp neighbor print

radius server ISE
 address ipv4 10.0.0.10 auth-port 1812 acct-port 1813
 key SECRET

radius-server host 10.0.0.10 key SECRET authentication accounting

radius-server host 10.0.0.10 key SECRET

radius-server host 10.0.0.10 key plaintext SECRET

radius-server host 10.0.0.10 key SECRET

set access radius-server 10.0.0.10 secret SECRET

radius-server template R1
 radius-server authentication 10.0.0.10 1812
 radius-server shared-key cipher SECRET

/radius add address=10.0.0.10 secret=SECRET service=login

config user radius
  edit ISE
    set server 10.0.0.10
    set secret SECRET

config user radius
  edit ISE
    set server 10.0.0.10
    set secret SECRET

config user radius
  edit "ISE"
    set server 10.0.0.10
    set secret SECRET

aaa-server ISE protocol radius
aaa-server ISE (inside) host 10.0.0.10
 key SECRET

set shared server-profile radius ISE server S1 ip-address 10.0.0.10 secret SECRET port 1812

aaa new-model
dot1x system-auth-control
interface Gi1/0/1
 authentication port-control auto
 dot1x pae authenticator

feature dot1x
interface Eth1/1
 dot1x port-control auto

dot1x system-auth-control
interface Ethernet1
 dot1x pae authenticator
 dot1x port-control auto

aaa authentication port-access dot1x authenticator
 enable
interface 1/1/1
 aaa authentication port-access dot1x authenticator
  enable

aaa port-access authenticator 1
aaa port-access authenticator active

set protocols dot1x authenticator interface ge-0/0/1

dot1x enable
interface GigabitEthernet0/0/1
 dot1x enable

/interface dot1x server add interface=ether2 auth-types=dot1x

config switch interface
  edit port1
    config port-security
      set port-security-mode 802.1X

config switch-controller security-policy 802-1X
  edit "dot1x-pol"
    set security-mode 802.1X
config ports
  edit port1
    set port-security-policy "dot1x-pol"

show authentication sessions

show dot1x all

show dot1x hosts

show port-access clients

show port-access authenticator

show dot1x interface ge-0/0/1 detail

display dot1x

diagnose switch 802-1x status

diagnose switch-controller switch-info 802.1X <SN>

interface Gi1/0/1
 ip access-group MY-ACL in

interface Eth1/1
 ip access-group MY-ACL in

interface Ethernet1
 ip access-group MY-ACL in

interface 1/1/1
 apply access-list ip MY-ACL in

interface 1
 ip access-group MY-ACL in

set interfaces ge-0/0/1 unit 0 family ethernet-switching filter input MY-FILTER

interface GigabitEthernet0/0/1
 traffic-filter inbound acl name MY-ACL

(use /ip firewall filter or /interface bridge filter)

config switch acl ingress
  edit 1
    config classifier
      set dst-ip-prefix 10.0.0.10/32
    config action
      set drop enable

config switch-controller acl ingress
  edit 1
    config classifier
      set dst-ip-prefix 10.0.0.10/32
    config action
      set drop enable

monitor session 1 source interface Gi1/0/1
monitor session 1 destination interface Gi1/0/24

monitor session 1
 source interface Eth1/1 both
 destination interface Eth1/24
 no shut

monitor session 1 source Ethernet1
monitor session 1 destination Ethernet24

mirror session 1
 destination interface 1/1/24
 source interface 1/1/1 both
 enable

mirror-port 24
interface 1
 monitor all both mirror 1

set forwarding-options analyzer A input ingress interface ge-0/0/1
set forwarding-options analyzer A input egress interface ge-0/0/1
set forwarding-options analyzer A output interface ge-0/0/24

observe-port 1 interface GigabitEthernet0/0/24
interface GigabitEthernet0/0/1
 port-mirroring to observe-port 1 both

/interface ethernet switch set switch1 mirror-source=ether1 mirror-target=ether24

config switch mirror
  edit 1
    set dst port24
    set src-ingress port1
    set src-egress port1
    set status active

config mirror
  edit 1
    set dst port24
    set src-ingress port1
    set src-egress port1
    set status active

storm-control broadcast level 1

storm-control broadcast level 1

storm-control broadcast level 1

rate-limit broadcast 1000 kbps

interface 1
 broadcast-limit 5

set forwarding-options storm-control-profiles SC all bandwidth-percentage 5
set interfaces ge-0/0/1 unit 0 family ethernet-switching storm-control SC

broadcast-suppression 5

tacacs server TAC1
 address ipv4 10.0.0.11
 key SECRET
aaa new-model
aaa authentication login default group tacacs+ local

feature tacacs+
tacacs-server host 10.0.0.11 key SECRET
aaa authentication login default group TACGRP

tacacs-server host 10.0.0.11 key SECRET
aaa authentication login default group tacacs+ local

set system tacplus-server 10.0.0.11 secret SECRET
set system authentication-order [ tacplus password ]

config user tacacs+
  edit "TAC1"
    set server 10.0.0.11
    set key SECRET

aaa-server TAC protocol tacacs+
aaa-server TAC (inside) host 10.0.0.11
 key SECRET

show users

show users

show users

show system users

display users

/user active print

get system admin list

show ssh sessions

show admins

banner motd ^C Authorised use only ^C

banner motd #Authorised use only#

banner motd
Authorised use only
EOF

banner motd $Authorised use only$

banner motd "Authorised use only"

set system login message "Authorised use only"

header login information "Authorised use only"

/system note set note="Authorised use only" show-at-login=yes

config system global
  set pre-login-banner enable

banner motd Authorised use only

set deviceconfig system login-banner "Authorised use only"

username admin privilege 15 secret <password>

username admin password <password> role network-admin

username admin privilege 15 role network-admin secret <password>

user admin group administrators password plaintext <password>

password manager user-name admin

set system login user admin class super-user authentication plain-text-password

aaa
 local-user admin password irreversible-cipher <password>
 local-user admin service-type ssh
 local-user admin privilege level 15

/user add name=admin2 group=full password=<password>

config system admin
  edit admin
    set password <password>
    set accprofile super_admin

config system admin
  edit "admin2"
    set accprofile "super_admin"
    set password <password>

username admin password <password> privilege 15

set mgt-config users admin2 password
set mgt-config users admin2 permissions role-based superuser yes

interface vlan 99
 ip address 10.0.99.2 255.255.255.0
ip default-gateway 10.0.99.1

interface mgmt0
 vrf member management
 ip address 10.0.99.2/24
vrf context management
 ip route 0.0.0.0/0 10.0.99.1

vrf instance MGMT
interface Management1
 vrf MGMT
 ip address 10.0.99.2/24
ip route vrf MGMT 0.0.0.0/0 10.0.99.1

interface mgmt
 no shutdown
 ip static 10.0.99.2/24
 default-gateway 10.0.99.1

vlan 99
 ip address 10.0.99.2/24
ip default-gateway 10.0.99.1

set interfaces me0 unit 0 family inet address 10.0.99.2/24

interface Vlanif99
 ip address 10.0.99.2 24
ip route-static 0.0.0.0 0 10.0.99.1

/ip address add address=10.0.99.2/24 interface=bridge1
/ip route add gateway=10.0.99.1

config system interface
  edit mgmt
    set ip 10.0.99.2 255.255.255.0
    set allowaccess ping ssh https

(address comes from FortiLink; the switch is reached through the FortiGate)

config system interface
  edit "mgmt"
    set ip 10.0.99.2 255.255.255.0
    set allowaccess ping https ssh

interface Management1/1
 nameif management
 security-level 100
 ip address 10.0.99.2 255.255.255.0

set deviceconfig system ip-address 10.0.99.2 netmask 255.255.255.0 default-gateway 10.0.99.1

ip domain-name example.com
crypto key generate rsa modulus 3072
ip ssh version 2

feature ssh
ssh key rsa 3072

management ssh
 no shutdown

ssh server vrf mgmt

ip ssh

set system services ssh

stelnet server enable
ssh user admin authentication-type password

/ip service set ssh disabled=no

config system interface
  edit mgmt
    set allowaccess ssh

(set on the FortiGate)

config system interface
  edit "mgmt"
    set allowaccess ping https ssh

crypto key generate rsa modulus 3072
ssh 10.0.99.0 255.255.255.0 management
ssh version 2

set deviceconfig system service disable-ssh no

ntp server 10.0.0.1

ntp server 10.0.0.1 use-vrf management

ntp server 10.0.0.1

ntp server 10.0.0.1
ntp enable

timesync ntp
ntp enable
ntp server 10.0.0.1

set system ntp server 10.0.0.1

ntp-service unicast-server 10.0.0.1

/system ntp client set enabled=yes servers=10.0.0.1

config system ntp
  config ntpserver
    edit 1
      set server 10.0.0.1

config switch-controller managed-switch
  edit <SN>
    (switches follow the FortiGate system time)

config system ntp
  set ntpsync enable
  set type custom
  config ntpserver
    edit 1
      set server 10.0.0.1

ntp server 10.0.0.1

set deviceconfig system ntp-servers primary-ntp-server ntp-server-address 10.0.0.1

show ntp status

show ntp peer-status

show ntp status

show ntp status

show ntp status

show ntp associations

display ntp-service status

/system ntp client print

diagnose sys ntp status

diagnose sys ntp status

show ntp status

show ntp

logging host 10.0.0.9

logging server 10.0.0.9

logging host 10.0.0.9

logging 10.0.0.9

logging 10.0.0.9

set system syslog host 10.0.0.9 any notice

info-center loghost 10.0.0.9

/system logging action add name=remote target=remote remote=10.0.0.9
/system logging add topics=info action=remote

config log syslogd setting
  set status enable
  set server 10.0.0.9

config switch-controller switch-log
  set status enable

config log syslogd setting
  set status enable
  set server 10.0.0.9

logging enable
logging host inside 10.0.0.9

set shared log-settings syslog SYS server SRV server 10.0.0.9

show logging

show logging last 100

show logging

show logging

show logging

show log messages

display logbuffer

/log print

execute log display

execute log filter category 0
execute log display

show logging

show log system
show log traffic

snmp-server community PUBLIC RO

snmp-server community PUBLIC ro

snmp-server community PUBLIC ro

snmp-server vrf mgmt
snmp-server community PUBLIC

snmp-server community PUBLIC operator

set snmp community PUBLIC authorization read-only

snmp-agent
snmp-agent community read PUBLIC

/snmp community add name=PUBLIC addresses=10.0.0.0/24

config system snmp community
  edit 1
    set name PUBLIC

config switch-controller snmp-community
  edit 1
    set name PUBLIC

config system snmp community
  edit 1
    set name PUBLIC

snmp-server community PUBLIC
snmp-server host inside 10.0.0.9 poll

set deviceconfig system snmp-setting access-setting version v2c snmp-community-string PUBLIC

copy running-config tftp://10.0.0.1/sw1.cfg

copy running-config tftp://10.0.0.1/sw1.cfg vrf management

copy running-config flash:sw1.cfg

copy running-config tftp://10.0.0.1/sw1.cfg vrf mgmt

copy running-config tftp 10.0.0.1 sw1.cfg

show configuration | save /var/tmp/sw1.conf

tftp 10.0.0.1 put vrpcfg.zip

/export file=sw1
/system backup save name=sw1

execute backup config tftp sw1.cfg 10.0.0.1

execute backup config tftp fgt.cfg 10.0.0.1

execute backup config tftp fgt.cfg 10.0.0.1

copy running-config tftp://10.0.0.1/asa.cfg

scp export configuration from running-config.xml to [email protected]:/backup/

ip name-server 10.0.0.53
ip domain name example.com

ip name-server 10.0.0.53
ip domain-name example.com

ip name-server 10.0.0.53

ip dns server-address 10.0.0.53

ip dns server-address priority 1 10.0.0.53

set system name-server 10.0.0.53

dns server 10.0.0.53

/ip dns set servers=10.0.0.53

config system dns
  set primary 10.0.0.53

config system dns
  set primary 10.0.0.53
  set secondary 10.0.0.54

dns server-group DefaultDNS
 name-server 10.0.0.53

set deviceconfig system dns-setting servers primary 10.0.0.53

clock timezone CET 1
clock summer-time CEST recurring

clock timezone CET 1 0
clock summer-time CEST 5 sun mar 02:00 5 sun oct 03:00 60

clock timezone Europe/Brussels

set system time-zone Europe/Brussels

clock timezone CET add 01:00:00

/system clock set time-zone-name=Europe/Brussels

config system global
  set timezone "Europe/Brussels"

clock timezone CET 1

set deviceconfig system timezone Europe/Brussels

snmp-server group G v3 priv
snmp-server user U G v3 auth sha <auth> priv aes 128 <priv>

snmp-server user U network-operator auth sha <auth> priv aes-128 <priv>

snmp-server user U G v3 auth sha <auth> priv aes <priv>

set snmp v3 usm local-engine user U authentication-sha authentication-password <auth>
set snmp v3 usm local-engine user U privacy-aes128 privacy-password <priv>

config system snmp user
  edit "U"
    set security-level auth-priv
    set auth-proto sha
    set auth-pwd <auth>
    set priv-proto aes
    set priv-pwd <priv>

snmp-server group G v3 priv
snmp-server user U G v3 auth sha <auth> priv aes 128 <priv>

set system services ssh
set system services netconf ssh

/ip service set ssh address=10.0.99.0/24

config system interface
  edit "port1"
    set allowaccess ping https ssh snmp fgfm

ssh 10.0.99.0 255.255.255.0 management
http 10.0.99.0 255.255.255.0 management

set network profiles interface-management-profile MGMT ssh yes https yes ping yes
set network interface ethernet ethernet1/1 layer3 interface-management-profile MGMT

show power inline

show power-over-ethernet brief

show power-over-ethernet brief

show poe interface

display poe information

/interface ethernet poe print

get switch poe inline

diagnose switch-controller switch-info poe <SN>

power inline auto
power inline never

power-over-ethernet
no power-over-ethernet

interface 1
 power-over-ethernet
 no power-over-ethernet

set poe interface ge-0/0/1 disable

interface GigabitEthernet0/0/1
 poe enable
 undo poe enable

/interface ethernet poe set ether1 poe-out=off
/interface ethernet poe set ether1 poe-out=auto-on

config switch physical-port
  edit port1
    set poe-status enable   (or disable)

config ports
  edit port1
    set poe-status enable   (or disable)

test cable-diagnostics tdr interface Gi1/0/1
show cable-diagnostics tdr interface Gi1/0/1

/interface ethernet cable-test ether1

diagnose switch physical-ports cable-diag port1

show interfaces transceiver detail

show interface transceiver details

show interfaces transceiver

show interface 1/1/1 dom

show interfaces transceiver 1 detail

show interfaces diagnostics optics xe-0/0/1

display transceiver interface GigabitEthernet0/0/1 verbose

/interface ethernet monitor sfp1 once

get switch modules detail

show tech-support

show tech-support

show tech-support

show tech

show tech

request support information

display diagnostic-information

/system sup-output name=sup

execute tac report

show tech-support

scp export tech-support to [email protected]:/tmp/

execute switch-controller get-conn-status
execute switch-controller diagnose-connection <SN>

dir flash:

dir bootflash:

dir flash:

show images

show flash

file list /var/tmp/
show system storage

dir

/file print

install add file flash:cat9k_iosxe.bin activate commit

install all nxos bootflash:nxos64-cs.bin

copy tftp://10.0.0.1/EOS.swi flash:
boot system flash:EOS.swi
reload

copy tftp://10.0.0.1/image.swi primary vrf mgmt
boot system primary

copy tftp flash 10.0.0.1 image.swi primary
boot system flash primary

request system software add /var/tmp/junos.tgz reboot

startup system-software image.cc
reboot

/system package update check-for-updates
/system package update install

execute restore image tftp FSW_image.out 10.0.0.1

execute restore image tftp FGT_image.out 10.0.0.1

copy tftp://10.0.0.1/asa.bin disk0:
boot system disk0:/asa.bin

request system software download version 11.1.0
request system software install version 11.1.0

write erase
reload

write erase
reload

write erase
reload

erase all zeroize

erase startup-config
reload

request system zeroize

reset saved-configuration
reboot

/system reset-configuration no-defaults=yes

execute factoryreset

execute factoryreset

configure factory-default

request system private-data-reset

config firewall policy
  edit 10
    set name "LAN-to-WAN"
    set srcintf "lan"
    set dstintf "wan1"
    set srcaddr "all"
    set dstaddr "all"
    set action accept
    set schedule "always"
    set service "ALL"
    set nat enable
    set logtraffic all
  next
end

access-list INSIDE-IN extended permit tcp 192.168.10.0 255.255.255.0 any eq 443
access-group INSIDE-IN in interface inside

set rulebase security rules LAN-to-WAN from trust to untrust source any destination any application any service application-default action allow log-end yes

show firewall policy
diagnose firewall iprope list 100004

show access-list INSIDE-IN

show rule-hit-count vsys vsys-name vsys1 rule-base security rules all

diagnose firewall iprope lookup 10.0.0.5 12345 8.8.8.8 443 tcp port2

packet-tracer input inside tcp 10.0.0.5 12345 8.8.8.8 443

test security-policy-match from trust to untrust source 10.0.0.5 destination 8.8.8.8 protocol 6 destination-port 443

config firewall policy
  move 20 before 10

access-list INSIDE-IN line 1 extended permit tcp any any eq 22

move rulebase security rules R2 before R1

config firewall address
  edit "SRV1"
    set subnet 10.0.0.10 255.255.255.255
  next
  edit "EXAMPLE"
    set type fqdn
    set fqdn "example.com"
  next
end
config firewall addrgrp
  edit "SERVERS"
    set member "SRV1" "SRV2"

object network SRV1
 host 10.0.0.10
object-group network SERVERS
 network-object object SRV1

set address SRV1 ip-netmask 10.0.0.10/32
set address-group SERVERS static [ SRV1 SRV2 ]

config firewall service custom
  edit "TCP-8443"
    set tcp-portrange 8443
  next
end
config firewall service group
  edit "WEB"
    set member "HTTP" "HTTPS" "TCP-8443"

object service TCP-8443
 service tcp destination eq 8443
object-group service WEB tcp
 port-object eq 80
 port-object eq 443

set service TCP-8443 protocol tcp port 8443
set service-group WEB members [ service-http service-https TCP-8443 ]

(in the policy)
  set nat enable                 # use the outgoing interface address

config firewall ippool
  edit "POOL1"
    set startip 203.0.113.10
    set endip 203.0.113.20
  next
end
(in the policy)
  set ippool enable
  set poolname "POOL1"

object network LAN
 subnet 192.168.10.0 255.255.255.0
 nat (inside,outside) dynamic interface

set rulebase nat rules SNAT from trust to untrust source any destination any source-translation dynamic-ip-and-port interface-address interface ethernet1/1

config firewall vip
  edit "WEB-VIP"
    set extintf "wan1"
    set extip 203.0.113.10
    set mappedip "10.0.0.10"
    set portforward enable
    set extport 443
    set mappedport 443
    set protocol tcp
  next
end
(use "WEB-VIP" as dstaddr in the policy)

object network WEB
 host 10.0.0.10
 nat (inside,outside) static 203.0.113.10 service tcp 443 443
access-list OUTSIDE-IN extended permit tcp any object WEB eq 443

set rulebase nat rules DNAT-WEB from untrust to untrust source any destination 203.0.113.10 service service-https destination-translation translated-address 10.0.0.10
set rulebase security rules WEB from untrust to dmz destination 203.0.113.10 service service-https action allow

show firewall vip
show firewall ippool

show nat
show xlate

show running nat-policy

diagnose sys session filter src 10.0.0.5
diagnose sys session filter dport 443
diagnose sys session list
diagnose sys session filter clear

show conn address 10.0.0.5
show conn port 443

show session all filter source 10.0.0.5 destination-port 443

diagnose sys session filter src 10.0.0.5
diagnose sys session clear

clear conn address 10.0.0.5

clear session all filter source 10.0.0.5

(in the policy)
  set logtraffic all          # or utm

access-list INSIDE-IN extended permit tcp any any eq 443 log

set rulebase security rules LAN-to-WAN log-end yes

config firewall local-in-policy
  edit 1
    set intf "wan1"
    set srcaddr "ADMIN-NETS"
    set dstaddr "all"
    set action accept
    set service "HTTPS" "SSH"
    set schedule "always"

access-list MGMT-IN extended permit tcp 10.0.99.0 255.255.255.0 any eq 22
access-group MGMT-IN in interface outside control-plane

set network profiles interface-management-profile MGMT ssh yes https yes permitted-ip 10.0.99.0/24

config firewall policy
  edit 20
    set internet-service enable
    set internet-service-name "Microsoft-Office365"

set rulebase security rules O365 application ms-office365

config firewall shaper traffic-shaper
  edit "LIMIT-10M"
    set maximum-bandwidth 10240
  next
end
config firewall shaping-policy
  edit 1
    set service "ALL"
    set srcaddr "GUESTS"
    set dstaddr "all"
    set traffic-shaper "LIMIT-10M"

policy-map POLICE
 class class-default
  police output 10000000
service-policy POLICE interface outside

(QoS profile, QoS policy rule and QoS enabled on the egress interface:
 easiest in the web UI under Network > QoS)

config vpn ipsec phase1-interface
  edit "TO-BRANCH"
    set interface "wan1"
    set ike-version 2
    set remote-gw 198.51.100.2
    set psksecret <key>
    set proposal aes256-sha256
    set dpd on-idle
  next
end
config vpn ipsec phase2-interface
  edit "TO-BRANCH"
    set phase1name "TO-BRANCH"
    set proposal aes256-sha256
    set src-subnet 10.0.0.0 255.255.255.0
    set dst-subnet 10.1.0.0 255.255.255.0
  next
end

crypto ikev2 policy 10
 encryption aes-256
 integrity sha256
 group 14
 prf sha256
crypto ikev2 enable outside
crypto ipsec ikev2 ipsec-proposal AES256
 protocol esp encryption aes-256
 protocol esp integrity sha-256
crypto ipsec profile VTI
 set ikev2 ipsec-proposal AES256
tunnel-group 198.51.100.2 type ipsec-l2l
tunnel-group 198.51.100.2 ipsec-attributes
 ikev2 remote-authentication pre-shared-key <key>
 ikev2 local-authentication pre-shared-key <key>
interface Tunnel1
 nameif TO-BRANCH
 ip address 169.254.10.1 255.255.255.252
 tunnel source interface outside
 tunnel destination 198.51.100.2
 tunnel mode ipsec ipv4
 tunnel protection ipsec profile VTI

set network ike gateway GW1 protocol ikev2 local-address interface ethernet1/1 peer-address ip 198.51.100.2 authentication pre-shared-key key <key>
set network ipsec crypto-profiles ipsec-crypto-profiles IPSEC esp encryption aes-256-cbc authentication sha256
set network tunnel ipsec TUN1 auto-key ike-gateway GW1 ipsec-crypto-profile IPSEC tunnel-interface tunnel.1

show crypto ikev2 sa
show crypto ipsec sa

get vpn ipsec tunnel summary
diagnose vpn tunnel list name TO-BRANCH
diagnose vpn ike gateway list

show crypto ikev2 sa
show crypto ipsec sa

show vpn ike-sa
show vpn ipsec-sa

diagnose vpn ike log-filter dst-addr4 198.51.100.2
diagnose debug application ike -1
diagnose debug enable
(then: diagnose debug disable / diagnose debug reset)

debug crypto ikev2 protocol 127
debug crypto ikev2 platform 127

less mp-log ikemgr.log

diagnose vpn ike gateway clear name TO-BRANCH

clear crypto ikev2 sa

clear vpn ike-sa gateway GW1
clear vpn ipsec-sa tunnel TUN1

interface Tunnel0
 ip address 10.255.0.1 255.255.255.252
 tunnel source GigabitEthernet0/0
 tunnel destination 198.51.100.2

feature tunnel
interface Tunnel0
 ip address 10.255.0.1/30
 tunnel source Ethernet1/1
 tunnel destination 198.51.100.2

interface Tunnel0
 tunnel mode gre
 tunnel source 203.0.113.2
 tunnel destination 198.51.100.2
 ip address 10.255.0.1/30

set interfaces gr-0/0/0 unit 0 tunnel source 203.0.113.2 destination 198.51.100.2
set interfaces gr-0/0/0 unit 0 family inet address 10.255.0.1/30

interface Tunnel0/0/1
 tunnel-protocol gre
 source 203.0.113.2
 destination 198.51.100.2
 ip address 10.255.0.1 30

/interface gre add name=gre1 local-address=203.0.113.2 remote-address=198.51.100.2
/ip address add address=10.255.0.1/30 interface=gre1

config system gre-tunnel
  edit "gre1"
    set interface "wan1"
    set local-gw 203.0.113.2
    set remote-gw 198.51.100.2

get vpn ssl monitor
diagnose vpn ike gateway list

show vpn-sessiondb anyconnect

show global-protect-gateway current-user

config system ha
  set group-name "HA1"
  set mode a-p
  set password <key>
  set hbdev "ha1" 50 "ha2" 100
  set priority 200
  set override disable
end

failover lan unit primary
failover lan interface FOLINK GigabitEthernet0/3
failover interface ip FOLINK 10.255.0.1 255.255.255.252 standby 10.255.0.2
failover

set deviceconfig high-availability enabled yes group group-id 1 mode active-passive
set deviceconfig high-availability interface ha1 port ha1-a ip-address 10.255.0.1 netmask 255.255.255.252

get system ha status
diagnose sys ha status

show failover

show high-availability state

diagnose sys ha checksum cluster
execute ha synchronize start

write standby

show high-availability state-synchronization
request high-availability sync-to-remote running-config

diagnose sys ha reset-uptime

failover active   (on the standby unit)

request high-availability state suspend
request high-availability state functional

execute ha manage 1 admin

config <table>        enter a section
  edit <name>         create or open an entry
    set <key> <value>
  next                finish an entry
end                   save and leave the section
abort                 leave without saving
show / get / diagnose / execute
?  and <TAB>          help and completion

config firewall addrgrp
  edit "SERVERS"
    append member "SRV3"
    unselect member "SRV1"
    show

config system global
  set admin-sport 8443
  set admin-ssh-port 2222
end
config system admin
  edit "admin2"
    set trusthost1 10.0.99.0 255.255.255.0

config system global
  set vdom-mode multi-vdom
end
config vdom
  edit CUSTOMER-A
  next
end
config vdom
  edit root
  (commands for that VDOM)
config global
  (commands for the whole box)

mode multiple
context CUSTOMER-A

set vsys vsys2 display-name CUSTOMER-A

config system interface
  edit "vlan10"
    set vdom "root"
    set vlanid 10
    set interface "port2"
    set ip 10.0.10.1 255.255.255.0
    set allowaccess ping
  next
end

interface GigabitEthernet0/1.10
 vlan 10
 nameif users
 security-level 100
 ip address 10.0.10.1 255.255.255.0

set network interface ethernet ethernet1/2 layer3 units ethernet1/2.10 tag 10 ip 10.0.10.1/24

config system interface
  edit "agg1"
    set type aggregate
    set member "port3" "port4"
    set lacp-mode active

interface Port-channel1
interface GigabitEthernet0/2
 channel-group 1 mode active

set network aggregate-ethernet ae1 layer3 ip 10.0.0.1/24
set network interface ethernet ethernet1/3 aggregate-group ae1

config system zone
  edit "LAN-ZONE"
    set interface "port2" "port3"
end
config system switch-interface
  edit "lan"
    set member "lan1" "lan2"

set zone trust network layer3 [ ethernet1/2 ethernet1/3 ]

config system dhcp server
  edit 1
    set interface "port2"
    set default-gateway 192.168.10.1
    set netmask 255.255.255.0
    set dns-server1 1.1.1.1
    config ip-range
      edit 1
        set start-ip 192.168.10.100
        set end-ip 192.168.10.200
      next
    end
  next
end

dhcpd address 192.168.10.100-192.168.10.200 inside
dhcpd dns 1.1.1.1
dhcpd enable inside

set network dhcp interface ethernet1/2 server option lease timeout 1440 dns primary 1.1.1.1
set network dhcp interface ethernet1/2 server ip-pool 192.168.10.100-192.168.10.200

execute dhcp lease-list

show dhcpd binding

show dhcp server lease interface all

execute update-now
diagnose autoupdate versions
diagnose debug rating

execute backup config tftp fgt.cfg 10.0.0.1
execute restore config tftp fgt.cfg 10.0.0.1

config firewall policy
  edit 10
    set utm-status enable
    set ssl-ssh-profile "certificate-inspection"
    set av-profile "default"
    set webfilter-profile "default"
    set ips-sensor "default"
    set application-list "default"
  next
end

set rulebase security rules LAN-to-WAN profile-setting group DEFAULT-PROFILES

show antivirus profile
show webfilter profile
show ips sensor
show application list
show dnsfilter profile
show firewall ssl-ssh-profile

config user local
  edit "alice"
    set type password
    set passwd <password>
  next
end
config user group
  edit "STAFF"
    set member "alice"

username alice password <password>

set shared local-user-database user alice phash <hash>

config user ldap
  edit "AD"
    set server "10.0.0.20"
    set cnid "sAMAccountName"
    set dn "dc=example,dc=com"
    set type regular
    set username "CN=svc-fw,OU=Service,DC=example,DC=com"
    set password <password>

aaa-server AD protocol ldap
aaa-server AD (inside) host 10.0.0.20
 ldap-base-dn dc=example,dc=com
 ldap-login-dn CN=svc-fw,OU=Service,DC=example,DC=com
 ldap-login-password <password>

set shared server-profile ldap AD server S1 address 10.0.0.20 port 389
set shared server-profile ldap AD base dc=example,dc=com bind-dn "CN=svc-fw,OU=Service,DC=example,DC=com" bind-password <password>

diagnose test authserver radius ISE pap alice <password>
diagnose test authserver ldap AD alice <password>

test aaa-server authentication ISE host 10.0.0.10 username alice password <password>

test authentication authentication-profile AUTH-PROFILE username alice password

diagnose debug application fnbamd -1
diagnose debug enable

debug radius all
debug aaa authentication

less mp-log authd.log

config system sdwan
  set status enable
  config members
    edit 1
      set interface "wan1"
      set gateway 203.0.113.1
    next
    edit 2
      set interface "wan2"
      set gateway 198.51.100.1
    next
  end
  config health-check
    edit "Google"
      set server "8.8.8.8"
      set members 1 2
    next
  end
  config service
    edit 1
      set name "Voice"
      set mode sla
      set dst "all"
    next
  end
end

(path monitoring: set network virtual-router default routing-table ip static-route R1 path-monitor ...)

diagnose sys sdwan member
diagnose sys sdwan health-check
diagnose sys sdwan service4

route-map PBR permit 10
 match ip address SRC-NETS
 set ip next-hop 198.51.100.1
interface Vlan10
 ip policy route-map PBR

config router policy
  edit 1
    set input-device "port2"
    set src "10.0.0.0/255.255.255.0"
    set dst "0.0.0.0/0.0.0.0"
    set gateway 198.51.100.1
    set output-device "wan2"

route-map PBR permit 10
 match ip address SRC-NETS
 set ip next-hop 198.51.100.1

set rulebase pbf rules R1 from zone trust source 10.0.0.0/24 action forward egress-interface ethernet1/2 nexthop ip-address 198.51.100.1

config system link-monitor
  edit "ISP1"
    set srcintf "wan1"
    set server "8.8.8.8"
    set gateway-ip 203.0.113.1
    set interval 1000
    set failtime 5

sla monitor 1
 type echo protocol ipIcmpEcho 8.8.8.8 interface outside
sla monitor schedule 1 life forever start-time now
track 1 rtr 1 reachability
route outside 0.0.0.0 0.0.0.0 203.0.113.1 1 track 1

config system interface
  edit "fortilink"
    set type aggregate
    set member "port5"
    set fortilink enable
    set ip 10.255.1.1 255.255.255.0
    set allowaccess ping capwap fabric
end
config switch-controller managed-switch
  edit <SN>
    set fsw-wan1-admin enable

get wireless-controller wtp-status
diagnose wireless-controller wlac -c wtp

diagnose debug reset
diagnose debug flow filter addr 10.0.0.5
diagnose debug flow show function-name enable
diagnose debug flow trace start 100
diagnose debug enable
(when done)
diagnose debug disable
diagnose debug reset

packet-tracer input inside tcp 10.0.0.5 12345 8.8.8.8 443 detailed

test security-policy-match from trust to untrust source 10.0.0.5 destination 8.8.8.8 protocol 6 destination-port 443

diagnose sniffer packet any "host 10.0.0.5 and port 443" 4 0 l

capture CAP interface inside match tcp host 10.0.0.5 any eq 443
show capture CAP

debug dataplane packet-diag set filter match source 10.0.0.5 destination-port 443
debug dataplane packet-diag set filter on
debug dataplane packet-diag set capture stage firewall file cap.pcap
debug dataplane packet-diag set capture on
(when done: set capture off, then view-pcap filter-pcap cap.pcap)

diagnose sys top 2 30
diagnose sys top-mem
diagnose sys top-summary

show processes cpu-usage sorted

show running resource-monitor

diagnose hardware sysinfo conserve
get system performance status

diagnose hardware deviceinfo nic port1
diagnose netlink interface list port1

diagnose debug crashlog read
execute tac report

diagnose debug application dhcps -1
diagnose debug application dnsproxy -1
diagnose ip router command show "show ip ospf neighbor"
diagnose debug enable

diagnose ip arp list
diagnose ip address list
get router info routing-table details 10.0.0.5

show arp
show ip address