FortiOS CLI Config (Misc)

Quick Notes for Fortigate/FortiWifi settings

  • Set up Bridge Interface of multiple physical interfaces:
  • config system switch-interface edit new_internal
    set member internal wifiset type switch set vdom root end
  • Reserved DHCP Address
    • Enter the following command Config System DHCP Reserved-Address and press enter, prompt will change and will have (reserved-address) in parenthesis.
    • The name of the new reservation item needs to be entered: Type in Edit “name of device” and press enter – note you need the quotation mark
      • Now you need to assign the IP and MAC address using the command Set ip 192.168.x.x – press enter. x is the last two octets – Set mac 00:XX:XX:XX:XX:XX – press enter
      • Type in the command next and then end
      • Confirm the setting by typing in the command Show : – you should see a response with the new settings
  • Daily Restart (via CLI)
    • config system global
      set daily-restart enable
      set restart-time 05:06
  • Setup PPTP Server
    • Assume Internal Trusted Zone is 192.168.1.x
    • Let's Assign 192.168.10.x for PPTP client
    • Create a user
      • config user local
            edit "pptp_user"
                set type password
                set passwd

    • Create a user group
      • config user group
            edit "PPTP_group"
                set member "pptp_user"

    • Enable PPTP server
      • config vpn pptp
            set status enable
            set eip
            set sip
            set usrgrp "PPTP_group"

    • Create a Firewall Object for the PPTP client on WAN interface
      • config firewall address
            edit "pptp_client"
                set associated-interface "wan1"
                set subnet
    • Create Firewall Policy - PPTP client to Internet (WAN)
      In this way, we can use PPTP as a VPN service to access other Internet
      • config firewall policy
            edit 1
                set srcintf "wan1"
                set dstintf "wan1"
                set srcaddr "pptp_client"
                set dstaddr "all"
                set action accept
                set schedule "always"
                set service "ALL"
                set nat enable

    • Check if PPTP client can be connected
      • FWF60C # diagnose vpn pptp status
        VDOM = root 0 State = 1, IP-mode = manual IP =
        -------------------------- Client --------------------------
        Index = 1 Pid = 594 Remote = Local = yyy.yyy.yyy.yyy Assigned =
    • Reference:


Popular Posts