0

I have a recurring occurance at 02:30 (2:30 AM) every night, where DNS name resolutions fail.
I'd like to run the following CLI commands on our FortiGate 60D at 02:20, so I'll have some data to debug the DNS issue:

dia debug reset 
dia de flow filter port 53 
dia de consol time en 
dia de flow show fun en 
dia de flow trace start 100000000 
dia de en

I was thinking of using crontab to execute a CLI script, or a list of CLI commands, something like:

ssh <my_fortigate_ip> "dia debug reset ; dia de flow filter port 53 ; dia de consol time en ; dia de flow show fun en ; dia de flow trace start 100000000 ; dia de en"
  1. Can more than one CLI commands be entered on a CLI shell line? What is the separator between CLI commands?
  2. Can an ssh key exchange (or equivalent) be performed so I could log in to the FortiGate from a certain machine, without being prompted for a password?
  3. Is there another way to collect data non-interactively on a FortiGate between certain times?
Improve this question
5
  • Aren't you capturing what is happening in your log or SNMP server? – Ron Maupin♦ Aug 23 '19 at 18:26
  • No, @Ron. We have no active log or SNMP servers. – boardrider Aug 23 '19 at 18:40
  • Well, you seriously need to install a monitoring infrastructure for a business network. – Ron Maupin♦ Aug 23 '19 at 18:45
  • Just wondering..can't we make use of REST API and pust set of commands directly to fortigate – user5337995 Aug 24 '19 at 15:34
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can provide and accept your own answer. – Ron Maupin♦ Dec 15 '19 at 18:37
2

The 60D is a bit tricky since it doesn't log much locally. I never understood why it can't log to a local USB stick. I'd recommend setting up a syslog server.

Can more than one CLI commands be entered on a CLI shell line? What is the separator between CLI commands?

No, I don't think FortiOS supports that. You'll need to send line breaks in between.

Can an ssh key exchange (or equivalent) be performed so I could log in to the FortiGate from a certain machine, without being prompted for a password?

Yes. You can set a local admin password by running

config system admin
    edit admin
      set ssh-public-key1 "<key-type> <key-value>"

See https://kb.fortinet.com/kb/documentLink.do?externalID=11985 for details.

Is there another way to collect data non-interactively on a FortiGate between certain times?

I'd simply run a packet capture with a filter set so that it doesn't run out before that problem happens.

You can run a packet capture from the GUI or in CLI

diag sniffer packet <interface> <'filter'> <verbose> <count> a

See https://kb.fortinet.com/kb/documentLink.do?externalId=11186 for details.

You could also schedule a script but I haven't actually done that yet.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.