Home > > > Fortinet CLI Commands Every Security Professional Should Know

Fortinet CLI Commands Every Security Professional Should Know

Author : cpavan kumar | Published On : 14 Aug 2026

Fortinet Training Institute provides learning resources that can help IT professionals build practical skills for working with Fortinet security technologies. One of the most useful skills for FortiGate administrators is knowing how to work with the command-line interface (CLI).

The FortiGate CLI gives administrators direct access to configuration, monitoring, and troubleshooting functions. While many tasks can be completed through the graphical user interface (GUI), CLI knowledge becomes especially useful when diagnosing network problems or managing advanced settings.

This guide covers important Fortinet CLI commands that security professionals should understand and explains where each command can be useful in everyday network administration.

What Is the FortiGate CLI?

The FortiGate CLI is a text-based interface used to configure, monitor, and troubleshoot Fortinet devices. Administrators can access it through a console connection, SSH, or other supported management methods.

The CLI provides detailed control over FortiGate settings. It is particularly helpful when a configuration needs to be checked quickly or when a problem cannot be easily identified through the GUI.

For professionals preparing for NSE Certifications, developing basic CLI skills can also strengthen their understanding of FortiGate administration.

Why Should Security Professionals Learn Fortinet CLI Commands?

CLI knowledge is useful for more than just changing configurations. It can help administrators understand what is happening inside a FortiGate device.

Some common benefits include:

  • Faster troubleshooting

  • More detailed configuration control

  • Easier system monitoring

  • Quick access to diagnostic information

  • Better understanding of FortiGate architecture

  • Efficient management of repetitive tasks

A security professional does not necessarily need to memorize every available command. Instead, it is more useful to understand the most common commands and know when to use them.

Basic FortiGate CLI Navigation Commands

Before working with advanced settings, you should understand how to move through the CLI.

Accessing Configuration Sections

FortiGate organizes configuration settings into different sections. The config command is used to enter a particular configuration area.

For example, administrators may enter areas related to:

  • System settings

  • Interfaces

  • Firewall policies

  • Static routing

  • VPN configuration

Once inside a configuration section, the available commands depend on that particular context.

Using the Show Command

The show command is one of the most useful commands for viewing configuration information.

It can help administrators inspect the settings within the current configuration section.

This is particularly useful when checking whether a setting has been configured as expected.

Using the Get Command

The get command displays information about the current configuration or operational status, depending on the CLI context.

It is useful when you want to review settings without making changes.

Using the End Command

After completing work inside a configuration section, the end command takes you back to the main CLI level.

Understanding these basic navigation commands makes it easier to work safely in the FortiGate CLI.

Commands for Checking System Information

Security professionals often need to check the condition and configuration of a FortiGate device.

Get System Status

The system status command provides important information about the device, including details such as the FortiOS version and system information.

This can be useful when verifying software versions or checking whether a device is running the expected firmware.

Get System Performance

Performance-related commands help administrators review resource usage.

Depending on the command and FortiOS version, you can inspect information related to:

  • CPU usage

  • Memory usage

  • System uptime

  • Session information

Monitoring these resources can help identify performance problems.

FortiGate Interface Commands

Network interfaces are fundamental to FortiGate configuration. CLI commands can help administrators inspect interface settings and operational status.

Checking Interface Information

Administrators can use interface-related commands to review:

  • IP addresses

  • Interface status

  • Administrative settings

  • Network zones

  • VLAN configuration

This information is particularly useful when troubleshooting connectivity.

Checking Interface Status

If users suddenly lose network access, checking the interface status should be one of the first troubleshooting steps.

A disabled interface, incorrect IP address, or connectivity problem can prevent traffic from reaching the firewall.

Firewall Policy Commands

Firewall policies determine which traffic is allowed or denied.

Viewing Firewall Policies

CLI commands can be used to inspect configured firewall policies and verify settings such as:

  • Source addresses

  • Destination addresses

  • Services

  • NAT

  • Security profiles

  • Policy status

Checking the policy configuration can help identify why particular traffic is being blocked or allowed.

Checking Policy Configuration

When troubleshooting a connection, verify that the relevant policy contains the correct source, destination, service, and interface settings.

Policy order is also important because FortiGate evaluates policies according to its traffic-matching process.

Routing and Connectivity Commands

Routing problems are common causes of network connectivity issues.

Checking the Routing Table

A routing table command allows administrators to see how FortiGate decides where network traffic should go.

This can help identify:

  • Missing routes

  • Incorrect gateways

  • Unexpected routing paths

  • Interface-related routing problems

Testing Network Connectivity

Ping is a simple but valuable troubleshooting tool.

Administrators can use ping to check whether FortiGate can reach another IP address. This helps determine whether a basic network connection exists.

Traceroute

Traceroute helps identify the path traffic takes toward a destination.

If connectivity exists but traffic is taking an unexpected route, traceroute can provide useful information for further investigation.

DNS Troubleshooting Commands

DNS problems can cause websites, applications, and other services to appear unavailable even when the underlying network connection is working.

CLI tools can help administrators check DNS-related settings and test name resolution.

When troubleshooting DNS, check:

  • Configured DNS servers

  • DNS reachability

  • Name resolution

  • Network connectivity

This can help determine whether the issue is related to the firewall, DNS server, or wider network.

VPN Troubleshooting Commands

VPNs are widely used for secure communication between offices, data centers, and remote users.

Checking IPsec VPN Status

CLI commands can provide information about IPsec tunnels, including their current state and negotiation details.

If a tunnel is not working, administrators can inspect the tunnel status and configuration to identify possible problems.

Diagnosing VPN Issues

VPN troubleshooting may involve checking:

  • Phase 1 settings

  • Phase 2 settings

  • Authentication

  • Encryption parameters

  • Routing

  • Firewall policies

Using CLI diagnostics can provide information that may not be immediately visible in the GUI.

Session and Traffic Monitoring

FortiGate maintains information about active network sessions. Monitoring sessions can help administrators understand how traffic is flowing through the firewall.

Viewing Active Sessions

Session information can show details about current connections, helping administrators investigate traffic-related problems.

Monitoring Traffic

Traffic monitoring commands can be useful when determining whether packets are reaching the FortiGate device and how they are being processed.

This is especially valuable when troubleshooting firewall policies or unexpected connectivity behavior.

FortiGate Debug and Diagnostic Commands

Diagnostic commands are powerful tools for experienced administrators.

Packet Capture

Packet capture can help determine whether packets are reaching an interface and what happens to them as they pass through the device.

It can be useful for investigating:

  • Dropped packets

  • Unexpected traffic

  • Connectivity problems

  • Application issues

Debug Flow

Flow-based debugging can help administrators understand how FortiGate processes specific traffic.

It can reveal information about policy matching, routing decisions, and packet handling.

Because diagnostic commands can generate a large amount of information, they should be used carefully and stopped when they are no longer needed.

Best Practices When Using the FortiGate CLI

CLI access provides significant control, so administrators should use it carefully.

Check Before Making Changes

Review the existing configuration before modifying anything. A small change can affect network connectivity or security policies.

Keep Configuration Backups

Regular backups provide a recovery option if an unexpected configuration change causes problems.

Understand the Command Before Running It

Avoid executing commands simply because they appear in an online tutorial. Make sure you understand what a command does and whether it applies to your FortiOS version.

Use Diagnostic Commands Carefully

Debugging and packet-capture tools can generate substantial output or consume system resources. Use them only when necessary and stop them after completing the investigation.

Document Important Changes

Recording configuration changes makes troubleshooting easier and provides a useful reference for future administrators.

How to Improve Your Fortinet CLI Skills

The best way to become comfortable with the CLI is through regular practice.

Start with simple configuration and monitoring commands. Once you understand the basics, move toward troubleshooting exercises involving routing, firewall policies, VPNs, and traffic flow.

A virtual lab can be particularly useful because it allows you to experiment without affecting a production network.

If you are preparing for NSE Certifications, combine CLI practice with your broader Fortinet study plan. Understanding why a command is used is more valuable than memorizing a long list of syntax.

Frequently Asked Questions

Do I need to know every Fortinet CLI command?

No. FortiGate has a large number of CLI commands, and memorizing all of them is unnecessary. Focus on commands used for configuration, monitoring, and troubleshooting.

Is CLI better than the FortiGate GUI?

Neither approach is universally better. The GUI is convenient for many administrative tasks, while the CLI provides detailed control and powerful troubleshooting capabilities. Skilled administrators should be comfortable using both.

Can beginners learn FortiGate CLI?

Yes. Beginners can start with basic navigation, system information, interface checks, routing commands, and simple troubleshooting. Regular practice makes the CLI easier to use.

Is Fortinet CLI knowledge useful for cybersecurity jobs?

Yes. FortiGate administration and troubleshooting skills can be useful in network security, firewall administration, and cybersecurity roles.

Conclusion

FortiGate CLI knowledge is an important practical skill for security professionals who manage and troubleshoot enterprise networks. Commands for checking system status, interfaces, firewall policies, routing, VPNs, sessions, and traffic can make everyday administration more efficient. However, effective CLI use is about more than memorizing syntax. Understanding what each command does and knowing when to use it is far more valuable. With regular lab practice and a structured learning approach, professionals can build strong FortiGate administration skills and gain a solid foundation for pursuing NSE Certifications and advancing their careers in network security.