FortiOS CLI —
Kompakte Referenz auf Deutsch

# Konfiguration anzeigen
show full-configuration
show firewall policy
show system interface

# In Kontext wechseln
config system interface
config firewall policy

# Objekt bearbeiten
    edit "wan"         # Interface nach Name
    edit 1             # Policy nach ID
    edit 0             # Neues Objekt anlegen

# Werte setzen
    set ip 192.168.1.1 255.255.255.0
    set allowaccess ping https ssh

# Werte löschen
    unset allowaccess

# Objekt abschließen
    next

# Kontext verlassen + anwenden
end

# Einzelnes Objekt löschen
config firewall policy
    delete 5
end

config system interface
    edit "wan"
        set mode dhcp              # oder: static, pppoe
        set allowaccess ping https
        set role wan
    next
    edit "lan"
        set ip 192.168.1.99 255.255.255.0
        set allowaccess ping https ssh
        set role lan
    next
end

# VLAN-Subinterface
config system interface
    edit "lan.10"
        set vdom root
        set interface "lan"
        set vlanid 10
        set ip 192.168.10.1 255.255.255.0
        set allowaccess ping
    next
end

config router static
    edit 1
        set gateway 192.168.68.1
        set device "wan"
    next
    edit 2
        set dst 10.10.0.0 255.255.0.0
        set gateway 192.168.1.2
        set device "lan"
    next
end

config firewall policy
    edit 0
        set name        "LAN-to-WAN"
        set srcintf     "lan"
        set dstintf     "wan"
        set srcaddr     "all"
        set dstaddr     "all"
        set action      accept
        set schedule    "always"
        set service     "ALL"
        set nat         enable
        set logtraffic  all
    next
end

# Policy für VIP (eingehend) — NAT aus!
config firewall policy
    edit 0
        set name        "HTTPS-to-Nginx"
        set srcintf     "wan"
        set dstintf     "lan"
        set srcaddr     "all"
        set dstaddr     "VIP-HTTPS"    # VIP-Objekt
        set action      accept
        set service     "HTTPS"
        set nat         disable        # ← wichtig bei VIPs!
    next
end

config firewall vip
    edit "VIP-HTTPS"
        set extip      192.168.68.81   # WAN-IP der FortiGate
        set extintf    "wan"            # ← NICHT "wan1" beim 30E!
        set portforward enable
        set protocol   tcp
        set extport    443
        set mappedip   192.168.1.71   # Ziel-IP intern
        set mappedport 443
    next
end

# IP-Range VIP (ohne Port-Forwarding)
config firewall vip
    edit "VIP-Range"
        set extip    192.168.68.81
        set extintf  "wan"
        set mappedip "192.168.1.71-192.168.1.71"
    next
end

# Adressobjekt anlegen
config firewall address
    edit "Server1"
        set subnet 192.168.1.71 255.255.255.255
    next
end

# Adressgruppe
config firewall addrgrp
    edit "Server-Gruppe"
        set member "Server1" "Server2"
    next
end

config system dhcp server
    edit 1
        set interface        "lan"
        set default-gateway  192.168.1.99
        set netmask          255.255.255.0
        set dns-server1      192.168.1.99
        set dns-server2      9.9.9.9
        config ip-range
            edit 1
                set start-ip 192.168.1.10
                set end-ip   192.168.1.200
            next
        end
        config reserved-address
            edit 1
                set ip  192.168.1.71
                set mac aa:bb:cc:dd:ee:01
                set description "Server1"
            next
        end
    next
end

# SSL-VPN Settings
config vpn ssl settings
    set servercert     "self-sign"
    set tunnel-ip-pools "SSLVPN_TUNNEL_ADDR1"
    set port           443
    set source-interface "wan"
    set source-address   "all"
    set default-portal  "tunnel-access"
end

# SSL-VPN Firewall Policy
config firewall policy
    edit 0
        set name     "SSL-VPN-Access"
        set srcintf  "ssl.root"
        set dstintf  "lan"
        set srcaddr  "all"
        set dstaddr  "all"
        set action   accept
        set service  "ALL"
    next
end

# 1. Filter setzen (Quell-IP des Clients)
diagnose debug flow filter addr 192.168.68.100

# Optional: nach Ziel-Port filtern
diagnose debug flow filter dport 443

# 2. Trace starten (20 Pakete)
diagnose debug flow trace start 20

# 3. Debug aktivieren
diagnose debug enable

# 4. Traffic auslösen (z.B. Browser aufrufen)
# Ausgabe erscheint in der CLI

# 5. Debug stoppen
diagnose debug disable
diagnose debug reset
diagnose debug flow filter clear

# DHCP debuggen
diagnose debug application dhcpd -1
diagnose debug enable

# DNS debuggen
diagnose debug application dnsproxy -1
diagnose debug enable

# SSL-VPN debuggen
diagnose debug application sslvpn -1
diagnose debug enable

# Immer aufräumen:
diagnose debug disable
diagnose debug reset