PowerFGT
This is a Powershell module for configure a FortiGate (Fortinet) Firewall.
With this module (version 0.10.0) you can manage:
There is some extra feature
More functionality will be added later.
Connection can use HTTPS (default) or HTTP
Tested with FortiGate (using 5.6.x, 6.x, 7.x and 8.x (beta) firmware but it will be also work with 5.4.x)
Add (Experimental) support of VDOM is available using -vdom parameter for each cmdlet
Usage
All resource management functions are available with the Powershell verbs GET, ADD, COPY, SET, REMOVE.
For example, you can manage Address with the following commands:
Get-FGTFirewallAddressAdd-FGTFirewallAddressCopy-FGTFirewallAddressSet-FGTFirewallAddressRemove-FGTFirewallAddress
Requirements
- Powershell 5 or 6.x/7.x (Core) (If possible get the latest version)
- A Fortinet FortiGate Firewall and HTTPS enable (recommended)
Instructions
Install the module
# Automated installation (Powershell 5 or later):
Install-Module PowerFGT
# Import the module
Import-Module PowerFGT
# Get commands in the module
Get-Command -Module PowerFGT
# Get help
Get-Help Get-FGTFirewallAddress -Full
Examples
Connecting to the FortiGate Firewall
The first thing to do is to connect to a FortiGate Firewall with the command Connect-FGT :
# Connect to the FortiGate Firewall
Connect-FGT 192.0.2.1
#we get a prompt for credential
You can select the port using -port parameter
# Connect to the FortiGate Firewall using port 4443
Connect-FGT 192.0.2.1 -port 4443
if you are using OTP (FortiToken) for admin access, you can use -token_code or -token_prompt for specifity or ask the token/OTP when connecting
# Connect to the FortiGate Firewall with the token asked
Connect-FGT 192.0.2.1 -token_prompt
You can also connect using API Token (Documentation for Generate REST API )
# Connect to the FortiGate Firewall with API Token
Connect-FGT 192.0.2.1 -apitoken 79GyN89Q7w00rG6pj09yd7wGG3kmds
if you get a warning about Unable to connect Look Issue
Address
You can create a new Address Add-FGTFirewallAddress, retrieve its information Get-FGTFirewallAddress,
modify its properties Set-FGTFirewallAddress, copy/clone its properties Copy-FGTFirewallAddress
or delete it Remove-FGTFirewallAddress.
# Get information about ALL address (using Format Table)
Get-FGTFirewallAddress | Format-Table
q_origin_key name uuid subnet
------------ ---- ---- ------
FIREWALL_AUTH_PORTAL_ADDRESS FIREWALL_AUTH_PORTAL_ADDRESS a940cdea-368c-51e9-2596-5ddfd54a087a 0.0.0.0 0.0.0.0
SSLVPN_TUNNEL_ADDR1 SSLVPN_TUNNEL_ADDR1 a9416aca-368c-51e9-fe74-7dbb95fa64c9 10.212.134.200 10.212...
all all a940cc32-368c-51e9-82f5-fa5337e9f45c 0.0.0.0 0.0.0.0
autoupdate.opera.com autoupdate.opera.com a918c192-368c-51e9-ca8d-88cc94ed2d54 0.0.0.0 0.0.0.0
google-play google-play a918cd22-368c-51e9-2f4f-2d914955741a 0.0.0.0 0.0.0.0
swscan.apple.com swscan.apple.com a918d1dc-368c-51e9-08a7-c6004bf38fb9 0.0.0.0 0.0.0.0
update.microsoft.com update.microsoft.com a918d650-368c-51e9-0cca-5f006a059f0b 0.0.0.0 0.0.0.0
# Create an address (type ipmask)
Add-FGTFirewallAddress -Name 'My PowerFGT Network' -ip 192.0.2.1 -mask 255.255.255.0
q_origin_key : My PowerFGT Network
name : My PowerFGT Network
uuid : 9c65f75e-383e-51e9-a33a-caeffb7cfd33
subnet : 192.0.2.0 255.255.255.0
type : ipmask
start-ip : 192.0.2.0
end-ip : 255.255.255.0
fqdn :
country :
wildcard-fqdn :
cache-ttl : 0
wildcard : 192.0.2.0 255.255.255.0
sdn :
tenant :
organization :
epg-name :
subnet-name :
sdn-tag :
policy-group :
comment :
visibility : enable
associated-interface :
color : 0
filter :
obj-id :
list : {}
tagging : {}
allow-routing : disable
# Get information an address (name) and display only some field (using Format-Table)
Get-FGTFirewallAddress -name "My PowerFGT Network" | Select name, subnet, type, start-ip, end-ip | Format-Table
name subnet type start-ip end-ip
---- ------ ---- -------- ------
My PowerFGT Network 192.0.2.0 255.255.255.0 ipmask 192.0.2.0 255.255.255.0
# Get information some address (filter_type contains) and display only some field (using Format-Table)
Get-FGTFirewallAddress -name update -filter_type contains | Select name, type, fqdn | Format-Table
name type fqdn
---- ---- ----
autoupdate.opera.com fqdn autoupdate.opera.com
update.microsoft.com fqdn update.microsoft.com
# Modify an address (name, comment, interface...)
Get-FGTFirewallAddress -name "My PowerFGT Network" | Set-FGTFirewallAddress -name "MyNetwork" -comment "My comment" -interface port2
q_origin_key : MyNetwork
name : MyNetwork
uuid : 9c65f75e-383e-51e9-a33a-caeffb7cfd33
subnet : 192.0.2.0 255.255.255.0
type : ipmask
start-ip : 192.0.2.0
end-ip : 255.255.255.0
fqdn :
country :
wildcard-fqdn :
cache-ttl : 0
wildcard : 192.0.2.0 255.255.255.0
sdn :
tenant :
organization :
epg-name :
subnet-name :
sdn-tag :
policy-group :
comment : My comment
visibility : enable
associated-interface : port2
color : 0
filter :
obj-id :
list : {}
tagging : {}
allow-routing : disable
# Copy/Clone an address
Get-FGTFirewallAddress -name "MyNetwork" | Copy-FGTFirewallAddress -name "My New Network"
q_origin_key : My New Network
name : My New Network
uuid : 0c8da508-3840-51e9-f525-0601066767cc
subnet : 192.0.2.0 255.255.255.0
type : ipmask
start-ip : 192.0.2.0
end-ip : 255.255.255.0
fqdn :
country :
wildcard-fqdn :
cache-ttl : 0
wildcard : 192.0.2.0 255.255.255.0
sdn :
tenant :
organization :
epg-name :
subnet-name :
sdn-tag :
policy-group :
comment : My comment
visibility : enable
associated-interface : p
提示：代码过长已自动截断
Filtering
For Invoke-FGTRestMethod, it is possible to use -filter parameter
You need to use FortiGate API syntax :
| Key |
Operator |
Pattern |
Full Request |
Description |
| schedule |
== |
always |
GET /api/v2/cmdb/firewall/policy/?filter=schedule==always |
Only return firewall policy with schedule ‘always’ |
| schedule |
!= |
always |
GET /api/v2/cmdb/firewall/policy/?filter=schedule!=always |
Return all firewall policy with schedule other than ‘always’ |
and Filter Operators :
| Operator |
Description |
| == |
Case insensitive match with pattern. |
| != |
Does not match with pattern (case insensitive). |
| =@ |
Pattern found in object value (case insensitive). |
| !@ |
Pattern not found in object value (case insensitive). |
| <= |
Value must be less than or equal to pattern. |
| < |
Value must be less than pattern. |
| >= |
Value must be greater than or equal to pattern. |
| > |
Value must be greater than pattern. |
For Invoke-FGTRestMethod and Get-XXX cmdlet like Get-FGTFirewallAddress, it is possible to using some helper filter (-filter_attribute, -filter_type, -filter_value)
# Get Firewall Address named myFGT
Get-FGTFirewallAddress -name myFGT
...
# Get Firewall Address contains myFGT
Get-FGTFirewallAddress -name myFGT -filter_type contains
...
# Get Firewall Address where subnet equal 192.0.2.0 255.255.255.0
Get-FGTFirewallAddress -filter_attribute subnet -filter_type equal -filter_value 192.0.2.0 255.255.255.0
...
Actually, support only equal and contains filter type
Address Group
You can create a new Address Group Add-FGTFirewallAddressGroup, retrieve its information Get-FGTFirewallAddressGroup,
modify its properties Set-FGTFirewallAddressGroup, copy/clone its properties Copy-FGTFirewallAddressGroup,
Add member to Address Group Add-FGTFirewallAddressGroupMember and remove member Remove-FGTFirewallAddressGroupMember,
or delete it Remove-FGTFirewallAddressGroup.
# Get information about ALL address Group (using Format Table)
Get-FGTFirewallAddressgroup | Format-Table
q_origin_key name uuid member
------------ ---- ---- ------
My Address Group My Address Group 292f6eaa-2613-51ea-866d-06cedca8805 {@{q_origin_key=FGT1; name=FGT1}, @{q_origin_ke…
# Add an address Group with FGT1 and FGT2
Add-FGTFirewallAddressGroup -name "My Address Group" -member FGT1, FGT2
q_origin_key : My Address Group
name : My Address Group
uuid : 292f6eaa-2613-51ea-866d-06cedca8805
member : {@{q_origin_key=FGT1; name=FGT1}, @{q_origin_key=FGT2; name=FGT2}}
comment :
visibility : enable
color : 0
tagging : {}
allow-routing : disable
# Add FGT3 member to existing address Group
Get-FGTFirewallAddressGroup -name "My Address Group" | Add-FGTFirewallAddressGroupMember -member FGT3
q_origin_key : MyAddressGroup
name : MyAddressGroup
uuid : 292f6eaa-2613-51ea-866d-06cedca8805a
member : {@{q_origin_key=FGT1; name=FGT1}, @{q_origin_key=FGT2; name=FGT2}, @{q_origin_key=FGT3; name=FGT3}}
comment :
visibility : enable
color : 0
tagging : {}
allow-routing : disable
# Remove FGT2 member to existing address Group
Get-FGTFirewallAddressGroup -name "My Address Group" | Remove-FGTFirewallAddressGroupMember -member FGT2
q_origin_key : My Address Group
name : My Address Group
uuid : 292f6eaa-2613-51ea-866d-06cedca8805a
member : {@{q_origin_key=FGT1; name=FGT1}, @{q_origin_key=FGT3; name=FGT3}}
comment :
visibility : enable
color : 0
tagging : {}
allow-routing : disable
# Modify an address (comment, member...)
Get-FGTFirewallAddressGroup -name "My Address Group" | Set-FGTFirewallAddressGroup -comment "My Address Group with only FGT2" -member FGT2
q_origin_key : My Address Group
name : My Address Group
uuid : 292f6eaa-2613-51ea-866d-06cedca8805a
member : {@{q_origin_key=FGT2; name=FGT2}}
comment : My Address Group with only FGT2
visibility : enable
color : 0
tagging : {}
allow-routing : disable
# Copy/Clone an address Group
Get-FGTFirewallAddressGroup -name "My Address Group" | Copy-FGTFirewallAddressGroup -name "My New Address Group"
q_origin_key : My New Address Group
name : My New Address Group
uuid : 9c2673a8-2614-51ea-9ab0-dfbd6f2c0475
member : {@{q_origin_key=FGT2; name=FGT2}}
comment : My Address Group with only FGT2
visibility : enable
color : 0
tagging : {}
allow-routing : disable
# Remove an address Group
Get-FGTFirewallAddressGroup -name "My Address Group" | Remove-FGTFirewallAddressGroup
Confirm
Are you sure you want to perform this action?
Performing the operation "Remove Firewall Address Group" on target "My Address Group".
[Y] Yes [A] Yes to All [N] No [L] No to All [S] Suspend [?] Help (default is "Y"): Y
Virtual IP
You can create a new Virtual IP Add-FGTFirewallVip, retrieve its information Get-FGTFirewallVip,
or delete it Remove-FGTFirewallVip.
# Get information about ALL Virtual IP (using Format Table)
Get-FGTFirewallVip | Format-Table
q_origin_key name id uuid comment type dns-mapping-ttl ldb-method src-filter service
------------ ---- -- ---- ------- ---- --------------- ---------- ---------- -------
myVIP1 myVIP1 0 3ccb44c6-2662-51ea-a469-3148c8eff287 static-nat 0 static {} {}
myVIP3-8080 myVIP3-8080 0 73989828-2662-51ea-c969-4ad22d450075 static-nat 0 static {} {}
# Add a Virtual IP with Static NAT (192.2.0.1 => 198.51.100.1)
Add-FGTFirewallVip -name myVIP1 -type static-nat -extip 192.2.0.1 -mappedip 198.51.100.1
q_origin_key : myVIP1
name : myVIP1
id : 0
uuid : 3ccb44c6-2662-51ea-a469-3148c8eff287
comment :
type : static-nat
dns-mapping-ttl : 0
ldb-method : static
src-filter : {}
service : {}
extip : 192.2.0.1
extaddr : {}
mappedip : {@{q_origin_key=198.51.100.1; range=198.51.100.1}}
[...]
# Add a Virtual IP with Static NAT and Port Forward (192.2.0.2:8080 => 198.51.100.2:80)
Add-FGTFirewallVip -name myVIP2-8080to80 -type static-nat -extip 192.2.0.2 -mappedip 198.51.100.2 -portforward -extport 8080 -mappedport 80
q_origin_key : myVIP2-8080to80
name : myVIP2-8080to80
id : 0
uuid : 73989828-2662-51ea-c969-4ad22d450075
comment :
type : static-nat
dns-mapping-ttl : 0
ldb-method : static
src-filter : {}
service : {}
extip : 192.2.0.2
extaddr : {}
mappedip : {@{q_origin_key=198.51.100.2; range=198.51.100.2}}
mapped-addr :
extintf : any
arp-reply : enable
server-type :
persistence : none
nat-source-vip : disable
portforward : enable
protocol : tcp
extport : 8080
mappedport : 80
[...]
# Remove a Virtual IP
Get-FGTFirewallVip -name myVIP1 | Remove-FGTFirewallVip
Confirm
Are you sure you want to perform this action?
Performing the operation "Remove Firewall VIP" on target "myVIP1".
[Y] Yes [A] Yes to All [N] No [L] No to All [S] Suspend [?] Help (default is "Y"): Y
Virtual IP Group
You can create a new VIP Group Add-FGTFirewallVIPGroup, retrieve its information Get-FGTFirewallVIPGroup,
modify its properties Set-FGTFirewallVIPGroup, copy/clone its properties Copy-FGTFirewallVIPGroup,
Add member to Address Group Add-FGTFirewallVIPGroupMember and remove member Remove-FGTFirewallVIPGroupMember,
or delete it Remove-FGTFirewallVIPGroup.
# Get information about ALL VIP Group (using Format Table)
Get-FGTFirewallVipGroup | Format-Table
name q_origin_key uuid interface color comments member
---- ------------ ---- --------- ----- -------- ------
MyVIPGroup MyVIPGroup cb875532-3d82-51eb-f120-075c29c10657 any 0 {@{name=myVIP1; q_origin_key=myVIP1}, @{name=myVIP2; q_origin_key=myVIP2}}
# Add a VIP Group with myVIP1 and myVIP2
Add-FGTFirewallVIPGroup -name "MyVIPGroup" -member myVIP1, myVIP2
name : MyVIPGroup
q_origin_key : MyVIPGroup
uuid : cb875532-3d82-51eb-f120-075c29c10657
interface : any
color : 0
comments :
member : {@{name=myVIP1; q_origin_key=myVIP1}, @{name=myVIP2; q_origin_key=myVIP2}}
# Add myVIP3 member to existing Virtual IP GROUP
Get-FGTFirewallVIPGroup -name "MyVIPGroup" | Add-FGTFirewallVIPGroupMember -member myVIP3
name : MyVIPGroup
q_origin_key : MyVIPGroup
uuid : cb875532-3d82-51eb-f120-075c29c10657
interface : any
color : 0
comments :
member : {@{name=myVIP1; q_origin_key=myVIP1}, @{name=myVIP2; q_origin_key=myVIP2}, @{name=myVIP3; q_origin_key=myVIP3}}
# Remove myVIP2 member to existing Virtual IP Group
Get-FGTFirewallVIPGroup -name "MyVIPGroup" | Remove-FGTFirewallVIPGroupMember -member myVIP2
name : MyVIPGroup
q_origin_key : MyVIPGroup
uuid : cb875532-3d82-51eb-f120-075c29c10657
interface : any
color : 0
comments :
member : {@{name=myVIP1; q_origin_key=myVIP1}, @{name=myVIP3; q_origin_key=myVIP3}}
# Modify a Virtual IP Group
Get-FGTFirewallVIPGroup -name "MyVIPGroup" | Set-FGTFirewallVIPGroup -comment "My Virtual IP with only myVIP2" -member myVIP2
name : MyVIPGroup
q_origin_key : MyVIPGroup
uuid : cb875532-3d82-51eb-f120-075c29c10657
interface : any
color : 0
comments : My Virtual IP with only myVIP2
member : {@{name=myVIP2; q_origin_key=myVIP2}}
# Remove a Virtual IP Group
Get-FGTFirewallVIPGroup -name "MyVIPGroup" | Remove-FGTFirewallVIPGroup
Confirm
Are you sure you want to perform this action?
Performing the operation "Remove Firewall VIP Group" on target "MyVIPGroup".
[Y] Yes [A] Yes to All [N] No [L] No to All [S] Suspend [?] Help (default is "Y"): y
Policy
You can create a new Policy Add-FGTFirewallPolicy, retrieve its information Get-FGTFirewallPolicy
Add member to source or destinationn address Add-FGTFirewallPolicyMember and remove member Add-FGTFirewallPolicyMember,
set it Set-FGTFirewallPolicy or delete it Remove-FGTFirewallPolicy.
# Get information about ALL Policies (using Format Table)
Get-FGTFirewallPolicy | Format-Table
q_origin_key policyid name uuid srcintf dstintf srcaddr
------------ -------- ---- ---- ------- ------- -------
1 1 MyFGTPolicy 31a7ad9e-266e-51ea-1691-4906abad2e8b {@{q_origin_key=port1; name=port1}} {@{q_origin_key=port2; name=port2}} {@{q_origin_key=all; name=all}
2 2 MyFGTPolicy2 3c8e5212-266e-51ea-2300-dc5fcb1a8e2a {@{q_origin_key=port1; name=port1}} {@{q_origin_key=port3; name=port3}} {@{q_origin_key=all; name=all}}
# Add Policy (MyFGTPolicy) allow ALL traffic between port1 to port2
Add-FGTFirewallPolicy -name MyFGTPolicy -srcintf port1 -dstintf port2 -srcaddr all -dstaddr all
q_origin_key : 1
policyid : 1
name : MyFGTPolicy
uuid : 31a7ad9e-266e-51ea-1691-4906abad2e8b
srcintf : {@{q_origin_key=port1; name=port1}}
dstintf : {@{q_origin_key=port2; name=port2}}
srcaddr : {@{q_origin_key=all; name=all}}
dstaddr : {@{q_origin_key=all; name=all}}
internet-service : disable
internet-service-id : {}
internet-service-custom : {}
internet-service-src : disable
internet-service-src-id : {}
internet-service-src-custom : {}
rtp-nat : disable
rtp-addr : {}
learning-mode : disable
action : accept
send-deny-packet : disable
firewall-session-dirty : check-all
status : enable
schedule : always
schedule-timeout : disable
service : {@{q_origin_key=ALL; name=ALL}}
[...]
# Add Policy (MyFGTPolicy2) allow ALL traffic between port1 to port3 and enable NAT (but disable rule)
Add-FGTFirewallPolicy -name MyFGTPolicy2 -srcintf port1 -dstintf port3 -srcaddr all -dstaddr all -nat -status:$false -skip
q_origin_key : 2
policyid : 2
name : MyFGTPolicy2
uuid : 6ad55b33-e514-4d60-a661-6addfe7b3ac8
srcintf : {@{q_origin_key=port1; name=port1}}
dstintf : {@{q_origin_key=port3; name=port3}}
srcaddr : {@{q_origin_key=all; name=all}}
dstaddr : {@{q_origin_key=all; name=all}}
internet-service : disable
internet-service-src : disable
rtp-nat : disable
learning-mode : disable
action : accept
status : disable
schedule : always
schedule-timeout : disable
[...]
# Add FGT2 and FGT3 to source address (only FGT1 before)
Get-FGTFirewallPolicy -name MyFGTPolicy3 | Add-FGTFirewallPolicyMember -srcaddr FGT1, FGT2
q_origin_key : 3
policyid : 3
name : MyFGTPolicy3
uuid : d7d0fa66-3352-51ec-52cf-a215389b0ddb
srcintf : {@{q_origin_key=port1; name=port1}}
dstintf : {@{q_origin_key=port2; name=port2}}
srcaddr : {@{q_origin_key=FGT1; name=FGT1}, @{q_origin_key=FGT2; name=FGT2}, @{q_origin_key=FGT3;name=FGT3}}
dstaddr : {@{q_origin_key=all; name=all}}
internet-service : disable
internet-service-src : disable
rtp-nat : disable
learning-mode : disable
action : accept
status : disable
schedule : always
schedule-timeout : disable
[...]
# Remove FGT3 from destination address (FGT1, FGT2, FGT3 before)
Get-FGTFirewallPolicy -name MyFGTPolicy3 | Remove-FGTFirewallPolicyMember -srcaddr FGT3
q_origin_key : 3
policyid : 3
name : MyFGTPolicy3
uuid : d7d0fa66-3352-51ec-52cf-a215389b0ddb
srcintf : {@{q_origin_key=port1; name=port1}}
dstintf : {@{q_origin_key=port2; name=port2}}
srcaddr : {@{q_origin_key=all; name=all}}
dstaddr : {@{q_origin_key=FGT1; name=FGT1}, @{q_origin_key=FGT2; name=FGT2}}
internet-service : disable
internet-service-src : disable
rtp-nat : disable
learning-mode : disable
action : accept
status : disable
schedule : always
提示：代码过长已自动截断
Zone
You can create a new Zone Add-FGTSystemZone, retrieve its information Get-FGTFSystemZone,
modify its properties Set-SystemZone,
Add member to Zone Add-SystemZoneMember and remove member Remove-SystemZoneMember,
or delete it Remove-SystemZone.
# Get information about ALL Zone
Get-FGTSystemZone
name : myPowerFGTZone
q_origin_key : myPowerFGTZone
tagging : {}
description :
intrazone : deny
interface : {@{interface-name=port5; q_origin_key=port5}, @{interface-name=port6; q_origin_key=port6}}
# Add new Zone myPowerFGTZone2 with port7 and intrazone allowed
Add-FGTSystemZone -name myPowerFGTZone2 -intrazone allow -interfaces port7
name : myPowerFGTZone2
q_origin_key : myPowerFGTZone2
tagging : {}
description :
intrazone : allow
interface : {@{interface-name=port7; q_origin_key=port7}}
# Add new member (port8) to existing zone myPowerFGTZone2
Get-FGTSystemZone -name myPowerFGTZone2 | Add-FGTSystemZoneMember -interfaces port8
name : myPowerFGTZone2
q_origin_key : myPowerFGTZone2
tagging : {}
description :
intrazone : allow
interface : {@{interface-name=port7; q_origin_key=port7}, @{interface-name=port8; q_origin_key=port8}}
# Remove port7 member to existing zone myPowerFGTZone2
Get-FGTSystemZone -name myPowerFGTZone2 | Remove-FGTSystemZoneMember -interfaces port7
name : myPowerFGTZone2
q_origin_key : myPowerFGTZone2
tagging : {}
description :
intrazone : allow
interface : {@{interface-name=port8; q_origin_key=port8}}
# Modify a Zone (intrazone, interface...)
Get-FGTSystemZone -name myPowerFGTZone2 | Set-FGTSystemZone -intrazone deny
name : myPowerFGTZone2
q_origin_key : myPowerFGTZone2
tagging : {}
description :
intrazone : deny
interface : {@{interface-name=port8; q_origin_key=port8}}
# Remove a zone
Get-FGTSystemZone -name myPowerFGTZone2 | Remove-FGTSystemZone
Confirm
Are you sure you want to perform this action?
Performing the operation "Remove zone" on target "myPowerFGTZone2".
[Y] Yes [A] Yes to All [N] No [L] No to All [S] Suspend [?] Help (default is "Y"): Y
Routing
Static Route
You can create a new Static Route Add-FGTRouterStatic, retrieve its information Get-FGTRouterStatic,
or delete it Remove-FGTRouterStatic.
# Get information about ALL Static Route (using Format Table)
Get-FGTRouterStatic | Format-Table
seq-num q_origin_key status dst src gateway distance weight priority device
------- ------------ ------ --- --- ------- -------- ------ -------- ------
2 2 enable 192.0.2.0 255.255.255.0 0.0.0.0 0.0.0.0 198.51.100.254 10 0 0 port1
3 3 enable 198.51.100.0 255.255.255.0 0.0.0.0 0.0.0.0 192.0.2.254 10 0 0 port2
# Add Static Route to 192.0.2.0/24 via 198.51.100.254 from port1
Add-FGTRouterStatic -dst 192.0.2.0/24 -gateway 198.51.100.254 -device port1
seq-num : 2
q_origin_key : 2
status : enable
dst : 192.0.2.0 255.255.255.0
src : 0.0.0.0 0.0.0.0
gateway : 198.51.100.254
distance : 10
weight : 0
priority : 0
device : port1
comment :
blackhole : disable
dynamic-gateway : disable
sdwan-zone : {}
dstaddr :
internet-service : 0
internet-service-custom :
link-monitor-exempt : disable
vrf : 0
bfd : disable
[...]
# Add Static Route to 198.51.100.0/24 via 192.0.2.254 from port2
Add-FGTRouterStatic -dst 198.51.100.0/24 -gateway 192.0.2.254 -device port2
seq-num : 3
q_origin_key : 3
status : enable
dst : 198.51.100.0 255.255.255.0
src : 0.0.0.0 0.0.0.0
gateway : 192.0.2.254
distance : 10
weight : 0
priority : 0
device : port2
comment :
blackhole : disable
dynamic-gateway : disable
sdwan-zone : {}
dstaddr :
internet-service : 0
internet-service-custom :
link-monitor-exempt : disable
vrf : 0
bfd : disable
[...]
# Remove a Static Route
Get-FGTRouterStatic -filter_attribute seq-num -filter_type equal -filter_value 2 | Remove-FGTRouterStatic
Confirm
Are you sure you want to perform this action?
Performing the operation "Remove Router Static" on target "2".
[Y] Yes [N] No [?] Help (default is "N"): y
BGP
You can retrieve BGP information Get-FGTRouterBGP or configure it Set-FGTRouterBGP.
# Get information about Router BGP
Get-FGTRouterBGP
as :
router-id :
keepalive-timer : 60
holdtime-timer : 180
always-compare-med : disable
bestpath-as-path-ignore : disable
bestpath-cmp-confed-aspath : disable
bestpath-cmp-routerid : disable
bestpath-med-confed : disable
bestpath-med-missing-as-worst : disable
client-to-client-reflection : enable
dampening : disable
deterministic-med : disable
ebgp-multipath : enable
ibgp-multipath : disable
[...]
# Configure BGP (AS and router-id)
Set-FGTRouterBGP -as 65001 -router_id 192.0.2.1
as : 65001
router-id : 192.0.2.1
[...]
# for configure BGP extra value, you need to use -data (for example holdtime and ebgp-multipath)
$data = @{ "holdtime-timer" = 120 ; "ebgp-multipath" = "enable" }
Set-FGTRouterBGP -data $data
[...]
holdtime-timer : 120
[...]
ebgp-multipath : enable
[...]
OSPF
You can retrieve OSPF information Get-FGTRouterOSPF or configure it Set-FGTRouterOSPF.
# Get information about Router OSPF
Get-FGTRouterOSPF
abr-type : standard
auto-cost-ref-bandwidth : 1000
distance-external : 110
distance-inter-area : 110
distance-intra-area : 110
database-overflow : disable
database-overflow-max-lsas : 10000
database-overflow-time-to-recover : 300
default-information-originate : disable
default-information-metric : 10
default-information-metric-type : 2
default-information-route-map :
default-metric : 10
distance : 110
rfc1583-compatible : disable
router-id : 0.0.0.0
[...]
# Configure OSPF (Arouter-id)
Set-FGTRouterOSPF -router_id 192.0.2.1
[...]
router-id : 192.0.2.1
[...]
# for configure OSPF extra value, you need to use -data (for example b and bfd)
$data = @{ "distance" = 150 ; "bfd" = "enable" }
Set-FGTRouterOSPF -data $data
[...]
distance : 150
[...]
bfd : enable
[...]
Interface
You can create a new interface (Vlan …) Add-FGTSystemInterface, retrieve its information Get-FGTSystemInterface,
modify its properties Set-FGTSystemInterface or delete it Remove-FGTSystemInterface.
# Get information about ALL Interface (using Format Table)
Get-FGTSystemInterface | Format-Table
name q_origin_key vdom vrf cli-conn-status fortilink switch-controller-source-ip mode client-options distance
---- ------------ ---- --- --------------- --------- --------------------------- ---- -------------- --------
fortilink fortilink root 0 0 enable outbound static {} 5
l2t.root l2t.root root 0 0 disable outbound static {} 5
naf.root naf.root root 0 0 disable outbound static {} 5
port1 port1 root 0 0 disable outbound static {} 5
port2 port2 root 0 0 disable outbound static {} 5
port3 port3 root 0 0 disable outbound static {} 5
port4 port4 root 0 0 disable outbound static {} 5
port5 port5 root 0 0 disable outbound static {} 5
port6 port6 root 0 0 disable outbound static {} 5
port7 port7 root 0 0 disable outbound static {} 5
port8 port8 root 0 0 disable outbound static {} 5
port9 port9 root 0 0 disable outbound static {} 5
port10 port10 root 0 0 disable outbound static {} 5
ssl.root ssl.root root 0 0 disable outbound static {} 5
# Create an interface (type vlan)
Add-FGTSystemInterface -vlan_id 23 -interface port9 -name "PowerFGT_vlan23"
name : PowerFGT_vlan23
q_origin_key : PowerFGT_vlan23
vdom : root
vrf : 0
cli-conn-status : 0
fortilink : disable
switch-controller-source-ip : outbound
mode : static
[...]
# Create an interface (type LACP)
Add-FGTSystemInterface -name PowerFGT_lacp -atype lacp -member port9, port10
name : PowerFGT_lacp
q_origin_key : PowerFGT_lacp
vdom : root
vrf : 0
[...]
type : aggregate
[...]
member : {@{interface-name=port9; q_origin_key=port9}, @{interface-name=port10; q_origin_key=port10}}
lacp-mode : active
[...]
# Create an interface (type Loopback)
Add-FGTSystemInterface -name PowerFGT_lo -loopback -mode static -ip 192.0.2.1 -netmask 255.255.255.255 -allowaccess ping
name : PowerFGT_lo
q_origin_key : PowerFGT_lo
vdom : root
[...]
ip : 192.0.2.1 255.255.255.255
allowaccess : ping
type : loopback
[...]
# Get information an Interface (name) and display only some field (using Format-Table)
Get-FGTSystemInterface -name PowerFGT_vlan23 | select name, vlanid, ip
name vlanid ip
---- ------ --
PowerFGT_vlan23 23 0.0.0.0 0.0.0.0
# Modify an interface (description, ip ...)
Get-FGTSystemInterface -name PowerFGT_vlan23 | Set-FGTSystemInterface -alias ALIAS_PowerFGT -role lan -mode static -ip 192.0.2.1 -netmask 255.255.255.0 -allowaccess ping,https
name : PowerFGT_vlan23
q_origin_key : PowerFGT_vlan23
vdom : root
[...]
ip : 192.0.2.1 255.255.255.0
allowaccess : ping https
[...]
interface : port9
external : disable
vlan-protocol : 8021q
vlanid : 23
[...]
description :
alias : ALIAS_PowerFGT
[...]
role
提示：代码过长已自动截断
Security Profiles
You can change System Settings and System Global (settings) using Set-FGTSystemSettings and Set-FGTSystemGlobal
It is possible to Get Security Profiles (Antivirus, Application Control, DNS Filter, ISDB, SSL/SSH, IPS)
Get-FGTAntivirusProfile List and Settings of AntivirusGet-FGTApplicationList List and Settings of Application (List)Get-FGTDnsfilterProfile List and Settings of DNS Filter ProfileGet-FGTFirewallInternetServiceName List of Internet Service Name (ISDB)Get-FGTFirewallSSLSSHProfile List and Settings of SSL/SSH ProfileGet-FGTIpsSensor List and Settings of IPS Sensor
Settings
You can change System Settings and System Global (settings) using Set-FGTSystemSettings and Set-FGTSystemGlobal
# Get ALL information about System Global
Get-FGTSystemGlobal
language : english
gui-ipv6 : disable
gui-replacement-message-groups : disable
gui-local-out : disable
gui-certificates : enable
gui-custom-language : disable
gui-wireless-opensecurity : disable
gui-display-hostname : disable
gui-fortigate-cloud-sandbox : disable
gui-firmware-upgrade-warning : enable
gui-allow-default-hostname : disable
gui-forticare-registration-setup-warning : enable
gui-cdn-usage : enable
admin-https-ssl-versions : tlsv1-2
[...]
# Get only admintimeout and admin-sport of System Global
Get-FGTSystemGlobal -Name admintimeout, admin-sport
admintimeout admin-sport
------------ -----------
5 443
# Configure admintimeout and admin-sport of System Global
Set-FGTSystemGlobal -admintimeout 30 -admin_sport 8443
[...]
admintimeout : 30
[...]
admin-sport : 8443
[...]
# for configure a setting not yet available on parameter of Set-FGTSystemGlobal, you can use
$data = @{ "two-factor-sms-expiry" = 120 }
Set-FGTSystemGlobal -data $data
[...]
two-factor-sms-expiry : 120
[...]
# Get ALL information about System Settings
Get-FGTSystemSettings
comments :
opmode : nat
ngfw-mode : profile-based
http-external-dest : fortiweb
firewall-session-dirty : check-all
manageip :
gateway : 0.0.0.0
ip : 0.0.0.0 0.0.0.0
manageip6 : ::/0
gateway6 : ::
ip6 : ::/0
device :
bfd : disable
[...]
# Get only gui-allow-unnamed-policy and opmode of System Settings
Get-FGTSystemSettings -Name gui-allow-unnamed-policy, opmode
gui-allow-unnamed-policy opmode
------------------------ ------
disable nat
# Configure gui-allow-unnamed-policy of System Settings
Set-FGTSystemSettings -gui_allow_unnamed_policy
[...]
gui-allow-unnamed-policy : enable
[...]
# for configure a setting not yet available on parameter of Set-FGTSystemSettings, you can use
$data = @{ "location-id" = "192.0.2.1" }
Set-FGTSystemSettings -data $data
[...]
location-id : 192.0.2.1
[...]
System Admin
You can manage (System) Admin (Local) on FortiGate.
You can create a new (System) Admin Add-FGTSystemAdmin, retrieve its information Get-FGTSystemAdmin,
modify its properties Set-FGTSystemAdmin or delete it Remove-FGTSystemAdmin.
# Create an Admin Local (using SecureString password) MyFGTAdmin with access profile super_admin
$mypassword = ConvertTo-SecureString myadminpassword -AsPlainText -Force
Add-FGTSystemAdmin -Name MyFGTAdmin -password $mypassword -accprofile super_admin
name : MyFGTAdmin
q_origin_key : MyFGTAdmin
wildcard : disable
remote-auth : disable
remote-group :
password : ENC XXXX
old-password : ENC XXXX
peer-auth : disable
peer-group :
trusthost1 : 0.0.0.0 0.0.0.0
trusthost2 : 0.0.0.0 0.0.0.0
[...]
# Get information about ALL System Admin (using Format Table)
Get-FGTSystemAdmin | Format-Table
name q_origin_key wildcard remote-auth remote-group password old-password peer-auth peer-group trusthost1
---- ------------ -------- ----------- ------------ -------- ------------ --------- ---------- ----------
MyFGTAdmin MyFGTAdmin disable disable ENC XXXX ENC XXXX disable 0.0.0.0 0.0.0.0
admin admin disable disable ENC XXXX ENC XXXX disable 0.0.0.0 0.0.0.0
# Modify an System Admin (trusthost1...)
Get-FGTSystemAdmin MyFGTAdmin| Set-FGTSystemAdmin -trusthost1 192.0.2.1/32
name : MyFGTAdmin
q_origin_key : MyFGTAdmin
wildcard : disable
[...]
trusthost1 : 192.0.2.1 255.255.255.255
[...]
# Remove an System Admin
Get-FGTSystemAdmin MyFGTAdmin| Remove-FGTSystemAdmin
Confirm
Are you sure you want to perform this action?
Performing the operation "Remove System Admin" on target "MyFGTAdmin".
[Y] Yes [A] Yes to All [N] No [L] No to All [S] Suspend [?] Help (default is "Y"): Y
User
You can manage user (Local, LDAP, RADIUS, TACACS) on FortiGate and also manage user directory (LDAP, RADIUS, TACACS) and group.
User Local
You can create a new User Local Add-FGTUserLocal, retrieve its information Get-FGTUserLocal,
modify its properties Set-FGTUserLocal or delete it Remove-FGTUserLocal.
# Create an User Local (using SecureString password) MyFGTUserLocal
$mypassword = ConvertTo-SecureString mypassword -AsPlainText -Force
Add-FGTUserLocal -Name MyFGTUserLocal -passwd $mypassword
name : MyFGTUserLocal
q_origin_key : MyFGTUserLocal
id : 16779153
status : enable
type : password
passwd : ENC XXXX
ldap-server :
radius-server :
tacacs+-server :
two-factor : disable
two-factor-authentication :
two-factor-notification :
fortitoken :
[...]
# Get information about ALL User Local (using Format Table)
Get-FGTUserLocal | Format-Table
name q_origin_key id status type passwd ldap-server radius-server tacacs+-server two-factor
---- ------------ -- ------ ---- ------ ----------- ------------- -------------- ----------
MyFGTUserLocal MyFGTUserLocal 16779153 enable password ENC XXXX disable
guest guest 16777217 enable password ENC XXXX disable
# Modify an User Local (status...)
Get-FGTUserLocal -name MyFGTUserLocal | Set-FGTUserLocal -status:$false
name : MyFGTUserLocal
q_origin_key : MyFGTUserLocal
id : 16779153
status : disable
[...]
# Remove an User Local
Get-FGTUserLocal -name MyFGTUserLocal | Remove-FGTUserLocal
Confirm
Are you sure you want to perform this action?
Performing the operation "Remove User Local" on target "MyFGTUserLocal".
[Y] Yes [A] Yes to All [N] No [L] No to All [S] Suspend [?] Help (default is "Y"): Y
User LDAP
You can create a new User LDAP Add-FGTUserLDAP, retrieve its information Get-FGTUserLDAP,
modify its properties Set-FGTUserLDAP or delete it Remove-FGTUserLDAP.
# Create an User LDAP (using SecureString password) MyFGTUserLDAP
$mypassword = ConvertTo-SecureString mypassword -AsPlainText -Force
Add-FGTUserLDAP -Name MyFGTUserLDAP -server ldap.powerfgt -dn "dc=fgt,dc=power,dc=powerfgt" -type regular -username svc_powerfgt -password $mypassword
name : MyFGTUserLDAP
q_origin_key : MyFGTUserLDAP
server : ldap.powerfgt
secondary-server :
tertiary-server :
status-ttl : 300
server-identity-check : enable
source-ip :
source-port : 0
cnid : cn
dn : dc=fgt,dc=power,dc=powerfgt
type : regular
two-factor : disable
two-factor-authentication :
two-factor-notification :
two-factor-filter :
username : svc_powerfgt
password : ENC XXXX
[...]
# Get information about ALL User LDAP (using Format Table)
Get-FGTUserLDAP | Format-Table
name q_origin_key server secondary-server tertiary-server status-ttl server-identity-check source-ip source-port cnid
---- ------------ ------ ---------------- --------------- ---------- --------------------- --------- ----------- ----
MyFGTUserLDAP MyFGTUserLDAP ldap.powerfgt 300 enable 0 cn
# Modify an User LDAP (server...)
Get-FGTUserLDAP -name MyFGTUserLDAP | Set-FGTUserLDAP -server ldap2.powerfgt
name : MyFGTUserLDAP
q_origin_key : MyFGTUserLDAP
server : ldap2.powerfgt
[...]
# Create an User Local using this User LDAP
Add-FGTUserLocal -Name MyFGTUserLocalLDAP -ldap_server MyFGTUserLDAP
name : MyFGTUserLocalLDAP
q_origin_key : MyFGTUserLocalLDAP
id : 16779240
status : enable
type : ldap
passwd :
ldap-server : MyFGTUserLDAP
[...]
# Remove an User LDAP
Get-FGTUserLDAP -name MyFGTUserLDAP | Remove-FGTUserLDAP
Confirm
Are you sure you want to perform this action?
Performing the operation "Remove User Ldap" on target "MyFGTUserLDAP".
[Y] Yes [A] Yes to All [N] No [L] No to All [S] Suspend [?] Help (default is "Y"): y
User RADIUS
You can create a new User LDAP Add-FGTUserRADIUS, retrieve its information Get-FGTUserRADIUS,
modify its properties Set-FGTUserRADIUS or delete it Remove-FGTUserRADIUS.
# Create an User RADIUS (using SecureString password) MyFGTUserRADIUS
$secret = ConvertTo-SecureString mysecret -AsPlainText -Force
Add-FGTUserRADIUS -Name MyFGTUserRADIUS -server radius.powerfgt -secret $mysecret
name : MyFGTUserRADIUS
q_origin_key : MyFGTUserRADIUS
server : radius.powerfgt
secret : ENC XXXX
secondary-server :
secondary-secret :
tertiary-server :
tertiary-secret :
timeout : 5
status-ttl : 300
all-usergroup : disable
use-management-vdom : disable
switch-controller-nas-ip-dynamic : disable
nas-ip : 0.0.0.0
[...]
# Get information about ALL User RADIUS (using Format Table)
Get-FGTUserRADIUS | Format-Table
name q_origin_key server secret secondary-server secondary-secret tertiary-server tertiary-secret timeout status-ttl
---- ------------ ------ ------ ---------------- ---------------- --------------- --------------- ------- ----------
MyFGTUserRADIUS MyFGTUserRADIUS radius.powerfgt ENC XXXX 5 300
# Modify an User RADIUS (server...)
Get-FGTUserRADIUS -name MyFGTUserRADIUS | Set-FGTUserRADIUS -server radius2.powerfgt
name : MyFGTUserRADIUS
q_origin_key : MyFGTUserRADIUS
server : radius2.powerfgt
[...]
# Create an User Local using this User RADIUS
Add-FGTUserLocal -Name MyFGTUserLocalRADIUS -radius_server MyFGTUserRADIUS
name : MyFGTUserLocalRADIUS
q_origin_key : MyFGTUserLocalRADIUS
id : 16779241
status : enable
type : radius
passwd :
ldap-server :
radius-server : MyFGTUserRADIUS
[...]
# Remove an User RADIUS
Get-FGTUserRADIUS -name MyFGTUserRADIUS | Remove-FGTUserRADIUS
Confirm
Are you sure you want to perform this action?
Performing the operation "Remove User Radius" on target "MyFGTUserRADIUS".
[Y] Yes [A] Yes to All [N] No [L] No to All [S] Suspend [?] Help (default is "Y"): Y
User TACACS
You can create a new User LDAP Add-FGTUserTACACS, retrieve its information Get-FGTUserTACACS,
modify its properties Set-FGTUserTACACS or delete it Remove-FGTUserTACACS.
# Create an User TACACS (using SecureString password) MyFGTUserTACACS
$mykey = ConvertTo-SecureString mykey -AsPlainText -Force
Add-FGTUserTACACS -Name MyFGTUserTACACS -server tacacs.powerfgt -key $mykey
name : MyFGTUserTACACS
q_origin_key : MyFGTUserTACACS
server : tacacs.powerfgt
secondary-server :
tertiary-server :
port : 49
key : ENC XXXX
secondary-key :
tertiary-key :
status-ttl : 300
[...]
# Get information about ALL User TACACS (using Format Table)
Get-FGTUserTACACS | Format-Table
name q_origin_key server secondary-server tertiary-server port key secondary-key tertiary-key status-ttl
---- ------------ ------ ---------------- --------------- ---- --- ------------- ------------ ----------
MyFGTUserTACACS MyFGTUserTACACS tacacs.powerfgt 49 ENC XXXX 300
# Modify an User TACACS (server...)
Get-FGTUserTACACS -name MyFGTUserTACACS | Set-FGTUserTACACS -server tacacs2.powerfgt
name : MyFGTUserTACACS
q_origin_key : MyFGTUserTACACS
server : tacacs2.powerfgt
[...]
# Create an User Local using this User TACACS
Add-FGTUserLocal -Name MyFGTUserLocalTACACS -tacacs_server MyFGTUserTACACS
name : MyFGTUserLocalTACACS
q_origin_key : MyFGTUserLocalTACACS
id : 16779242
status : enable
type : tacacs+
passwd :
ldap-server :
radius-server :
tacacs+-server : MyFGTUserTACACS
[...]
# Remove an User TACACS
Get-FGTUserTACACS -name MyFGTUserTACACS | Remove-FGTUserTACACS
Confirm
Are you sure you want to perform this action?
Performing the operation "Remove User Tacacs" on target "MyFGTUserTACACS".
[Y] Yes [A] Yes to All [N] No [L] No to All [S] Suspend [?] Help (default is "Y"): Y
User Group
You can create a new User Group Add-FGTUserGroup, retrieve its information Get-FGTUserGroup,
modify its properties Set-FGTUserGroup, copy/clone its properties Copy-FGTUserGroup,
Add member to Address Group Add-FGTUserGroupMember and remove member Remove-FGTUserGroupMember,
or delete it Remove-FGTUserGroup.
# Get information about ALL User Group (using Format Table)
Get-FGTUserGroup |
> README 内容过长，已截取前 64 KB。完整内容请前往 GitHub 仓库查看。
评论