How To Show Configuration On Fortigate CLI: Comprehensive Administrative Guide
Mastering the Fortinet command line interface for retrieving running configurations ensures rapid firewall auditing, efficient troubleshooting, and precise change management without relying on the graphical user interface. This guide details exact syntax methods, filtering techniques, and output management to pull accurate configuration datasets from any FortiOS environment.
Pre-Operation & Administrative Checklist
Executing commands within the Fortinet CLI environment requires specific baseline privileges, secure terminal access protocols, and a firm grasp of firmware operational standards. Before running any configuration queries, administrators must verify administrative profiles, terminal session properties, and environmental boundaries to prevent performance degradation or unauthorized information exposure.
- Essential tools and access methods: Secure Shell (SSH) client such as PuTTY, SecureCRT, or native macOS/Linux terminal; Console cable (RJ-45 to DB9/USB) with serial communication software configured to 9600-8-N-1; Administrator account with super_admin or read-only profile permissions.
- Mandatory prerequisite knowledge: Familiarity with FortiOS hierarchical configuration syntax (config system, edit, set, end); Understanding of output pagination controls (spacebar for next page, enter for next line, q to quit); Awareness of security implications regarding plain-text password displays and cryptographic keys.
- Estimated duration and benchmarks: Initial connection and authentication take under 2 minutes; Running comprehensive configuration audits takes approximately 3 to 5 minutes depending on firewall model size and rulebase volume.
Step-by-Step Configuration Retrieval Workflow
Navigating through the Fortinet CLI to extract system parameters requires specific command hierarchies designed to target the global configuration, scoped feature sets, or specific interface sub-elements.
Step 1: Establish Secure CLI Session and Verify Context
Connect to the FortiGate firewall via SSH or an out-of-band console cable, then log in using an administrative credential. Upon successful authentication, the terminal will display the hostname prompt, indicating you are in the global execution context. Verify that you possess the necessary privilege level by typing get system status to confirm the FortiOS version, serial number, and operational mode.
Pro-Tip: Always verify your VDOM (Virtual Domain) context before executing global show commands, as operating inside a specific VDOM will restrict your configuration view to only that virtual instance unless you explicitly switch to the root context using the command config global.
Step 2: Execute the Global Configuration Display Command
Type show running-configuration or simply show at the root prompt to dump the entire active configuration text file to the terminal buffer. Because enterprise firewalls maintain extensive rulebases, security profiles, and routing tables, this output will be extremely long and will engage the built-in pagination system. Use the spacebar to advance page by page or press the enter key to scroll line by line through the displayed configuration script.
Warning: Running a raw show command on a massive enterprise FortiGate without output redirection can overwhelm local terminal buffers and leak sensitive pre-shared keys, local user password hashes, or encrypted secrets into unencrypted local scrollback history.
Step 3: Apply Filters and Scope Output with Grep
To avoid scrolling through thousands of lines of irrelevant parameters, narrow your data retrieval by piping the show command into the built-in grep utility. For example, typing show | grep system interface will instantly isolate and display only the configuration blocks associated with physical and logical network interfaces. You can also use regular expressions and modifier flags such as show | grep -f to filter specific text strings or configuration keywords.
Step 4: Export and Save Configuration Snapshots
When you need to review the configuration externally or archive a baseline snapshot for backup purposes, utilize external logging features within your terminal emulator or execute a backup command to transfer the file directly via TFTP, SFTP, or USB storage. Execute the execute backup config tftp or execute backup config sftp command to securely offload the complete text configuration file to a designated remote server repository without manual copy-pasting.
Fortinet Stack Configuration (FortiGate, FortiSwitch and FortiAP)
FortiOS Command Syntax and Output Filtering Reference
| Command Syntax | Target Parameter | Filtering Method | Primary Administrative Use Case |
|---|---|---|---|
| show | Global active configuration | None (Full dump) | Complete baseline audits and full system migrations |
| show system interface | Physical and logical ports | Built-in CLI view | Validating IP addressing, MTU, and administrative access |
| show firewall policy | Security rules and NAT | Grep piping | Auditing firewall rule IDs, packet logging, and traffic flows |
| show router static | Static routing table | Context-scoped display | Troubleshooting default gateways and static route metrics |
| show system global | Core system parameters | Direct syntax target | Checking hostname, time settings, and operational timeouts |
Common Administrative Failures and Field Fixes
Executing configuration queries on production firewalls can occasionally result in terminal hangups, authorization lockouts, or unreadable outputs if environmental thresholds or syntax rules are ignored.
- Root Cause: Terminal buffer overflow causing the CLI session to freeze or drop during a massive global show command execution.
- Actionable Fix: Terminate the hung session safely, reconnect via SSH, and utilize targeted scoped commands (such as show firewall policy instead of a raw show) or configure your terminal emulator to handle unlimited scrollback buffers and logging safely.
- Root Cause: Incomplete configuration visibility caused by operating silently within a restricted Virtual Domain (VDOM).
- Actionable Fix: Switch to the global administrative context by entering config global, then verify your view settings to ensure you are auditing the intended security domain or tenant space.
- Root Cause: Accidental exposure of sensitive cryptographic keys, local database credentials, or pre-shared secrets in shared monitoring terminals.
- Actionable Fix: Use the hide-password option or ensure that administrative sessions are restricted to encrypted, trusted management subnets and local screen locks are enforced immediately after auditing.
Frequently Asked Questions
How do I view only the modified configuration parameters compared to the factory defaults?
You can execute the show full-configuration command to see every single parameter, including default values, or use specialized audit tools. FortiOS does not maintain a native diff command directly in the standard CLI for runtime changes, so administrators typically compare saved revision files using external text comparison utilities.
Can I search for a specific IP address within all FortiGate configuration sections?
Yes, you can utilize the grep utility combined with wildcard patterns. Typing show | grep -f "192.168.1.100" allows the CLI to parse through every single configuration block and return only the lines containing that specific address.
What is the difference between show and show full-configuration?
The standard show command displays only non-default configuration parameters that have been explicitly modified from their factory-default states. Conversely, show full-configuration outputs every single variable, flag, and timer supported by the FortiOS firmware, regardless of whether it was manually altered.
How do I stop a long running configuration dump in the FortiOS CLI?
If you initiated a massive configuration output and need to abort the stream, press the combination of Ctrl + C on your keyboard. This interrupts the active process immediately and returns you cleanly to the operational command prompt.
Is it safe to run configuration show commands on a live production firewall?
Yes, running show commands is entirely read-only and places virtually no strain on the FortiGate data plane processor. However, administrators should exercise caution regarding screen-scraping sensitive data like pre-shared secrets or administrator password hashes in shared control rooms.
Streamline your network operations and secure your infrastructure perimeter by implementing rigorous configuration auditing workflows on your FortiGate enterprise firewalls today.
