topic Re: Web UI/clish idea in Firewall and Security Management

Web UI/clish idea

the_rock — Mon, 30 Dec 2024 16:57:21 GMT

Hey guys,

Client asked me about this recently and I am pretty sure its not possible currently from web UI, but they wanted to know if there were any plans to implement it eventually. Im referring to something like below on Fortinet, where bunch of web UI settings can be edited in built in cli (terminal) directly.

Thoughts?

Andy

Re: Web UI/clish idea

AkosBakos — Mon, 30 Dec 2024 17:10:53 GMT

Good idea 🙂 Let's make an RFE 🙂

But the hosting servers and storages are burning from the Forti screenshot 🙂

Ákos

Re: Web UI/clish idea

the_rock — Mon, 30 Dec 2024 17:17:49 GMT

Its super basic lab brother 🙂

Re: Web UI/clish idea

the_rock — Mon, 30 Dec 2024 17:36:18 GMT

Just submitted an RFE and got an email with reference number, lets see what happens 🙂

Andy

Re: Web UI/clish idea

Lesley — Mon, 30 Dec 2024 18:12:12 GMT

Did you asked RFE for GAIA or GAIA embedded or both? What happens in you press in this case the button?

You go to CLI and will show correct CLI reference?

Re: Web UI/clish idea

the_rock — Mon, 30 Dec 2024 18:15:35 GMT

Hey,

Just asked for regular fw, not embedded. In Fortinet, yes, if you press option I pointed out, it will show you cli config in embedded cli (terminal) and you can even change it right there.

I was thinking maybe "configuration" option in CP web UI may do something, but nothing comes up no matter how many times I press it.

Andy

Re: Web UI/clish idea

the_rock — Mon, 30 Dec 2024 18:16:58 GMT

Example of what I gave initially.

Andy

Re: Web UI/clish idea

Lesley — Mon, 30 Dec 2024 18:21:01 GMT

Cool I get it, handy if you want to learn the CLI also

Re: Web UI/clish idea

the_rock — Mon, 30 Dec 2024 18:24:59 GMT

I think so, ya.

Re: Web UI/clish idea

Lloyd_Braun — Mon, 30 Dec 2024 18:36:56 GMT

there is a >_ button in the top pane next to the lock button that opens a cli that is tunneled over HTTPS. or you are looking for something that opens up in a specific cli configuration context?

Re: Web UI/clish idea

the_rock — Mon, 30 Dec 2024 18:39:22 GMT

Correct, BUT, that opens generic clish, NOT for specific/given settings, like Fortinet screenshot I posted.

Andy

Re: Web UI/clish idea

the_rock — Mon, 30 Dec 2024 18:40:00 GMT

To answer your question, yes, thats what customer was asking me about 🙂

Re: Web UI/clish idea

Lloyd_Braun — Mon, 30 Dec 2024 18:50:28 GMT

i see, seems like a big clish revamping to have contexts like that, but that could be cool

Re: Web UI/clish idea

the_rock — Mon, 30 Dec 2024 18:51:48 GMT

Lets see, it would be cool indeed 🙂

Andy

Re: Web UI/clish idea

AkosBakos — Mon, 30 Dec 2024 19:09:47 GMT

To be honest, the config structure of the Fortigate is totally different. Start with #edit

akos

Re: Web UI/clish idea

the_rock — Mon, 30 Dec 2024 19:14:48 GMT

Yep, totally different. I would say its somewhat similar to Cisco OS, see below examples from my lab.

Andy

Literally any command can be shortened.

Using username "admin".
admin@172.16.10.147's password:
Send automatic password
Access denied
admin@172.16.10.147's password:
Fortigate-VM #
Fortigate-VM # diag debug disable

Fortigate-VM # di de di

Fortigate-VM # get sys status
Version: FortiGate-VM64-KVM v7.6.1,build3457,241127 (GA.F)
First GA patch build date: 240724
Security Level: High
Firmware Signature: certified
Virus-DB: 1.00000(2018-04-09 18:07)
Extended DB: 1.00000(2018-04-09 18:07)
Extreme DB: 1.00000(2018-04-09 18:07)
AV AI/ML Model: 0.00000(2001-01-01 00:00)
IPS-DB: 6.00741(2015-12-01 02:30)
IPS-ETDB: 6.00741(2015-12-01 02:30)
APP-DB: 6.00741(2015-12-01 02:30)
Proxy-IPS-DB: 6.00741(2015-12-01 02:30)
Proxy-IPS-ETDB: 6.00741(2015-12-01 02:30)
Proxy-APP-DB: 6.00741(2015-12-01 02:30)
FMWP-DB: 0.00000(2001-01-01 00:00)
IPS Malicious URL Database: 1.00001(2015-01-01 01:01)
IoT-Detect: 0.00000(2022-08-17 17:31)
OT-Detect-DB: 0.00000(2001-01-01 00:00)
OT-Patch-DB: 0.00000(2001-01-01 00:00)
OT-Threat-DB: 6.00741(2015-12-01 02:30)
IPS-Engine: 7.01026(2024-11-14 23:09)
Serial-Number: FGVM2V0000159742
License Status: Valid
VM Resources: 2 CPU/2 allowed, 1993 MB RAM
Log hard disk: Not available
Hostname: Fortigate-VM
Private Encryption: Disable
Operation Mode: NAT
Current virtual domain: root
Max number of virtual domains: 2
Virtual domains status: 1 in NAT mode, 0 in TP mode
Virtual domain configuration: disable
FIPS-CC mode: disable
Current HA mode: standalone
Branch point: 3457
Release Version Information: GA
FortiOS x86-64: Yes
System time: Mon Dec 30 14:14:19 2024
Last reboot reason: power cycle

Fortigate-VM # get sy st

ambiguous command before 'st'
Command fail. Return code -7

Fortigate-VM # get sy sta

ambiguous command before 'sta'
Command fail. Return code -7

Fortigate-VM # get sy stat
Version: FortiGate-VM64-KVM v7.6.1,build3457,241127 (GA.F)
First GA patch build date: 240724
Security Level: High
Firmware Signature: certified
Virus-DB: 1.00000(2018-04-09 18:07)
Extended DB: 1.00000(2018-04-09 18:07)
Extreme DB: 1.00000(2018-04-09 18:07)
AV AI/ML Model: 0.00000(2001-01-01 00:00)
IPS-DB: 6.00741(2015-12-01 02:30)
IPS-ETDB: 6.00741(2015-12-01 02:30)
APP-DB: 6.00741(2015-12-01 02:30)
Proxy-IPS-DB: 6.00741(2015-12-01 02:30)
Proxy-IPS-ETDB: 6.00741(2015-12-01 02:30)
Proxy-APP-DB: 6.00741(2015-12-01 02:30)
FMWP-DB: 0.00000(2001-01-01 00:00)
IPS Malicious URL Database: 1.00001(2015-01-01 01:01)
IoT-Detect: 0.00000(2022-08-17 17:31)
OT-Detect-DB: 0.00000(2001-01-01 00:00)
OT-Patch-DB: 0.00000(2001-01-01 00:00)
OT-Threat-DB: 6.00741(2015-12-01 02:30)
IPS-Engine: 7.01026(2024-11-14 23:09)
Serial-Number: FGVM2V0000159742
License Status: Valid
VM Resources: 2 CPU/2 allowed, 1993 MB RAM
Log hard disk: Not available
Hostname: Fortigate-VM
Private Encryption: Disable
Operation Mode: NAT
Current virtual domain: root
Max number of virtual domains: 2
Virtual domains status: 1 in NAT mode, 0 in TP mode
Virtual domain configuration: disable
FIPS-CC mode: disable
Current HA mode: standalone
Branch point: 3457
Release Version Information: GA
FortiOS x86-64: Yes
System time: Mon Dec 30 14:14:36 2024
Last reboot reason: power cycle

Fortigate-VM #

Re: Web UI/clish idea

JozkoMrkvicka — Mon, 30 Dec 2024 22:00:45 GMT

If I am user configured to access only Web-UI, should I be allowed to see clish commands ?

There are 3 types of access-mechanisms to be available for specific user: Web-UI, CLI, Gaia-API.

All OS config data are saved in plain-text file (/config/db/initial) and as SQLite database (/config/db/initial_db). I am pretty sure Web-UI is getting these data from CLI anyway (show/dbget). The same should apply to modify something over Web-UI/Clish/Gaia-API (here set,add,delete or dbset should be used).

To have this topic complete, may we get the RFE number so someone can ask for the progress in the future?

Re: Web UI/clish idea

the_rock — Tue, 31 Dec 2024 00:04:27 GMT

Not sure if Im allowed to share RFE reference...

Thoughs @PhoneBoy ?

Re: Web UI/clish idea

PhoneBoy — Tue, 31 Dec 2024 01:29:03 GMT

You realize you can access the CLI from the WebUI, right?
This is from R82, but I'm pretty sure it's also available in earlier versions.

Re: Web UI/clish idea

the_rock — Tue, 31 Dec 2024 01:32:48 GMT

Of course, thats been there forever. BUT, thats NOT what customer was talking about 🙂

He wanted to know if say you clicked on "dhcp server" tab, if there would ever be an option to edit that config in cli, or any other tab for that matter. Same like the Fortigate screenshot I posted.

Andy