Fireware Command Line Interface Fireware Reference v12.6.4 Command Line Interface Reference v12.6.4 WatchGuard Fireboxes About This Guide Information in this guide is subject to change without notice. Companies, names, and data used in examples herein are fictitious unless otherwise noted. No part of this guide may be reproduced or transmitted in any form or by any means, electronic or mechanical, for any purpose, without the express written permission of WatchGuard Technologies, Inc. Guide revised: 2/22/2021 Copyright, Trademark, and Patent Information Copyright © 1998–2021 WatchGuard Technologies, Inc. All rights reserved. All trademarks or trade names mentioned herein, if any, are the property of their respective owners. Complete copyright, trademark, patent, and licensing information can be found in the Copyright and Licensing Guide, available online: http://www.watchguard.com/wgrd-help/documentation/overview ii Fireware v12.6.4 Table of Contents Fireware Command Line Interface Reference v12.6.4 i About This Guide ii Copyright, Trademark, and Patent Information ii Table of Contents iii Introduction to the CLI 1 About the CLI Reference Guide 1 Command Reference Format 1 Command Reference Notation 2 Special Characters 2 Sample Command References 2 history 3 export 3 Start the Command Line Interface 4 Connect with a Serial Cable 4 Connect with TCP/IP 5 Connect to the CLI on an XTMv Device 5 Enter Commands in the CLI 7 Terminal Commands 7 Get Help 8 help 8 Syntax in Help Output 9 "?" Command 11 Error Handling in the CLI 11 Import and Export Files 12 Command Modes Overview 13 About CLI Command Modes 13 Main Command Mode 14 Configuration Command Mode 14 Interface Command Mode 14 Link Aggregation Command Mode 15 CLI Reference iii Policy Command Mode 15 Common Commands 15 Command Line Interface Prompt 16 Common Commands 17 About Common Commands 17 List of Common Commands 17 Common Command Reference 18 exit 18 help 19 history 20 ! 20 show 20 show access-portal 23 show alias 23 show antivirus 23 show auth-portal 24 show app-control 24 show auth-server 24 show auth-setting 25 show auth-user-group 25 show backup-list 26 show botnet 26 show bovpn-gateway 26 show bovpn-tunnel 26 show bovpn-vif 27 show bovpntls-client 27 show bridge 27 show categories 28 show certificate 28 show cluster 29 show connection 30 show data-loss-prevention 30 iv Fireware v12.6.4 show ddns 30 show device-mgmt-user 31 show external-auth-hotspot 31 show feature-key 31 show fqdn 31 show geolocation 32 show global-setting 32 show gwc 33 show hotspot 34 show hotspot users 34 show interface 34 show intrusion-prevention 35 show ip 35 show link-aggregation 36 show link-monitor 36 show log-cache 36 show log-setting 38 show modem 38 show mvpn-ipsec 38 show mvpn-rule 39 show network-scan 39 show policy-type 39 show pppoe 39 show proposal 40 show proxy-action 40 show quota 40 show reputation-enabled-defense 41 show rule 41 show sd-wan 41 show signature-update 42 show snat 42 show spamblocker 43 CLI Reference v show stp 43 show sys-storage 43 show traffic-management 43 show trusted-ca-certificates 44 show update-history 44 show usb 44 show user-group 45 show users 45 show v6 45 show vlan 46 show vpn-setting 46 show vpn-status 46 show web-server-cert 47 show wireless 47 show wireless rogue-ap 47 Main Command Mode 49 Main Commands 49 Enter the Main Command Mode 50 List of Main Mode Commands 50 Main Command Mode Reference 52 arp flush 52 backup image 52 cache-flush scan 53 cert-request 53 checksum 54 clock 54 cluster 55 configure 56 csfc 56 debug-cli 57 delete 57 device-mgmt-user 58 vi Fireware v12.6.4 diagnose 58 diagnose to 59 diagnose auth-server 59 diagnose cluster 60 diagnose dynroute 60 diagnose fqdn 60 diagnose hardware 61 diagnose vpn 64 dnslookup 68 export 70 fault-report 71 fips 72 fqdn 73 gwc 74 import 75 mgmt-user-unlock 77 no vpn-status 77 password 77 ping 78 ping -6 78 policy-check 79 quota-reset 79 reboot 80 restore 80 rps 81 shutdown 81 signature-update 81 sync 82 sysinfo 82 tcpdump 82 tlsv13 83 traceroute 83 CLI Reference vii trusted-ca-certificates 84 unlock 84 upgrade 85 upgrade certificate 85 usb 86 vpn-tunnel diag-report 88 vpn-tunnel rekey 88 who 88 Configuration Command Mode 91 Configuration Commands 91 Enter the Configuration Command Mode 92 List of Configuration Mode Commands 92 Configuration Command Mode Reference 94 access-portal 94 app-control 101 auth-portal 102 auth-setting 105 botnet 110 bridge 110 cluster 115 data-loss-prevention 119 ddns 119 default-packet-handling 120 device-mgmt-user 122 dnswatch 123 external-auth-hotspot 124 feature-key 126 geolocation 127 global-setting 128 gwc 132 hotspot 142 interface 146 viii Fireware v12.6.4 intrusion-prevention 146 ip 148 link-aggregation 153 link-monitor 153 log-setting 155 logon-disclaimer 160 loopback 161 managed-client 162 mobile-security 164 modem 166 multi-wan 170 netflow 172 network-mode 174 network-scan 177 ntp 177 policy 178 pppoe 178 quota-action 181 quota-exception 181 quota-rule 182 sd-wan 183 signature-update 185 snat 186 snmp 188 static-arp 189 system 190 threat-detection 190 trusted-ca-certificates 191 v6 ip route 191 vlan 192 vpn-setting 197 web-server-cert 199 CLI Reference ix wireless access-point 200 wireless client 204 wireless radio-settings 206 wireless rogue-ap 207 Interface Command Mode 211 Interface Commands 211 Enter the Interface Command Mode 212 List of Interface Mode Commands 212 Interface Command Mode Reference 213 dhcp 213 enable 216 ip 216 link-speed 218 mac-access-control 218 mac-ip-binding 219 mtu 219 name 220 pppoe 220 qos 222 secondary 223 system-dhcp 223 type 224 v6 224 vpn-pmtu 228 Link Aggregation Command Mode 231 Link Aggregation Commands 231 Enter Link Aggregation Command Mode 232 List of Link Aggregation Mode Commands 232 Link Aggregation Command Mode Reference 233 dhcp 233 ip 236 link-speed 236 x Fireware v12.6.4 member 237 mode 237 mtu 238 override-mac 238 pppoe 238 secondary 240 security-zone 241 system-dhcp 242 Policy Command Mode 243 Policy Commands 243 Enter the Policy Command Mode 244 List of Policy Mode Commands 244 Policy Command Mode Reference 246 alias 246 antivirus 249 apply 250 apt-blocker 250 apt-blocker notification 251 auth-server 252 auth-user-group 255 bovpn-gateway 256 bovpn-tunnel 262 bovpn-vif 266 bovpntls-client 275 dynamic-nat 275 ike-v2-shared 276 l2tp 277 mvpn-ikev2 283 mvpn-ipsec 285 mvpn-rule 288 one-to-one-nat 291 policy-tag 292 CLI Reference xi policy-type 293 proposal 294 quarantine-server 294 reputation-enabled-defense 295 rule 295 schedule 304 spamblocker 304 sslvpn 306 traffic-management 310 user-group 311 users 311 xii Fireware v12.6.4 1 Introduction to the CLI About the CLI Reference Guide WatchGuard® Firebox devices include a Command Line Interface (CLI) installed on the hardware. You can connect to the Firebox and use the CLI as an alternative to the Web UI or WatchGuard System Manager software. You can use the CLI with any terminal client that supports SSH2. This section provides information about how to use the command reference in this document. Command Reference Format The syntax section for each command uses this format: A shaded area shows a single syntax for a command that uses the notation described in the subsequent section. After each command, guidance and comments for the command are shown. For commands where a choice is available for a particular portion of the command, all possible options are described. In the case where a command requires no guidance or comments, this area contains the text “No options available.” CLI Reference 1 Introduction to the CLI Command Reference Notation The syntax section of each command uses a standardized format and notation: Notation Meaning bold Bold text indicates commands and keywords that you enter as shown italic Italic text indicates an argument that you provide. Examples include an account name, password, FTP location, or IP address. [x] Square brackets enclose an optional keyword or argument. (x) Parentheses enclose a required keyword or argument. ... An ellipsis (three consecutive periods without spaces) after an element indicates that the element can be repeated. | A vertical line, called a pipe, that is enclosed within braces or square brackets indicates a choice within a set of keywords or arguments. [x|y] Square brackets around keywords or arguments separated by a pipe indicate an optional choice between separate, mutually exclusive options. (x|y) Parentheses around keywords or arguments separated by a pipe indicate a required choice between separate, mutually exclusive options. [x(y|z)] Parentheses and a pipe within square brackets indicate a required choice within an optional element. Special Characters If you must include special characters within a command argument, such as a password, you can enclose the argument in double quotes " " to remove (escape) the special meaning associated with those characters. Example restore image from usb flash-image backup.fxi "configpassfoo&" Sample Command References A command reference provides: n The command n A brief description of the command n The command syntax n Examples, where appropriate The subsequent commands are two sample command references. Where appropriate, the example also includes sample output. 2 Fireware v12.6.4 Introduction to the CLI history Description Display the command history list with line numbers.