FortiGate Administration Guide - FirewallShop.com

Access profiles
System Administrators
The access profile has a similar effect on administrator access to CLI commands.
The following table shows which command types are available in each access
control category. You can access “get” and “show” commands with read access.
Access to “config” commands requires write access.
Table 30: Access profile control of access to CLI commands
Access control
Admin Users (admingrp)
Antivirus Configuration (avgrp)
Auth Users (authgrp)
Firewall Configuration (fwgrp)
FortiProtect Update (updategrp)
IPS Configuration (ipsgrp)
Log & Report (loggrp)
Maintenance (mntgrp)
Network Configuration (netgrp)
Router Configuration (routegrp)
Available CLI commands
system admin
system accprofile
antivirus
user
firewall
Use the set fwgrp custom and config
fwgrp-permission commands to set some
firewall permissions individually. Selections can
be made for policy, address, service, schedule,
profile, and other (VIP) configurations. For more
information, see FortiGate CLI Reference.
system autoupdate
execute update-av
execute update-ips
execute update-now
ips
alertemail
log
system fortianalyzer
execute log
execute formatlogdisk
execute restore
execute backup
execute batch
execute usb-disk
system arp-table
system dhcp
system interface
system zone
execute dhcp lease-clear
execute dhcp lease-list
execute clear system arp table
execute interface
router
execute router
execute mrouter
FortiGate Version 3.0 MR5 Administration Guide
170 01-30005-0203-20070830