Mastering grep on the FortiGate CLI: Every Switch, Explained

By Manny Fernandez

September 24, 2026

Mastering grep on the FortiGate CLI: Every Switch, Explained

If you live in the FortiGate CLI, grep is the difference between scrolling through 4,000 lines of show output and landing on the exact line you need in one shot. FortiOS ships a trimmed-down grep that you pipe onto get, show, and diagnose output. It is not GNU grep, and it has one Fortinet-specific trick that makes it far more useful than the generic version.

This post covers every switch, what it does, and when to reach for it.

Background

Grep has been on FortiOS for a long time. Community reports place the basic flag set as far back as FortiOS 4.0 MR3. The context-aware -f switch arrived later in the 5.x era and is the one most engineers still do not know about.

The quickest way to see what your build supports is to feed grep an invalid flag and read the usage banner:

FGT # show | grep -X
grep: invalid option -- X
Usage: grep [-invfcABC] PATTERN

The Switch Reference

Switch	Name	What it does
(none)	Basic match	Prints every line containing the pattern
`-i`	Ignore case	Case-insensitive match
`-v`	Invert	Prints lines that do NOT match
`-n`	Line numbers	Prefixes each match with its line number
`-c`	Count	Prints only the number of matching lines
`-f`	Fortinet context	Prints the full config block around each match
`-A <num>`	After	Prints NUM lines of trailing context
`-B <num>`	Before	Prints NUM lines of leading context
`-C <num>`	Context	Prints NUM lines before and after

Basic Syntax

<get | show | diagnose ...> | grep [switches] <pattern>

Wrap any pattern that contains spaces in double quotes, and escape inner quotes with a backslash:

show firewall policy | grep "set srcintf \"port1\""

-i: Ignore Case

Object names in FortiOS are case-sensitive, but humans are not consistent. Use -i when you are not sure how someone named an object.

show firewall address | grep -i webserver

This catches WebServer, WEBSERVER, and webserver-dmz in one pass.

-v: Invert Match

Strip out the noise. Great for filtering out lines you already know about.

get system interface physical | grep -v "status: down"
diagnose sys session list | grep -v "proto=17"

The second example removes UDP sessions from session list output so TCP stands out.

-n: Line Numbers

Useful when you are correlating grep output with a full show dump you exported, or when you want a sense of where in the config something lives.

show | grep -n "set vdom"

-c: Count Only

Returns a single number instead of the matching lines. This is the quick-audit switch.

show firewall policy | grep -c "edit"
show firewall policy | grep -c "set action deny"
show firewall policy | grep -c "set logtraffic disable"

In three commands you know your total policy count, how many are explicit denies, and how many policies are not logging. That last number belongs in every QBR.

-f: Fortinet Context (The Killer Feature)

This is the switch that makes FortiOS grep worth learning. Standard grep has no idea that a set line belongs to an edit block, which belongs to a config tree. The -f switch does: it returns every match wrapped in its complete configuration hierarchy.

Without -f:

FGT # show | grep ldap-group1
    edit "ldap-group1"
            set groups "ldap-group1"

You know the group exists and is referenced somewhere. That is it.

With -f:

FGT # show | grep -f ldap-group1
config user group
    edit "ldap-group1"
        set member "pc40-LDAP"
    next
end
config firewall policy
    edit 2
        set srcintf "port31"
        set dstintf "port32"
        ...
        set groups "ldap-group1"
    next
end

Now you see the object definition AND every policy that references it, each wrapped in its full config / edit / next / end structure. Practical uses:

show | grep -f "WEB-SRV-01"           # where is this address used?
show firewall policy | grep -f wan1   # every policy touching wan1
show | grep -f "set status disable"   # every disabled object, in context

A big bonus: -f output is valid CLI syntax. You can copy a block, edit it, and paste it into another FortiGate.

Gotcha: -f only makes sense against show output, since that is where the config hierarchy exists. On get or diagnose output it has no structure to work with, so use -A, -B, or -C there instead.

-A, -B, -C: Line Context

These give you raw line counts around a match. They are the right tool for diagnose and get output, which have no config hierarchy.

-A (after) prints lines following the match:

diagnose sys session list | grep -A 12 "dport=443"

-B (before) prints lines preceding the match:

get router info routing-table all | grep -B 2 "10.0.0.0/16"

-C (context) prints lines on both sides:

diagnose vpn ike gateway list | grep -C 5 "HQ-TUNNEL"
get system performance status | grep -C 3 "Memory"

Before -f existed, the standard workaround for viewing a whole policy was a large context window such as grep -C 20. That still works, but -f is cleaner because it stops exactly at block boundaries instead of guessing.

Combining Switches

Switches stack. A few combos worth memorizing:

show | grep -fi "guest"                     # context + case-insensitive
show firewall policy | grep -ci "accept"    # case-insensitive count
diagnose sys session list | grep -in -A 5 "198.18.10.5"

Quick Reference Cheat Sheet

Goal	Command
Find everywhere an object is used	`show \| grep -f "<object>"`
Count firewall policies	`show firewall policy \| grep -c edit`
Count policies not logging	`show firewall policy \| grep -c "logtraffic disable"`
Case-insensitive object hunt	`show firewall address \| grep -i "<name>"`
Hide down interfaces	`get system interface physical \| grep -v "status: down"`
Session detail for a host	`diagnose sys session list \| grep -A 12 "<ip>"`
Route lookup with neighbors	`get router info routing-table all \| grep -C 2 "<prefix>"`
VPN tunnel detail	`diagnose vpn ike gateway list \| grep -C 5 "<tunnel>"`

Troubleshooting and Gotchas

No output at all. Check quoting first. If your pattern contains spaces or quotation marks, wrap it in double quotes and escape inner quotes with a backslash.

-f returns too much. A short pattern like port1 also matches port10 through port19. Include the surrounding quotes from the config line to anchor on the exact object name:

show | grep -f "\"port1\""

Missing default values. show only displays non-default settings, so grep cannot find what is not printed. Use show full-configuration when you need to search defaults:

show full-configuration system global | grep -i timeout

Not GNU grep. Do not expect -E, -o, -w, -r, or long options like --color. If the usage banner does not list it, your build does not support it.

VDOM scope. On multi-VDOM units, grep only sees the output of the command you piped it from. Enter the correct VDOM (or config global) before searching.

Mastering grep on the FortiGate CLI: Every Switch, Explained

Background

The Switch Reference

Basic Syntax

-i: Ignore Case

-v: Invert Match

-n: Line Numbers

-c: Count Only

-f: Fortinet Context (The Killer Feature)

-A, -B, -C: Line Context

Combining Switches

Quick Reference Cheat Sheet

Troubleshooting and Gotchas

Recent posts