PowerFGT PowerShell Module

The Add-FGTRouterStatic cmdlet uses different parameter sets to define the type of route being created. You must provide the required parameters specific to the desired routing behavior:

Standard Route via Device

Requires -dst (destination) and -device (interface).

Blackhole Route

Requires -dst and the -blackhole switch. This is used to drop traffic to a specific destination.

ISDB (Internet Service Database) Routes

Used for routing based on predefined internet services.

• ISDB via Device: Requires -device and -internet_service (ID).
• ISDB Blackhole: Requires -internet_service (ID) and the -blackhole switch.

Destination Address Routes

• dstaddr_device: Requires -dstaddr, -device, and optionally -blackhole.
• dstaddr_blackhole: Requires -dstaddr and the -blackhole switch.

PowerFGT allows you to target specific Virtual Domains (VDOMs) using the -vdom parameter on most cmdlets. By default, the root VDOM is used.

Usage Patterns:

• Single VDOM: Get-FGTFirewallAddress -vdom vdomX
• Multiple specific VDOMs: Get-FGTFirewallAddress -vdom vdomX,root
• All VDOMs: Get-FGTFirewallAddress -vdom *

Connection Settings:

• Set the default VDOM during connection: Connect-FGT <IP> -vdom vdomX
• Change the default VDOM for an existing connection: Set-FGTConnection -vdom vdomY

To run the full suite of integration tests, navigate to the integration folder and use the Invoke-Pester command.

Invoke-Pester *

Tests are organized by functional area. You can run specific test files or target specific test names within a file to save time.

Run all tests in a specific functional file:

Invoke-Pester Connection.Tests.ps1

Run a specific test case within a file: Use the -testName parameter to target a specific Describe block or test name.

Invoke-Pester Connection.Tests.ps1 -testName "Connect to a FortiGate (using HTTP)"

To enable a policy, use the -status switch. To disable a policy, use the -status:$false syntax.

# Disable a policy
$MyFGTPolicy | Set-FGTFirewallPolicy -status:$false

You can update contact details such as email or SMS phone numbers using the following parameters:

• -email_to <String>: Sets the user's email address.
• -sms_phone <String>: Sets the user's SMS phone number (can also be set via the -data hashtable).
• -data <Hashtable>: Used for arbitrary data updates, such as @{ "sms-phone" = "XXXXXXXXXX" }.

# Set email
$MyFGTUserLocal | Set-FGTUserLocal -email_to newpowerfgt@fgt.power

# Set SMS via hashtable
$data = @{ "sms-phone" = "XXXXXXXXXX" }
$MyFGTUserLocal | Set-FGTUserLocal -data $data

Use the following flags to change the output format:

• -meta: Returns the Switch Group object along with metadata (e.g., q_ref for usage).
• -schema: Returns the schema definition of the Switch Group instead of the object list.
• -skip: Returns only the relevant attributes of the objects, ignoring non-essential data.

Get-FGTSwitchGroup -meta
Get-FGTSwitchGroup -schema
Get-FGTSwitchGroup -skip

Virtual IPs (VIPs) are used for NAT configurations. You can manage them using:

• Add-FGTFirewallVip: Create a new VIP.
• Get-FGTFirewallVip: Retrieve VIP information.
• Remove-FGTFirewallVip: Delete a VIP.

Common configurations include static-nat and port forwarding.

# Add a basic Static NAT VIP (192.2.0.1 => 198.51.100.1)
Add-FGTFirewallVip -name myVIP1 -type static-nat -extip 192.2.0.1 -mappedip 198.51.100.1

# Add a Static NAT VIP with Port Forwarding (192.2.0.2:8080 => 198.51.100.2:80)
Add-FGTFirewallVip -name myVIP2-8080to80 -type static-nat -extip 192.2.0.2 -mappedip 198.51.100.2 -portforward -extport 8080 -mappedport 80

# Remove a VIP
Get-FGTFirewallVip -name myVIP1 | Remove-FGTFirewallVip