The following table shows the different CLI commands and their availability for different roles.
| Command Name | Updater | Maintainer | ReadOnly | ReadWrite | Admin |
|---|---|---|---|---|---|
| adduser | N | N | N | N | Y |
| accelerate-ftp | N | N | N | N | Y |
| accelerate-ftp status | N | N | N | N | Y |
| appidlog <enable | disable> | N | N | N | N | Y |
| appidlog status | N | N | N | N | Y |
| arp delete | N | N | N | Y | Y |
| arp dump | N | N | Y | Y | Y |
| arp flush | N | N | N | Y | Y |
| arp spoof | N | N | N | Y | Y |
| atdcache autopurge <enable|disable> | N | N | N | N | Y |
| atdcache autopurge status | N | N | N | N | Y |
| auditlogupload | N | N | Y | Y | Y |
| checkmanagerconnectivity | N | N | N | N | Y |
| clearmalwarecache <all | atd | flash | gam | mvx | office | pdf> | N | N | N | N | Y |
| clrstat | N | N | N | Y | Y |
| clrtsstats | N | N | N | N | Y |
| clear ssl outbound urlcache | N | N | Y | Y | Y |
| commands | Y | Y | Y | Y | Y |
| console eventlog (on|off|status) | N | N | N | N | Y |
| debug | N | N | N | Y | Y |
| deinstall | N | Y | N | Y | Y |
| deleteallusers | N | N | N | N | Y |
| deletemgrsecintf | N | Y | N | Y | Y |
| deletesignatures | N | N | N | Y | Y |
| deleteuser | N | N | N | N | Y |
| disconnectalertandpktlogchannels | N | Y | N | Y | Y |
| dnsprotect | N | N | N | Y | Y |
| dnsprotect (add|delete) | N | N | N | Y | Y |
| dnsprotect resetlist | N | N | N | Y | Y |
| downloadstatus | Y | Y | Y | Y | Y |
| dumpappidlog <1-100>|running | N | N | N | N | Y |
| exit | Y | Y | Y | Y | Y |
| exportsensorcerts | N | N | Y | Y | Y |
| factorydefaults | N | N | N | Y | Y |
| failovermode forward-peer-stp (enable|disable) | N | N | N | Y | Y |
| filerep gti md5 <md5_hash> | N | N | N | Y | Y |
| fwdump acl | N | N | N | N | Y |
| guest-portal | N | N | N | Y | Y |
| help | Y | Y | Y | Y | Y |
| Importsensorcerts | N | N | N | Y | Y |
| ipreassembly timeout forward | N | N | N | Y | Y |
| latency-monitor | N | N | N | Y | Y |
| latency-monitor enable action <alert-only | put-in-layer2> | N | N | N | Y | Y |
| latency-monitor restore-inline enable <10-60> | N | N | N | N | Y |
| latency-monitor restore-inline disable | N | N | N | N | Y |
| latency-monitor sensitivity-level <high | medium | low> | N | N | N | N | Y |
| logstat (all|datapath|mgmt|dos) | N | N | N | N | Y |
| layer2 mode | N | N | N | Y | Y |
| loadconfiguration | N | Y | N | Y | Y |
| loadimage | Y | Y | N | Y | Y |
| loadsavedimage | N | N | N | Y | Y |
| lockuser | N | N | N | N | Y |
| logstat | N | N | Y | Y | Y |
| ntbastat | N | N | Y | Y | Y |
| passwd | Y | Y | Y | Y | Y |
| ping | Y | Y | Y | Y | Y |
| quit | Y | Y | Y | Y | Y |
| raidrepair | N | N | Y | Y | Y |
| reboot | Y | Y | N | Y | Y |
| reconnectalertandpktlogchannels | N | Y | N | Y | Y |
| rescuedisk | N | N | N | Y | Y |
| resetconfig | N | N | N | Y | Y |
| secureerase | N | N | N | Y | Y |
| sensor perf-debug<time in minutes> | N | N | N | Y | Y |
| sensor perf-debug off | N | N | N | Y | Y |
| sensor perf-debug status | N | N | Y | Y | Y |
| sensor-datapath-stat-analysis log | N | N | N | N | Y |
| sensor-datapath-stat-analysis show | N | N | N | N | Y |
| sensordroppktevent | N | N | N | Y | Y |
| set atdcachepurge interval hours <1-192> | N | N | N | N | Y |
| set autorecovery | N | N | N | Y | Y |
| set auxport (enable|disable) | N | N | N | Y | Y |
| set console timeout | N | N | N | Y | Y |
| set debugmode passwd | N | N | N | N | Y |
| set dnsprotect | N | N | N | Y | Y |
| set dospreventionseverity <dos-measure-name> <inbound | outbound> <0-200> | N | N | N | Y | Y |
| set dpimonitor <enable | disable> | N | N | N | N | Y |
| set dpimonitor-action <enable|disable> | N | N | N | N | Y |
| set flowvolumelimit disable | N | N | N | Y | Y |
| set flowvolumelimit enable <threshold> | N | N | N | Y | Y |
| set gigfailopen disable | N | N | N | Y | Y |
| set gigfailopendelay | N | N | N | Y | Y |
| set hypervisor server ip | N | Y | N | Y | Y |
| set inactiveuserslock <enable | disable> | N | N | N | N | Y |
| set intfport id flowcontrol | N | N | N | Y | Y |
| set manager alertport | N | N | N | Y | Y |
| set manager alertport_RSA-2048-bit | N | N | N | Y | Y |
| set manager installsensorport | N | N | N | Y | Y |
| set manager installsensorport_RSA-2048-bit | N | N | N | Y | Y |
| set manager ip | N | Y | N | Y | Y |
| set manager logport | N | N | N | Y | Y |
| set manager logport_RSA-2048-bit | N | N | N | Y | Y |
| set manager secondary ip | N | Y | N | Y | Y |
| set ma wakeup port [<1-65536>] | N | N | N | N | Y |
| set mgmtport auto | N | N | N | Y | Y |
| set mgmtport mtu | N | N | N | Y | Y |
| set mgmtport speed | N | N | N | Y | Y |
| set mnsconfig | N | N | N | N | Y |
| set mnsconfig radiusLB | N | N | N | N | Y |
| set nmsuserwriteaccess | N | N | N | Y | Y |
| set outofcontext acllookup <enable|disable> | N | N | N | N | Y |
| set portsettletime <seconds> | N | N | N | Y | Y |
| set scpserver ip | Y | Y | N | Y | Y |
| set sensor gateway | N | Y | N | Y | Y |
| set sensor gateway-ipv6 | N | Y | N | Y | Y |
| set sensor ip/ipv6 | N | Y | N | Y | Y |
| set sensor name | N | N | N | Y | Y |
| set sensor sharedsecretkey | N | Y | N | Y | Y |
| set sessionlimit timeout | N | N | N | N | Y |
| set sshinactivetimeout | N | N | N | Y | Y |
| set syncookietcpreset (on|off) | N | N | N | Y | Y |
| set tacacsauthorization | N | N | N | Y | Y |
| set tcpudpchecksumerror drop | N | N | N | Y | Y |
| set tcpudpchecksumerror forward | N | N | N | Y | Y |
| set tftpserver ip | Y | Y | N | Y | Y |
| set userconfigvolumdosthreshold | N | N | N | Y | Y |
| set vlanbasedrecon | N | N | N | N | Y |
| setfailopencfg restore-inline | N | N | N | N | Y |
| setfailopencfg restore-inline-interval < 5-60 minutes > | N | N | N | N | Y |
| setfailopencfg internal/external-failopen bypass/inline | N | N | N | N | Y |
| setup | N | N | N | Y | Y |
| show | Y | Y | Y | Y | Y |
| show auditlogtomgr status | N | N | N | Y | Y |
| show acl stats | N | N | Y | Y | Y |
| show arp spoof status | N | N | Y | Y | Y |
| show auditlog | N | N | Y | Y | Y |
| show auditlog status | N | N | Y | Y | Y |
| show autorecovery status | N | N | Y | Y | Y |
| show auxport status | N | N | Y | Y | Y |
| show botnet-alertstats | N | N | N | Y | Y |
| show console timeout | N | N | Y | Y | Y |
| show coppersfpserialnumbers | N | N | Y | Y | Y |
| show dnsprotect | N | N | Y | Y | Y |
| show dnsprotectstat | N | N | Y | Y | Y |
| show dospreventionprofile | N | N | Y | Y | Y |
| show dospreventionseverity | N | N | Y | Y | Y |
| show dpimonitor status | N | N | N | N | Y |
| show dpimonitor-action status | N | N | N | N | Y |
| show dxl status | N | N | N | N | Y |
| show eventlog | N | N | Y | Y | Y |
| show failover-status | N | N | Y | Y | Y |
| show flows | N | N | Y | Y | Y |
| show flowvolumelimit config | N | N | Y | Y | Y |
| show gam engine stats | N | N | N | N | Y |
| show gigfailopendelay | N | N | Y | Y | Y |
| show gti config | N | N | Y | Y | Y |
| show gti stats ip | N | N | N | N | Y |
| show inactiveuserslock status | N | N | N | N | Y |
| show inlinepktdropstat | N | N | Y | Y | Y |
| show ingress-egress stat | N | N | Y | Y | Y |
| show intfport | N | N | Y | Y | Y |
| show l7ae status | N | N | N | N | Y |
| show l7ddosstat | N | N | N | N | Y |
| show layer2 forward all | N | N | Y | Y | Y |
| show layer2 forward intfport <port> | N | N | N | Y | Y |
| show layer2 mode | N | N | Y | Y | Y |
| show malwareenginestats | N | N | N | N | Y |
| show malwarefilestats | N | N | N | N | Y |
| show mem-usage | N | N | Y | Y | Y |
| show mgmtport | N | N | Y | Y | Y |
| show mnsconfig | N | N | N | N | Y |
| show msoffice-dfi stats | N | N | N | N | Y |
| show mvx config | N | N | Y | Y | Y |
| show mvx stats | N | N | N | N | Y |
| show mvx status | N | N | N | N | Y |
| show netstat | N | N | Y | Y | Y |
| show nmsuserwriteaccess status | N | N | N | N | Y |
| show outofcontext acllookup | N | N | N | N | Y |
| show parsetunneledtraffic status | N | N | Y | Y | Y |
| show pktcapture status | N | N | N | Y | Y |
| show pluggable– module | N | N | Y | Y | Y |
| show portsettletime | N | N | Y | Y | Y |
| show previous256byteslogging status | N | N | Y | Y | Y |
| show raid status | N | N | N | Y | Y |
| show rescueimages | N | N | Y | Y | Y |
| show respport r1 | N | N | N | N | Y |
| show savedalertinfo | N | N | Y | Y | Y |
| show savedimages | N | N | N | Y | Y |
| show sensordroppktevent status | N | N | Y | Y | Y |
| show sensor-load | N | N | Y | Y | Y |
| show sessionlimit timeout | N | N | N | N | Y |
| show snort config | N | N | N | N | Y |
| show sshaccesscontrol status | N | N | Y | Y | Y |
| show sshinactivetimeout | N | N | Y | Y | Y |
| show sshlog status | N | N | N | N | Y |
| show ssl config | N | N | Y | Y | Y |
| show ssl stats | N | N | Y | Y | Y |
| show ssl stats inbound agents | N | N | N | Y | Y |
| show sslagentaccesscontrol satus | N | N | N | Y | Y |
| show suricata sbstats | N | N | N | N | Y |
| show suricata enginestats | N | N | N | N | Y |
| show syncookietcpreset | N | N | Y | Y | Y |
| show syslog statistics | N | N | Y | Y | Y |
| show tacacs | N | N | Y | Y | Y |
| show tcpipstats | N | N | Y | Y | Y |
| show tcpudpchecksumerror | N | N | Y | Y | Y |
| show tiestats | N | N | N | N | Y |
| show userconfigvolumedosthreshold | N | N | Y | Y | Y |
| show userInfo stats | Y | Y | Y | Y | Y |
| show vlanbasedrecon status | N | N | N | N | Y |
| showfailopencfg | N | N | N | N | Y |
| shutdown | N | N | N | Y | Y |
| snmpv2support | N | N | N | N | Y |
| sshd disable | N | N | N | Y | Y |
| sshd enable | N | N | N | Y | Y |
| sshlogupload WORD | N | N | N | N | Y |
| sshaccesscontrol resetlist | N | N | N | Y | Y |
| sslagentaccesscontrol resetlist | N | N | N | Y | Y |
| status | Y | Y | Y | Y | Y |
| Suricata <on|off> | N | N | N | N | Y |
| traceupload | N | N | Y | Y | Y |
| unlockuser | N | N | N | N | Y |
| userlist | N | N | N | N | Y |
| userpasswd | N | N | N | N | Y |
| userrole | N | N | N | N | Y |
| vlanbridestp | N | N | N | Y | Y |
| watchdog | N | N | N | Y | Y |
| whoami | Y | Y | Y | Y | Y |