MikroTik RouterOS v7 & Fortinet FortiOS: CLI Cheat Sheet & Firewall Triage
In modern mid-market enterprise, ISP edges, and branch environments, MikroTik and Fortinet represent the backbone of perimeter routing and Next-Generation Firewalls (NGFW). When a DDoS floods your conntrack table or memory pressure triggers FortiGate Conserve Mode, GUI web interfaces freeze. Here is the rigorous engineering field guide to CLI survival, real-time packet sniffing, and Zero-Trust baseline configuration.
⚠️ PRODUCTION GOLDEN RULE: Never modify perimeter firewall chains or IPsec policies without an active safety net. On MikroTik, always engage
Ctrl + X (Safe Mode) before applying changes. On Fortinet, maintain a secondary console connection or configure an automated rollback timer before adjusting management interfaces.
📶
Need Card 8 laminated on your server rack?
Check Card 8 in our A4 Runbook Suite: Emergency Edge & Firewall Triage for MikroTik v7 & FortiOS CLI.
1. Edge & Firewall Rosetta Stone (MikroTik vs. Fortinet)
When triaging multi-vendor networks, mapping equivalent CLI diagnostic operations between RouterOS v7 hierarchical syntax and FortiOS flat diagnostic trees saves crucial minutes during incident response:
| Administrative Task | 📶 MikroTik RouterOS v7 | 🛡️ Fortinet FortiOS CLI |
|---|---|---|
| Routing Table Inspection View active FIB & default route |
/ip route print where active |
get router info routing-table all |
| Resource & Memory Pressure Detect CPU spikes or RAM exhaustion |
/system resource print |
diagnose hardware sysinfo memory |
| Packet Capture / Live Sniffing Real-time wire analysis for port 443 |
/tool torch interface=ether1 port=443 |
diagnose sniffer packet any "port 443" 4 20 l |
| Connection State Table Inspect & flush stateful sessions |
/ip firewall connection print count-only |
diagnose sys session full-stat |
| IPsec VPN Tunnel Status Verify IKE Phase 1 & IPsec Phase 2 |
/ip ipsec active-peers print |
diagnose vpn ike gateway list |
| Configuration Backup Export non-default scripts without passwords |
/export file=rescue_cfg compact hide-sensitive |
execute backup config ftp /backup.cfg 10.0.0.5 user pass |
| Emergency Rollback / Recovery Prevent terminal lockouts during edits |
Ctrl + X (Safe Mode toggle) |
execute rollback-config (FortiManager) |
2. Interactive Terminal Command Deck
Safe Mode & L2 RoMON Emergency Recovery
Activate automatic change rollback and enable Router Management Overlay Network (RoMON) for L2 MAC access without valid IP routing.
# Press Ctrl + X to toggle Safe Mode (console prompt changes to <SAFE>)
/export file=rescue_cfg compact hide-sensitive
/romon set enabled=yes secrets="SpecSecure2026"
/system backup save name=pre_maintenance_backup
Conntrack Table DDoS Triage & Stateless RAW Filtering
When connection tracking maxes out under SYN floods, bypass CPU conntrack overhead with hardware FastTrack and pre-routing RAW drops.
/ip firewall connection print count-only
/ip firewall connection tracking set max-entries=524288
/ip firewall connection remove [find timeout>30s]
/ip firewall raw add chain=prerouting src-address-list=blackhole action=drop comment="Stateless Pre-Routing Drop"
/ip firewall filter add chain=forward action=fasttrack-connection connection-state=established,related order=1
WireGuard Site-to-Site Tunnel Configuration
Configure native WireGuard in RouterOS v7 for lightweight, high-throughput encrypted backhaul between branch offices.
/interface wireguard add name=wg-branch01 listen-port=13231 mtu=1420
/ip address add address=10.254.0.1/30 interface=wg-branch01
/interface wireguard peers add interface=wg-branch01 public-key="TARGET_PEER_PUBKEY=" allowed-address=10.254.0.2/32,192.168.20.0/24 endpoint-address=203.0.113.10 endpoint-port=13231 persistent-keepalive=25s
/ip route add dst-address=192.168.20.0/24 gateway=10.254.0.2
Conserve Mode Triage & Memory Relief Protocol
Identify memory leaks in WAD/IPS proxy workers, flush cached sessions, and prevent uninspected traffic bypass during red conserve states.
diagnose hardware sysinfo memory
diagnose sys top 2 25
fnsysctl killall wad
diagnose debug crashlog read
config system global
set memory-use-threshold-extreme 92
set memory-use-threshold-red 88
end
Hardware Packet Flow Trace & Sniffer Engine
Step-by-step kernel packet decision trace to uncover why traffic is dropped, which NAT translation occurs, and which security policy matched.
diagnose debug reset
diagnose debug flow filter saddr 192.168.1.100
diagnose debug flow filter daddr 10.0.0.50
diagnose debug flow filter dport 443
diagnose debug flow show function-name enable
diagnose debug flow trace start 15
diagnose debug enable
# Run sniffer in parallel:
diagnose sniffer packet any "host 192.168.1.100 and port 443" 4 20 l
IPsec IKEv2 Phase 1 & Phase 2 Tunnel Recovery
Query negotiation failure counters, force peer re-negotiation, and clear dead security associations without reloading the firewall.
diagnose vpn ike gateway list name "IPSEC_HQ_TUNNEL"
diagnose vpn tunnel list name "IPSEC_HQ_TUNNEL"
diagnose vpn ike status
diagnose vpn ike gateway clear name "IPSEC_HQ_TUNNEL"
diagnose vpn tunnel flush "IPSEC_HQ_TUNNEL"
High Availability (HA) Cluster Sync & Heartbeat Triage
Compare cluster configuration checksums, diagnose split-brain conditions, and force configuration re-synchronization from the primary node.
get system ha status
diagnose sys ha checksum cluster
diagnose sys ha checksum recalculate
execute ha synchronize stop
execute ha synchronize start
3. Production Hardening Checklist (NIS2 & CIS Controls)
🛡️ MANDATORY PERIMETER HARDENING RULES:
- Disable Unencrypted Management: On MikroTik, run
/ip service disable telnet,ftp,www,api. On Fortinet, ensure administrative access on WAN interfaces only permits HTTPS and SSH with trusted host limits. - Firmware Hygiene & CVE Patching: MikroTik RouterOS v7 should track the Long-Term / Stable tree. Fortinet FortiOS must be patched against known SSL-VPN heap buffer vulnerabilities.
- Automated Off-Box Configuration Backups: Centralize encrypted backups nightly via automated SCP/FTP scripts to satisfy NIS2 Article 21 disaster recovery mandates.