Get FortiGate system status (firmware version, hostname, serial, uptime). Use this first to verify connectivity.

List all firewall address groups (just names). Use this to find which group contains a specific IP, or to see available groups before calling fortigate_get_address_group.

Get full details of a specific address group, including all member IPs/addresses. Useful for finding which IPs are in groups like 'Wifi', 'IT Team', 'Only Use AI'.

List all firewall address objects (single IPs/subnets, just names). Useful for finding objects like 'ip068', 'ip080'.

Get details of a specific firewall address object (the actual IP/subnet it represents).

List all firewall policies in order with key fields (id, name, src, dst, service, action). Top of list = highest priority. Use this to understand traffic flow rules.

Get full details of a specific firewall policy by ID.

List all web filter profiles (just names).

Get full details of a web filter profile, including URL filters (allow/block lists) and category filters. Useful for understanding what 'Only Use AI', 'Translator Google' profiles allow.

List all custom firewall services (just names). Useful for understanding services like 'Everest_default', 'anydesk_6568'.

Safely create a firewall policy. Defaults to dry_run=true. To apply, set FORTIGATE_ENABLE_WRITE=true and pass confirm exactly as the configured confirmation phrase.

Safely update a firewall policy. Reads the current policy first and defaults to dry_run=true.

Safely create a firewall address object. Defaults to dry_run=true. To apply, set FORTIGATE_ENABLE_WRITE=true and pass confirm exactly as the configured confirmation phrase.

Safely update a firewall address object. Reads the current object first and defaults to dry_run=true.

Safely delete a firewall address object. Reads the current object first and defaults to dry_run=true.

Safely create a firewall address group with explicit members. Defaults to dry_run=true.

Safely add, remove, or replace address group members. Reads current members first and defaults to dry_run=true.

Safely delete a firewall address group. Reads the current object first and defaults to dry_run=true.