# FortiOS CLI config explainer

> Paste a FortiOS config block and get the structure as a tree with every verb explained. It flags the trap that costs the most: `set` on a multi-value field REPLACES the whole list, so setting one source address on a policy that had four silently removes three. It also catches unclosed blocks and reminds you that `end` is what commits. Local and offline.

- Tool: https://ronutz.com/en/tools/fortios-cli-config-explainer
- Family: Operations & Fieldcraft

---

## What it does

Paste a FortiOS configuration block and the tool returns the structure as a tree with every verb explained: what `config`, `edit`, `set`, `unset`, `append`, `next`, `end` and `abort` each do, and where the block sits at each line. Local and offline; it reads structure, not semantics.

## The trap it exists to catch

**`set` on a multi-value field replaces the whole list.** `set srcaddr "internal-net"` on a policy that had four source addresses leaves it with one — successfully, silently, with nothing in the output mentioning it. The command that adds is **`append`**.

The tool warns on every `set` against a known list field, naming the field and the line. That is the single most expensive habit in FortiOS CLI work and it is invisible in a block read casually — which is exactly when blocks get read.

## Two more it always says

- **`edit` creates what it cannot find.** A mistyped policy ID does not produce an error, it produces a policy.
- **`end` is the only line that commits.** `next` closes an entry and stays in the table; `abort` closes and discards. A block using `end` where `next` was meant leaves the table early and every remaining edit lands somewhere else.

It also reports **unclosed blocks**, because an unclosed block has committed nothing and pasting one into a live session leaves you somewhere unexpected.

## What it will not do

It does not know your address objects, your policies or your VDOM layout, and it cannot say whether a value is sensible. It answers whether the command shape does what the person typing it probably expected — which is a different and often more useful question.

It also cannot know what was in a field before. When it warns that a `set` replaces a list, **the question it is asking you to answer is what that list contained.**

## Standards and references

- [Fortinet - FortiOS CLI reference: using the CLI, command syntax and the config/edit/set/next/end structure](https://docs.fortinet.com/document/fortigate/7.4.0/cli-reference)
- [Fortinet - Firewall policy (FortiOS administration guide)](https://docs.fortinet.com/document/fortigate/7.4.2/administration-guide/656084/firewall-policy)

## Related reading

- [The FortiOS CLI verb that quietly deletes things](https://ronutz.com/en/learn/fortios-cli-grammar.md): config, edit, set, next, end — a small grammar with three traps. `set` replaces a whole list, `edit` creates what it cannot find, and `end` is the only line that commits.