FortiGate CLI reference for system state, interfaces, ARP, routing, sessions, policy/NAT, SD-WAN, IPsec and debug flow.
System status
- Version & uptime — get system statusCheck model, FortiOS, HA mode and uptime before comparing syntax.
- System performance — get system performance statusShows CPU, memory, sessions and uptime.
- Processes — diagnose sys top 1 20Shows active consumers; quit with q.
- HA status — get system ha statusUse on clusters for roles, state and synchronization.
Interfaces & ARP
- Physical interfaces — get system interface physicalChecks link and physical state depending on platform/FortiOS.
- Interface config — show system interfaceShows VLAN, IP, roles and configured settings.
- ARP table — get system arpConfirms L2 resolution of local peers.
- Sourced ping — execute ping-options source 192.168.1.1Choose source before execute ping to reproduce a specific path.
Routing
- Full routing table — get router info routing-table allChecks selected route, protocol and next hop.
- Route lookup — get router info routing-table details 8.8.8.8Shows route details for a destination.
- BGP summary — get router info bgp summaryUse only when BGP is configured.
- OSPF neighbors — get router info ospf neighborChecks OSPF adjacencies when configured.
Sessions, policies & NAT
- Sessions — diagnose sys session listVery verbose without filters; filter first in production.
- Session address filter — diagnose sys session filter addr 192.168.1.10Limits session output to a specific address.
- Policy counters — diagnose firewall iprope show 100004Advanced/version-sensitive command; also use GUI policy counters.
- VIP/NAT — show firewall vipChecks published VIP objects before blaming policy.
SD-WAN
- Health checks — diagnose sys sdwan health-checkShows SLA/member status depending on FortiOS.
- SD-WAN service — diagnose sys sdwan serviceChecks link selection by SD-WAN rules.
- Configuration — show system sdwanChecks members, SLAs and rules.
- Effective route — get router info routing-table allAlways correlate SD-WAN with the effective routing table.
IPsec / IKE
- Tunnel summary — get vpn ipsec tunnel summaryFirst high-level IPsec state.
- Tunnel detail — diagnose vpn tunnel list name NOM_DU_TUNNELShows SAs, selectors and counters for one tunnel.
- IKE gateways — diagnose vpn ike gateway listChecks IKE negotiation and peer state.
- IKE debug — diagnose debug application ike -1Run briefly with debug enabled and always disable afterwards.
Sniffer & debug flow
- Targeted sniffer — diagnose sniffer packet any 'host 192.168.1.10 and port 443' 4 0 lConfirms ingress/egress and TCP flags without external capture.
- Flow filter — diagnose debug flow filter addr 192.168.1.10Set filter before starting trace.
- Flow trace — diagnose debug flow trace start 100Look for policy id, route, DNAT/SNAT and drop reason.
- Stop debug — diagnose debug disableMandatory after debug to avoid load and console noise.
Tests & DNS
- Ping — execute ping 8.8.8.8Use ping-options source/interface for the intended path.
- Traceroute — execute traceroute 8.8.8.8Useful to separate local routing from upstream transit.
- System DNS — get system dnsChecks resolvers used by the FortiGate itself.
- Resolve hostname — execute ping exemple.frName-resolution failures can affect FQDN objects and services.
Key points
- Syntax varies by FortiOS and model; verify ? and version-specific documentation.
- Always filter sessions/debug/sniffer on busy appliances.
- After debugging, run diagnose debug disable and reset filters if needed.
- Capture route, policy, session and packet evidence for the same flow before changing configuration.