FortiGate — diagnostic memo

Check model, FortiOS, HA mode and uptime before comparing syntax.

Shows CPU

Shows active consumers; quit with q.

Use on clusters for roles, state and synchronization.

Checks link and physical state depending on platform/FortiOS.

Shows VLAN, IP, roles and configured settings.

Confirms L2 resolution of local peers.

Choose source before execute ping to reproduce a specific path.

Checks selected route, protocol and next hop.

Shows route details for a destination.

Use only when BGP is configured.

Checks OSPF adjacencies when configured.

Very verbose without filters; filter first in production.

Limits session output to a specific address.

Advanced/version-sensitive command; also use GUI policy counters.

Checks published VIP objects before blaming policy.

Shows SLA/member status depending on FortiOS.

Checks link selection by SD-WAN rules.

Checks members, SLAs and rules.

Always correlate SD-WAN with the effective routing table.

First high-level IPsec state.

Shows SAs, selectors and counters for one tunnel.

Checks IKE negotiation and peer state.

Run briefly with debug enabled and always disable afterwards.

Confirms ingress/egress and TCP flags without external capture.

Set filter before starting trace.

Look for policy id, route, DNAT/SNAT and drop reason.

Mandatory after debug to avoid load and console noise.

Use ping-options source/interface for the intended path.

Useful to separate local routing from upstream transit.

Checks resolvers used by the FortiGate itself.

Name-resolution failures can affect FQDN objects and services.