IT Toolbox
IT Toolbox

FortiGate Center

Fortinet / FortiOS

FortiGate Center

Guided diagnostics, CLI commands and field guidance for VPN, SD-WAN, HA, routing, policies, NAT, interfaces and FortiGate performance.

Système Show la version FortiOS
get system status
Système Show les performances générales
get system performance status
Système Lister les processus
diagnose sys top 1 20
Networking Show les interfaces physiques
get system interface physical
Networking Details d’une interface
diagnose hardware deviceinfo nic <INTERFACE>
Networking Routing table complète
get router info routing-table all
Networking Tester un ping
execute ping <IP>
Networking Choisir l’IP source d’un ping
execute ping-options source <IP_SOURCE>
Networking Traceroute
execute traceroute <IP>
DNS Show les DNS système
get system dns
DNS Tester une résolution
execute nslookup example.com
VPN Résumé des tunnels IPsec
get vpn ipsec tunnel summary
VPN Details IKE
diagnose vpn ike gateway list
VPN Details tunnels IPsec
diagnose vpn tunnel list
VPN Lister sessions SSL VPN
diagnose vpn ssl list
SD-WAN État des health-checks
diagnose sys sdwan health-check
SD-WAN État des règles SD-WAN
diagnose sys sdwan service
HA État du cluster HA
get system ha status
HA État détaillé HA
diagnose sys ha status
HA Checksums du cluster
diagnose sys ha checksum cluster
Firewall Show les policies
show firewall policy
Firewall Show les VIP
show firewall vip
Sessions Reset le filtre de session
diagnose sys session filter clear
Sessions Filtrer par IP source
diagnose sys session filter src <IP>
Sessions Filtrer par IP destination
diagnose sys session filter dst <IP>
Sessions List sessions filtrées
diagnose sys session list
Capture Sniffer un hôte
diagnose sniffer packet any 'host <IP>' 4 0 l
Debug Filtrer flow debug par IP
diagnose debug flow filter addr <IP>
Debug Démarrer flow debug
diagnose debug flow trace start 100
Debug Activer le debug
diagnose debug enable
Debug Désactiver le debug
diagnose debug disable

Générateur de sniffer

Flow debug

À utiliser avec un filtre précis sur un équipement en production.

1

Filtrer avant de debugger

Évitez les captures ou flow debug sans filtre sur un FortiGate chargé.

2

Arrêter le debug

Après analyse : diagnose debug disable.

3

Backupr avant modification

Exportez la configuration avant un changement important.

4

Check la version

Les commandes disponibles peuvent varier selon FortiOS.

5

Tester le retour

Un flux aller fonctionnel ne garantit pas le routage ou NAT du chemin retour.

6

Journaliser

Activez les logs nécessaires sur les policies critiques pour faciliter le diagnostic.

Important: certaines commandes de debug peuvent generate beaucoup de sortie ou affecter les performances. Utilisez-les avec des filtres adaptés et sur une duration courte.
Field troubleshooting

Center mission

8 playbooks

Troubleshoot FortiGate traffic from interface and routing state through policies, sessions, NAT and VPN, using strict filters before any debug.

Quick triage

  • Record FortiOS version, uptime, HA and load before any action.
  • Check WAN/LAN state and routing table.
  • Define source, destination, port and flow timestamp precisely.
  • Check policy/NAT/session before enabling flow debug.
  • Back up the configuration before a production change.

Decision tree

WAN down or no IP→

Address link, DHCP/PPPoE or carrier before policies.

WAN up but Internet down→

Test route, DNS, then flow/session with a precise source.

Only one service or host is blocked→

Compare policy, NAT/VIP and session for the targeted flow.

Only VPN is down→

Separate Phase 1, Phase 2, selectors, routes and policies.

Intervention playbooks

Start read-only, collect evidence, then change one variable at a time.

01WAN up but no InternetRead-only
Symptom

WAN interface is up, but clients can no longer reach the Internet.

Checks

  • Confirm IP/mask/gateway and physical errors.
  • Check default route and any SD-WAN rules.
  • Test from the FortiGate with an appropriate source.

Commands / evidence

get system interface physicalget router info routing-table allexecute ping 1.1.1.1

Expected result

The FortiGate has a valid route and can reach a public IP from the correct link.

Corrective actions

  • Fix route/gateway/SLA before changing user policies.
  • If public IP works but names do not, troubleshoot DNS separately.

Escalate when

Carrier link does not respond, gateway is unreachable or loss begins upstream.

02IPsec VPN is downRead-only
Symptom

Tunnel is down or traffic is absent after a change, WAN outage or rekey.

Checks

  • Separate Phase 1 and Phase 2.
  • Compare peer, PSK/certificate, proposals and DH.
  • Validate selectors, routes and policies once tunnel is up.

Commands / evidence

get vpn ipsec tunnel summarydiagnose vpn ike gateway listdiagnose vpn tunnel list

Expected result

Phase 1 and Phase 2 are up with expected selectors and increasing counters.

Corrective actions

  • Fix the parameter preventing negotiation first; change one side at a time.
  • After UP, test a real flow and verify the return path.

Escalate when

Persistent timeout despite reachable UDP 500/4500, certificate error or mismatch requiring the remote side.

03SSL VPN / FortiClient cannot connectRead-only
Symptom

Timeout, MFA failure, authentication denied or connection without internal network access.

Checks

  • Check listener/port, portal and group mapping.
  • Check user, MFA and allowed source.
  • After connection, check routes, split tunnel and policies.

Commands / evidence

diagnose vpn ssl listshow vpn ssl settingsdiagnose debug application sslvpn -1

Expected result

User authenticates, gets a session and routes/policies cover the destination.

Corrective actions

  • Limit SSL VPN debug to the test duration, then disable it.
  • Fix mapping/portal or routing based on the failing step.

Escalate when

Issue involves SAML/IdP, public certificate or affects all users after an upgrade.

04SD-WAN degraded or wrong link selectedRead-only
Symptom

Traffic moves to an unexpected link, latency is high or SLA is marked down.

Checks

  • Read health checks and latency/loss/jitter values.
  • Compare SD-WAN rules, priorities and strategy.
  • Check routes and already established sessions.

Commands / evidence

diagnose sys sdwan health-checkdiagnose sys sdwan serviceget router info routing-table all

Expected result

SLAs reflect reality and the rule selects the intended member.

Corrective actions

  • Fix target/SLA or rule order without masking a carrier outage.
  • Account for existing sessions when testing failover.

Escalate when

Measurements conflict between FortiGate and carrier, loss varies or multi-site SD-WAN design is affected.

05Firewall policy blocks a flowRead-only
Symptom

A specific flow fails while routing and interfaces are correct.

Checks

  • Define exact source/destination/port.
  • Check policy order, objects, services, schedule and UTM.
  • Observe the session or flow debug with a filter.

Commands / evidence

show firewall policydiagnose sys session filter cleardiagnose debug flow filter addr <IP>

Expected result

Flow matches the intended policy and return traffic uses a coherent route.

Corrective actions

  • Make the minimum necessary policy change instead of creating a broad rule.
  • Temporarily log the flow if interpretation remains ambiguous.

Escalate when

Block comes from a complex security profile, proxy or central policy.

06Inbound VIP / NAT does not workRead-only
Symptom

Published service is unreachable from the Internet despite a correct public IP.

Checks

  • Check VIP, external interface, extip, mappedip and port forward.
  • Confirm WAN→LAN policy uses the correct VIP.
  • Sniff WAN arrival and server response.

Commands / evidence

show firewall vipshow firewall policydiagnose sniffer packet any "host <IP>" 4 0 l

Expected result

Packet arrives on WAN, is DNATed to the target and response returns through the FortiGate.

Corrective actions

  • Fix VIP/policy or server return path depending on the break point.
  • Test from a truly external network to avoid hairpin effects.

Escalate when

No packet reaches WAN, upstream carrier NAT exists or critical publication requires a change window.

07High CPU / conserve modeIntrusive / escalation
Symptom

FortiGate is slow, sessions are dropped, memory is high or conserve mode is entered.

Checks

  • Record CPU, memory, sessions and dominant processes.
  • Look for a sudden increase in sessions or abnormal traffic.
  • Check FortiOS context before killing any process.

Commands / evidence

get system performance statusdiagnose sys top 1 20diagnose sys session stat

Expected result

The pressure source is identified and resources return below thresholds without losing critical functions.

Corrective actions

  • Reduce the cause (traffic, logging, inspection, known bug) rather than reboot blindly.
  • Prepare backup and a maintenance window if reboot/upgrade becomes necessary.

Escalate when

Conserve mode persists, system process crashes, memory leak is suspected or appliance is undersized.

08HA cluster out of syncIntrusive / escalation
Symptom

HA members are out of sync, states differ or failover is uncertain.

Checks

  • Check roles, heartbeat, uptime and priority.
  • Compare checksums and FortiOS versions.
  • Record failed interfaces/monitored links.

Commands / evidence

get system ha statusdiagnose sys ha statusdiagnose sys ha checksum cluster

Expected result

Members see the same cluster, same version and synchronized checksums.

Corrective actions

  • Fix heartbeat connectivity/version/configuration before any forced resync.
  • Back up both states if a configuration divergence must be analyzed.

Escalate when

Split-brain, risky production failover, persistent checksum divergence or hardware failure.

End-of-intervention checklist

  • Disable all temporary debug and filters.
  • Retest traffic in both directions and from the real source.
  • Check for no new HA/SD-WAN/performance alerts.
  • Back up configuration after a validated change.
  • Document the policy, route, tunnel or object changed.

Continue in BAOI

Related cheat sheetFortiGate — CLI diagnostics IT toolsCalculate, inspect or generate without leaving the workflow. ProceduresFollow a controlled implementation procedure. Known failuresCross-check the symptom with known failure patterns.

See also:. ping from a FortiGate.

See also:. FortiGate Central NAT.

♡ 0