Low operational impact, but confirm the target, source interface and active context before execution.
FortiGate · FortiOS · 7.4
When to use this content
Use this reference when you need to inspect, validate or explain the current state of FortiGate during operational troubleshooting.
Overview
execute ping tests Layer 3 reachability from the FortiGate itself.
The basic command is simple, but execute ping-options makes it much more useful for real troubleshooting because you can control the source address, outgoing interface, packet size, timeout, and whether SD-WAN/policy-route logic is used.
Basic command
execute ping 10.2.20.10
FortiGate normally sends a small series of ICMP Echo Requests and displays the replies and summary statistics.
Why source selection matters
A ping generated by the FortiGate is local-out traffic. It is not identical to forwarding traffic generated by a user device.
That distinction matters because the FortiGate may select a source IP or route that does not represent the flow you are trying to test.
When validating a specific path, set the source explicitly whenever practical.
View available options
execute ping-options ?
Useful options include source, interface, timeout, packet size, DF bit, TTL, and SD-WAN behaviour.
Set a source IP
execute ping-options source 10.1.10.1
execute ping 10.2.20.10
This is useful when:
- Testing a site-to-site VPN from a specific local subnet.
- Validating return routing toward a FortiGate interface IP.
- Testing reachability using an address that should be included in a Phase 2 selector.
Set an outgoing interface
execute ping-options interface wan1
execute ping 8.8.8.8
Use this when you need to constrain the test to a particular egress interface.
View current ping-option state
execute ping-options view-settings
This is important after previous troubleshooting because ping options can remain changed for later tests within the CLI context.
Reset ping options
Before or after a test, restore defaults where appropriate. The available reset behaviour can vary by FortiOS release, so verify with:
execute ping-options ?
If you changed specific settings manually, return them to the intended/default values before relying on later tests.
SD-WAN consideration
Fortinet provides a use-sdwan option for ping testing.
This matters because a locally generated ping may otherwise behave differently from production traffic that matches SD-WAN rules or policy routes.
Check the available syntax on the running FortiOS release:
execute ping-options use-sdwan ?
Common troubleshooting patterns
Test an Internet destination
execute ping 8.8.8.8
A successful response proves ICMP reachability from the FortiGate using the selected local-out path. It does not prove DNS works and does not prove clients behind the firewall can reach the Internet.
Test a remote VPN network with a controlled source
execute ping-options source 10.1.10.1
execute ping 10.2.20.10
If this works but a client in 10.1.10.0/24 still fails, investigate forwarding policy, endpoint configuration, selectors, NAT, or differences between the FortiGate-originated test and the client flow.
Test packet-size or MTU behaviour
Use data-size and df-bit to test whether fragmentation or path MTU may be contributing to a problem.
Always check supported values first:
execute ping-options ?
How to interpret failures
100% packet loss
Possible causes include:
- No route
- Wrong route
- Remote host offline
- ICMP blocked
- Return route missing
- VPN selector mismatch
- Wrong source address
- SD-WAN/policy-route mismatch
Do not conclude "the network is down" from ping alone.
Ping works but application fails
This proves ICMP reachability only. Continue with:
- TCP/UDP port testing from an appropriate endpoint
- Packet sniffer
- Debug flow
- Server listening-port validation
- Endpoint firewall checks
- Application logs
Validation workflow
For a meaningful ping test, record:
- Destination
- Source IP
- Outgoing interface or SD-WAN behaviour
- Packet loss
- Latency
- Whether the source represents the production traffic you are testing
Risks and considerations
Ping is normally low impact. However, incorrect interpretation can lead to wrong conclusions.
The biggest operational mistake is treating a FortiGate-originated successful ping as proof that a forwarded user session must also work.
Related articles
- FortiGate routing table
- FortiGate packet sniffer
- FortiGate debug flow
- FortiGate IPsec tunnel established but no traffic
Sources
See the authoritative Fortinet reference in the article metadata.
This article is part of a path
Knowledge graph
Explicit editorial relationships across prerequisites, commands, troubleshooting, Labs and next steps.
Did this article help you solve the problem?
Each account can vote once per article. You can change your vote without increasing the total count.
0 user reports