FortiGate diagnose debug flow
Use FortiGate debug flow to trace how traffic is processed, routed, NATed, accepted, or denied by FortiOS.
Knowledge Base
Search practical IT knowledge
Search titles, full article content, commands, error messages, vendors, products, versions and tags.
18 results for
natBuild a segmented small business network in Cisco Packet Tracer
Build and validate three VLANs, inter-VLAN routing, DHCP, internal and guest DNS, NAT/PAT and a minimum-access guest policy in a Cisco Packet Tracer lab.
FortiToken activation email fails: FortiGate SMTP local-out source IP
Troubleshoot FortiToken enrollment emails that time out on SMTP TCP/465 when FortiGate local-out traffic uses an unsuitable WAN source address.
FortiGate IPsec tunnel is up but traffic does not pass
Systematically troubleshoot a FortiGate IPsec tunnel that is established but does not carry the expected application or subnet traffic.
FortiGate IPsec IKEv2 VPN with FortiToken MFA and local users
Configure and verify a FortiGate dial-up IKEv2 VPN using local users, EAP-MSCHAPv2, FortiToken Mobile, and the free FortiClient VPN.
Meraki mesh repeater fails 802.1X because the gateway AP is missing from Windows NPS RADIUS Clients
Troubleshoot a Cisco Meraki MR mesh repeater where normal SSIDs work but an Enterprise/802.1X SSID fails with RADIUS timeouts because the gateway AP is not registered as a RADIUS Client in Windows Network Policy Server.
FortiGate get router info routing-table all
Display the active FortiGate routing table and interpret connected, static, dynamic, and default routes during connectivity troubleshooting.
FortiGate IKEv2 VPN with Microsoft NPS, Active Directory and FortiToken MFA
Build an AD-backed IKEv2 remote-access VPN with Microsoft NPS/RADIUS, mandatory FortiToken MFA, and least-privilege access policies based on AD group membership.
Configure FortiGate IKEv2 remote-access VPN with LDAP and EAP-TTLS
Configure a FortiGate IKEv2 dial-up VPN using LDAP-backed AD groups, FortiClient EAP-TTLS and least-privilege firewall access.
FortiClient IKEv2 VPN fails after partial XML import: missing PSK
Diagnose an IKEv2 connection failure after importing a sanitized FortiClient XML profile that omits the pre-shared key.
vCenter Certificate Status alarm caused by expired BACKUP_STORE certificates
Resolve a persistent vCenter Certificate Status alarm when active certificates are valid but expired historical certificates remain in the VECS BACKUP_STORE.
vCenter Server certificate stores and common certificate alarms
Reference guide to the main vCenter Server certificate stores, what each certificate is used for, and which alarm or troubleshooting path normally applies.
vCenter virtual disks show 0 GB or blank properties due to SSL trust mismatch
Troubleshoot vCenter Server when VM disk capacity or disk properties appear as 0 GB, blank, or unavailable while the same VMDKs display correctly in the ESXi Host Client.
FortiGate diagnose sniffer packet
Capture and inspect packets directly on a FortiGate to determine whether traffic enters, exits, or crosses expected interfaces.
FortiGate diagnose vpn tunnel list
Inspect FortiGate IPsec tunnel security associations, selectors, state, and packet counters from the CLI.
FortiGate execute ping and ping-options
Use FortiGate ping and ping-options to test IP reachability with controlled source, interface, timeout, packet size, and SD-WAN behaviour.
FortiGate get system arp
Display the FortiGate ARP table to map IPv4 addresses to learned MAC addresses and interfaces during local-network troubleshooting.
Client receives a guest VLAN address after an access port is assigned to the wrong VLAN
Trace a client that loses access to an internal web service through its DHCP lease, switch access VLAN, trunk and router ACL, then validate the port correction.