FortiGate CLI Commands for Troubleshooting

Basic Configuration Commands:

Fortigate firewall is delivered with default settings of

Management IP Address: 192.168.1.99 / 255.255.255.0
Credentials: admin with no password

1. Configure Host Name:

FW# config system global
(global)# set hostname FG100D
FW# end

2. Configure MGMT Interface

FW# config system interface
(interface)# edit mgmt
(mgmt)# set ip 192.168.80.254 255.255.255.0
(mgmt)# set allowaccess ping https ssh
(mgmt)# end

3. Configure DNS

FW# config system dns
(dns)# set primary 192.168.80.150
(dns)# set secondary 192.168.80.151
(dns)# set domain “itadminguide.com”
(dns)# end

4. Configure NTP Server

FW# config system ntp
(ntp)# set server 192.168.80.10
(ntp)# set status enable
(ntp)# end

 

Basic Troubleshooting Commands:

5. Ping a host name or IP address

FW# execute ping

//ping from a specific firewall interface
FW# execute ping-options source <interface ip>
FW# execute ping

6. ARP

FW# get system arp

// clear arp table
FW# execute clear system arp table

7. Routing

//similar to “show ip route” in Cisco
FW# get router info routing-table all

//route cache, current session with routing information
FW# diagnose ip rtcache list

 

Automatic Backup Configuration:

8. Automatic Configuration Backup after each logout

FW# config system global
FW# set revision-backup-on-logout enable
FW# end

All backup revisions can be seen in GUI > admin (top right) > Configuration > Revisions

 

Troubleshooting IPSec VPN tunnel logs

When troubleshooting site-to-site IPSEC VPN tunnels in FortiGate firewalls, these commands enable debugging on the firewall console and provide detailed information to identify the problem.

  • Login to CLI as admin
  • Disable any debug that are currently running

diagnose debug disable

  • Clear any debug filters that are previously applied

diagnose vpn ike log-filter clear

  • Set filter to show debug logs of a specific VPN tunnel. This is especially helpful if you have several VPN tunnels and facing problem with only one peer.

diagnose vpn ike log-filter dst-addr4 10.10.10.1

  • Enable debug mode on IKE handshaking process.

diagnose debug app ike 255

  • Enable debug logging to console

diagnose debug enable

After you fix the problem, don’t forget to disable debug

diagnose debug disable

You may also like...

Thank you for visiting us. To continue receiving updates, please Subscribe to our Social Media Channels.

Menu Title