Fortigate Troubleshooting 40 Mr2

Troubleshooting
FortiOS™ Handbook v2
for FortiOS 4.0 MR2
FortiOS™ Handbook: Troubleshooting
v2
25 October 2010
01-42002-0129304-20101025
for FortiOS 4.0 MR2
© Copyright 2010 Fortinet, Inc. All rights reserved. No part of this publication including text, examples,
diagrams or illustrations may be reproduced, transmitted, or translated in any form or by any means,
electronic, mechanical, manual, optical or otherwise, for any purpose, without prior written permission of
Fortinet, Inc.
Trademarks
Dynamic Threat Prevention System (DTPS), APSecure, FortiASIC, FortiBIOS, FortiBridge, FortiClient,
FortiGate®, FortiGate Unified Threat Management System, FortiGuard®, FortiGuard-Antispam,
FortiGuard-Antivirus, FortiGuard-Intrusion, FortiGuard-Web, FortiLog, FortiAnalyzer, FortiManager,
Fortinet®, FortiOS, FortiPartner, FortiProtect, FortiReporter, FortiResponse, FortiShield, FortiVoIP, and
FortiWiFi are trademarks of Fortinet, Inc. in the United States and/or other countries. The names of actual
companies and products mentioned herein may be the trademarks of their respective owners.
Contents
Introduction 9
Before you begin . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9
How this guide is organized . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9
Document conventions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12
IP addresses . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12
Example Network configuration . . . . . . . . . . . . . . . . . . . . . . . . . . 14
Cautions, Notes and Tips . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15
Typographical conventions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16
CLI command syntax conventions . . . . . . . . . . . . . . . . . . . . . . . . . 16
Entering FortiOS configuration data . . . . . . . . . . . . . . . . . . . . . . . . . . 18
Entering text strings (names). . . . . . . . . . . . . . . . . . . . . . . . . . . . 18
Entering numeric values . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19
Selecting options from a list . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19
Enabling or disabling options. . . . . . . . . . . . . . . . . . . . . . . . . . . . 19
Registering your Fortinet product. . . . . . . . . . . . . . . . . . . . . . . . . . . . 19
Fortinet products End User License Agreement . . . . . . . . . . . . . . . . . . . . 19
Training . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20
Documentation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20
Fortinet Tools and Documentation CD . . . . . . . . . . . . . . . . . . . . . . . 20
Fortinet Knowledge Base . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20
Comments on Fortinet technical documentation . . . . . . . . . . . . . . . . . 20
Customer service and technical support . . . . . . . . . . . . . . . . . . . . . . . . 20
Troubleshooting process 21
Establish a baseline . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21
Define the Problem . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21
Gathering Facts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22
Search for a solution . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23
Technical Documentation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23
Release Notes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23
Knowledge Center . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23
Fortinet Technical Discussion Forums . . . . . . . . . . . . . . . . . . . . . . . 23
Fortinet Training Services Online Campus . . . . . . . . . . . . . . . . . . . . . 23
Create a troubleshooting plan . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23
Providing Supporting Elements . . . . . . . . . . . . . . . . . . . . . . . . . . 24
Obtain any required additional equipment . . . . . . . . . . . . . . . . . . . . . . . 24
Ensure you have administrator level access to required equipment . . . . . . . . . . 24
FortiOS™ Handbook v2: Troubleshooting

01-42002-0129304-20101025 3
http://docs.fortinet.com/ • Feedback
Contents
Contact Fortinet Customer Support for assistance . . . . . . . . . . . . . . . . . . . 24
Troubleshooting tools 25
FortiOS Diagnostics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25
Resource Usage . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25
Processes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26
Proxy Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27
Hardware NIC . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28
Hardware Troubleshooting . . . . . . . . . . . . . . . . . . . . . . . . . . . 29
Conserve Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30
Antivirus Failopen . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31
Traffic Trace . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32
Session Table . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32
Finding Object Dependencies . . . . . . . . . . . . . . . . . . . . . . . . . . . 35
Flow Trace . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36
Flow Trace Output Example - HTTP . . . . . . . . . . . . . . . . . . . . . . 37
Flow Trace Output Example - IPSec (policy-based) . . . . . . . . . . . . . . 39
Packet Sniffer . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 40
FA2 and NP2 Based Interfaces . . . . . . . . . . . . . . . . . . . . . . . . 41
Debug Command. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43
Debug Output Example . . . . . . . . . . . . . . . . . . . . . . . . . . . . 44
Other Commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 45
ARP Table . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 45
Time and Date Settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . 46
FortiGate Ports . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 47
Diagnostic Commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 48
FortiAnalyzer/FortiManager Ports . . . . . . . . . . . . . . . . . . . . . . . . . 49
FortiGuard Troubleshooting . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 50
Sorting the Server List . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 50
Calculating Weight . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 50
FortiGuard URL Rating . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 52
Technical Support Organization Overview 53

Fortinet Global Customer Services Organization. . . . . . . . . . . . . . . . . . . . 53
Creating an Account . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 54
Registering a Device . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55
Reporting Problems . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 57
Logging Online Tickets . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 57
Fortinet Partners . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 57
Fortinet Customers. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 58
Following Up On Online Tickets . . . . . . . . . . . . . . . . . . . . . . . . . . 60
Telephoning a Technical Support Center . . . . . . . . . . . . . . . . . . . . . 61
Americas . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 61
EMEA . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 61
Troubleshooting for FortiOS 4.0 MR2

4 01-42002-0129304-20101025
Contents
APAC . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 61
Assisting Technical Support . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 62
Support Priority Levels . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 63
Priority 1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 63
Priority 2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 63
Priority 3 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 63
Priority 4 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 63
Return Material Authorization Process . . . . . . . . . . . . . . . . . . . . . . . . . 64
Troubleshooting connectivity 67
Check hardware connections . . . . . . . . . . . . . . . . . . . . . . . . . . . 68
Run ping and traceroute . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 68
Ping . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 69
Traceroute . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 70
Verify the contents of the routing table (in NAT mode). . . . . . . . . . . . . . . 72
For Transparent mode, check the bridging information . . . . . . . . . . . . . . 72
What checking the bridging information can tell you . . . . . . . . . . . . . . 72
How to check the bridging information . . . . . . . . . . . . . . . . . . . . . 72
Perform a sniffer trace . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 73
What can sniffing packets tell you . . . . . . . . . . . . . . . . . . . . . . . 73
How do you sniff packets . . . . . . . . . . . . . . . . . . . . . . . . . . . 74
Debug the packet flow . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 75
Examine the firewall session list . . . . . . . . . . . . . . . . . . . . . . . . . . 76
Other diagnose commands. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 76
Troubleshooting ‘get’ commands 77

exec tac report . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 78
get firewall iprope list . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 79
get firewall iprope appctrl . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 80
get firewall proute. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 81
get hardware cpu . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 82
get hardware nic . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 84
get hardware cpu . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 86
get hardware memory . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 87
get hardware npu ipsec-sa . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 88
get hardware npu list . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 89
get hardware npu performance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 91
get hardware npu status . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 93
get hardware status. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 95
get ips session . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 96
get router info kernel . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 97

01-42002-0129304-20101025 5
Contents
get system arp . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 98

get system auto-update. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 99
get system auto-update version . . . . . . . . . . . . . . . . . . . . . . . . . . . . 102
get system ha status . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 104
get system performance firewall . . . . . . . . . . . . . . . . . . . . . . . . . . . . 106
get system performance firewall packet-distribution . . . . . . . . . . . . . . . . . . 107
get system performance status . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 108
get system performance top . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 109
get system session-info full-stat . . . . . . . . . . . . . . . . . . . . . . . . . . . . 111
get system session-helper . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 112
get system session-table list . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 113
get system session-table statistics . . . . . . . . . . . . . . . . . . . . . . . . . . . 114
get system session-info ttl . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 115
get system startup-error-log . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 116
get test application . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 117
get test application urlfilter . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 121
get vpn status ike config . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 122
get vpn status ike crypto . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 123
get vpn status ike errors . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 124
get vpn status ike status detailed . . . . . . . . . . . . . . . . . . . . . . . . . . . . 125
get vpn status ipsec . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 126
get vpn status ssl hw-acceleration-status . . . . . . . . . . . . . . . . . . . . . . . 127
get vpn status ssl list . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 128
get vpn status tunnel dialup-list. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 129
get vpn status tunnel list . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 130
get vpn status tunnel stat . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 131
get vpn status concentrator. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 132
get webfilter ftgd-statistics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 133
get webfilter status . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 135
Troubleshooting bootup issues 137

A. You have text on the screen, but you have problems . . . . . . . . . . . . . . . . 137
B. You don’t see the boot options menu . . . . . . . . . . . . . . . . . . . . . . . . 137
C. You have problems with the console text . . . . . . . . . . . . . . . . . . . . . . 138
D. You have visible power problems . . . . . . . . . . . . . . . . . . . . . . . . . . 138
E. You have a suspected defective FortiOS unit . . . . . . . . . . . . . . . . . . . . 139

6 01-42002-0129304-20101025
Contents
Index 141

01-42002-0129304-20101025 7
Contents

8 01-42002-0129304-20101025
Introduction
Welcome and thank you for selecting Fortinet products for your network protection.
This guide is intended for administrators who need guidance on different network needs
and information on basic and advanced configurations of dynamic routing.
Dynamic routing is required in complex and changing network configurations where static
routing does not provide sufficient convergence, redundancy, or other extended
functionality.
This guide provides detailed information about FortiGate dynamic routing including
common dynamic routing features, troubleshooting, and each of the protocols including
RIP, BGP, and OSPF.
This chapter contains the following topics:
• Before you begin
• Document conventions
• Registering your Fortinet product
• Fortinet products End User License Agreement
• Fortinet documentation
• Fortinet documentation
• Training
Before you begin

Before you begin using this guide, please ensure that:
• You have administrative access to the web-based manager and/or CLI.
• The FortiGate unit is integrated into your network.
• The operation mode has been configured to NAT/Route mode.
• The system time, DNS settings, administrator password, and network interfaces have
been configured.
• Firmware, FortiGuard Antivirus and FortiGuard Antispam updates are completed.
While using the instructions in this guide, note that:
• Administrators are assumed to be super_admin administrators unless otherwise
specified. Some restrictions will apply to other administrators.
How this guide is organized

This handbook chapter describes concepts of troubleshooting and solving issues that may
occur with FortiGate units.
This FortiOS Handbook chapter contains the following sections:
Troubleshooting process walks you through best practice concepts of FortiOS
troubleshooting.
Troubleshooting tools describes some of the basic commands and parts of FortiOS that
can help you with troubleshooting.

01-42002-0129304-20101025 9
Before you begin Introduction
Technical Support Organization Overview describes how Fortinet Support operates, what
they will need from you if you contact them, and what you can expect in general.
Troubleshooting connectivity walks you through some troubleshooting methods that apply
to common issues you may have such as network connectivity problems.
Troubleshooting ‘get’ commands provides a list of diagnostic commands that can help you
troubleshoot your FortiOS unit.
Troubleshooting bootup issues addresses some potential problems your unit may have
when booting up. The format is an easy to follow step by step question and answer format.

10 01-42002-0129304-20101025
Introduction Before you begin

01-42002-0129304-20101025 11
Document conventions
Fortinet technical documentation uses the conventions described below.
IP addresses
To avoid publication of public IP addresses that belong to Fortinet or any other
organization, the IP addresses used in Fortinet technical documentation are fictional and
follow the documentation guidelines specific to Fortinet. The addresses used are from the
private IP address ranges defined in RFC 1918: Address Allocation for Private Internets,
available at http://ietf.org/rfc/rfc1918.txt?number-1918.
Most of the examples in this document use the following IP addressing:
• IP addresses are made up of A.B.C.D
• A - can be one of 192, 172, or 10 - the non-public addresses covered in RFC 1918.
• B - 168, or the branch / device / virtual device number.
• Branch number can be 0xx, 1xx, 2xx - 0 is Head office, 1 is remote, 2 is other.
• Device or virtual device - allows multiple FortiGate units in this address space
(VDOMs).
• Devices can be from x01 to x99.
• C - interface - FortiGate units can have up to 40 interfaces, potentially more than one
on the same subnet
• 001 - 099- physical address ports, and non -virtual interfaces
• 100-255 - VLANs, tunnels, aggregate links, redundant links, vdom-links, etc.
• D - usage based addresses, this part is determined by what device is doing
• The following gives 16 reserved, 140 users, and 100 servers in the subnet.
• 001 - 009 - reserved for networking hardware, like routers, gateways, etc.
• 010 - 099 - DHCP range - users
• 100 - 109 - FortiGate devices - typically only use 100
• 110 - 199 - servers in general (see later for details)
• 200 - 249 - static range - users
• 250 - 255 - reserved (255 is broadcast, 000 not used)
• The D segment servers can be farther broken down into:
• 110 - 119 - Email servers
• 120 - 129 - Web servers
• 130 - 139 - Syslog servers
• 140 - 149 - Authentication (RADIUS, LDAP, TACACS+, FSAE, etc)
• 150 - 159 - VoIP / SIP servers / managers
• 160 - 169 - FortiAnalyzers
• 170 - 179 - FortiManagers
• 180 - 189 - Other Fortinet products (FortiScan, FortiDB, etc.)
• 190 - 199 - Other non-Fortinet servers (NAS, SQL, DNS, DDNS, etc.)
• Fortinet products, non-FortiGate, are found from 160 - 189.
FortiOS 4.0 MR2

12 01-42002-0129304-20101025
The following table shows some examples of how to choose an IP number for a device
based on the information given. For internal and dmz, it is assumed in this case there is
only one interface being used.
Table 1: Examples of the IP numbering
Location and device Internal Dmz External

Head Office, one FortiGate 10.011.101.100 10.011.201.100 172.20.120.191
Head Office, second FortiGate 10.012.101.100 10.012.201.100 172.20.120.192
Branch Office, one FortiGate 10.021.101.100 10.021.201.100 172.20.120.193
Office 7, one FortiGate with 9 10.079.101.100 10.079.101.100 172.20.120.194
VDOMs
Office 3, one FortiGate, web n/a 10.031.201.110 n/a
server
Bob in accounting on the 10.0.11.101.200 n/a n/a
corporate user network (dhcp)
at Head Office, one FortiGate
Router outside the FortiGate n/a n/a 172.20.120.195
01-42002-0129304-20101025 13
Example Network configuration

The network configuration shown in Figure 1 or variations on it is used for many of the
examples in this document. In this example, the 172.20.120.0 network is equivalent to the
Internet. The network consists of a head office and two branch offices.
Figure 1: Example network configuration

WLAN: 10.12.101.100
SSID: example.com
Password: supermarine
DHCP range: 10.12.101.200-249
Linux PC
10.11.101.20
IN
10 T
.11
.10
FortiWiFi-80CM 1.1
01
Windows PC
10.11.101.10
Internal network 10
.11
.10 Po
1.1 rt 2
02
P P
10 ort 2 17 ort 1
.11 10 2.2 (s
.10 .11 0 . 1 n i ff
1.1 Switch .10 Po 20 er
FortiAnalyzer-100B 30 1.1 rt 2 FortiGate-82C .14 mo
00 1 de
)
10
.11
.10 Por
1.1 t 1
10 P
17 ort 1 3)
2.2 nd
0.1 2a
2 0.1 rts
41 o
FortiGate-620B fp
Po rt 8 r o
HA cluster
an rt 2 Po mirro
FortiMail-100C d3 (
rt 1
Po
Switch
He
ad
o ff
ice
P
10 ort 1
.21
.10
FortiGate-3810A 1.1
01
Linux PC 17
2.2
10.21.101.10 Bra 0.1
20 WAN
nch Bra .12 1
o ff nch 2
ice o ff
ice I
10 ntern
.31 al
.10
FortiGate-51B 1.1
0 0
0
1 .16
rt 1 10
Po 0.21.
1
Windows PC
10.31.101.10
FortiManager-3000B
rt 4
Po .100
1
2 .10
.2
10 Cluster
Port 1: 10.21.101.102
FortiGate-5005FA2
Port 1: 10.21.101.102
FortiGate-5005FA2
Port 1: 10.21.101.103
FortiSwitch-5003A
Port 1: 10.21.101.161
FortiGate-5050-SM
Port 1: 10.21.101.104
Engineering network
10.22.101.0
FortiOS 4.0 MR2

14 01-42002-0129304-20101025
Cautions, Notes and Tips

Fortinet technical documentation uses the following guidance and styles for cautions,
notes and tips.
Caution: Warns you about commands or procedures that could have unexpected or
undesirable results including loss of data or damage to equipment.
Note: Presents useful information, but usually focused on an alternative, optional method,
such as a shortcut, to perform a step.
Tip: Highlights useful additional information, often tailored to your workplace activity.
01-42002-0129304-20101025 15
Typographical conventions
Fortinet documentation uses the following typographical conventions:
Table 2: Typographical conventions in Fortinet technical documentation
Convention Example
Button, menu, text box, From Minimum log level, select Notification.
field, or check box label
CLI input config system dns
set primary <address_ipv4>
end
CLI output FGT-602803030703 # get system settings
comments : (null)
opmode : nat
Emphasis HTTP connections are not secure and can be intercepted by a third
party.
File content <HTML><HEAD><TITLE>Firewall
Authentication</TITLE></HEAD>
<BODY><H4>You must authenticate to use this
service.</H4>
Hyperlink Visit the Fortinet Technical Support web site,
https://support.fortinet.com.
Keyboard entry Type a name for the remote VPN peer or client, such as
Central_Office_1.
Navigation Go to VPN > IPSEC > Auto Key (IKE).
Publication For details, see the FortiOS Handbook.
CLI command syntax conventions

This guide uses the following conventions to describe the syntax to use when entering
commands in the Command Line Interface (CLI).
Brackets, braces, and pipes are used to denote valid permutations of the syntax.
Constraint notations, such as <address_ipv4>, indicate which data types or string
patterns are acceptable value input.
Table 3: Command syntax notation
Convention Description
Square brackets [ ] A non-required word or series of words. For example:
[verbose {1 | 2 | 3}]
indicates that you may either omit or type both the verbose word and
its accompanying option, such as:
verbose 3
FortiOS 4.0 MR2

16 01-42002-0129304-20101025
Table 3: Command syntax notation (Continued)
Angle brackets < > A word constrained by data type.
To define acceptable input, the angled brackets contain a descriptive
name followed by an underscore ( _ ) and suffix that indicates the
valid data type. For example:
<retries_int>
indicates that you should enter a number of retries, such as 5.
Data types include:
• <xxx_name>: A name referring to another part of the
configuration, such as policy_A.
• <xxx_index>: An index number referring to another part of the
configuration, such as 0 for the first static route.
• <xxx_pattern>: A regular expression or word with wild cards
that matches possible variations, such as *@example.com to
match all email addresses ending in @example.com.
• <xxx_fqdn>: A fully qualified domain name (FQDN), such as
mail.example.com.
• <xxx_email>: An email address, such as
admin@mail.example.com.
• <xxx_url>: A uniform resource locator (URL) and its associated
protocol and host name prefix, which together form a uniform
resource identifier (URI), such as
http://www.fortinet./com/.
• <xxx_ipv4>: An IPv4 address, such as 192.168.1.99.
• <xxx_v4mask>: A dotted decimal IPv4 netmask, such as
255.255.255.0.
• <xxx_ipv4mask>: A dotted decimal IPv4 address and netmask
separated by a space, such as
192.168.1.99 255.255.255.0.
• <xxx_ipv4/mask>: A dotted decimal IPv4 address and
CIDR-notation netmask separated by a slash, such as such as
192.168.1.99/24.
• <xxx_ipv6>: A colon( : )-delimited hexadecimal IPv6 address,
such as 3f2e:6a8b:78a3:0d82:1725:6a2f:0370:6234.
• <xxx_v6mask>: An IPv6 netmask, such as /96.
• <xxx_ipv6mask>: An IPv6 address and netmask separated by a
space.
• <xxx_str>: A string of characters that is not another data type,
such as P@ssw0rd. Strings containing spaces or special
characters must be surrounded in quotes or use escape
sequences.
• <xxx_int>: An integer number that is not another data type,
such as 15 for the number of minutes.
01-42002-0129304-20101025 17
Entering FortiOS configuration data
Table 3: Command syntax notation (Continued)
Curly braces { } A word or series of words that is constrained to a set of options
delimited by either vertical bars or spaces.
You must enter at least one of the options, unless the set of options is
surrounded by square brackets [ ].
Options Mutually exclusive options. For example:
delimited by {enable | disable}
vertical bars | indicates that you must enter either enable or disable, but must
not enter both.
Options Non-mutually exclusive options. For example:
delimited by {http https ping snmp ssh telnet}
spaces indicates that you may enter all or a subset of those options, in any
order, in a space-delimited list, such as:
ping https ssh
Note: To change the options, you must re-type the entire list. For
example, to add snmp to the previous example, you would type:
ping https snmp ssh
If the option adds to or subtracts from the existing list of options,
instead of replacing it, or if the list is comma-delimited, the exception
will be noted.
Entering FortiOS configuration data

The configuration of a FortiGate unit is stored as a series of configuration settings in the
FortiOS configuration database. To change the configuration you can use the web-based
manager or CLI to add, delete or change configuration settings. These configuration
changes are stored in the configuration database as they are made.
Individual settings in the configuration database can be text strings, numeric values,
selections from a list of allowed options, or on/off (enable/disable).
Entering text strings (names)

Text strings are used to name entities in the configuration. For example, the name of a
firewall address, administrative user, and so on. You can enter any character in a
FortiGate configuration text string except, to prevent Cross-Site Scripting (XSS)
vulnerabilities, text strings in FortiGate configuration names cannot include the following
characters:
" (double quote), & (ampersand), ' (single quote), < (less than) and < (greater than)
You can determine the limit to the number of characters that are allowed in a text string by
determining how many characters the web-based manager or CLI allows for a given name
field. From the CLI, you can also use the tree command to view the number of
characters that are allowed. For example, firewall address names can contain up to 64
characters. When you add a firewall address to the web-based manager you are limited to
entering 64 characters in the firewall address name field. From the CLI you can do the
following to confirm that the firewall address name field allows 64 characters.
config firewall address
tree
-- [address] --*name (64)
|- subnet
|- type
|- start-ip
|- end-ip
FortiOS 4.0 MR2

18 01-42002-0129304-20101025
Registering your Fortinet product
|- fqdn (256)
|- cache-ttl (0,86400)
|- wildcard
|- comment (64 xss)
|- associated-interface (16)
+- color (0,32)
Note that the tree command output also shows the number of characters allowed for other
firewall address name settings. For example, the fully-qualified domain name (fqdn) field
can contain up to 256 characters.
Entering numeric values

Numeric values are used to configure various sizes, rates, numeric addresses, or other
numeric values. For example, a static routing priority of 10, a port number of 8080, or an
IP address of 10.10.10.1. Numeric values can be entered as a series of digits without
spaces or commas (for example, 10 or 64400), in dotted decimal format (for example the
IP address 10.10.10.1) or as in the case of MAC or IPv6 addresses separated by colons
(for example, the MAC address 00:09:0F:B7:37:00). Most numeric values are standard
base-10 numbers, but some fields (again such as MAC addresses) require hexadecimal
numbers.
Most web-based manager numeric value configuration fields limit the number of numeric
digits that you can add or contain extra information to make it easier to add the acceptable
number of digits and to add numbers in the allowed range. CLI help includes information
about allowed numeric value ranges. Both the web-based manager and the CLI prevent
you from entering invalid numbers.
Selecting options from a list

If a configuration field can only contain one of a number of selected options, the
web-based manager and CLI present you a list of acceptable options and you can select
one from the list. No other input is allowed. From the CLI you must spell the selection
name correctly.
Enabling or disabling options

If a configuration field can only be on or off (enabled or disabled) the web-based manager
presents a check box or other control that can only be enabled or disabled. From the CLI
you can set the option to enable or disable.
Registering your Fortinet product

Before you begin configuring and customizing features, take a moment to register your
Fortinet product at the Fortinet Technical Support web site, https://support.fortinet.com.
Many Fortinet customer services, such as firmware updates, technical support, and
FortiGuard Antivirus and other FortiGuard services, require product registration.
For more information, see the Fortinet Knowledge Center article Registration Frequently
Asked Questions.
Fortinet products End User License Agreement

See the Fortinet products End User License Agreement.
01-42002-0129304-20101025 19
Training
Training
Fortinet Training Services provides courses that orient you quickly to your new equipment,
and certifications to verify your knowledge level. Fortinet provides a variety of training
programs to serve the needs of our customers and partners world-wide.
To learn about the training services that Fortinet provides, visit the Fortinet Training
Services web site at http://campus.training.fortinet.com, or email training@fortinet.com.
Documentation
The Fortinet Technical Documentation web site, http://docs.fortinet.com, provides the
most up-to-date versions of Fortinet publications, as well as additional technical
documentation such as technical notes.
In addition to the Fortinet Technical Documentation web site, you can find Fortinet
technical documentation on the Fortinet Tools and Documentation CD, and on the Fortinet
Knowledge Center.
Fortinet Tools and Documentation CD

Many Fortinet publications are available on the Fortinet Tools and Documentation CD
shipped with your Fortinet product. The documents on this CD are current at shipping
time. For current versions of Fortinet documentation, visit the Fortinet Technical
Documentation web site, http://docs.fortinet.com.
Fortinet Knowledge Base

The Fortinet Knowledge Base provides additional Fortinet technical documentation, such
as troubleshooting and how-to-articles, examples, FAQs, technical notes, a glossary, and
more. Visit the Fortinet Knowledge Base at http://kb.fortinet.com.
Comments on Fortinet technical documentation

Please send information about any errors or omissions in this or any Fortinet technical
document to techdoc@fortinet.com.
Customer service and technical support

Fortinet Technical Support provides services designed to make sure that your Fortinet
products install quickly, configure easily, and operate reliably in your network.
To learn about the technical support services that Fortinet provides, visit the Fortinet
Technical Support web site at https://support.fortinet.com.
You can dramatically improve the time that it takes to resolve your technical support ticket
by providing your configuration file, a network diagram, and other specific information. For
a list of required information, see the Fortinet Knowledge Base article FortiGate
Troubleshooting Guide - Technical Support Requirements.
FortiOS 4.0 MR2

20 01-42002-0129304-20101025
Troubleshooting process
Before you begin troubleshooting anything but the most minor issues, you need to
prepare. Doing so will shorten the time to solve your issue.
Before starting you need to:
• Establish a baseline
• Search for a solution
• Create a troubleshooting plan
• Obtain any required additional equipment
• Ensure you have administrator level access to required equipment
• Contact Fortinet Customer Support for assistance
Establish a baseline
Note that many of these questions are some form of comparing the current situation to
normal operation. For this reason it is recommended that you know what your normal
operating status is. This can easily be accomplished through logs, or regularly running
information gathering commands and saving the output. Then when there is a problem,
this regular operation data will enable you to determine what is different.
It is a good idea to backup the FortiOS configuration for your unit on a regular basis. Apart
from troubleshooting, if you accidently change something the backup can help you restore
normal operation quickly and easily.
Some simple commands that you can run to get normal operating data include:
get system status Displays versions of firmware and FortiGuard

engines, and other
diagnose firewall statistic show Displays the amount of network traffic broken down
into categories such as email, VoIP, TCP, UDP, etc.
get router info routing-table all Displays all the routes in the routing table including
their type, source, and other useful data.
get ips session Displays memory used and max available to IPS as
well and counts.
get webfilter ftgd-statistics Displays list of FortiGuard related counts of status,
errors, and other data.
These commands are just a sample. Feel free to include any extra information gathering
commands that apply to your system, for example if you regularly have active VPN
connections you should record information about them using the get vpn series of
commands. See “Troubleshooting ‘get’ commands” on page 77.
Define the Problem

Before starting to troubleshooting a problem, ask the following questions:

01-42002-0129304-20101025 21
Define the Problem Troubleshooting process
• What is the problem?

Do not assume that the problem is being experienced is the actual problem. First
determine that the problem does not lie elsewhere before starting to troubleshoot the
FortiGate device.
• Has it ever worked before?
• Can the problem be reproduced at will or is it intermittent?
If the problem is intermittent, it may be dependent on system load.
• What has changed?
Do not assume that nothing has changed in the network. Use the FortiGate event log
to see if any configuration changes were made. The change could be in the operating
environment, for example, a gradual increase in load as more sites are forwarded
through the firewall.
If something has changed, see what the effect is if the change is rolled back.
• After determining the scope of the problem and isolating it, what applications,
users, and/or operating systems does it effect?
Before you can solve a problem, you need to understand it. Often this step can be the
longest in this process.
Ask questions such as:
• What is not working? Be specific.
• Is there more than one thing not working?
• Is it partly working? If so, what parts are working?
• Is it a connectivity issue? or is there an application that isn’t reaching the
Internet?
Be as specific as possible with your answers, even if it takes awhile to find the answers.
These questions will help you define the problem. Once the problem is defined, you can
search for a solution and then create a plan on how to solve it.
Gathering Facts
Fact gathering is an important part of defining the problem.
Consider the following:
• Where did the problem occur?
• When did the problem occur and to whom?
• What components are involved?
• What is the affected application?
• Can the problem be traced using a packet sniffer?
• Can the problem be traced in the session table?
• Can log files be obtained that indicate a failure has occurred?
Answers to these questions will help you narrow down the problem, and what you have to
check during your troubleshooting. The more things you can eliminate, the fewer things
you need to check during troubleshooting.

22 01-42002-0129304-20101025
Troubleshooting process Search for a solution
Search for a solution

An administrator can save time and effort during the troubleshooting process by first
checking to see if the issue has been experienced before. Several resources are available
that can provide valuable information about technical issues, including:
Technical Documentation
Installation Guides, Administration Guides, Quick Start Guides, and other technical
documents are available online at the following URL:
http://docs.fortinet.com
Release Notes
Issues that are uncovered after the technical documentation has been published will often
be listed in the Release Notes that accompany the device.
Knowledge Center
The Fortinet Knowledge Center provides access to a variety of articles, white papers, and
other documentation providing technical insight into a range of Fortinet products. The
Knowledge Center is available online at the following URL:
http://kc.fortinet.com
Fortinet Technical Discussion Forums

An online technical forum allows administrators to contribute to discussions about issues
related to their Fortinet products. Searching the forum can help the administrator identify if
an issue has been experienced by another user. The support forums can be accessed at
the following URL:
http://support.fortinet.com/forum
Fortinet Training Services Online Campus

The Fortinet Training Services Online Campus hosts a collection of tutorials and training
materials which can be used to increase knowledge of the Fortinet products.
http://campus.training.fortinet.com
Create a troubleshooting plan

Once you have defined the problem, and searched for a solution you can create a plan to
solve that problem. Even if your search didn’t find a solution to your problem you may
have found some additional things to check to further define your problem.
The plan should list all the possible causes of the problem that you can think of, and how
to test for each possible cause.
The plan will act as a checklist so that you know what you have tried and what is left to
check. This is important to have if more than one person will be doing the troubleshooting.
Without a written plan, people will become easily confused and steps will be skipped. Also
if you have to hand over the problem to someone else, providing them with a detailed list
of what data has been gathered and what solutions have been already tried demonstrates
a good level of professionalism.

01-42002-0129304-20101025 23
Obtain any required additional equipment Troubleshooting process
Be ready to add to your plan as needed. After you are part way through, you may discover
that you forgot some tests or a test you performed discovered new information. This is
normal.
Also if you contact support, they will require information about your problem as well as
what you have already tried to fix the problem. This should all be part of your plan.
Providing Supporting Elements

If the Fortinet Technology Assistance Center (TAC) needs to be contacted to help you with
your issue, be prepared to provide the following information:
• The firmware build version (use the get system status command)
• A recent configuration file
• A recent debug log
• A network topology diagram
• Tell the support team what troubleshooting steps have already been performed and the
results.
For additional information about contacting Fortinet Customer Support, see “Technical
Support Organization Overview” on page 53.
All of this is your troubleshooting plan.
Obtain any required additional equipment

You may require additional networking equipment, computers, or other equipment to test
your solution.
Normally network administrators have additional networking equipment available either to
loan you, or a lab where you can bring the FortiGate unit to test.
If you do not have access to equipment, check for shareware applications that can
perform the same task. Often there are software solutions when hardware is too
expensive.
Ensure you have administrator level access to required equipment

Before troubleshooting your FortiGate unit, you will need administrator access to the
equipment. If you are a client on a FortiGate unit with virtual domains enabled, often you
can troubleshoot within your own VDOM. However, you should inform your FortiGate
unit’s super admin that you will be doing troubleshooting.
Also, you may need access to other networking equipment such as switches, routers, and
servers to help you test. If you do not normally have access to this equipment, contact
your network administrator for assistance.
Contact Fortinet Customer Support for assistance

You have defined your problem, researched a solution, put together a plan to find the
solution, and executed that plan. At this point if the problem has not been solved, its time
to contact Fortinet Customer Support for assistance.
For more information, see “Technical Support Organization Overview” on page 53.

24 01-42002-0129304-20101025
Troubleshooting tools
This section includes a number of tools you can use during troubleshooting, including:
• FortiOS Diagnostics
• FortiGate Ports
• FortiAnalyzer/FortiManager Ports
• FortiGuard Troubleshooting
FortiOS Diagnostics
A collection of diagnostic commands are available in FortiOS for troubleshooting and
performance monitoring.
Within the CLI commands, the two main groups of diagnostic commands are get and
diagnose commands. Both commands display information about system resources,
connections, and settings that enable you to locate and fix problems, or to monitor system
performance.
When you call Fortinet Customer Support, you will be asked to provide information about
your unit and its current state through the use of these CLI commands.
This section includes diagnostics commands to help with:
• Resource Usage
• Processes
• Proxy Operation
• Hardware NIC
• Conserve Mode
• Traffic Trace
• Session Table
• Finding Object Dependencies
• Flow Trace
• Packet Sniffer
• Debug Command
Additional diagnostic commands are covered in “Troubleshooting ‘get’ commands” on
page 77, and commands related to specific features are covered in the chapter for that
specific feature. For example in-depth diagnostics for dynamic routing are covered in the
dynamic routing chapter.
Resource Usage
Monitor the CPU/memory usage of internal processes using the following command:
diag sys top <delay> <max_lines>
The data listed includes the name of the daemon, the process ID, whether the process is
sleeping or running, the CPU percentage being used, and the memory percentage being
used.

01-42002-0129304-20101025 25
FortiOS Diagnostics Troubleshooting tools
Processes
List information about processes running on the FortiGate unit using the following
command:
diag sys top
Sample output:
Run Time: 13 days, 13 hours and 58 minutes
0U, 0S, 98I; 123T, 25F, 32KF
newcli 903 R 0.5 5.5
sshd 901 S 0.5 4.0
Where the codes displayed on the second output line mean the following:
• U is % of user space applications using CPU. In the example, 0U means 0% of the user
space applications are using CPU.
• S is % of system processes (or kernel processes) using CPU. In the example, 0S
means 0% of the system processes are using the CPU.
• I is % of idle CPU. In the example, 98I means the CPU is 98% idle.
• T is the total FortiOS system memory in Mb. In the example, 123T means there are
123 Mb of system memory.
• F is free memory in Mb. In the example, 25F means there is 25 Mb of free memory.
• KF is the total shared memory pages used. In the example, 32KF means the system is
using 32 shared memory pages.

26 01-42002-0129304-20101025
Troubleshooting tools FortiOS Diagnostics
Each additional line of the command output displays information for each of the processes
running on the FortiGate unit. For example, the third line of the output is:
newcli 903 R 0.5 5.5
Where:
• newcli is the process name. Other process names can include ipsengine, sshd,
cmdbsrv, httpsd, scanunitd, and miglogd.
• 903 is the process ID. The process ID can be any number.
• R is the state in which the process is running. The process state can be:
R running.
S sleep.
Z zombie.
D disk sleep.
• 0.5 is the amount of CPU that the process is using. CPU usage can range from 0.0 for
a process that is sleeping to higher values for a process that is taking a lot of CPU time.
• 5.5 is the amount of memory that the process is using. Memory usage can range from
0.1 to 5.5 and higher.
Enter the following single-key commands when diagnose sys top is running:
• Press q to quit.
• Press p to sort the processes by the amount of CPU that the processes are using.
• Press m to sort the processes by the amount of memory that the processes are using.
Proxy Operation
Monitor proxy operations using the following command:
diag test application <application> <option>
The <application> value can include the following:
ftpd ftp proxy
http http proxy
im im proxy
imap imap proxy
ipsengine ips sensor
ipsmonitor ips monitor
pop3 pop3 proxy
smtp smtp proxy
urlfilter urlfilter daemon

01-42002-0129304-20101025 27
The <option> value for use with this command can include:
1 Dump Memory Usage
2 Drop all connections
4 Display connection state *
44 Display info per connection *
444 Display connections per state *
5 Toggle AV Bypass mode
6 Toggle Print Stat mode every ~40 seconds
7 Toggle Backlog Drop
8 Clear stats
88 Toggle statistic recording - stats cleared
9 Toggle Accounting info for display
99 Restart proxy
These commands, except for the ones identified with an “*”, should only be used under the
guidance of Fortinet Support.
Hardware NIC
Monitor hardware network operations using the following command:
diag hardware deviceinfo nic <interface>
The information displayed by this command is important as errors at the interface are
indicative of data link or physical layer issues which may impact the performance of the
FortiGate unit.
The following is sample output when <interface> = internal:
System_Device_Name port5
Current_HWaddr 00:09:0f:68:35:60
Permanent_HWaddr 00:09:0f:68:35:60
Link up
Speed 100
Duplex full
[……]
Rx_Packets=5685708
Tx_Packets=4107073
Rx_Bytes=617908014
Tx_Bytes=1269751248
Rx_Errors=0
Tx_Errors=0
Rx_Dropped=0
Tx_Dropped=0
[…..]

28 01-42002-0129304-20101025
Hardware Troubleshooting
Field Definition
Rx_Errors = rx error Bad frame was marked as error by PHY.
count
Rx_CRC_Errors + This error is only valid in 10/100M mode.
Rx_Length_Errors -
Rx_Align_Errors
Rx_Dropped or Running out of buffer space.
Rx_No_Buffer_Count
Rx_Missed_Errors Equals Rx_FIFO_Errors + CEXTERR (Carrier Extension Error Count).
Only valid in 1000M mode, whichis marked by PHY.
Tx_Errors = ECOL (Excessive Collisions Count). Only valid in half-duplex mode.
Tx_Aborted_Errors
Tx_Window_Errors LATECOL (Late Collisions Count). Late collisions are collisions that
occur after 64-byte time into the transmission of the packet while
working in 10 to100Mb/s data rate and 512-byte timeinto the
transmission of the packet while working in the 1000Mb/s data rate. This
register only increments if transmits are enabled and the device is in
half-duplex mode.
Rx_Dropped See Rx_Errors.
Tx_Dropped Not defined.
Collisions Total number of collisions experienced by the transmitter. Valid in half-
duplex mode.
Rx_Length_Errors Transmission length error.
Rx_Over_Errors Not defined.
Rx_CRC_Errors Frame CRC error.
Rx_Frame_Errors Same as Rx_Align_Errors. This error is only valid in 10/100M mode.
Rx_FIFO_Errors Same as Rx_Missed_Errors - a missed packet count.
Tx_Aborted_Errors See Tx_Errors.
Tx_Carrier_Errors The PHY should assert the internal carrier sense signal during every
transmission. Failure to do so may indicate that the link has failed or the
PHY has an incorrect link configuration. This register only increments if
transmits are enabled. This register is not valid in internal SerDes 1
mode (TBI mode for the 82544GC/EI) and is only valid when the
Ethernet controller is operating at full duplex.
Tx_FIFO_Errors Not defined.
Tx_Heartbeat_Errors Not defined.
Tx_Window_Errors See LATECOL.
Tx_Single_Collision_Fr Counts the number of times that a successfully transmitted packed
ames encountered a single collision. The value only increments if transmits
are enabled and the Ethernet controller is in half-duplex mode.
Tx_Multiple_Collision_ A Multiple Collision Count which counts the number of times that a
Frames transmit encountered more than one collision but less than 16. The
value only increments if transmits are enabled and the Ethernet
controller is in half-duplex mode.
Tx_Deferred Counts defer events. A defer event occurs when the transmitter cannot
immediately send a packet due to the medium being busy because
another device is transmitting, the IPG timer has not expired, half-duplex
deferral events are occurring, XOFF frames are being received, or the
link is not up. This register only increments if transmits are enabled. This
counter does not increment for streaming transmits that are deferred
due to TX IPG.
Rx_Frame_Too_Longs The Rx frame is over size.
Rx_Frame_Too_Shorts The Rx frame is too short.
Rx_Align_Errors This error is only valid in 10/100M mode.
Symbol Error Count Counts the number of symbol errors between reads - SYMERRS. The
count increases for every bad symbol received, whether or not a packet
is currently being received and whether or not the link is up. This register
only increments in internal SerDes mode.
Note: The counters displayed depend on the type of NIC interface. Please see the
following website for more information:
http://kc.forticare.com/default.asp?id=1979&Lang=1&SID=

01-42002-0129304-20101025 29
Conserve Mode
The FortiOS antivirus/IPS system operates in one of two modes, depending on the unit’s
available shared memory. If the shared memory utilization is below a defined upper
threshold, the system is in non-conserve mode. If the used shared memory goes beyond
this threshold, the system enters conserve mode and remains there until the shared
memory utilization drops below a second threshold, slightly lower than the original. These
thresholds are non-configurable; the threshold above which the system enters conserve
mode is 80%, the system will not go back to non-conserve mode until the shared memory
usage goes below 70%.
Conserve mode occurs under high usage and traffic conditions. It is expected to be a
temporary condition that is self-correcting when bursty traffic subsides.
When in conserve mode, any new sessions are ignored (no SYN-ACK from the FortiGate
unit) or passed without being scanned.
The following is sample output from the event log:
66 2008-04-16 14:01:31 critical The system has entered system
conserve mode

30 01-42002-0129304-20101025
Antivirus Failopen
Dealing with high traffic volume may cause the problem dealing with low memory
situations or when dealing with connection pool limits affecting a single proxy. If a
FortiGate unit is receiving large volumes of traffic on a specific proxy, it is possible that the
unit will exceed the connection pool limit. If the number of free connections within a proxy
connection pool reaches zero, problems may occur.
Antivirus failopen is a safeguard feature that determines the behavior of the FortiGate
antivirus system if it becomes overloaded in high traffic. The feature is configurable only
though the CLI.
config system global set av_failopen {off|one-shot|pass
|idledrop}
av-failopen-session controls the behavior when the proxy connection pool is
exhausted. Again in this case, the FortiGate unit does not send the SYN-ACK. Failopen is
only available on FortiGate models 300A and higher. On other lower FortiGate models, the
failopen action is configured to pass.
The set av-failopen command has the following four options:
• off
If the FortiGate unit enters conserve mode, the antivirus system will stop accepting
new AV sessions but will continue to process current active sessions.
• one-shot
If the FortiGate unit enters conserve mode, all subsequent connections bypass the
antivirus system but current active sessions will continue to be processed. One-shot is
similar to pass but will not automatically turn off once the condition causing av-failopen
has stopped.
• idledrop
When configured in this mode, the antivirus failopen mechanism will drop connections
based on the clients that have the most open connections.
• pass
Pass becomes the default setting when the av-failopen-session command has
been run. If the system enters conserve mode, connections bypass the antivirus
system until the system enters non-conserve mode again. Current active sessions will
continue to be processed.
Note: The one-shot and pass options do not content filter traffic. Therefore, the data
stream could contain malicious content.

01-42002-0129304-20101025 31
Traffic Trace
Traffic tracing allows a specific packet stream to be followed.
View the characteristics of a traffic session though specific firewall policies using:
diag sys session
Trace per-packet operations for flow tracing using:
diag debug flow
Trace per-Ethernet frame using:
diag sniffer packet
Session Table
The FortiGate session table can be viewed from either the CLI or Web Config. The most
useful troubleshooting data comes from the CLI. The session table in Web Config also
provides some useful summary information, particularly the current policy number that the
session is using.
In Web Config, click Add Content and select Top Sessions. In the Top Sessions pane, click
the Details link. (If there are not enough entries in the session table, try browsing to a
different web site and re-examine the table.) The Policy ID shows which firewall policy
matches the session. The sessions that do not have a Policy ID entry originate from the
FortiGate device.

32 01-42002-0129304-20101025
The session table output from the CLI (diag system session list) is very verbose,
so even on a system with a small load, displaying the session table will generate a large
amount of output. For this reason, filters are used to display only the session data of
interest.
Filter a column in Web Config by clicking the funnel icon on the column heading or from
the CLI by creating a filter.
An entry is placed in the session table for each traffic session passing through a firewall
policy. The following command will list the information for a session in the table:
diag sys session list
Sample Output:
session info: proto=6 proto_state=05 expire=89 timeout=3600
flags=00000000 av_idx=0 use=3
bandwidth=204800/sec guaranteed_bandwidth=102400/sec
traffic=332/sec prio=0 logtype=session ha_id=0 hakey=4450
tunnel=/
state=log shape may_dirty
statistic(bytes/packets/err): org=3408/38/0 reply=3888/31/0
tuples=2
orgin->sink: org pre->post, reply pre->post oif=3/5
gwy=192.168.11.254/10.0.5.100
hook=post dir=org act=snat 10.0.5.100:1251-
>192.168.11.254:22(192.168.11.105:1251)
hook=pre dir=reply act=dnat 192.168.11.254:22-
>192.168.11.105:1251(10.0.5.100:1251)
pos/(before,after) 0/(0,0), 0/(0,0)
misc=0 domain_info=0 auth_info=0 ftgd_info=0 ids=0x0 vd=0
serial=00007c33 tos=ff/ff

01-42002-0129304-20101025 33
Since output can be verbose, the filter option allows specific information to be displayed,
for example:
diag sys session filter <option>
The <option> values available include the following:
clear clear session filter
dport dest port
dst destination IP address
negate inverse filter
policy policy ID
proto protocol number
sport source port
src source IP address
vd index of virtual domain. -1 matches all
Even though UDP is a sessionless protocol, the FortiGate unit still keeps track of the
following two different states:
• UDP reply not seen with a value of 0
• UDP reply seen with a value of 1
The following illustrates FW session states from the session table:
State Meaning
log Session is being logged.
local Session is originated from or destined for local stack.
ext Session is created by a firewall session helper.
may_dirty Session is created by a policy. For example, the session for ftp
control channel will have this state but ftp data channel will
not. This is also seen when NAT is enabled.
ndr Session will be checked by IPS signature.
nds Session will be checked by IPS anomaly.
br Session is being bridged (TP) mode.

34 01-42002-0129304-20101025
Finding Object Dependencies

An administrator may not be permitted to delete a configuration object if there are other
configuration objects that depend on it. This command identifies other objects which
depend on or make reference to the configuration object in question. If an error is
displayed that an object is in use and cannot be deleted, this command can help identify
the source of the problem.
When running multiple VDOMs, this command is run in the Global configuration only and it
searches for the named object both in the Global and VDOM configuration most recently
used:
diag sys checkused <path.object.mkey>
For example, to verify which objects are referred to in a firewall policy with an ID of 1, enter
the command as follows:
diag sys checkused firewall.policy.policyid 1
To check what is referred to by interface port1, enter the following command:

diag sys checkused system.interface.name port1
To show all the dependencies for an interface, enter the command as follows:
diag sys checkused system.interface.name <interface name>
Sample Output:
entry used by table firewall.address:name '10.98.23.23_host’
entry used by table firewall.address:name 'NAS'
entry used by table firewall.address:name 'all'
entry used by table firewall.address:name 'fortinet.com'
entry used by table firewall.vip:name 'TORRENT_10.0.0.70:6883'
entry used by table firewall.policy:policyid '21'
In this example, the interface has dependent objects, including four address objects, one
VIP, and three firewall policies.

01-42002-0129304-20101025 35
Flow Trace
To trace the flow of packets through the FortiGate unit, use the following command:
diag debug flow trace start
Follow packet flow by setting a flow filter using this command:

diag debug flow filter <option>
Filtering options include the following:

addr IP address
clear clear filter
daddr destination IP address
dport destination port
negate inverse filter
port port
proto protocol number
saddr source IP address
sport source port
vd index of virtual domain, -1 matches all
Enable the output to be displayed to the CLI console using the following command:
diag debug flow show console
Start flow monitoring with a specific number of packets using this command:
diag debug flow trace start <N>
Stop flow tracing at any time using:

diag debug flow trace stop
The following is an example of the flow trace for the device at the following IP address:
203.160.224.97
diag debug enable
diag debug flow filter addr 203.160.224.97
diag debug flow show console enable
diag debug flow show function-name enable
diag debug flow trace start 100

36 01-42002-0129304-20101025
Flow Trace Output Example - HTTP

Connect to the web site at the following address to observe the debug flow trace. The
display may vary slightly:
http://www.fortinet.com
Comment: SYN packet received:

id=20085 trace_id=209 func=resolve_ip_tuple_fast
line=2700 msg="vd-root received a packet(proto=6,
192.168.3.221:1487->203.160.224.97:80) from port5."
SYN sent and a new session is allocated:
id=20085 trace_id=209 func=resolve_ip_tuple line=2799
msg="allocate a new session-00000e90"
Lookup for next-hop gateway address:
id=20085 trace_id=209 func=vf_ip4_route_input line=1543
msg="find a route: gw-192.168.11.254 via port6"
Source NAT, lookup next available port:
id=20085 trace_id=209 func=get_new_addr line=1219
msg="find SNAT: IP-192.168.11.59, port-31925"
direction“
Matched firewall policy. Check to see which policy this session matches:
id=20085 trace_id=209 func=fw_forward_handler line=317
msg="Allowed by Policy-3: SNAT"
Apply source NAT:
id=20085 trace_id=209 func=__ip_session_run_tuple
line=1502 msg="SNAT 192.168.3.221->192.168.11.59:31925"
SYN ACK received:
id=20085 trace_id=210 func=resolve_ip_tuple_fast line=2700
msg="vd-root received a packet(proto=6, 203.160.224.97:80-
>192.168.11.59:31925) from port6."
Found existing session ID. Identified as the reply direction:
msg="Find an existing session, id-00000e90, reply
direction"
Apply destination NAT to inverse source NAT action:
line=1516 msg="DNAT 192.168.11.59:31925-
>192.168.3.221:1487"

01-42002-0129304-20101025 37
Lookup for next-hop gateway address for reply traffic:

ACK received:
msg="vd-root received a packet(proto=6,
192.168.3.221:1487->203.160.224.97:80) from port5."
Match existing session in the original direction:
msg="Find an existing session, id-00000e90, original
direction"
Apply source NAT:
line=1502 msg="SNAT 192.168.3.221->192.168.11.59:31925"
Receive data from client:
192.168.3.221:1487->203.160.224.97:80) from port5."
Match existing session in the original direction:
line=2727 msg="Find an existing session, id-00000e90,
original direction"
Apply source NAT:
line=1502 msg="SNAT 192.168.3.221->192.168.11.59:31925"
Receive data from server:
203.160.224.97:80->192.168.11.59:31925) from port6."
Match existing session in reply direction:
line=2727 msg="Find an existing session, id-00000e90,
reply direction"
Apply destination NAT to inverse source NAT action:
line=1516 msg="DNAT 192.168.11.59:31925-
>192.168.3.221:1487"

38 01-42002-0129304-20101025
Flow Trace Output Example - IPSec (policy-based)

id=20085 trace_id=1 msg="vd-root received a packet(proto=1,
10.72.55.240:1->10.71.55.10:8) from internal."
id=20085 trace_id=1 msg="allocate a new session-00001cd3"
id=20085 trace_id=1 msg="find a route: gw-66.236.56.230 via
wan1"
id=20085 trace_id=1 msg="Allowed by Policy-2: encrypt"
id=20085 trace_id=1 msg="enter IPsec tunnel-RemotePhase1"
id=20085 trace_id=1 msg="encrypted, and send to 15.215.225.22
with source 66.236.56.226"
id=20085 trace_id=1 msg="send to 66.236.56.230 via intf-wan1“
id=20085 trace_id=2 msg="vd-root received a packet (proto=1,
10.72.55.240:1-1071.55.10:8) from internal."
id=20085 trace_id=2 msg="Find an existing session, id-00001cd3,
original direction"
id=20085 trace_id=2 msg="enter IPsec ="encrypted, and send to
15.215.225.22 with source 66.236.56.226“ tunnel-RemotePhase1"
id=20085 trace_id=2 msgid=20085 trace_id=2 msg="send to
66.236.56.230 via intf-wan1"

01-42002-0129304-20101025 39
Packet Sniffer
Details within packets passing through particular interfaces can be displayed using the
packet sniffer with the following command:
diag sniffer packet <interface> <filter> <verbose> <count>
The <interface> value can be any physical or virtual interface name. Use any for all
interfaces.
The <filter> value limits the display of packets using filters, including Berkeley Packet
Filtering (BPF) syntax.
'[[src|dst] host<host_name_or_IP1>] [[src|dst]
host<host_name_or_IP2>] [[arp|ip|gre|esp|udp|tcp] [port_no]]
[[arp|ip|gre|esp|udp|tcp] [port_no]]‘
If a second host is specified, only the traffic between the two hosts will be displayed.
Use flexible, logical filters for the packet sniffer or none. For example, to print UDP 1812
traffic between host1 and either host2 or host3, use the following:
'udp and port 1812 and host host1 and \( host2 or host3 \)‘
The <verbose> option allows different levels of information to be displayed. The verbose
levels include:
1 Print header of packets
2 Print header and data from the IP header of the packets
3 Print header and data from the Ethernet header of the packets
4 Print header of packets with interface name
5 Print header and data from ip of packets with interface name
6 Print header and data from ethernet of packets with interface
The <count> value indicates the number of packets the sniffer needs before stopping.
A script to convert FortiGate sniffer output to the PCAP format is available from Fortinet at
the following address:
http://kc.forticare.com/default.asp?id=1186&SID=&Lang=1

40 01-42002-0129304-20101025
FA2 and NP2 Based Interfaces

Many Fortinet products contain network processors. Some of these products contain
FortiAccel (FA2) network processors while others contain NP2 network processors.
Network processor features, and therefore offloading requirements, vary by network
processor model.
When using the FA2- and NP2-based interfaces, only the initial session setup will be seen
through the diag debug flow command. If the session is correctly programmed into the
ASIC (fastpath), the debug flow command will no longer see the packets arriving at the
CPU. If the NP2 functionality is disabled, the CPU will see all the packets, however, this is
only recommended for troubleshooting purposes.
First, obtain the NP2 and port numbers with the following command:
diag npu np2 list
Sample Output:
ID PORTS
-- -----
0 port1
0 port2
0 port3
0 port4
ID PORTS
-- -----
1 port5
1 port6
1 port7
1 port8
ID PORTS
-- -----
2 port9
2 port10
2 port11
2 port12
ID PORTS
-- -----
3 port13
3 port14
3 port15
3 port16

01-42002-0129304-20101025 41
Run the following commands:

diag npu np2 fastpath disable 0
(where 0 is the NP2 number)
Then, run this command:
diag npu np2 fastpath-sniffer enable port1
Sample Output:
NP2 Fast Path Sniffer on port1 enabled
This will cause all traffic on port1 of NP2 0 to be sent to the CPU meaning a standard
sniffer trace can be taken and other diag commands should work if it was a standard CPU
driven port.
These commands are only for the newer NP2 interfaces. FA2 interfaces are more limited
as the sniffer will only capture the initial packets before the session is offloaded into HW
(FA2). The same holds true for the diag debug flow command as only the session
setup will be shown, however, this is usually enough for this command to be useful.

42 01-42002-0129304-20101025
Debug Command
Debug output provides continuous, real-time event information. Debugging output
continues until it is explicitly stopped or until the unit is rebooted. Debugging output can
affect system performance and will be continually generated even though output might not
be displayed in the CLI console.
Debug information displayed in the console will scroll in the console display and may
prevent CLI commands from being entered, for example, the command to disable the
debug display. To turn off debugging output as the display is scrolling by, press the Ç key
to recall the recent diag debug command, press backspace, and type “0”, followed by
Enter.
Debug output display is enabled using the following command:
diag debug enable
When finished examining the debug output, disable it using:
diag debug disable
Once enabled, indicate the debug information that is required using this command:
diag debug <option> <level>
Debug command options include the following:
application application
authd authentication daemon
cli debug cli
console console
crashlog crash log info
disable disable debug output
enable enable debug output
flow trace packet flow in kernel
haproxy haproxy
info show active debug level settings
kernel kernel
rating display rating info
report report for tech support
reset reset all debug level to default
The debug level can be set at the end of the command. Typical values are 2 and 3, for
example:
diag debug application DHCPS 2
diag debug application spamfilter 2
Fortinet support will advise which debugging level to use.
Timestamps can be enabled in the debug output using the following command:
diag debug console timestamp enable

01-42002-0129304-20101025 43
Debug Output Example

This example shows the IKE negotiation for a secure logging connection from a FortiGate
unit to a FortiAnalyzer system.
diag debug enable
diag debug application ike 3 <remote gateway IP address>
Sample Output:
FGh_FtiLog1: IPsec SA connect 0 192.168.11.2->192.168.10.201:500,
natt_mode=0 rekey=0 phase2=FGh_FtiLog1
FGh_FtiLog1: using existing connection, dpd_fail=0
FGh_FtiLog1: found phase2 FGh_FtiLog1
FGh_FtiLog1: IPsec SA connect 0 192.168.11.2 -> 192.168.10.201:500
negotiating
FGh_FtiLog1: overriding selector 225.30.5.8 with 192.168.11.2
FGh_FtiLog1: initiator quick-mode set pfs=1536...
FGh_FtiLog1: try to negotiate with 1800 life seconds.
FGh_FtiLog1: initiate an SA with selectors: 192.168.11.2/0.0.0.0-
>192.168.10.201, ports=0/0, protocol=0/0
Send IKE Packet(quick_outI1):192.168.11.2:500(if0) ->
192.168.10.201:500, len=348
Initiator: sent 192.168.10.201 quick mode message #1 (OK)
FGh_FtiLog1: set retransmit: st=168, timeout=6.
In this example:
192.168.11.2->192.168.10.201:500 Source and Destination gateway IP
address
dpd_fail=0 Found existing Phase 1
pfs=1536... Create new Phase 2 tunnel

44 01-42002-0129304-20101025
Other Commands
ARP Table
To view the ARP cache, use the following command:
get sys arp
To view the ARP cache in the system, use this command:

diag ip arp list
Sample Output:
index=14 ifname=internal 224.0.0.5 01:00:5e:00:00:05
state=00000040 use=72203 confirm=78203 update=72203 ref=1
index=13 ifname=dmz 192.168.3.100 state=00000020 use=1843
confirm=650179 update=644179 ref=2 ? VIP
index=13 ifname=dmz 192.168.3.109 02:09:0f:78:69:ff
index=14 ifname=internal 192.168.11.56 00:1c:23:10:f8:20
To remove the ARP cache, use this command:

execute clear system arp table
To remove a single ARP entry, use:

diag ip arp delete <interface name> <IP address>
To remove all entries associated with a particular interface, use this command:
diag ip arp flush <interface name>
To add static ARP entries, use the following command:

config system arp-table

01-42002-0129304-20101025 45
Time and Date Settings

Check time and date settings for log message timestamp synchronization (the Fortinet
support group may request this) and for certificates that have a time requirement to check
for validity. Use the following commands:
execute time
current time is: 12:40:48
last ntp sync:Thu Mar 16 12:00:21 2006
execute date
current date is: 2006-03-16
To force synchronization with an NTP server, toggle the following command:

set ntpsync enable/disable
If all devices have the same time, it helps to correlate log entries from different devices.
For more information on useful diagnostic commands, see “Troubleshooting ‘get’

commands” on page 77 and “Troubleshooting connectivity” on page 67.

46 01-42002-0129304-20101025
Troubleshooting tools FortiGate Ports
FortiGate Ports
In the TCP and UDP stacks, there are 65 535 ports available for applications to use when
communicating with each other. Many of these ports are commonly known to be
associated with specific applications or protocols. These known ports can be useful when
troubleshooting your network.
Use the following ports while troubleshooting the FortiGate device:
Port(s) Functionality
UDP 53 DNS lookup, RBL lookup
UDP 53 or UDP FortiGuard Antispam or Web Filtering rating lookup
8888
UDP 53 FDN Server List - source and destination port numbers vary by
(default) or UDP originating or reply traffic. See the article “How do I troubleshoot
8888 and UDP performance issues when FortiGuard Web Filtering is enabled?” in the
Knowledge Center.
1027 or UDP
1031
UDP 123 NTP Synchronization
UDP 162 SNMP Traps
UDP 514 Syslog - All FortiOS versions can use syslog to send log messages to
remote syslog servers. FortiOS v2.80 and v3.0 can also view logs
stored remotely on a FortiAnalyzer unit.
TCP 22 Configuration backup to FortiManager unit or FortiGuard Analysis and
Management Service.
TCP 25 SMTP alert email, encrypted virus sample auto-submit
TCP 389 or TCP LDAP or PKI authentication
636
TCP 443 FortiGuard Antivirus or IPS update - When requesting updates from a
FortiManager unit instead of directly from the FDN, this port must be
reconfigured as TCP 8890.
TCP 443 FortiGuard Analysis and Management Service
TCP 514 FortiGuard Analysis and Management Service log transmission (OFTP)
TCP 541 SSL Management Tunnel to FortiGuard Analysis and Management
Service (FortiOS v3.0 MR6 or later)
TCP 10151 FortiGuard Analysis and Management Service contract validation
TCP 514 Quarantine, remote access to logs and reports on a FortiAnalyzer unit,
device registration with FortiAnalyzer units (OFTP)
TCP 1812 RADIUS authentication

01-42002-0129304-20101025 47
Diagnostic Commands Troubleshooting tools
Diagnostic Commands

48 01-42002-0129304-20101025
Troubleshooting tools Diagnostic Commands
FortiAnalyzer/FortiManager Ports
If you have a FortiAnalyzer unit or FortiManager unit on your network you may need to use
the following ports for troubleshooting network traffic.
Functionality Port(s)
DNS lookup UDP 53
NTP synchronization UDP 123
Windows share UDP 137-138
SNMP traps UDP 162
Syslog, log forwarding UDP 514
Log and report upload TCP 21 or TCP 22
SMTP alert email TCP 25
User name LDAP queries for reports TCP 389 or TCP 636
RVS update TCP 443
RADIUS authentication TCP 1812
Log aggregation client TCP 3000
Note: For more information about FortiAnalyzer/FortiManager ports, see the Fortinet
Knowledge Center at the following address:
http://kc.forticare.com/default.asp?SID=&Lang=1&id=773.

01-42002-0129304-20101025 49
FortiGuard Troubleshooting Troubleshooting tools
FortiGuard Troubleshooting
The diag debug rating command shows the list of FDS servers the FortiGate unit is
using to send web filtering requests. Rating requests are only sent to the server on the top
of the list in normal operation. Each server is probed for RTT every two minutes.
diagnose debug rating
Sample Output:
Locale : english
License : Contract
Expiration : Thu Oct 9 02:00:00 2008
Hostname : a.b.c.d
-=- Server List (Mon Feb 18 12:55:48 2008) -=-
IP Weight RTT Flags TZ Packets CurrLost TotalLost

a.b.c.d. 0 1 DI 2 1926879 0 11176
g.h.u.y. 10 329 1 10263 0 633
r.h.g.t. 20 169 0 16105 0 80
e.b.a.u. 20 182 0 6741 0 776
x.c.v.b. 20 184 0 5249 0 987
q.w.e.r. 25 181 0 12072 0 178
Output Details
The following flags in diag debug rating indicate the server status:
• D - the server was found through the DNS lookup of the hostname. If the hostname
returns more than one IP address, all of them will be flagged with D and will be used
first for INIT requests before falling back to the other servers.
• I - the server to which the last INIT request was sent.
• F - the server has not responded to requests and is considered to have failed.
• T - the server is currently being timed.
Sorting the Server List

The server list is sorted first by weight. The server with the smallest RTT is put at the top
of the list, regardless of weight. When a packet is lost (there has been no response in 2
seconds), it will be resent to the next server in the list. Therefore, the top position in the list
is selected based on RTT while the other list positions are based on weight.
Calculating Weight
The weight for each server increases with failed packets and decreases with successful
packets. To lower the possibility of using a remote server, the weight is not allowed to dip
below a base weight, calculated as the difference in hours between the FortiGate unit and
the server times 10. The further away the server is, the higher its base weight and the
lower in the list it will appear.
Note: The output for the diag debug rating command will vary based on the state
of the FortiGate device.

50 01-42002-0129304-20101025
Troubleshooting tools FortiGuard Troubleshooting
The following output is from a FortiGate device that has no DNS resolution for
service.fortiguard.net.
If only three IP addresses appear with the D flag, it means that DNS is good but probably
the FortiGuard ports (53,8888) are blocked.
When the license is expired, an INIT request will be sent every 10 minutes for up to six
attempts. If a license is not found after this limit is reached, the INIT requests will be sent
every day.
A low source port number may appear which means that port 1024 and 1025 could be
blocked on the path to the FDS. Increase the source port on the FortiGate device with the
following commands:
config sys global
set ip-src-port-range <start-end> (Default 1024-25000)

01-42002-0129304-20101025 51
FortiGuard Troubleshooting Troubleshooting tools
FortiGuard URL Rating

The following commands can be used to troubleshoot issues with FortiGuard URL ratings:
diag debug enable
diag debug application urlfilter -1
Sample Output:
id=93000 msg="pid=57 urlfilter_main-723 in main.c received
pkt:count=91, a=/tmp/.thttp.socket/21" id=22009 msg="received
a request /tmp/.thttp.socket, addr_len=21: d=
="www.goodorg.org:80, id=12853, vfid=0, type=0,
client=192.168.3.90, url=/" id=99501 user="N/A"
src=192.168.3.90 sport=1321 dst=<dest_ip> dport=80
service="http" cat=43 cat_desc=“Organisation"
hostname="www.goodorg.org" url="/" status=blocked msg="URL
belongs to a denied category in policy"
Sample Output:
id=22009 msg="received a request /tmp/.thttp.socket,
addr_len=21: d=pt.dnstest.google.com:80, id=300, vfid=0,
type=0, client=192.168.3.12, url=/gen_204"
id=93003 user="N/A" src=192.168.3.12 sport=21715 dst=<dest_ip>
dport=80 service="http" cat=41 cat_desc="Search Engines"
hostname="pt.dnstest.google.com" url="/gen_204"
status=passthrough msg="URL belongs to an allowed category in
the policy"

52 01-42002-0129304-20101025
Technical Support Organization
Overview
Fortinet Global Customer Services Organization
The Fortinet Global Customer Services Organization is composed of three regional
Technical Assistance Centers (TAC):
• The Americas (AMER)
• Europe, Middle East, and Africa (EMEA)
• Asia Pacific (APAC)
The regional TACs are contacted through a global call center. Incoming service requests
are then routed to the appropriate TAC.
Each regional TAC delivers technical support to the customers in its regions during its
hours of operation. These TACs also combine to provide seamless, around-the-clock
support for all customers.
Regional TAC
· Focused Teams
APAC AMER · Technical Support
Corporate · RMA
CSS · Customer Services
· Remote Access Labs
AMEA
24x7
Regional TAC Global Call
Handling Layer

01-42002-0129304-20101025 53
Creating an Account Technical Support Organization Overview
Creating an Account
To receive technical support and service updates, Fortinet products in the organization
must be registered. The Product Registration Form on the support website will allow the
registration to be completed online.
Creating an account on the support website is the first step in registering products.
Once the account has been created, the Product Registration Form will be displayed and
the product details can be provided. Alternately, the product registration can be completed
at a later time.

54 01-42002-0129304-20101025
Technical Support Organization Overview Registering a Device
Registering a Device
Complete the following steps when registering a device for support purposes:
1 Log in using the Username and Password defined when the account was created.
2 Select Add Registration on the left-hand side.

01-42002-0129304-20101025 55
Registering a Device Technical Support Organization Overview
3 Select New Fortinet Product/License Registration.
4 Select the appropriate Product Model.

5 Enter the Serial Number.
6 Enter the Support Contract No. provided by Fortinet when the support contract was
purchased.
7 In the Product Description field, explain where this unit is physically located.
8 Click Next and accept the End User License Agreement (EULA) to complete the
registration.

56 01-42002-0129304-20101025
Technical Support Organization Overview Reporting Problems
Reporting Problems
Problems can be reported to a Fortinet Technical Assistance Center in the following ways:
• By logging an online ticket
• By phoning a technical support center
Logging Online Tickets

Problem reporting methods differ depending on the type of customer.
Fortinet Partners
Fortinet Partners are entitled to priority web-based technical support. This service is
designed for partners who provide initial support to their customers and who need to open
a support ticket with Fortinet on their behalf. We strongly encourage submission and
follow up of support tickets using this service.
The support ticket can be submitted after logging into the partner website using one of the
following links using FortiPartner account details:
http://partners.fortinet.com
This link will redirect to the general Partner Extranet website. Click Support > Online
Support Ticket.
https://www.forticare.com:1443/customersupport/login/partnerlog
in.aspx
This link redirects to the Partner Online Support Ticket section also known as FortiCare.
Note: The Partner Online Support Ticket section is accessed through HTTPS on port
1443. Ensure that the firewall allows external access this port. Also note that a
customer’s Fortinet device must have a valid support contract to be able submit the
support request as a Partner.

01-42002-0129304-20101025 57
Reporting Problems Technical Support Organization Overview
Fortinet Customers
Fortinet customers should complete the following steps to report a technical problem
online:
1 Log in to the support web site at the following address with the account credentials
used when the account was created:
http://support.fortinet.com
2 Click View Products.
3 In the Products List, select the product that is causing the problem.
4 Complete the Create Support Ticket fields.

58 01-42002-0129304-20101025

01-42002-0129304-20101025 59
Reporting Problems Technical Support Organization Overview
Following Up On Online Tickets

Perform the following steps to follow up on an existing issue.
Partners should log into the following web site:
http://partners.fortinet.com
Customer should log into the following site:
http://support.fortinet.com.
1 Login with the account credentials used when the account was created.
2 Click View Support Tickets on the left-hand side. Use the Search fields on the View
Tickets form to locate the tickets assigned to the account.
3 Select the appropriate ticket number. Closed tickets cannot be updated. A new ticket
must be submitted if it concerns the same problem.
4 Add a New Comment or Attachment.
5 Click Submit when complete.
Note: Every web ticket update triggers a notification to the ticket owner or ticket queue
supervisor.

60 01-42002-0129304-20101025
Telephoning a Technical Support Center

The Fortinet Technical Assistance Centers can also be contacted by phone.
Americas
• Telephone: 1-866-648-4638
• Hours: Monday to Friday 6:00 AM to 6:00 PM (Pacific Daylight Time)
EMEA
• Telephone: +33-4-898-0555
If a support call is placed outside of EMEA business hours (Monday to Friday 9:00 AM
to 6:00 PM (Central European Daylight Time)), priority 1 issues will be transferred to
another Fortinet Technical Solutions center according to the Follow the Sun policy,
meaning wherever it’s daylight, that TAC will be taking all support calls.
• Hours: Monday to Friday 9:00 AM to 6:00 PM (Central European Daylight Time)
APAC
• Telephone: +603-2711-7391
• Hours: Monday to Friday 9:00 AM to 6:00 PM (Malaysia Time)

01-42002-0129304-20101025 61
Assisting Technical Support Technical Support Organization Overview
Assisting Technical Support

The more information that can be provided to Fortinet technical support, the better they
can assist in resolving the issue. Every new support request should contain the following
information:
• A valid contact name, phone number, and email address.
• A clear and accurate problem description.
• A detailed network diagram with complete IP address schema.
• The configuration file, software version, and build number of the Fortinet device.
• Additional log files such as Antivirus log, Attack log, Event log, Debug log or similar
information to include in the ticket as an attachment. If a third-party product is involved,
for example, email server, FTP server, router, or switch, please provide the information
on its software revision version, configuration, and brand name.
The following Knowledge Center article provides an example of what type of technical
information and network diagram details should be submit to receive the quickest
resolution time to a problem:
http://kc.forticare.com/default.asp?id=1068&SID=&Lang=1

62 01-42002-0129304-20101025
Technical Support Organization Overview Support Priority Levels
Support Priority Levels

Fortinet technical support assigns the following priority levels to support cases:
Priority 1
This Critical priority is assigned to support cases in which:
• The network or system is down causing customers to experience a total loss of service.
• There are continuous or frequent instabilities affecting traffic-handling capability on a
significant portion of the network.
• There is a loss of connectivity or isolation to a significant portion of the network.
• This issue has created a hazard or an emergency.
Priority 2
This Major priority is assigned to support cases in which:
• The network or system event is causing intermittent impact to end customers.
• There is a loss of redundancy.
• There is a loss of routine administrative or diagnostic capability.
• There is an inability to deploy a key feature or function.
• There is a partial loss of service due to a failed hardware component.
Priority 3
This Medium priority is assigned to support cases in which:
• The network event is causing only limited impact to end customers.
• Issues seen in a test or pre-production environment exist that would normally cause
adverse impact to a production network.
• The customer is making time sensitive information requests.
• There is a successful workaround in place for a higher priority issue.
Priority 4
This Minor priority is assigned to support cases in which:
• The customer is making information requests and asking standard questions about the
configuration or functionality of equipment.
Customers must report Priority 1 and 2 issues by phone directly to the Fortinet EMEA
Support Center.
For lower priority issues, you may submit an assistance request (ticket) via the web
system.
The web ticket system also provides a global overview of all ongoing support requests.

01-42002-0129304-20101025 63
Return Material Authorization Process Technical Support Organization Overview
Return Material Authorization Process

In cases where hardware issues are being experiences and a replacement unit must be
sent. This is referred to as a Return Material Authorization (RMA). In the cases or RMAs,
the support contract must be moved to the new device. Customers can move the support
contract from the failing production unit to the new device through the support web site.
To start the process, log into the support web site with the credentials indicated when the
account was created.
From View Products, locate the serial number of the defective unit from the list of devices
displayed for the account.

64 01-42002-0129304-20101025
Technical Support Organization Overview Return Material Authorization Process
The Product Support Details for the selected device will be displayed.

01-42002-0129304-20101025 65
Return Material Authorization Process Technical Support Organization Overview
In the RMA Replacement section of the Product Support Details page, enter the serial
number of the replacement device and click RMA Replace.
This will transfer the support contract from the defective unit to the new unit with the serial
number provided.

66 01-42002-0129304-20101025
Troubleshooting connectivity
When there are connectivity problems it can be for a number of reasons - hardware
problems such as cabling or interfaces, routing problems, firewall problems, and so on.
These general troubleshooting tips provide a starting point for you to determine why your
network is behaving unexpectedly. This section includes general troubleshooting
methods. More in depth coverage of these topics, such as transparent mode and firewall
sessions, can be found in the Firewall Fundamentals section of this book.
The general troubleshooting tips include, and can help answer the following questions.
1 “Check hardware connections” on page 68
Are all the cables and interfaces connected properly?
2 “Run ping and traceroute” on page 68

Are you experiencing complete packet loss?
3 “Verify the contents of the routing table (in NAT mode)” on page 72
Are there routes in the routing table for default and static routes?
Do all connected subnets have a route in the routing table?
Does a route wrongly have a higher priority than it should?
4 “For Transparent mode, check the bridging information” on page 72

Are you having problems in transparent mode?
5 “Perform a sniffer trace” on page 73

Is traffic entering the FortiGate unit and does it arrive on the expected interface?
Is the ARP resolution correct for the next-hop destination?
Is the traffic exiting the FortiGate unit to the destination as expected?
Is the traffic being sent back to the originator?
6 “Debug the packet flow” on page 75

Is the traffic entering or leaving the FortiGate unit as expected?
7 “Examine the firewall session list” on page 76

Are there active firewall sessions?
In addition to these steps, you may find other diagnose commands useful. See “Other
diagnose commands” on page 76.

01-42002-0129304-20101025 67
Check hardware connections

If there is no traffic flowing from the FortiGate unit, it may be a hardware problem.
To check hardware connections

• ensure the network cables are properly plugged into the interfaces
• ensure there are connection lights for the network cables on the unit
• change the cable if the cable or its connector are damaged or you are unsure about the
cable’s type or quality—such as straight through or crossover, or possibly exposed
wires at the connector.
• connect the FortiGate unit to different hardware
• ensure the link status is set to Up for the interface, see Status > Network > Interface —
the link status is based on the physical connection and cannot be set in FortiOS
If any of these solve the problem, it was a hardware connection problem. You should still
perform some basic software connectivity tests to ensure complete connectivity. It might
also be that the interface is disabled, or have its Administrative Status set Down.
To enable an interface - web-based manager

1 Using the web-based management interface, go to System > Network > Interface.
2 Select and edit the interface to enable, such as port1.
3 Find Administrative Status at the bottom of the screen, and select Up.
4 Select Apply.
To enable an interface - CLI

config system interface
edit port1
set status enable
next
end
Run ping and traceroute

Ping and traceroute are useful tools in network troubleshooting. Alone either one can
determine network connectivity between two points. However, ping can be used to
generate simple network traffic to view with diagnose commands on the FortiGate unit.
This combination can be a very powerful one in locating network problems.
In addition to their normal uses, ping and traceroute can tell you if your computer or
network device has access to a domain name server (DNS). While both tools can use IP
addresses alone, they can also use domain names for devices. This is an added
troubleshooting feature that can be useful in determining why particular services, such as
email or web browsing, may not be working properly.
Note: If ping does not work, you likely have it disabled on at least one of the interface
settings, and firewall policies for that interface.
Both ping and traceroute require particular ports to be open on firewalls, or they cannot
function. Since you typically use these tools to troubleshoot, you can allow them in the
firewall policies and on interfaces only when you need them, and otherwise keep the ports
disabled for added security.

68 01-42002-0129304-20101025
Ping
The ping command sends a very small packet to the destination, and waits for a response.
The response has a timer that may expire, indicating the destination is unreachable. The
behavior of ping is very much like a sonar ping from a submarine, where the command
gets its name.
Ping is part of Layer-3 on the OSI Networking Model. Ping sends Internet Control
Message Protocol (ICMP) “echo request” packets to the destination, and listens for “echo
response” packets in reply. However, many public networks block ICMP packets because
ping can be used in a denial of service (DoS) attack (such as Ping of Death or a smurf
attack), or by an attacker to find active locations on the network. By default, FortiGate units
have ping enabled and broadcast-forward is disabled on the external interface.
What ping can tell you

Beyond the basic connectivity information, ping can tell you the amount of packet loss (if
any), how long it takes the packet to make the round trip, and the variation in that time
from packet to packet.
If there is some packet loss detected, you should investigate:

• possible ECMP, split horizon, network loops
• cabling to ensure no loose connections
If there is total packet loss, you should investigate:

• hardware - ensure cabling is correct, and all equipment between the two locations is
accounted for
• addresses and routes - ensure all IP addresses and routing information along the route
is configured as expected
• firewalls - ensure all firewalls are set to allow PING to pass through
How to use ping

Ping syntax is the same for nearly every type of system on a network.
To ping from a Windows PC

1 Go to a DOS prompt. Typically you go to Start > Run, enter cmd and select OK.
2 Enter ping 10.11.101.100 to ping the default internal interface of the FortiGate unit
with four packets.
Other options include:
• -t to send packets until you press “Control-C”
• -a to resolve addresses to domain names where possible
• -n X to send X ping packets and stop
Output appears as:
C:\>ping 10.11.101.101
Pinging 10.11.101.101 with 32 bytes of data:

Reply from 10.11.101.101: bytes=32 time=10ms TTL=255
Reply from 10.11.101.101: bytes=32 time<1ms TTL=255

01-42002-0129304-20101025 69
Ping statistics for 10.11.101.101:

Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 0ms, Maximum = 10ms, Average = 3ms
To ping from a Linux PC

1 Go to a command line prompt.
2 Enter “/bin/etc/ping 10.11.101.101”.
Output appears as:
To ping from a FortiGate unit

1 Connect to the CLI either through telnet or through the CLI widget on the web-based
manager dashboard.
2 Enter exec ping 10.11.101.101 to send 5 ping packets to the destination. There
are no options.
Output appears as:
Head_Office_620b # exec ping 10.11.101.101
PING 10.11.101.101 (10.11.101.101): 56 data bytes
64 bytes from 10.11.101.101: icmp_seq=0 ttl=255 time=0.3 ms
--- 10.11.101.101 ping statistics ---

5 packets transmitted, 5 packets received, 0% packet loss
round-trip min/avg/max = 0.2/0.2/0.3 ms
Traceroute
Where ping will only tell you if it reached its destination and came back successfully,
traceroute will show each step of its journey to its destination and how long each step
takes. If ping finds an outage between two points, traceroute can be used to locate exactly
where the problem is.
What is traceroute
Traceroute works by sending ICMP packets to test each hop along the route. It will send
out three packets, and then increase the time to live (TTL) setting by one each time. This
effectively allows the packets to go one hop farther along the route. This is the reason why
most traceroute commands display their maximum hop count before they start tracing the
route — that is the maximum number of steps it will take before declaring the destination
unreachable. Also the TTL setting may result in steps along the route timing out due to
slow responses. There are many possible reasons for this to occur.
Traceroute by default uses UDP datagrams with destination ports numbered from 33434
to 33534. The traceroute utility usually has an option to specify use of ICMP echo request
(type 8) instead, as used by the Windows tracert utility. If you have a firewall and if you
want traceroute to work from both machines (Unix-like systems and Windows) you will
need to allow both protocols inbound through your FortiGate firewall policies (UDP with
ports from 33434 to 33534 and ICMP type 8).

70 01-42002-0129304-20101025
How do you use traceroute

The traceroute command varies slightly between operating systems. Note that in MS
Windows the command name is shortened to “tracert”. Also note that your output will
list different domain names and IP addresses along your route.
To use traceroute on an MS Windows PC

1 Go to a DOS prompt. Typically you go to Start > Run, enter “cmd” and select OK.
2 Enter “tracert fortinet.com” to trace the route from the PC to the Fortinet
website.
Output will appear as:
C:\>tracert fortinet.com
Tracing route to fortinet.com [208.70.202.225]

over a maximum of 30 hops:
1 <1 ms <1 ms <1 ms 172.20.120.2
2 66 ms 24 ms 31 ms 209-87-254-xxx.storm.ca [209.87.254.221]
3 52 ms 22 ms 18 ms core-2-g0-0-1104.storm.ca [209.87.239.129]
4 43 ms 36 ms 27 ms core-3-g0-0-1185.storm.ca [209.87.239.222]
5 46 ms 21 ms 16 ms te3-x.1156.mpd01.cogentco.com [38.104.158.69]
6 25 ms 45 ms 53 ms te8-7.mpd01.cogentco.com [154.54.27.249]
7 89 ms 70 ms 36 ms te3-x.mpd01.cogentco.com [154.54.6.206]
8 55 ms 77 ms 58 ms sl-st30-chi-.sprintlink.net [144.232.9.69]
9 53 ms 58 ms 46 ms sl-0-3-3-x.sprintlink.net [144.232.19.181]
10 82 ms 90 ms 75 ms sl-x-12-0-1.sprintlink.net [144.232.20.61]
11 122 ms 123 ms 132 ms sl-0-x-0-3.sprintlink.net [144.232.18.150]
12 129 ms 119 ms 139 ms 144.232.20.7
13 172 ms 164 ms 243 ms sl-321313-0.sprintlink.net [144.223.243.58]
14 99 ms 94 ms 93 ms 203.78.181.18
15 108 ms 102 ms 89 ms 203.78.176.2
16 98 ms 95 ms 97 ms 208.70.202.225
Trace complete.
The first, or leftmost column, is the hop count, which cannot go over 30 hops.
The second, third, and fourth columns are how long each of the three packets takes to
reach this stage of the route. These values are in milliseconds and normally vary quite a
bit. Typically a value of “<1ms” indicates a local connection.
The fifth, or rightmost column, is the domain name of that device and its IP address or
possibly just the IP address.
To perform a traceroute on a Linux PC

1 Go to a command line prompt.
2 Enter “/bin/etc/traceroute fortinet.com”.
The Linux traceroute output is very similar to the MS Windows tracert output.

01-42002-0129304-20101025 71
Verify the contents of the routing table (in NAT mode)

When you have some connectivity, or possibly none at all a good place to look for
information is the routing table.
The routing table is where all the currently used routes are stored for both static and
dynamic protocols. If a route is in the routing table, it saves the time and resources of a
lookup. If a route isn’t used for a while and a new route needs to be added, the oldest least
used route is bumped if the routing table is full. This ensures the most recently used routes
stay in the table. Note that if your FortiGate unit is in Transparent mode, you are unable to
perform this step.
If the FortiGate is running in NAT mode, verify that all desired routes are in the routing
table : local subnets, default routes, specific static routes, and dynamic routing protocols.
To check the routing table in the web-based manager, use the Routing Monitor — go to
System > Routing > Monitor. In the CLI, use the command get router routing-
table all.
For Transparent mode, check the bridging information

When FortiOS is in transparent mode, the unit acts like a bridge sending all incoming
traffic out on the other interfaces.
What checking the bridging information can tell you
How to check the bridging information

To list the existing bridge instance on the unit, use the following command:
diagnose netlink brctl (bridge control) list
Sample Output:
list bridge information
1. root.b fdb: size=256 used=6 num=7 depth=2
simple=no
Total 1 bridges
To display the forward domains, use the following command:

diagnose netlink brctl domain <name> <id>
Sample Output:
show bridge root.b ione forward domain.
id=101 dev=trunk_1 6
To list the existing bridge MAC table, use the following command:
diagnose netlink brctl name host <name>

72 01-42002-0129304-20101025
Sample Output:
show bridge control interface root.b host.
fdb: size=256, used=6, num=7, depth=2, simple=no
Bridge root.b host table
port no device devname mac addr ttl attributes
2 7 wan2 02:09:0f:78:69:00 0 Local Static
5 6 vlan_1 02:09:0f:78:69:01 0 Local Static
3 8 dmz 02:09:0f:78:69:01 0 Local Static
4 9 internal 02:09:0f:78:69:02 0 Local Static
3 8 dmz 00:80:c8:39:87:5a 194
4 9 internal 02:09:0f:78:67:68 8
1 3 wan1 00:09:0f:78:69:fe 0 Local Static
To list the existing bridge port list, use this command:

diagnose netlink brctl name port <name>
Sample Output:
show bridge root.b data port.
trunk_1 peer_dev=0
internal peer_dev=0
dmz peer_dev=0
wan2 peer_dev=0
wan1 peer_dev=0
Perform a sniffer trace

When troubleshooting networks and routing in particular, it helps to look inside the
headers of packets to determine if they are traveling along the route you expect that they
are. Packet sniffing can also be called a network tap, packet capture, or logic analyzing.
Note: If your FortiGate unit has NP2 interfaces that are offloading traffic, this will change
the sniffer trace. Before performing a trace on any NP2 interfaces, you should disable
offloading on those interfaces.
What can sniffing packets tell you

If you are running a constant traffic application such as ping, packet sniffing can tell you if
the traffic is reaching the destination, what the port of entry is on the FortiGate unit, if the
ARP resolution is correct, and if the traffic is being sent back to the source as expected.
Sniffing packets can also tell you if the Fortigate unit is silently dropping packets for
reasons such as RPF (Reverse Path Forwarding), also called Anti Spoofing, which
prevents an IP packet from being forwarded if its Source IP does not either belong to a
locally attached subnet (local interface), or be part of the routing between the FortiGate
and another source (static route, RIP, OSPF, BGP). Note that RPF can be disabled by
turning on asymmetric routing in the CLI (config system setting, set asymetric
enable), however this will disable stateful inspection on the FortiGate unit and cause
many features to be turned off.
Note If you configure virtual IP addresses on your Fortigate unit, it will use those
addresses in preference to the physical IP addresses. You will notice this when you are
sniffing packets because all the traffic will be using the virtual IP addresses. This is due to
the ARP update that is sent out when the VIP address is configured.

01-42002-0129304-20101025 73
How do you sniff packets

The general form of the internal FortiOS packet sniffer command is:
diag sniffer packet <interface_name> <‘filter’> <verbose>

<count>
To stop the sniffer, type CTRL+C.
<interface_name> The name of the interface to sniff, such as “port1” or “internal”.

This can also be “any” to sniff all interfaces.
<‘filter’> What to look for in the information the sniffer reads. “none”
indicates no filtering, and all packets will be displayed as the other
arguments indicate.
The filter must be inside single quotes (‘).
<verbose> The level of verbosity as one of:
1 - print header of packets
2 - print header and data from IP of packets
3 - print header and data from Ethernet of packets
<count> The number of packets the sniffer reads before stopping. If you
don’t put a number here, the sniffer will run forever unit you stop it
with <CTRL C>.
For a simple sniffing example, enter the CLI command diag sniffer packet port1
none 1 3. This will display the next 3 packets on the port1 interface using no filtering,
and using verbose level 1. At this verbosity level you can see the source IP and port, the
destination IP and port, action (such as ack), and sequence numbers.
In the output below, port 443 indicates these are HTTPS packets, and 172.20.120.17 is
both sending and receiving traffic.
Head_Office_620b # diag sniffer packet port1 none 1 3
interfaces=[port1]
filters=[none]
0.545306 172.20.120.17.52989 -> 172.20.120.141.443: psh
3177924955 ack 1854307757
0.545963 172.20.120.141.443 -> 172.20.120.17.52989: psh

1854307757 ack 3177925808
0.562409 172.20.120.17.52988 -> 172.20.120.141.443: psh

4225311614 ack 3314279933
For a more advanced example of packet sniffing, the following commands will report
packets on any interface travelling between a computer with the host name of “PC1” and
the computer with the host name of “PC2”. With verbosity 4 and above, the sniffer trace
will display the interface names where traffic enters or leaves the FortiGate unit.
Remember to stop the sniffer, type CTRL+C.
FGT# diagnose sniffer packet any "host <PC1> or host <PC2>" 4
or
FGT# diagnose sniffer packet any "(host <PC1> or host <PC2>) and
icmp" 4

74 01-42002-0129304-20101025
The following sniffer CLI command includes the ARP protocol in the filter which may be
useful to troubleshoot a failure in the ARP resolution (for instance PC2 may be down and
not responding to the FortiGate ARP requests).
FGT# diagnose sniffer packet any "host <PC1> or host <PC2> or

arp" 4
Debug the packet flow

Traffic should come in and leave the FortiGate. If you have determined that network traffic
is not entering and leaving the FortiGate unit as expected, debug the packet flow.
Debugging can only be performed using CLI commands. Debugging the packet flow
requires a number of debug commands to be entered as each one configures part of the
debug action, with the final command starting the debug.
Note: If your FortiGate unit has NP2 interfaces that are offloading traffic, this will change
the packet flow. Before performing the debug on any NP2 interfaces, you should disable
offloading on those interfaces.
The following configuration assumes that PC1 is connected to the internal interface of the
FortiGate unit and has an IP address of 10.11.101.200. PC1 is the host name of the
computer.
To debug the packet flow in the CLI, enter the following commands:
FGT# diag debug enable
FGT# diag debug flow filter add <PC1>
FGT# diag debug flow show console enable
FGT# diag debug flow trace start 100
FGT# diag debug enable
The start 100 argument in the above list of commands will limit the output to 100
packets from the flow. This is useful for looking at the flow without flooding your log or
display with too much information.
To stop all other debug activities, enter the command:

FGT# diag debug flow trace stop
The following is an example of debug flow output for traffic that has no matching Firewall
Policy, and is in turn blocked by the FortiGate unit. The denied message indicates the
traffic was blocked.
msg="vd-root received a packet(proto=6,
192.168.129.136:2854->192.168.96.153:1863) from port3."
id=20085 trace_id=319 func=resolve_ip_tuple line=2924

msg="allocate a new session-013004ac"

id=20085 trace_id=319 func=fw_forward_handler line=248 msg="

Denied by forward policy check"

01-42002-0129304-20101025 75
Examine the firewall session list

One further step is to examine the firewall session. The firewall session can
When examining the firewall session list in the CLI, filters may be used to reduce the
output. In the web-based manager, the filters are part of the interface.
To examine the firewall session list in the web-based manager

1 Go to System > status > Dashboard > Top Sessions.
2 Select Detach, and then Details.
3 Expand the session window to full screen to display the information.
4 Change filters, view associated firewall policy, column ordering, and so on to analyze
the sessions in the table.
5 Select the delete icon to terminate the session.
To examine the firewall session list in the CLI

FGT# diag sys session filter src PC1
FGT# diag sys session list
or
FGT# diag sys session filter dst PC1
FGT# diag sys session list
To clear all sessions corresponding to a filter

FGT# diag sys session filter dst PC1
FGT# diag sys session clear
Other diagnose commands

Diagnose commands are a series of commands available on all FortiGate units. These
commands can help you troubleshoot network activity. The packet sniffer mentioned
earlier is only one of many useful diagnose commands.
For additional diagnostic commands, see “Troubleshooting ‘get’ commands” on page 77.

76 01-42002-0129304-20101025
Troubleshooting ‘get’ commands
Troubleshooting ‘get’ commands

This section lists the CLI get commands that you can use to troubleshoot problems with
your FortiGate unit.
exec tac report get system session-info full-stat

get firewall iprope list get system session-helper
get firewall iprope appctrl get system session-table list
get firewall proute get system session-table statistics
get hardware cpu get system session-info ttl
get hardware memory get system startup-error-log
get hardware nic get test application
get hardware npu ipsec-sa get test application urlfilter
get hardware npu list get vpn status ike config
get hardware npu performance get vpn status ike crypto
get hardware npu status get vpn status ike errors
get hardware status get vpn status ike status detailed
get ips session get vpn status ipsec
get router info kernel get vpn status ssl hw-acceleration-
get system arp status
get system auto-update version get vpn status ssl list
get system ha status get vpn status tunnel dialup-list
get system performance firewall get vpn status tunnel list
get system performance firewall get vpn status tunnel stat
packet-distribution get vpn status concentrator
get system performance status get webfilter ftgd-statistics
get system performance top get webfilter status

01-42002-0129304-20101025 77
exec tac report Troubleshooting ‘get’ commands
exec tac report

Displays all debugging information including hardware/software status and information,
configuration, and debug outputs.
Syntax
exec tac report
Parameters
None.
Usage/Remarks
Use this command to view the information required when calling customer support.
When you run this command, it will take up to a few minutes to collect and display all the
information.
Scope: Global and Vdom
Output Example
FGT # exec tac report
----------------------------------------------------------------
Serial Number: FGT5002803033313 Diagnose output
----------------------------------------------------------------
Version: Fortigate-500 3.00,build0750,091009
Virus-DB: 8.00631(2008-01-15 14:27)
IPS-DB: 2.00461(2008-01-18 11:23)
Serial-Number: FGT5002803033313
BIOS version: 03000300
Log hard disk: Available
Hostname: FGT5002803033313
Operation Mode: NAT
Current virtual domain: root
Max number of virtual domains: 10
Virtual domains status: 2 in NAT mode, 1 in TP mode
Virtual domain configuration: enable
FIPS-CC mode: disable
Current HA mode: standalone
Distribution: International
Branch point: 750
MR/Patch Information: MR7 Patch 7
System time: Tue Dec 8 15:35:34 2009

78 01-42002-0129304-20101025
Troubleshooting ‘get’ commands get firewall iprope list
get firewall iprope list

Displays the rules defined in the Policy Group defined in the parameter. If no parameter is
entered, all the rules of every Policy Group is displayed.
Syntax
get firewall iprope list <policy group number>
Parameters
<policy group > The number of the Policy Group as defined in the Web Config
menu Firewall > Policy > Policy tab.
Usage/Remarks
Use this command to view the view the rules defined for a Policy Group. This is useful to
understand the behavior of the Policy Group per protocol.
Scope: Vdom
Output Example
FGT # get firewall iprope list 1
policy flag (20): auth
flag2 (0): imflag: sockport: 0 action: accept index: 0
schedule() group=00000001 av=00000000 au=00000000 vip=00000000
host=0 misc=0 grp_info=0 seq=0 hash=0
tunnel=
zone(1): 0 ->zone(1): 0
source(1): 0.0.0.0-255.255.255.255,
dest(1): 0.0.0.0-255.255.255.255,
source wildcard(0):
destination wildcard(0):
service(1):
[17:0x0:0/(0,65535)->(53,53)]
nat(1): flag=0 base=0.0.0.0:53 0.0.0.0-0.0.0.0(53:53)
mms: 0 0

01-42002-0129304-20101025 79
get firewall iprope appctrl Troubleshooting ‘get’ commands
get firewall iprope appctrl

Displays the list of applications defined in the application control list.
Syntax
get firewall iprope appctrl list
get firewall iprope appctrl status
Parameters
Usage/Remarks
Use this command to view the view the rules defined for peer to peer, or the status of
those rules.
Scope: Vdom
Output Example
FGT # get firewall iprope appctrl list
app-id=17953 list-id=2004 action=Pass
FGT # get firewall iprope appctrl status

appctrl table 3 list 1 app 1083 shaper 0
Keyword/Variable Description
list Display all the application IDs, which list they are in by ID, and the action
taken for each application.
status Display the number of ipropes for application control tables, lists,
applications, and traffic shapers.

80 01-42002-0129304-20101025
Troubleshooting ‘get’ commands get firewall proute
get firewall proute

Display configured policy routes.
Syntax
get firewall proute
Parameters
None.
Usage/Remarks
Use this command to view the policy routes configured on this unit’s current VDOM.
Scope: Vdom
Output Example
FGT # get firewall proute
list route policy info(vf=root):
iff=12 src=10.10.10.0/255.255.255.0 tos=0x00 tos_mask=0x00

dst=10.10.11.0/255.255.255.0 protocol=11 port=1:65535
oif=13 gwy=0.0.0.0
vf The current virtual domain (VDOM). All policy routes for this VDOM are
displayed.
iff Incoming interface
src The source IP and netmask for incoming traffic to be matched to the
policy
tos Type of service bit pattern in hexadecimal. This is matched and is good
for a specific TOS.
tos_mask Type of service bit mask in hexadecimal. Masks out unwanted bits. This
is good for matching multiple TOS values.
dst The destination IP and netmask for incoming traffic to be matched to the
policy.
protocol The protocol number to be matched.
port The range of ports to match for incoming traffic.
oif Outgoing interface where traffic is being directed to.
gwy Outgoing gateway where traffic is being directed to

01-42002-0129304-20101025 81
get hardware cpu Troubleshooting ‘get’ commands
get hardware cpu

Displays the CPU information.
Syntax
get hardware cpu
Parameters
Usage/Remarks
Use this command to view the specifications about all CPUs on the FortiGate unit.
Scope: Global
Output Example
FGT # get hardware cpu
Description sundance Ethernet driver1.01+LK1.21
chip_id 6
IRQ 5
System_Device_Name wan1
State up
Link up
Speed 100
Duplex full
Rx_Packets 52377
Tx_Packets 53098
Rx_Packets 47029877
Tx_Bytes 7199983
Collisions 0
Rx_Missed_Errors 0
Tx_Carrier_Errors 0
Description Name of the network driver.
chip_id Id of the chipset
IRQ IRQ
System_Device_Name Network device name (i.e. The physical interface name).
Current_HWaddr Current MAC address.
Permanent_HWaddr Permanent MAC address.
State Administrative status (up/down).
Link Link status (up/down).
Speed Negotiated or configured network speed.
Duplex Negotiator configured duplex mode.
Rx_Packets Packets' number received by the network device.

82 01-42002-0129304-20101025
Troubleshooting ‘get’ commands get hardware cpu
Tx_Packets Packets number transmitted by the network device.
Rx_Packets Amount of bytes received on the interface.
Tx_Bytes Amount of bytes sent from this interface.
Collisions Number of collisions usually due mostly to incorrect incorrect speed or
duplex settings.
Only valid in 1000M mode, which is marked by PHY.
transmission. Failure to do so may indicate that the link has failed, or
the PHY has an incorrect link configuration. This register only
increments if transmits are enabled. This register is not valid in internal
SerDes1 mode (TBI mode for the 82544GC/EI), and is only valid when
the Ethernet controller is operating at full duplex.

01-42002-0129304-20101025 83
get hardware nic Troubleshooting ‘get’ commands
get hardware nic

Displays information and statistics for the network interface card (NIC) specified.
Syntax
get hardware nic <interface>
Parameters
<interface> Enter the interface name. For example, internal, wan1, wan2.
Usage/Remarks
Use this command to view the interface information and statistics. This is useful when
debugging network problems on a particular interface, or providing Customer Support with
hardware information about your FortiGate unit.
Note that the output will be different for different NICs
Scope: Global
Output Example
FGT # get hardware nic wan1
Description sundance Ethernet driver1.01+LK1.21
chip_id 6
IRQ 5
System_Device_Name wan1
State up
Link up
Speed 100
Duplex full
FlowControl Tx off, Rx off
MTU_Size 1500
Rx_Packets 52377
Tx_Packets 53098
Rx_Packets 47029877
Tx_Bytes 7199983
Collisions 0
Rx_Missed_Errors 0
Tx_Carrier_Errors 0
Description Name of the network driver.
chip_id Id of the chipset
IRQ IRQ
System_Device_Name Network device name (i.e. The physical interface name).
Current_HWaddr Current MAC address.
Permanent_HWaddr Permanent MAC address.

84 01-42002-0129304-20101025
Troubleshooting ‘get’ commands get hardware nic
State Administrative status (up/down).
Link Link status (up/down).
Speed Negotiated or configured network speed.
Duplex Negotiated or configured duplex mode.
Rx_Packets Packets' number received by the network device.
Tx_Packets Packets number transmitted by the network device.
Rx_Packets Amount of bytes received on the interface.
Tx_Bytes Amount of bytes sent from this interface.
Collisions Number of collisions usually due mostly to incorrect incorrect speed or
duplex settings.
Only valid in 1000M mode, which is marked by PHY.
transmission. Failure to do so may indicate that the link has failed, or
the PHY has an incorrect link configuration. This register only
increments if transmits are enabled. This register is not valid in internal
SerDes1 mode (TBI mode for the 82544GC/EI), and is only valid when
the Ethernet controller is operating at full duplex.

01-42002-0129304-20101025 85
get hardware cpu Troubleshooting ‘get’ commands
get hardware cpu

Displays the detailed information for all installed CPUs on this unit.
Syntax
get hardware cpu
Parameters
None.
Usage/Remarks
Use this command to view detailed information about all CPUs on this unit. They are
numbered starting from zero. This list includes the main CPU, any NPUs, and any other
CPUs.
In addition to the brand, family, model, model name, speed and cache of the CPUs you
can also view the flags that are set which may help with advanced debugging.
Scope: Global
Output Example
FGT # get hardware cpu
processor : 0
vendor_id : GenuineIntel
cpu_family : 6
model : 8
model name : Pentium III (Coppermine)
stepping : 10
cpu Mhz : 701.596
cache size : 256 KB
fdiv_bug : no
hlt_bug : no
f00f_bug : no
coma_bug : no
fpu : yes
fpu_exception: yes
cpuid level : 2
wp : yes
flags : fpu vme de pse tsc msr pae mce cx8 sep mtrr pge mca
cmov pat pse36 mmx fxsr sse
bogomips : 1399.19

86 01-42002-0129304-20101025
Troubleshooting ‘get’ commands get hardware memory
get hardware memory

Displays the status of the memory resources.
Syntax
get hardware memory
Parameters
None.
Usage/Remarks
Use this command to view the status of the memory resources. This is useful to confirm
and identify any potential memory leaks or even to simply confirm that reduced FortiOS
performance is due to a shortage of free memory.
Scope: Global
Output Example
FGT # get hardware memory
total: used: free: shared: buffers: cached: shm:

Mem: 261955584 97312768 164642816 0 217088 55382016 51322880
Swap: 0 0 0
MemTotal: 255816 kB
MemFree: 160784 kB
MemShared: 0 kB
Buffers: 212 kB
Cached: 54084 kB
SwapCached: 0 kB
Active: 22832 kB
Inactive: 31524 kB
HighTotal: 0 kB
HighFree: 0 kB
LowTotal: 255816 kB
LowFree: 160784 kB
SwapTotal: 0 kB
SwapFree: 0 kB
Mem Memory size.
Swap Amount of memory in the swap
MemTotal HighTotal + LowTotal = amount of memory available on the unit
MemFree Free memory on the unit
SwapCached Amount of memory out of the Swap but remaining in the cache
Active Amount of memory recently used
Inactive Amount of memory which has not been used for a while
HighTotal Amount of memory which belongs to the zone ZONE_HIGHMEM
LowFree Amount of Free memory available in the zone ZONE_NORMAL

01-42002-0129304-20101025 87
get hardware npu ipsec-sa Troubleshooting ‘get’ commands
get hardware npu ipsec-sa

Display the IPSec security association (SA) of the network processing unit (NPU).
To apply hardware accelerated encryption and decryption, the FortiGate unit’s main
processing resources must first perform Phase I negotiations to establish the security
association (SA). The SA includes cryptographic processing instructions required by the
network processor, such as which encryption algorithms must be applied to the tunnel.
After ISAKMP negotiations, the FortiGate unit’s main processing resources send the SA to
the network processor, enabling the network processor to apply the negotiated hardware
accelerated encryption or decryption to tunnel traffic.
Syntax
get hardware npu { npu1 | npu2 | npu4} ipsec-sa <dev_name>
Parameters
<dev-name>
Usage/Remarks
Use this command to view the security association for hardware acceleration.
Scope: Global

88 01-42002-0129304-20101025
Troubleshooting ‘get’ commands get hardware npu list
get hardware npu list

Displays the network processing unit (NPU) devices and paired interface names.
This is important to know because the paired interfaces can be offload their traffic from the
main CPU to their NPU. However this can only be accomplished with paired interfaces.
Syntax
get hardware npu { legacy | np1 | np2 | np4 } list
Parameters
{ legacy | np1 | Specify which level of NPU interfaces are to be displayed.

np2 | np4 }
Usage/Remarks
Use this command to view the NPU devices and port numbers. This is useful because
some FortiOS products contain contain network processors. Network processor features,
and therefore offloading requirements, vary by network processor model.
If the specified version of NPU is not present on this FortiOS unit, a message indicating
that will be displayed.
Scope: Global
Output Example
FGT # get hardware npu np1 list
ID Interface
0 port9 port10
FGT # get hardware npu np2 list

ID PORTS
-- -----
0 port1
0 port2
0 port3
0 port4
ID PORTS
-- -----
1 port5
1 port6
1 port7
1 port8
ID PORTS
-- -----
2 port9
2 port10
2 port11
2 port12
ID PORTS

01-42002-0129304-20101025 89
get hardware npu list Troubleshooting ‘get’ commands
-- -----
3 port13
3 port14
3 port15
3 port16
ID The ID of the NPU assigned to these ports.
Interface The names of the interfaces in the NPU’s paired group.
An NPU can handle either two or four ports. Any incoming traffic on this
group of ports that leaves the FortiOS unit on the same group of ports
can be handled by the NPU. Otherwise, the unit’s CPU will be involved.
PORTS The names of the ports in the NPU’s group.

90 01-42002-0129304-20101025
Troubleshooting ‘get’ commands get hardware npu performance
get hardware npu performance

Displays the NPU performance for ISCP2, messages, and NAT.
Syntax
get hardware npu { legacy | np1 | np2 | np4 }performance <dev_id>
Parameters

np2 | np4 }
<dev_id> NPU ID number. If you are unsure you can enter a “?” to get a list
of available valid NPU ID numbers.
Usage/Remarks
Use this command to view the performance numbers for NPU devices. This can be useful
when you are checking NPU traffic—either for specific problems or for network
optimization.
Network processor features, and therefore offloading requirements, vary by network
processor model.
The values displayed are generally counts for the stated values. For example BADCSUM
is the number of bad checksums encountered.
Scope: Global
Output Example
FGT # get hardware npu np2 performance 1
ISCP2 Performance:
Nr_int : 0x00000005 INTwoInd : 0x00000000 RXwoDone :
0x00000000
PKTwoEnd : 0x00000000 PKTCSErr : 0x00000000
PKTidErr : 0x00000000 PHYInt : 0x0/0x0/0x0/0x0
CSUMOFF : 0x00000000 BADCSUM : 0x00000000 MSGINT :
0x00000000
IPSEC : 0x00000000 IPSVLAN : 0x00000000 SESMISS :
0x00000000
TOTUP : 0x00000000 TCPPLTOT : 0x00000000 TCPPLBADCT:
0x00000000
TCPPLBADL: 0x00000000 TCPPLSESI : 0x00000000 TCPPLSESR :
0x00000000
TCPPLBD : 0x00000000 TXInt : 0x0/0x0/0x0/0x0 RxI : 0x0
BDEmpty : 0x0/0x0/0x0/0x0 Congest: 0x0/0x0/0x0/0x0
TMM_Busy : 0x0
Poll List: 0 0 0 0
MSG Performance:
TOTMSG : 0x00000000 BADMSG : 0x00000000 TOUTMSG :
0x00000000 MSGLostEvent : 0x00000000
QUERY : 0x00000000 TAE : 0x00000000
SAEXP-SN : 0x00000000 SAEXP-TRF : 0x00000000 OUTUPD :
0x00000000 INUPD : 0x00000000
NULLTK: 0x00000000
NAT Performance: BYPASS (Enable) BLOCK (Disable)

01-42002-0129304-20101025 91
get hardware npu performance Troubleshooting ‘get’ commands
IRQ :00000005 QFTL :00000000 DELF :00000000 FFTL :00000000

OVTH :00000005 QRYF :00000000 INSF :00000000 INVC :00000000
ALLO :00000005 FREE :00000005 ALLOF :00000000 BPENTR:00000000 B
KENTR:00000000
PBPENTR:00000000 PBKENTR:00000000 NOOP :00000000 THROT :0000000
0(0x002625a0)
SWITOT:00000000 SWDTOT:00000000 ITDB:00000000 OTDB:000000000
SPISES:00000000 FLUSH:00000021
ISCP2 Performance This section displays information about the ISCP2 performance.
MSG Performance This section displays information about message traffic performance.
NAT Performance This section displays information about NAT traffic performance.
If BYPASS is enabled many of the counters will be zero.

92 01-42002-0129304-20101025
Troubleshooting ‘get’ commands get hardware npu status
get hardware npu status

Displays the NPU device status.
Syntax
get hardware npu { legacy | np1 | np2 | np4 }status <dev_id>
Parameters

np2 | np4 }
<dev_id> NPU ID number. If you are unsure you can enter a “?” to get a list
of available valid NPU ID numbers.
Usage/Remarks
Use this command to display the status of the interfaces attached to the NPU. This can be
useful for advanced users to debug traffic on the NPU interfaces.
If you enter an NPU or device ID that doesn’t exist, an error message stating that it was na
invalid NPU ID will be displayed.
Scope: Global
Output Example
FGT # get hardware np2 status 1
NP2 Status
ISCP2 c2160000 (Neighbor f7940000) 1a29:0703 256MB Base f8a5a000

DBG 0x00000000
RX SW Done 0 MTP 0x0
desc_alloc = c2152000
desc_size = 0x2000 count = 0x100
nxt_to_u = 0x0 nxt_to_f = 0x0
Total Interfaces: 4 Total Ports: 4
Number of Interface In-Use: 4
Interface c2160100 netdev c22bb000 0 Name port5
PHY: Attached
LB Mode 0 LB IDX 0/1 LB Ports: c2160644, 00000000, 00000000,
00000000
Port c2160644 Id 0 Status Down ictr 4
desc = c2232000
nxt_to_u = 0x00000000 nxt_to_f = 0x00000000
Intf c2160100
Interface c2160250 netdev c2168c00 1 Name port6
PHY: Attached
LB Mode 0 LB IDX 0/1 LB Ports: c21606f8, 00000000, 00000000,
00000000
Port c21606f8 Id 1 Status Down ictr 0
desc = c2126000
nxt_to_u = 0x00000000 nxt_to_f = 0x00000000
Intf c2160250

01-42002-0129304-20101025 93
get hardware npu status Troubleshooting ‘get’ commands
Interface c21603a0 netdev c2168800 2 Name port7

PHY: Attached
LB Mode 0 LB IDX 0/1 LB Ports: c21607ac, 00000000, 00000000,
00000000
Port c21607ac Id 2 Status Down ictr 0
desc = c2123000
nxt_to_u = 0x00000000 nxt_to_f = 0x00000000
Intf c21603a0
Interface c21604f0 netdev c2168400 3 Name port8
PHY: Attached
LB Mode 0 LB IDX 0/1 LB Ports: c2160860, 00000000, 00000000,
00000000
Port c2160860 Id 3 Status Down ictr 0
desc = c2122000
nxt_to_u = 0x00000000 nxt_to_f = 0x00000000
Intf c21604f0
NAT Information:
cmdq_qw = 0x2000 cmdq = c2140000
head = 0x5 tail = 0x5
APS (Enabled) information:
Session Install when TMM TSE OOE: Disable
Session Install when TMM TAE OOE: Disable
IPS anomaly check policy: Follow config
MSG Base = c2130000 QL = 0x1000 H = 0x0

94 01-42002-0129304-20101025
Troubleshooting ‘get’ commands get hardware status
get hardware status

Displays basic hardware information about the unit.
Syntax
get hardware status
Parameters
None.
Usage/Remarks
Use this command to get basic information about your unit’s hardware. This is a short list
that can be used to help guide troubleshooting efforts, especially by customer service. For
example if there is supposed to be compact flash memory available but this command
shows 0MB available, then you know there is a hardware problem with the memory.
Scope: Global
Output Example
FGT # get hardware status
Model name: Fortigate-3810A
ASIC version: CP6
ASIC SRAM: 64M
CPU: 02/21
RAM: 3532 MB
Compact Flash: 122 MB /dev/hda
USB Flash: not available
Network Card chipset: Broadcom 570x Tigon3 Ethernet Adapter
(rev.0x8003)
Network Card chipset: Intel(R) PRO/1000 Network Connection
(rev.0006)Related Commands

01-42002-0129304-20101025 95
get ips session Troubleshooting ‘get’ commands
get ips session

Displays the IPS session status. An Intrusion prevention system (IPS) is a network
security device that monitors network and/or system activities for malicious or unwanted
behavior and can react, in real-time, to block or prevent those activities.
Syntax
get ips session
Parameters
None.
Usage/Remarks
Viewing the IPS session status allows you to see if traffic is checked by the IPS engine
and if the IPS engine is working as expected. You can see the type of traffic and how
many sessions are being processed by the IPS engine. You can also see how much
memory the IPS engine is using.
Scope: Vdom
Output Example
FGT # get ips session
SYSTEM:
memory capacity 73400320
memory used 3982780
recent pps\bps 0\0K
session in-use 0
TCP: in-use\active\total 0\0\0
UDP: in-use\active\total 0\0\0
ICMP: in-use\active\total 0\0\0
memory capacity Total memory capacity in system.
memory used Used memory in system by IPS session.
recent pps\bps Recent IPS traffic in packets per second (pps) and bits per second
(bps).
session in-use Current IPS sessions in use.
TCP: in- The number of in use, active, and totalTransmission Control Protocol
use\active\total (TCP) messages.
UDP: in- The number of in use, active, and total User Datagram Protocol (UDP)
use\active\total messages.
ICMP: in- The number of in use, active and total Internet Control Message
use\active\total Protocol (ICMP) messages.

96 01-42002-0129304-20101025
Troubleshooting ‘get’ commands get router info kernel
get router info kernel

Displays the kernel routing table.
Syntax
get router info kernel
Parameters
None.
Usage/Remarks
Use this command to view the kernel routing table. Almost all computers and network
devices connected to Internet use routing tables to compute the next hop for a packet. It is
electronic table that is stored in a router or a networked computer. The routing table stores
the routes to particular network destinations. This information contains the topology of the
network immediately around it. The construction of routing table is the primary goal of
routing protocols and static routes.
Scope: Vdom
Output Example
FGT # get router info kernel
tab=254 vf=2 scope=0 type=1 proto=11 prio=0 0.0.0.0/0.0.0.0/0-
>192.168.0.0/24 pref=0.0.0.0 gwy=9.1.1.1 dev=5(port1)
192.168.0.0/24 The destination network or destination host.
gwy=9.1.1.1 The gateway address for the next hop.
dev=5(port1) Interface to which packets for this route is sent.

01-42002-0129304-20101025 97
get system arp Troubleshooting ‘get’ commands
get system arp

Displays the IPv4 ARP table.
Syntax
get system arp
Parameters
None.
Usage/Remarks
This command is useful to view or alter the contents of the kernel's ARP tables. For
example when you suspect a duplicate Internet address is the cause for some intermittent
network problem.
This command is not available in multiple VDOM mode.
Scope: Vdom
Output Example
FGT # get system arp
Address Age(min) Hardware Addr Interface
172.20.120.16 0 00:0d:87:5c:ab:65 internal
172.20.120.138 0 00:08:9b:09:bb:01 internal
Address The IP address that is linked to the MAC address. The default is
0.0.0.0
Age Current duration of the ARP entry in minutes. The default is 0.
Hardware Addr The hardware, or MAC address, to link with this IP
address. The default is 00:00:00:00:00:00:
Interface The physical interface the address is on.

98 01-42002-0129304-20101025
Troubleshooting ‘get’ commands get system auto-update
get system auto-update

Use this command to display information about the status FortiGuard updates on the
FortiGate unit.
Syntax
get system auto-update status
get system auto-update versions
Parameters
None.
Usage/Remarks
Use this command when you need to view the current antivirus and IPS status from the
FortiGate.
The status command is used to test the current connectivity status, and can retrieve
configuration information, such as Push Updates, Update schedules, or other parameters
related to the FortiGuard service operation.
The versions command provides extended information about each FortiGuard component
and its version, build number, contract expiry date, last update attempts and results.
Note: Result: Connectivity failure indicates the connections to the FortiGuard

servers is not possible. This may be a serious problem that needs to be addressed. Until it
is solved, you may not receive any FortiGuard updates leaving your network vulnerable.
These commands also allow the user to check whether the FortiGate is running the latest
AV and IPS packages.
Scope: Global
Output Example
FGT # get system auto-update status
FDN availabilty: available at Mon May 26 20:16:43 2008
Push update: disable

Scheduled update: enable
Update every: 1 hours at 16 minutes after the hour
Virus definitions update: enable
IPS definitions updates: enable
Server override: disable
Push address override: disable
Web proxy tunneling: disable
FDN availabilty Specify availability status and last access time (access time
corresponds to the scheduled update settings).
Possible values are: available/unavailable.
Push update Specify wether push update method is enabled or disabled.
Possible values are: enable/disable
Scheduled update Specify wether scheduled update is enabled or disabled.
Possible values are: enable/disable.

01-42002-0129304-20101025 99
get system auto-update Troubleshooting ‘get’ commands
Update every If scheduled update is enabled, specify the time defined to launch
the update.
IPS definitions updates Specify wether the IPS definitions update is enabled or disabled.
Server override Specify wether the use of another FDS server is enabled or
disabled.
If enabled a new line is displayed showing the FDS IP address
defined in the configuration.
For example:
Server override: enable
Server: 10.0.0.1
Push address override If push update is enabled, specify wether the Fortigate override
address feature is enabled or disabled.
If enabled, a new line is displayed showing the FDS IP address
and the TCP port (a.b.c.d:port) defined in the configuration.
Example:
Push address override: enable
Address: 10.0.0.2:9443
Web proxy tunneling Specify wether FortiGate device is using a proxy to retrieve AV
and IPS definitions updates.
If enabled, additional lines are displayed showing the proxy
settings.
Example:
Web proxy tunneling: enable
Proxy address: 10.0.0.3
Proxy port: 8890
Username: foo
Password: foo
FGT # get system auto-update versions

Last Update Attempt: Thu Sep 16 01:37:08 2010
Result: Connectivity failure
Attack Definitions
---------
Version: 2.00720
Contract Expiry Date: n/a
Last Updated using manual update on Tue Dec 1 17:55:00 2009
IPS Attack Engine

---------
Version: 1.00161
Last Updated using manual update on Tue Mar 23 15:21:00 2010
AS Rule Set
---------
Version: 1.00001

100 01-42002-0129304-20101025
Troubleshooting ‘get’ commands get system auto-update

AS Engine
---------
Version: 1.00001
Build: 0111
Vulnerability Compliance and Mangement
---------
Version: 1.00098
Last Updated using manual update on Thu Feb 11 16:40:00 2010
Last Update Attempt: n/a
Result: Updates Installed

01-42002-0129304-20101025 101
get system auto-update version Troubleshooting ‘get’ commands
get system auto-update version

Displays antivirus and IPS engines and definitions, and license information.
Syntax
get system auto-update version
Parameters
None.
Usage/Remarks
Use this command to view the antivirus and IPS engines and definitions and license
information. This is useful in determining when the antivirus engine, virus definitions,
attack definitions, IPS attack definitions, AS Rule set, AS engine, and FDS address were
last updated, when their contracts expire, which version they are using, and the result of
the last update.
Scope: Global
Output Example
FGT # get system auto-update version
AV Engine
---------
Version: 3.003
Last Updated using manual update on Wed Jan 9 18:26:00 2008
Virus Definitions
---------
Version: 8.631
Last Updated using manual update on Tue Jan 15 14:27:00 2008
Attack Definitions
---------
Version: 2.461
Last Updated using manual update on Fri Jan 18 11:23:00 2008
IPS Attack Engine

---------
Version: 1.091
Last Updated using manual update on Wed Jan 9 18:22:00 2008

102 01-42002-0129304-20101025
Troubleshooting ‘get’ commands get system auto-update version

FDS Address
---------
Version Version number of the engine or the definitions.
Contract Expiry Date The date the contract expires.
Last Updated using Date of the last manual update.
manual update on
Last Update Attempt The date when the last update was attempted.
Result The status of the last update.

01-42002-0129304-20101025 103
get system ha status Troubleshooting ‘get’ commands
get system ha status

Use this command to display information about an HA cluster. The command displays
general HA configuration settings. The command also displays information about how the
cluster unit that you have logged into is operating in the cluster.
Syntax
get system ha status
Parameters
None.
Usage/Remarks
Usually you would log into the primary unit CLI using SSH or telnet. In this case the
diagnose system ha status command displays information about the primary unit
first, and also displays the HA state of the primary unit (the primary unit operates in the
work state).
For a virtual cluster configuration, the diagnose system ha status command displays
information about how the cluster unit that you have logged into is operating in virtual
cluster 1 and virtual cluster 2. For example, if you connect to the cluster unit that is the
primary unit for virtual cluster 1 and the subordinate unit for virtual cluster 2, the output of
the diagnose system ha status command shows virtual cluster 1 in the work state and
virtual cluster 2 in the standby state. The diagnose system ha status command also
displays additional information about virtual cluster 1 and virtual cluster 2.
See the FortiGate CLI Reference Guide for more information.
Scope: Global
Output Example
FGT # get system ha status
Model: 5000
Mode: a-a
Group: 0
Debug: 0
ses_pickup: disable
load_balance: disable
schedule: round robin
Master:128 5001_Slot_4 FG50012204400045 1
Slave :100 5001_Slot_3 FG50012205400050 0
number of vcluster: 1
vcluster 1: work 10.0.0.2
Master:0 FG50012204400045
Slave :1 FG50012205400050
Model The FortiGate model number.
Mode The HA mode of the cluster: a-a or a-p.
Group The group ID of the cluster.
Debug The debug status of the cluster.
ses_pickup The status of session pickup: enable or disable.

104 01-42002-0129304-20101025
Troubleshooting ‘get’ commands get system ha status
load_balance The status of the load-balance-all keyword: enable or disable.
Relevant to active-active clusters only.
schedule The active-active load balancing schedule. Relevant to active-active
clusters only.
Master Master displays the device priority, host name, serial number, and
Slave cluster index of the primary (or master) unit.
Slave displays the device priority, host name, serial number, and cluster
index of the subordinate (or slave, or backup) unit or units.
The list of cluster units changes depending on how you log into the CLI.
Usually you would use SSH or telnet to log into the primary unit CLI. In
this case the primary unit would be at the top the list followed by the
other cluster units.
If you use execute ha manage or a console connection to log into a
subordinate unit CLI, and then enter diagnose system ha status the
subordinate unit that you have logged into appears at the top of the list
of cluster units.
number of vcluster The number of virtual clusters. If virtual domains are not enabled, the
cluster has one virtual cluster. If virtual domains are enabled the cluster
has two virtual clusters.

01-42002-0129304-20101025 105
get system performance firewall Troubleshooting ‘get’ commands
get system performance firewall

Displays the status of important software and hardware systems on your FortiGate unit.
Syntax
get system performance firewall packet-distribution
get system performance firewall statistics
Parameters
None
Usage/Remarks
Use this command to quickly see information about traffic through the firewall.
The Packet-distribution command divides network traffic into ten different packet sizes and
lists the number of packets in each category. This can help you spot hacking attempts or
optimize your network.
The Statistics command provides packet and byte counts for different major protocols and
packet types through the firewall. Packet types include TCP, UDP, ICMP, and IP.
Scope: All (Global and Vdom)
Output Example
FGT# get sys per firewall packet-distribution
getting packet distribution statistics...
0 bytes — 63 bytes: 3624747 packets
> 1500 bytes: 0 packets
FGT# get sys per firewall statistics

getting traffic statistics...
Browsing: 708624 packets, 408018318 bytes
DNS: 411789906583486464 packets, 0 bytes
E-Mail: 0 packets, 0 bytes
FTP: 0 packets, 0 bytes
Gaming: 0 packets, 0 bytes
IM: 0 packets, 0 bytes
Newsgroups: 0 packets, 0 bytes
P2P: 0 packets, 0 bytes
Streaming: 0 packets, 0 bytes
TFTP: 201239863725391872 packets, 56530359549952 bytes
VoIP: 3543070 packets, 25 bytes
Generic TCP: 55834574848 packets, 1786706395136 bytes
Generic UDP: 0 packets, 0 bytes
Generic ICMP: 0 packets, 0 bytes
Generic IP: 0 packets, 0 bytes

106 01-42002-0129304-20101025
Troubleshooting ‘get’ commands get system performance firewall packet-distribution

Displays the statistical data of the different size packets that go through the firewall.
Syntax
Parameters
None.
Usage/Remarks
Use this command to view the number of packets received in each of the listed sizes. This
can help find MTU related problems where larger packets are being split up or not
received properly.
Scope: Vdom
Output Example
FGT # get system performance firewall packet-distribution
getting packet distribution statistics...
> 1500 bytes: 0 packets

01-42002-0129304-20101025 107
get system performance status Troubleshooting ‘get’ commands
get system performance status

Displays the status of important software and hardware systems on your FortiGate unit.
Syntax
get system performance status
Parameters
Usage/Remarks
Use this command to quickly see important information about your FortiGate unit’s state.
Information includes CPU usage, memory usage, network usage, number of sessions,
viruses caught, IPS attacks blocked, and FortiGate unit uptime. These numbers provide a
quick look at how the FortiGate unit is doing. If any one number needs attention, you can
use other commands to get more information on that area.
Output Example
FGT# get sys performance status
CPU states: 0% user 0% system 0% nice 100% idle
Memory states: 10% used
Average network usage: 0 kbps in 1 minute, 0 kbps in 10 minutes,
13 kbps in 30 minutes
Average sessions: 31 sessions in 1 minute, 30 sessions in 10
minutes, 31 sessions in 30 minutes
Virus caught: 0 total in 1 minute
IPS attacks blocked: 0 total in 1 minute
Uptime: 44 days, 18 hours, 42 minutes

108 01-42002-0129304-20101025
Troubleshooting ‘get’ commands get system performance top
get system performance top

Displays the processes running on your FortiGate unit.
Syntax
get system performance top <delay> <max_lines>
Parameters
delay The amount of time, in seconds, in which the process information

is polled. The default is 5 seconds.
max_lines The maximum number of processes displayed in the output. The
default is 20 lines.
Usage/Remarks
Use this command when you need to view the processes running and the information
about each process. It displays as a static set of columns where the information changes
in place. To exit this display, press <Ctrl-C>.
Output Example
FGT # get system performance top 5 20
Run Time: 0 days, 1 hours and 53 minutes
1U, 1S, 97I; 248T, 99F, 73KF
newcli 113 S 1.0 2.1
sshd 107 S 0.7 1.9
newcli 114 R < 0.3 2.1
thttp 48 S 0.0 5.4
ipsengine 55 S < 0.0 5.2
ipsengine 50 S < 0.0 5.2
cmdbsvr 18 S 0.0 3.7
httpsd 71 S 0.0 3.3
httpsd 92 S 0.0 3.3
httpsd 37 S 0.0 2.8
scanunitd 90 S < 0.0 2.2
scanunitd 91 S < 0.0 2.1
merged_daemons 45 S 0.0 2.1
newcli 108 S 0.0 2.1
updated 59 S 0.0 2.0
newcli 112 S < 0.0 2.0
miglogd 35 S 0.0 1.9
nsm 28 S 0.0 1.9
imd 53 S 0.0 1.8
authd 52 S 0.0 1.7
Run Time Displays how long the FortiOS has been running as a string
U User CPU usage (%)
S System CPU usage (%)
I Idle CPU usage (%)
T Total memory

01-42002-0129304-20101025 109
get system performance top Troubleshooting ‘get’ commands
F Free memory
KF Kernel-free memory
Column 1 Process name
Column 2 Process identification (PID)
Column 3 One letter process status.
• S: sleeping process
• R: running process
• <: high priority
Column 4 CPU usage (%)
Column 5 Memory usage (%)

110 01-42002-0129304-20101025
Troubleshooting ‘get’ commands get system session-info full-stat
get system session-info full-stat

Displays the system’s full state session.
Syntax
get system session-info full-stat
Parameters
None.
Usage/Remarks
Use this command to display in-depth information session info about the system’s state.
This includes session table size, expected session table size, session count, firewall error
details, and more.
Scope: Global
Output Example
FGT # get system session-info full-stat
session table: table_size=131072 max_depth=1 used=50
expect session table: table_size=2048 max_depth=1 used=2
misc info: session_count=25 exp_count=2 clash=0
memory_tension_drop=0 ephemeral=0/32752 removeable=24
delete=0, flush=0, dev_down=4/16
firewall error stat:
error1=00000000
error2=00000000
error3=00000000
error4=00000000
tt=00000000
cont=00000000
ids_recv=00000000
url_recv=00000000
av_recv=00000000
fqdn_count=00000000
tcp reset stat:
syncqf=0 acceptqf=0 no-listener=0 data=0 ses=0 ips=0

01-42002-0129304-20101025 111
get system session-helper Troubleshooting ‘get’ commands
get system session-helper

Displays the session helper table IDs.
FortiGate units use session helpers to process sessions that have special requirements.
Session helpers function like proxies by getting information from the session and
performing support functions required by the session.
Syntax
get system session-helper
Parameters
None.
Usage/Remarks
Use this command to display if any of the pre-defined session-helpers are in use.
Scope: Global
Output Example
FGT # get system session-helper
== 1 ==
== 2 ==
== 3 ==
== 4 ==
== 5 ==
== 6 ==
== 7 ==
== 8 ==
== 9 ==
== 10 ==
== 11 ==
== 12 ==
== 13 ==
== 14 ==
== 15 ==
== 16 ==
== 17 ==
== 18 ==
== 19 ==
== 20 ==
1...20 If one of the pre-defined session helpers is in use, it will be listed here.

112 01-42002-0129304-20101025
Troubleshooting ‘get’ commands get system session-table list
get system session-table list

Displays the session table for the current vdom .
Syntax
get system session-table list
Parameters
None.
Usage/Remarks
Use this command to display information about the current session table. This can be a
quick and easy way to troubleshoot strange connectivity issues, such as some
applications working where others will not, or connectivity to one location but not another.
The session table tells you the protocol, IP addresses on both ends, and ports.
Scope: Global
Output Example
FGT # get system session-table list
PROTO EXPIRE SOURCE SOURCE-NAT DDESTINATION DESTINATION-
NAT
tcp 3600 172.16.200.254:46586 - 172.16.200.1:23 -
PROTO The protocol of the session—tcp or udp.
EXPIRE The number of seconds until the session expires.
SOURCE The source IP address and port.
SOURCE-NAT If the source IP is going through NAT, what the new address is.
DDESTINATION The destination IP address and port.
DESTINATION-NAT If the destination IP is going through NAT, what the new address is.

01-42002-0129304-20101025 113
get system session-table statistics Troubleshooting ‘get’ commands
get system session-table statistics

Displays statistics related to the session table.
Syntax
get system session-table statistics
Parameters
None.
Usage/Remarks
Use this command to get more in depth information about the session table including
information about any errors.
Scope: Global
Output Example
FGT # diagnose system session-table statistics
misc info: session_count=1 exp_count=0 clash=0
memory_tension_drop=0 emphemeral=0/57344 removeable=1
delete=0, flush=0, dev_down=0/0
firewall error stat:
error1=00000000
error2=00000000
error3=00000000
error4=00000000
tt=00000000
cont=00000000
ids_recv=00000000
url_recv=00000000
av_recv=00000000
fqdn_count=00000000
tcp reset stat:
syncqf=0 acceptqf=0 no-listener=4 data=0 ses=0 ips=0
global: ses_limit=0 ses6_limit=0 rt_limit=0 rt6_limit=0

114 01-42002-0129304-20101025
Troubleshooting ‘get’ commands get system session-info ttl
get system session-info ttl

Displays the system session time to live (ttl) configuration.
Syntax
get system session-info ttl
Parameters
None.
Usage/Remarks
Use this command to tell you the default time to live setting for sessions All sessions
created will have this length of time before they expire and need to create a new session
table entry.
Scope: Vdom
Output Example
FGT # get system session-info ttl
default : 3600
port:
default The default is 1 hour.
port The session port.

01-42002-0129304-20101025 115
get system startup-error-log Troubleshooting ‘get’ commands
get system startup-error-log

Displays the start-up configuration errors on the console.
Syntax
get system startup-error-log
Parameters
None.
Usage/Remarks
Use this command to view the start-up configuration errors on the console.
Output Example
FGT # get system startup-error-log
>>> config system replacemsg webproxy "http-err"
>>> set buffer "<html><head><title>%%HTTP_ERR_CODE%%
%%HTTP_ERR_DESC%%</title></head><body><font size=2><table
width=\"100%\"><tr><td bgcolor=#3300cc align=\"center\"
colspan=2><font color=#ffffff><b>%%HTTP_ERR_CODE%%
%%HTTP_ERR_DESC%%</b></font></td></tr></table><br><br>The
webserver for %%PROTOCOL%%%%URL%% reported that an error occurred
while trying to access the website. Please click <u><a
href=\"javascript:history.back()\">here</a></u> to return to the
previous page.<br><br><hr></font></body></html>"
>>> set header http
>>> set format html

116 01-42002-0129304-20101025
Troubleshooting ‘get’ commands get test application
get test application

Displays information statistics information, control proxies, and status.
Syntax
get test application <application> <level>
Parameters
<application> • acd — Aggregate Controller

• ddnscd — ddnscd daemon
• dhcprelay — dhcprelay
• dnsproxy — dns proxy
• ftpd — ftp proxy
• http — http proxy
• im — im proxy
• imap — imap proxy
• ipldbd — ipldbd daemon
• ipsengine — ips sensor
• ipsmonitor — ips monitor
• l2tpcd — l2tpcd
• nntp — nntp proxy
• pop3 — pop3 proxy
• pptpcd — pptp client
• proxyacceptor — proxy acceptor
• proxyworker — proxy worker
• scanunit — scanning unit
• sflowd — sflowd
• smtp — smtp proxy
• snmpd — snmpd daemon
• urlfilter — urlfilter daemon
• vs — virtual-server
• wad — wan optimization proxy
• wccpd -wccp daemon

01-42002-0129304-20101025 117
get test application Troubleshooting ‘get’ commands
<level> • 1: Dump Memory Usage

• 2: Drop all connections
• 22: Drop max idle connections
• 222: Drop all idle connections
• 4: Display connection stat
• 44: Display info per connection
• 444: Display connections per state
• 4444: Display per-VDOM statistics
• 44444: Display information about idle connections
• 5: Toggle AV Bypass mode. Toggle AV bypass mode. You
can use this level to diagnose AV scanning. When bypass
mode is activated, no AV scanning is done on traffic
handled by the proxy. Note: Antivirus scanning is
disabled.
• 6: Toggle Print Stat mode every ~40 seconds
• 7: Toggle Backlog Drop
• 8: Clear stats
• 88: Toggle statistic recording — stats cleared
• 9: Toggle Accounting info for display
• 99: Restart proxy. When you suspect a abnormal behavior
of the proxy, you can use this level value to restore it to its
normal state. Note: You will have a disruption in
services.
• 11: Display the SSL session ID cache statistics
• 12: Clear the SSL session ID cache statistics
• 13: Display the SSL session ID cache
• 14: Clear the SSL session ID cache
NOTE: Not all level numbers may be applicable to all

applications. Use the command diagnose test
application <application> 0 to see a list of valid
commands.
Usage/Remarks
Use this command to display information about advanced FortiOS applications such as
SSL, and VoIP.
Scope: Global
Output Examples
FGT # get test application ftpd 1
HTTP Proxy Test Usage
Fortigate-1000#
malloc memory usage
==================
pool buffer size: 2048 count: 2143 available: 2139
total memory used by buffer pools: 4286 (kB)
total allocated (malloc/realloc) memory: 0 (kB)
shm memory usage
==================
buffer pool not initialized
total allocated memory 0

118 01-42002-0129304-20101025
Troubleshooting ‘get’ commands get test application
FGT # get test application http 44

diagnose test application http 44
id=17 clt=914(r=1, w=0) srv=915(r=1, w=0) c:192.168.50.2:3608 ->
s:192.168.135.21:80 c2s/s2c=0/0
state=RESPONSE_PASS_STATE duration=0 expire=3590
Current connections = 1/2368
44 The first number is the counter of currently sessions in the connection
pool of the proxy. The second number is the maximum size of the proxy
connection pool table.
FG # get test application imap 4

Fortigate-1000# Running time (HH:MM:SS:usec) = 22:45:40:124613
Bytes sent = 65 (kb)
Bytes received = 2895 (kb)
Error Count (alloc) = 0
Error Count (accept) = 0
Error Count (bind) = 0
Error Count (connect) = 0
Error Count (read) = 0
Error Count (write) = 0
Error Count (poll) = 0
Last Error = 0
Scan Backlog drop = 0
Emails clean = 3
Emails detected = 2
Emails with scan errors = 0
Worms = 0
Blocked = 0
Virus = 2
Suspicious = 0
Fragmented emails = 0
Spam Detected = 0
Content Filtered emails = 0
Oversize Email Pass = 0
Oversize Email Blocked = 0
AV Bypass is off
Print is off
Drop on backlog is off
Account is on
setup_ok=7 setup_fail=0 poll_ok=2576/2576/1 sel_fail=0 conn_ok=0
conn_inp=7
step1=0 step2=0
scan=5 listen=7 cmdb=2 clt=2304 srv=258

01-42002-0129304-20101025 119
get test application Troubleshooting ‘get’ commands
FG # get test application ipsengine 7

FG # PACKET STATISTICS:
total packets 3487023
tcp packets 87
udp packets 0
icmp packets 2476747
discard packets 0
alert packets 45
log packets 0
pass packets 0
fragment packets 0
frag_trackers 0
rebuilt_frags 0
frag_incomplete 0
frag_timeout 0
rebuild_element 0
frag_mem_faults 0
tcp_stream_pkts 87
rebuilt_tcp 5
tcp_streams 4
rebuilt_segs 0
str_mem_faults 0
FG # get test application ipsmonitor 2

FG # enable ipsengine? no
FG # diagnose test application ipsmonitor 2
FG # enable ipsengine? Yes
FG # get test application pop3 444

FG # [OVERSIZE_STATE ] 1/1
FG # get test application smtp 44

FG # id=0 clt=10(r=1, w=0) srv=11(r=1, w=0) c:192.168.200.2:60811
-> s:192.168.50.2:25 c2s/s2c=0/0
state=CONNECTED_STATE duration=0 expire=3581

120 01-42002-0129304-20101025
Troubleshooting ‘get’ commands get test application urlfilter
get test application urlfilter

Displays statistics, clears the cached, increases the timeout values, and many other
functions for the URL filter engine.
Syntax
get test application urlfilter <number>
Parameters
<number> • 1 — -This menu

• 2 — Clear cache
• 3 — Display WF cache contents
• 4 — Display WF cache TTL list
• 5 — Display WF cache LRU list
• 6 — Display WF cache in tree format
• 7 — Toggle switch for dumping unrated packet
• 8 — Increase timeout for polling
• 9 — Decrease timeout for polling
• 10 — Print debug values
• 11 — Clear Spam Filter cache
• 12 — Clear AV Query cache
• 13 — Toggle switch for dumping expired license packets
• 14 — Show running timers (except request timers)
• 144 — Show running timers (including request timers)
• 15 — Send INIT requests
• 16 — Display WF cache contents of prefix type
• 99 — Restart the urlfilter daemon
Usage/Remarks
Use this command to troubleshoot and work with the URL filter engine.
Scope: Global
Output Example
FGT # get system application urlfilter 3
utree_stat: keylen=223 nodes=15 leaf=11
com.cisco.www cate = 52 len=13 ch=1
dhtml_pulldown/dropdownlib-100.js cate = 52 len=33 ch=0
niffer/snifflib-100.js cate = 52 len=22 ch=0
potlight/spotlightlib-120.js cate = 52 len=28 ch=0
offer/sp/cookie.js cate = 52 len=18 ch=0
cisco_detect.js cate = 52 len=15 ch=0
flyouts.js cate = 52 len=10 ch=0
global.js cate = 52 len=9 ch=0
hbx.js cate = 52 len=6 ch=0
sitewide_tools.js cate = 52 len=17 ch=0
windowutil.vb cate = 52 len=13 ch=0

01-42002-0129304-20101025 121
get vpn status ike config Troubleshooting ‘get’ commands
get vpn status ike config

Display the status of IKE VPN connections.
Syntax
get vpn status ike config
Parameters
None.
Usage/Remarks
Use this command to display all the IKE VPN configurations on your unit. It displays pretty
much all the information for them. This command can make it easy to quickly find a
particular IKE configuration you are looking for to verify a setting.
Scope: Vdom
Output Example
FGT # get vpn status ike config
vd: root/0
name: home1
serial: 3
version: 1
type: static
local: 0.0.0.0
remote: 220.100.65.98
mode: main
dpd: enable retry-count 3 interval 5000ms
auth: psk
dhgrp: 5
xauth: none
interface: external
phase2s:
home1_tunnel proto 0 src 0.0.0.0/0.0.0.0:0 dst 0.0.0.0/0.0.0.0:0
dhgrp 5
policies: any interface

122 01-42002-0129304-20101025
Troubleshooting ‘get’ commands get vpn status ike crypto
get vpn status ike crypto

Display the cryptography used on IKE VPN.
Syntax
get vpn status ike crypto
Parameters
None.
Usage/Remarks
Use this command to confirm what cryptography is used by IKE VPN connections.
Customer service may ask for this information if they are helping you are troubleshooting
VPN issues.
Scope: Vdom
Output Example
FGT # get vpn status ike crypto
software.dh: 4 3221216544
hardware.dh: 141492682 1088762808

01-42002-0129304-20101025 123
get vpn status ike errors Troubleshooting ‘get’ commands
get vpn status ike errors

Display VPN IKE errors.
Syntax
get vpn status ike errors
Parameters
None.
Usage/Remarks
Use this command if you are having IKE VPN problems and you want to determine exactly
what the problems are. This command will list the number of each error. This may allow
you to see a larger pattern of errors.
Scope: Vdom
Output Example
FGT # get vpn status ike errors
limits.euthanized: 141660798
limits.blocked: 3221216504
in.truncated: 0
in.giant: 0
in.baby: 0
in.baby.float: 0
out.fail: 0
iskamp.truncated: 0
iskamp.embryonic.connection.killed: 0
iskamp.embryonic.sa.killed: 0
iskamp.established.sa.killed: 0
quick.bad-status: 0
quick.duplicate-payload: 0
quick.not-encrypted: 0
quick.decryption.fail: 632
info.truncated: 648
info.hash.missing: 2
info.hash.size: 16
info.hash.content: 1074795752
mem.fail: 3221216520 141490409 1088762548

124 01-42002-0129304-20101025
Troubleshooting ‘get’ commands get vpn status ike status detailed
get vpn status ike status detailed

Display detailed status about IKE VPN Connections
Syntax
get vpn status ike status detailed
Parameters
None.
Usage/Remarks
Use this command to see detailed information about IKE VPN connections. This can be
useful to quickly compare VPN connections when one or some may not be working while
the others are working without problem.
Scope: Vdom
Output Example
FGT # get vpn status ike status detailed
vd: root/0
name: home1
version: 1
ISAKMP SA: created 0/0
IPsec SA: created 0/0

01-42002-0129304-20101025 125
get vpn status ipsec Troubleshooting ‘get’ commands
get vpn status ipsec

Display information about the status of VPN IPSec devices in use.
Syntax
get vpn status ipsec
Parameters
None.
Usage/Remarks
Use this command to display which crypto devices are used with VPN such as 3DES,
SHA1, and so on. A zero indicates that type of crypto is not used with any VPN
connections.
Scope: Vdom
Output Example
FGT # get vpn status ipsec
All ipsec crypto devices in use:
CP4:
null: 0 0
des: 0 0
3des: 0 0
aes: 0 0
null: 0 0
md5: 0 0
sha1: 0 0
sha256: 0 0
SOFTWARE:
null: 0 0
des: 0 0
3des: 0 0
aes: 0 0
null: 0 0
md5: 0 0
sha1: 0 0
sha256: 0 0

126 01-42002-0129304-20101025
Troubleshooting ‘get’ commands get vpn status ssl hw-acceleration-status
get vpn status ssl hw-acceleration-status

Display the status of SSL hardware accelerated VPN connections.
Hardware acceleration can be accomplished a number of ways. Some FortiGate models
incorporate network processors (NPUs) in the main unit, others support the addition of
AMC (Advanced Mezzanine Card) modules. The FortiGate-5000 series supports rear
transition modules (RTMs) that incorporate network processors.
Syntax
get vpn status ssl hw-acceleration-status
Parameters
None.
Usage/Remarks
Use this command to display the status of SSL hardware accelerated VPN connections.
This is useful if you need to troubleshoot a VPN connection that should be accelerated but
is not.
Scope: Vdom
Output Example
FGT # get vpn status ssl hw-acceleration-status
Acceleration hardware detected: kxp=on cipher=on

01-42002-0129304-20101025 127
get vpn status ssl list Troubleshooting ‘get’ commands
get vpn status ssl list

Display the status of list of SSL VPN connections.
Syntax
get vpn status ssl list
Parameters
None.
Usage/Remarks
Use this command to display the status of SSL list of VPN connections.
Scope: Vdom
Output Example
FGT # diagnose vpn status ssl list
SSL VPN is disabled.

128 01-42002-0129304-20101025
Troubleshooting ‘get’ commands get vpn status tunnel dialup-list
get vpn status tunnel dialup-list

Display the status of the VPN tunnel dialup list.
Syntax
get vpn status tunnel dialup-list <arg>
Parameters
<parameter>
Usage/Remarks
Use this command to display the status of the VPN tunnel dialup list.
Scope: Vdom
Output Example
FGT # get vpn status tunnel dialup-list <arg>

01-42002-0129304-20101025 129
get vpn status tunnel list Troubleshooting ‘get’ commands
get vpn status tunnel list

Display the status of all VPN tunnels
Syntax
get vpn status tunnel list
Parameters
None.
Usage/Remarks
Use this command to display the status of all VPN tunnels.
Scope: Vdom
Output Example
FGT # diag vpn tunnel list
list all ipsec tunnel in vd 0
------------------------------------------------------
name=phase1 ver=1 serial=1 0.0.0.0:0->10.10.10.20:0 lgwy=dyn
tun=tunnel mode=auto bound_lf=24
prooxy_id=1 child_num=0 refcnt=4 ilast=406158 olast=406158
stat: rxp=0 txp=0 rxb=0 txb=0
dpd: mode=active on=0 idle=5000ms retry=3 count=0 seqno=0
natt: mode=none draft=0 interval=0 remote_port=0
proxyid=phase2 proto=0 sa=0 ref=1 auto_negotiate=0 serial=1
src: 0:0.0.0.0/0.0.0.0:0
dst: 0:0.0.0.0/0.0.0.0:0
------------------------------------------------------
name=phase12 ver=1 serial=2 10.10.10.20:0->10.10.11.125:0
lgwy=static tun=intf mode=auto bound_if=24
proxyid_num=0 child_num=0 refcnt=4 ilast=406158 olast=406158
stat: rxp=0 txp=0 rxb=0 txb=0
dpd: mode=active on=0 idle=5000ms retry=3 count=0 seqno=0
natt: mode=none draft=0 interval=0 remote_port=0

130 01-42002-0129304-20101025
Troubleshooting ‘get’ commands get vpn status tunnel stat
get vpn status tunnel stat

Display the status of any VPN tunnels.
Syntax
get vpn status tunnel stat
Parameters
None.
Usage/Remarks
Use this command to display the status of vpn tunnels—this is brief information, suitable
for a quick check on general VPN tunnel information. The information includes the device,
tunnel id, proxy id, and if the tunnel is up or down.
Scope: Vdom
Output Example
FGT # diagnose vpn status tunnel stat
dev=3 tunnel=1 proxyid=3 sa=0 conc=1 up=0

01-42002-0129304-20101025 131
get vpn status concentrator Troubleshooting ‘get’ commands
get vpn status concentrator

Display VPN concentrator status.
In a hub and spoke VPN configuration, the hub is the concentrator.
Syntax
get vpn status concentrator <name>
Parameters
<name> Display all ipsec tunnels for this concentrator name.

Can include multiple entries here.
Usage/Remarks
Use this command to troubleshoot any VPN concentrators. This will help you locate
problems in your hub and spoke VPN configuration.
Scope: Vdom
Output Example
FGT # get vpn status concentrator phase1 phase2
list all ipsec tunnels in phase1 in vd 0
list all ipsec tunnels in phase2 in vd 0

132 01-42002-0129304-20101025
Troubleshooting ‘get’ commands get webfilter ftgd-statistics
get webfilter ftgd-statistics

Displays the FortiGuard rating statistics.
Syntax
get webfilter fortiguard statistics list ?
Parameters
None.
Usage/Remarks
Use this command to display details about your FortiGuard statistics. These numbers can
be useful in determining the the source of a problem. For example DNS failures can reveal
the source of problems that may be widespread and hard to track back to the source.
Scope: Global
Output Example
FGT # get webfilter fortiguard statistics list
Rating Statistics:
=====================
DNS failures : 3
DNS lookups : 16
Data send failures : 876
Data read failures : 0
Wrong package type : 0
Hash table miss : 1
Unknown server : 0
Incorrect CRC : 0
Proxy request failures : 0
Request timeout : 292
Total requests : 0
Requests to FortiGuard servers : 0
Server errored responses : 11
Relayed rating : 0
Invalid profile : 0
Allowed : 0
Blocked : 0
Logged : 0
Errors : 0
Cache Statistics:
=====================
Maximum memory : 0
Memory usage : 0
Nodes : 0
Leaves : 0
Prefix nodes : 0
Exact nodes : 0

01-42002-0129304-20101025 133
get webfilter ftgd-statistics Troubleshooting ‘get’ commands
Requests : 0
Misses : 0
Hits : 0
Prefix hits : 0
Exact hits : 0
No cache directives : 0
Add after prefix : 0
Invalid DB put : 0
DB updates : 0
Percent full : 0%
Branches : 0%
Leaves : 0%
Prefix nodes : 0%
Exact nodes : 0%
Miss rate : 0%
Hit rate : 0%
Prefix hits : 0%
Exact hits : 0%
DNS lookups Number of DNS look-ups for the domain name of the requested URL.
Data send failures Number of non-responsive servers.
Request timeout NUmber of seconds for the request time-out. A FortiGate unit sends the
URL rating request every 2 seconds.
Total requests Total number of URL rating requests to cache and FortiGuard servers.
Requests to Total number of URL rating requests to FortiGuard servers.
FortiGuard servers
Relayed rating The number of times the master communicates with FortiGuard servers
and relays all URL rating requests from the slaves in a HA cluster.
Maximum memory Amount of memory assigned to FortiGuard cache. The default is 2%.
Memory usage The amount of memory used to store the URL tree.
Prefix nodes The number of prefixes used for a URL to increase the cache hit rate.
Exact nodes The number of exact matches used for a URL.

134 01-42002-0129304-20101025
Troubleshooting ‘get’ commands get webfilter status
get webfilter status

Displays the webfilter information from FortiGuard.
Syntax
get webfilter status <refresh rate>
Parameters
<refresh rate> How often to refresh the server list(s).
Usage/Remarks
Use this command to display webfilter statistics and server information if the service is
enabled.
If the service is not enabled, this command displays the language of the locale and states
the service is not enabled.
Output Example
FGT # get webfilter status 4
Locale : english
License : Contract
Expiration : Wed Feb 11 02:00:00 2009
Hostname : service.fortiguard.net
-=- Server List (Mon May 26 22:36:34 2008) -=-
IP Weight RTT Flags TZ Packets Curr Lost Total Lost

212.95.252.121 10 77 0 83 0 8
62.209.40.73 0 86 1 83 0 8
62.209.40.72 0 92 DI 1 85 0 9
82.71.226.65 10 98 D 0 84 0 8
212.95.252.120 10 95 0 76 0 2
69.20.236.179 60 198 -5 84 0 9
66.117.56.42 60 189 -5 83 0 8
66.117.56.37 60 192 -5 83 0 8
69.20.236.180 60 213 -5 83 0 8
209.52.128.90 60 268 -5 84 0 9
121.111.236.179 80 383 9 83 0 8
121.111.236.180 80 404 9 83 0 8
72.52.72.243 90 289 -8 83 0 8
218.106.244.81 90 455 -8 83 0 8
69.90.198.55 90 297 D -8 85 0 9
Locale Local environment language.
License The license status:
• Contract
• Expired
• Trial
Expiration The date and time the license expires.

01-42002-0129304-20101025 135
get webfilter status Troubleshooting ‘get’ commands
Hostname The FortiGuard server the FortiGate connects to obtain the service. The
FortiGuard server will return the information to the FortiGate. The
default is service.fortiguard.net
IP The IP address of other FortiGuard servers.
Weight The priority value which the FortiGate uses to send the URL rating
request. The lower weight value takes higher preference. The weight is
calculated by time zone, packet round-trip time, and success rate.
RTT Flags The round-trip time between the URL rating request and the response
time from the FortiGuard server.
TZ Time zone of the FortiGuard server (Greenwich Mean Time +/- the
number).
Packets Total packets sent to the FortiGuard server.
Curr Lost The number of times the request is retried in a timeout period. The
default is 15 seconds.
Total Lost Total number of unresponsive requests.

136 01-42002-0129304-20101025
Troubleshooting bootup issues
When powering on your FortiOS unit, you may experience problems. This section
addresses some problems you may experience in this area in rare cases. If you continue
to have problems, please contact customer support for assistance.
Bootup issues, while rare, can be very difficult to troubleshoot due to the lack of
information about your issue. When the unit not running, you do not have access to your
typical tools such as diagnose CLI commands. This section walks you through some
possible issues to give you direction in these situations.
To troubleshoot a bootup problem with your unit, go to the section that lists your problem.
If you have multiple problems, go the problem closest to the top of the list first, and work
your way down the list.
Note: It is rare that units experience any of the symptoms listed here. Fortinet hardware is reliable
with a long expected operation life.
The issues covered in this section all refer to various potential bootup issues including:
• A. You have text on the screen, but you have problems
• B. You don’t see the boot options menu
• C. You have problems with the console text
• D. You have visible power problems
• E. You have a suspected defective FortiOS unit
A. You have text on the screen, but you have problems

Solution
1 If the text on the screen is garbled, ensure your Console Communication parameters
are ok. Check your quickstart guide for your specific model settings.
2 If that fixes your problem, you are done.
3 If not, go to B. You don’t see the boot options menu
B. You don’t see the boot options menu

Solution
1 Ensure you serial communication parameters are set to no flow control, and the
proper baud rate and reboot the FortiGate unit by powering off and on.
Note: FortiOS units ship with a baud rate of 9600 by default. If you have access, verify this with the
CLI command config system console get , or parse an archived configuration file for the term
baudrate.
2 If that fixes your problem go to E. You have a suspected defective FortiOS unit.
3 If it doesn’t fix your problem, go to E. You have a suspected defective FortiOS unit.

01-42002-0129304-20101025 137
C. You have problems with the console text Troubleshooting bootup issues
C. You have problems with the console text

1 Do you have any console message?
• If Yes, go to D. You have visible power problems
• If No, continue.
2 Is there garbage onscreen ?
• If Yes, ensure Console Communication parameters are ok.
•If that fixes the problem, you are done.
3 If no, does the unit stop before the Press Any Key to Download Boot Image
prompt ?
• If Yes, go to E. You have a suspected defective FortiOS unit.
• If No, go to Step 4.
4 Console Message - Press any key to Download Boot Image
5 When pressing a key do you see one of the following messages?
[G] Get Firmware image from TFTP server
[F] Format boot device
[B] Boot with backup firmware and act as default
[Q] Quit menu and continue to boot with default firmware
[H] Display this list of options
• If Yes, go to E. You have a suspected defective FortiOS unit.
6 If No, ensure you serial communication parameters are set to no flow control, and
the proper baud rate and reboot the FortiOS unit by powering off and on.
Note: FortiOS units ship with a baud rate of 9600 by default. If you have access, parse an archived
configuration file for the term baudrate or verify this setting with the CLI command:
config system console
get
7 Did the reboot fix the problem?

• Go to E. You have a suspected defective FortiOS unit
D. You have visible power problems

1 Is there any LED on?
• If No, ensure power is on. If that fixes the problem you are done. If not, continue.
• If Yes, continue.
2 Do you have an external power adapter?
• If No, go to E. You have a suspected defective FortiOS unit.
• If Yes, try replacing the power adapter.
3 Is the power supply defective or you can’t determine one way or the other?
• If No, go to E. You have a suspected defective FortiOS unit.
• If Yes, go to A. You have text on the screen, but you have problems

138 01-42002-0129304-20101025
Troubleshooting bootup issues E. You have a suspected defective FortiOS unit
E. You have a suspected defective FortiOS unit

If you have followed these steps and determined there is a good chance your unit is
defective, follow these steps.
1 Open a support ticket through FortiCare at https://support.fortinet.com
2 In the ticket, document the problem or problems, and these steps that you have taken.
3 Provide all console messages and output.
4 Indicate if you have a suspected hard disk issue, and provide your evidence.
Fortinet Customer Support will contact you to help you with your ticket and issue.

01-42002-0129304-20101025 139
E. You have a suspected defective FortiOS unit Troubleshooting bootup issues

140 01-42002-0129304-20101025
Index
A FortiOS
default password, 9
accelerated interfaces, 75
AMC (Advanced Mezzanine Card), 127 G
anti-spoofing, 73
ARP resolution, 75 glossary, 20
asymmetric routing, 73
H
B how-to, 20
Berkeley Packet Filtering (BPF), 40
I
C interfaces
certification, 20 accelerated NP2, 75
CLI syntax conventions, 16 Internet Control Message Protocol (ICMP), 69
comments, documentation, 20 introduction
Fortinet documentation, 20
conventions, 12
IP address
Cross-Site Scripting
private network, 12
protection from, 18
ISAKMP, 88
customer service, 20
D K
Knowledge Center, 20
diagnose commands, 76
document conventions
CLI syntax, 16 N
documentation, 20 network interface card (NIC), 84
commenting on, 20 NP2 interfaces, 75
conventions, 12
Fortinet, 20 O
domain name server (DNS), 68
operation mode, 9
F
P
FAQ, 20
FortiGate documentation packet sniffer, 73
commenting on, 20 verbosity level, 74
FortiGuard password
Antispam, 9 administrator, 9
Antivirus, 9, 19 Phase 1, 88
services, 19 product registration, 19
Fortinet
Knowledge Center, 20 R
Technical Documentation, 20
Technical Documentation, conventions, 12 registering
Technical Support, 20 with Fortinet Technical Support, 19
Technical Support, registering with, 19 RFC
Technical Support, web site, 19 1918, 12
Training Services, 20 RPF (Reverse Path Forwarding), 73
Fortinet customer service, 20
Fortinet documentation, 20 S
Fortinet Knowledge Center, 20 security association (SA), 88
stateful inspection, 73

01-42002-0129304-20101025 141
Index
T troubleshooting, 67
debug packet flow, 75
technical diagnose commands, 76
documentation, 20 firewall session list, 76
documentation conventions, 12 packet sniffing, 73
notes, 20 ping, 68
support, 20 routing table, 72
technical support, 20 traceroute, 68
Technology Assistance Center (TAC), 24
time to live (ttl), 115 V
Training Services, 20
vulnerability
Cross-Site Scripting, 18
XSS, 18
X
XSS vulnerability
protection from, 18

142 01-42002-0129304-20101025
Index

01-42002-0129304-20101025 143
Index

144 01-42002-0129304-20101025
Index

01-42002-0129304-20101025 145
Index

146 01-42002-0129304-20101025
Index

01-42002-0129304-20101025 147
Index

148 01-42002-0129304-20101025

Fortigate Troubleshooting 40 Mr2

Uploaded by

Document Information

Original Description:

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Fortigate Troubleshooting 40 Mr2

Uploaded by

Copyright:

Available Formats

Troubleshooting

FortiOS™ Handbook v2: Troubleshooting

Contact Fortinet Customer Support for assistance . . . . . . . . . . . . . . . . . . . 24

Technical Support Organization Overview 53

Troubleshooting for FortiOS 4.0 MR2

Troubleshooting ‘get’ commands 77

FortiOS™ Handbook v2: Troubleshooting

get system arp . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 98

Troubleshooting bootup issues 137

Troubleshooting for FortiOS 4.0 MR2

FortiOS™ Handbook v2: Troubleshooting

Troubleshooting for FortiOS 4.0 MR2

Before you begin

How this guide is organized

FortiOS™ Handbook v2: Troubleshooting

Troubleshooting for FortiOS 4.0 MR2

FortiOS™ Handbook v2: Troubleshooting

FortiOS 4.0 MR2

Table 1: Examples of the IP numbering

Location and device Internal Dmz External

Example Network configuration

Figure 1: Example network configuration

FortiOS 4.0 MR2

Cautions, Notes and Tips

CLI command syntax conventions

FortiOS 4.0 MR2

Table 3: Command syntax notation (Continued)

Table 3: Command syntax notation (Continued)

Entering FortiOS configuration data

Entering text strings (names)

FortiOS 4.0 MR2

Entering numeric values

Selecting options from a list

Enabling or disabling options

Registering your Fortinet product

Fortinet products End User License Agreement

Fortinet Tools and Documentation CD

Fortinet Knowledge Base

Comments on Fortinet technical documentation

Customer service and technical support

FortiOS 4.0 MR2

get system status Displays versions of firmware and FortiGuard

Define the Problem

FortiOS™ Handbook v2: Troubleshooting

• What is the problem?

Troubleshooting for FortiOS 4.0 MR2

Search for a solution

Fortinet Technical Discussion Forums

Fortinet Training Services Online Campus

Create a troubleshooting plan

FortiOS™ Handbook v2: Troubleshooting

Providing Supporting Elements

Obtain any required additional equipment

Ensure you have administrator level access to required equipment

Contact Fortinet Customer Support for assistance

Troubleshooting for FortiOS 4.0 MR2

FortiOS™ Handbook v2: Troubleshooting

Troubleshooting for FortiOS 4.0 MR2

FortiOS™ Handbook v2: Troubleshooting

Troubleshooting for FortiOS 4.0 MR2

FortiOS™ Handbook v2: Troubleshooting

Troubleshooting for FortiOS 4.0 MR2

FortiOS™ Handbook v2: Troubleshooting