Advanced troubleshooting

Doing a packet capture (sniffer)

diag sniffer packet any '!port 22' 4 10 <tsformat>
interfaces=[any]  (interface name can be specified)
filters=[udp and !port 22 and port 1812 and host 10.1.1.1]  (none can be used as well)
level=4 (print interface name and header)
count=10 (packets to dump)
tsformat=l (none specified then relative time, l-localtime)

Packet flow debug - Equivalent to FW Monitor in Check Point, to evaluate the packet being accepted, forwarded or denied:

diag debug flow show function enable
diag debug flow show console enable
diag debug flow filter addr 10.31.101.22
diag debug flow filter port 80
diag debug enable
diag debug flow trace start 100
diag debug disable

VPN debug commands:

diag vpn tunnel list | get ipsec tunnel list | get vpn ipsec tunnel summary
diag vpn ike log filter name <phase1-name>
diag vpn ike log filter src-addr4 <peer>
diag debug application ike -1 (or 255)
diag debug enable
diag vpn tunnel flush  <phase1-name>
diag vpn tunnel reset  <phase1-name>
diag debug disable

Reset/Clear VPN Tunnels

diag vpn ike restart
diag vpn ike gateway clear name <name_P1>
diag vpn ike gateway flush name <name_P1>

IPS information and bypass mode

 diag test application ipsmonitor <number>
  1-display engine information
  2-enable/disable IPS engine
  5-Toggle bypass status
  99-restart IPS engines/monitor

Restart IPS engine

diag test application ipsengine 99

Restart WebFilter

 diag test application urlfilter 99

Test authentication

diag test auth ldap <server> <username> <password>
diag test auth radius <server> <chap|pap|mschap|mschap2> <username> <password>

Display diagnostic information for the web cache database daemon (wacs).

diag wacs clear
diag wacs recents
diag wacs restart
diag wacs stats

Debug WebUI activity

diag debug cli 8 
diag debug enable

Contract and License check

exec log fortiguard test-connectivity 
get system fortiguard-service status 

Initialize the Log disk

exec formatlogdisk

Clear configuration (load factory defaults) but retains network interface configurations

execute factoryreset2 
exec reset all-except-ip (fortimanager/fortianalyzer)

It’s possible to load a new firmware without writing to the flash (just to evaluate it). Connect to serial console, set up a TFTP server, boot, interrupt it before 3 sec, then get the new firmware but choose to run it instead of save it