FortiGate firewalls help organizations protect networks, manage traffic, and enforce security policies. However, configuration errors, routing problems, VPN failures, and performance issues can affect network connectivity. Knowing the right troubleshooting commands helps network engineers identify root causes and restore services efficiently.

Fortinet NSE 4 Training can help learners develop practical knowledge of FortiGate configuration, security policies, and troubleshooting techniques. Understanding commonly used CLI commands is valuable for IT professionals who manage firewall infrastructure and want to strengthen their network security skills.

20 Practical FortiGate Troubleshooting Commands

The following commands cover common diagnostic tasks. Exact command availability and output may vary by FortiOS version and configuration.

1. Check System Information

get system status

Displays the FortiGate model, FortiOS version, operating mode, and other system details. Use it as an initial check when investigating compatibility or version-related issues.

2. View Interface Status

get system interface physical

Displays physical interface information, helping identify interfaces that are down or incorrectly configured.

3. Review IP Interface Configuration

show system interface

Displays interface configuration, including IP addressing and other settings. Review the relevant interface when investigating connectivity problems.

4. Check the Routing Table

get router info routing-table all

Displays available routes. Use it to verify that the firewall has a route toward the destination network.

5. Test Connectivity with Ping

execute ping 8.8.8.8

Tests IP connectivity to a destination. Failure may indicate routing, upstream connectivity, or filtering problems.

6. Trace the Network Path

execute traceroute 8.8.8.8

Helps identify where traffic stops along a route. Intermediate devices may not respond, so interpret results alongside other diagnostics.

7. Test DNS Resolution

execute nslookup example.com

Tests hostname resolution from the FortiGate CLI where supported. If resolution fails, inspect DNS configuration and reachability.

8. View Firewall Policies

show firewall policy

Displays firewall policy configuration. Check source and destination interfaces, addresses, services, and action settings when traffic is blocked.

9. Inspect Active Sessions

diagnose sys session list

Displays session information. Use appropriate filters where supported to investigate specific traffic flows.

10. Run a Packet Sniffer

diagnose sniffer packet any 'host 192.0.2.10' 4 10 l

Captures packets involving the specified host across interfaces. Replace the example address with the relevant IP address. Packet captures may contain sensitive information, so handle them securely.

11. Debug Firewall Traffic Flow

diagnose debug flow filter addr 192.0.2.10

diagnose debug flow show function-name enable

diagnose debug enable

diagnose debug flow trace start 10

Helps identify why traffic is accepted or dropped. Apply filters before enabling debug output. When finished, stop debugging:

diagnose debug flow trace stop

diagnose debug disable

diagnose debug reset

Run debug commands carefully, particularly on production firewalls.

12. Check CPU and Memory Usage

get system performance status

Displays performance information, including CPU and memory utilization. Sustained high usage may indicate resource pressure or unusually heavy traffic.

13. Review System Processes

diagnose sys top

Shows active processes and resource usage. Use it to investigate processes consuming unusually high CPU resources.

14. Check VPN Tunnels

get vpn ipsec tunnel summary

Provides an overview of IPsec tunnel status. If a tunnel is down, review peer reachability, Phase 1 and Phase 2 settings, and authentication parameters.

15. Inspect IPsec Configuration

show vpn ipsec phase1-interface

show vpn ipsec phase2-interface

Displays IPsec Phase 1 and Phase 2 configuration. Compare encryption, authentication, proposals, and selectors with the remote peer.

16. Check High Availability Status

get system ha status

Displays high-availability cluster information. Use it to review member status, synchronization, and primary-unit information.

17. Review DHCP Leases

execute dhcp lease-list

Displays DHCP lease information where the command is supported. Check address allocation when clients cannot obtain valid IP configurations.

18. Inspect Administratively Allowed Services

show system interface

Review the relevant interface's allowaccess configuration to determine whether management services such as HTTPS, SSH, or ping are permitted. Avoid enabling management access unnecessarily.

19. Check FortiGuard Connectivity

diagnose debug rating

Helps inspect FortiGuard rating server information on supported FortiOS versions. If services fail, review DNS, routing, licensing, and upstream connectivity.

20. Review Recent System Events

execute log filter category event

execute log display

Where supported, these commands help filter and display event logs. Logs can reveal interface changes, authentication failures, VPN events, and other useful troubleshooting details. Command syntax may differ by release and logging configuration.

Best Practices for FortiGate Troubleshooting

Follow a Structured Process

Start by identifying the affected users, applications, and destinations. Check interfaces, routes, policies, and sessions before making configuration changes.

Use Debug Commands Carefully

Debugging and packet capture can generate substantial output or expose sensitive information. Apply narrow filters, limit trace counts, and disable debugging immediately after collecting the necessary evidence.

Verify Changes and Document Results

Make targeted changes rather than modifying several settings simultaneously. Confirm that the issue is resolved and document the root cause, commands used, and corrective actions.

Check FortiOS Documentation

Consult the documentation for the installed FortiOS version before using commands that may differ across releases. Test unfamiliar commands in a lab when possible.

Conclusion

FortiGate troubleshooting commands help network engineers investigate connectivity failures, routing errors, firewall policy problems, VPN issues, and resource utilization. Using commands systematically makes it easier to isolate faults, verify configurations, and restore services while minimizing unnecessary changes. Careful use of packet captures and debugging tools also supports safer troubleshooting in production environments.

Professionals seeking to improve their firewall administration skills can explore practical labs and structured learning resources. Fortinet NSE 4 Certification is a relevant historical certification term associated with FortiGate security administration; candidates should check Fortinet's current certification program for the latest available credentials and training pathways.