FortiGate

Addresses and Policies

Make sure when adding any policy or address it is also added to the policy or address that you are trying to affect.

CLI Commands

Ping - can also be used as nslookup

1

exec ping 

FQDN addresses

Check for resolved IP addresses for all FQDN addresses in CLI:

1

diagnose firewall fqdn list

Show routing table

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23

# show all routes
get router info routing-table all

# Look for specific IP
get router info routing-table details <IP address>

# Show connected routes only
get router info routing-table connected

# Show static routes
get router info routing-table static

# Show BGP routes
get router info bgp network

# Show OSPF routes
get router info ospf route

# Find which interface owns an IP
show system interface

# Search configs for an IP
show full-configuration | grep -f <IP Address>

Add Bulk IPs to fortigate via CLI

check this guide: https://community.fortinet.com/t5/FortiGate/Technical-Tip-Creation-and-addition-of-bulk-IP-address-objects/ta-p/241823

Troubleshooting VPN connections

info video for troubleshooting VPN connections https://www.youtube.com/watch?v=CXWoTZ5t8XI&t=2923s

TLS Session Timeout

If no data is transferred for a TLS session seen by the firewall it will timeout and can cause a socket error on the application using the TLS connection. To fix this the TLS time to live timeout needs to be changed on the policy that allows the traffic. This needs to be done with a CLI command:

1
2
3
4
5
6
7

config vdom
edit 
config firewall policy
edit 
set session-ttl 28800
next
end

the session-ttl is in seconds. This can be changed back to the global default by setting it back to 0

VPN Tunnel Troubleshooting CLI

Use the following command in the CLI to test each phase 2 on a VPN tunnel:

1
2
3
4
5
6

diagnose vpn ike log-filter dst-addr4  
diagnose debug application ike -1
diagnose debug console timestamp enable
diagnose debug enable

diagnose debug disable

BGP troubleshooting

Get info on configured BGP neighbors:

1

get router info bgp neighbors

Get advertised routes to specific BGP neighbor:

1

get router info bgp neighbors <BGP neighbor ip address> advertised-routes

Force Update of advertised routes to BGP neighbour (May need to do after changing route prefix lists) Ensure to add “soft out” to command or BGP connections will drop and re-establish

1

execute router clear bgp ip <BGP neighbor ip address> soft out