Diagnostics

Module Objectives By the end of this module participants will be able to: Use diagnostic commands to troubleshoot and monitor performance of the FortiGate unit

Diagnostic Commands Tools for troubleshooting and performance monitoring

Diagnostics Commands Commands can be used to debug the operation of the FortiGate unit and to set parameters for displaying different levels of diagnostic information

Normal Operation Commands can be used to establish a baseline of normal operation Determine how system performs in a best case scenario Can be added to a script to be executed at periodic intervals to gather snapshots of overall CPU and memory usage Examples: get system status get system performance status

Resource Usage Commands can be used to check the resource usage of internal processes For example: diag sys top get sys perform top diag sys kill

Proxy Operations Commands can be used to test proxy operations Run these commands in the Global configuration For example: diag test application

Hardware Operations Commands can be used to monitor hardware network operations Errors at the interface are indicative of data link or physical layer issues that may impact the performance of the FortiGate unit For example: diag hardware deviceinfo nic

Memory Utilization The FortiGate antivirus/IPS system operates in one of two modes, depending on the unit’s available shared memory. If the shared memory utilization is below a defined upper threshold the system is in non-conserve mode If the used shared memory goes beyond this threshold the system enters conserve mode These thresholds are non-configurable The threshold above which the system enters conserve mode is 80%, the system will not go back to non-conserve mode until the shared memory usage goes below 70% Commands can be used in the Global configuration to determine to current mode For example: diag hardware sysinfo shm

Memory Utilization If FortiGate unit receives large volumes of traffic on a specific proxy, it is possible that the unit will exceed the connection pool limit Commands can be used on certain FortiGate models to determine the behavior of the FortiGate antivirus system if it becomes overloaded in high traffic and low memory situations For example: config system global set av-failopen {off|one-shot|pass|idledrop}

Traffic Trace Traffic tracing allows a specific packet stream to be followed Commands can be used in specific VDOMs to trace packets For example: diag sys session diag debug flow diag sniffer packet

Session Table An entry is placed in the session table for each traffic session passing through a firewall policy Commands can be used to display specific session table information For example: diag sys session list diag sys session filter diag sys session filter clear

Object Dependencies Configuration objects such as firewall policies may not be deleted if there are other objects that depend on it Command can be used to identify object dependencies For example: diag sys checkused

Flow Trace The flow of packets through the FortiGate unit can be monitored Commands can used to set filters on the traffic and display the data to the console For example: diag debug flow filter diag debug flow show console diag debug flow trace start diag debug flow trace stop

Packet Sniffing The information contained within packets passing through particular interfaces can be monitored Commands can used to set filters on the packets, identify the interfaces to be monitored and set the level of information to display For example: diag sniffer packet

Dealing With Network Processors On FortiGate devices using FA2 and NP2-based interfaces, only the initial session setup will be displayed through the flow commands For troubleshooting purposes, commands can be used to disable NP2 functionality For example: diag npu np2 list diag npu np2 fastpath disable diag npu np2 fastpath-sniffer enable port 1

Debugging Continuous, real-time event information can be displayed for troubleshooting purposes Debug output will continue until explicitly stopped or the FortiGate unit is rebooted System performance may be affected Output may be generated even though it is not displayed in the console Commands can be used to enable, disable and identify the level of information to be displayed For example: diag debug diag debug enable diag debug disable

ARP Tables The ARP table caches the responses to previous ARP requests for MAC address resolution Commands can be used to view and modify the ARP table cache For example: get sys arp diag ip arp list execute clear system arp table diag ip arp delete diag ip arp flush config system arp-table

Date and Time Log entries are timestamped with the current date and time Commands can be used to set the date and time For example: execute time execute date Commands can be used to receive time and date information from an NTP server For example: config system ntp set ntpsync enable/disable

Self Help Options Technical documentation Release Notes Knowledge Center Technical Discussion Forums Fortinet Training Online Campus

Labs Lab - Diagnostics Capturing packets Viewing session tables Proxy-based inspection Click here for step-by-step instructions on completing this lab

Student Resources Click hereClick here to view the list of resources used in this module