FortiGate FortiOS CLI Troubleshooting: Cheat Sheet

2026年8月25日 LOG admin

FortiGate's power lies in the diagnose command family - the CLI toolkit that reveals exactly what the firewall is doing with every packet, session and daemon. This cheat sheet, condensed from the official FortiOS CLI troubleshooting documentation, organizes the most useful diagnose commands by subsystem: IPS engine, WAD proxy, routing and BFD, SD-WAN link monitoring, authentication, IPsec VPN, logging and SIP ALG. Keep it handy for the next time a FortiGate misbehaves and you need hard evidence fast.

System Diagnostics: IPS Engine and WAD

diagnose test application ipsmonitor 1      # show IPS engine information
diagnose test application ipsmonitor 2      # enable/disable IPS engines
diagnose test application ipsmonitor 97     # start all IPS engines
diagnose test application ipsmonitor 98     # stop all IPS engines
diagnose ips session list                   # show IPS sessions per engine
diagnose test application wad 1000          # show all WAD processes
diagnose test application wad 2             # show total memory usage
diagnose test application wad 99            # restart all WAD processes

Network and Routing Diagnostics

diagnose ip arp list                        # show ARP entries
diagnose netlink brctl list                 # show all switch interfaces
get system interface                        # interface configuration and status
get router info6 bfd neighbor               # show BFD neighbors
diagnose test application bfd 1             # show BFD statistics

SD-WAN Link Monitoring

diagnose sys link-monitor interface <interface>    # link monitoring statistics
diagnose debug application link-monitor -1
diagnose debug enable                               # real-time link monitor debugging
diagnose test application lnkmtd 1                  # link monitor statistics

Authentication and FSSO

diagnose firewall auth list                  # list authenticated IPv4 users
diagnose firewall auth filter <filter>       # set filter for the list
diagnose wad user list                       # users authenticated by proxy
diagnose debug application fnbamd -1
diagnose debug application authd -1
diagnose debug enable                        # real-time auth debugging
diagnose test authserver <auth_protocol> <server> <user> <password>   # test auth from CLI
diagnose debug authd fsso list               # show FSSO logged-on users
execute fsso refresh                         # refresh FSSO user list (may cause outage)

IPsec VPN Troubleshooting

diagnose vpn ike gateway clear               # clear IKE gateways (Phase 1)
diagnose vpn ipsec status                    # encryption counters
diagnose vpn ike log filter <filter>         # filter IKE daemon debugs
diagnose debug application ike -1
diagnose debug enable                        # real-time IKE debugging

Logging and SIP ALG

diagnose log test                    # generate test logs
execute log filter <filter>          # set log filters
execute log filter dump              # show log filters
exec log display                     # show filtered logs
execute log delete                   # delete filtered logs
diagnose sys sip-proxy calls list    # active SIP proxy calls
diagnose sys sip-proxy stats         # SIP proxy statistics
diagnose debug application sip -1
diagnose debug enable                # real-time SIP debugging

Remember the golden rule of FortiGate debugging: enable the daemon debug with diagnose debug application <app> <level>, then activate output with diagnose debug enable, and disable it with diagnose debug disable when you are done to avoid console flooding.