Please enable JavaScript.
Coggle requires JavaScript to display documents.
Day 23 – Diagnostics & Troubleshooting - Coggle Diagram
Day 23 – Diagnostics & Troubleshooting
Troubleshooting Methodology (RAP)
RAP Overview
Structured firewall troubleshooting approach
Prevents random guessing
Routing (R)
Is there a route to the destination?
Correct outgoing interface selected
Next-hop reachable
Common Issues
Missing default route
Wrong VPN route
SD-WAN rule steering traffic incorrectly
Policy routes configured
Address Translation (A)
Is NAT required?
Correct SNAT or DNAT applied
NAT not interfering with VPN traffic
Common Issues
Missing SNAT for internet access
NAT overlap in VPN
Wrong VIP mapping
Permissions (P)
Firewall policy exists and matches traffic
Correct policy order
Security profiles not blocking traffic
Common Issues
Missing firewall policy
Wrong source or destination object
IPS or Web Filter blocking traffic
General Diagnosis
Observing Abnormal Behavior
Users report slowness
Intermittent connectivity issues
Random disconnections
Traffic Spikes
Sudden increase in bandwidth usage
Possible malware or misconfiguration
Physical and Network Layer Checks
Interface up or down status
Cable or ISP issues
Duplex or speed mismatch
Importance of General Diagnosis
Identifies whether issue is network, security, or performance related
Avoids unnecessary deep troubleshooting
Packet Sniffer
What is Packet Sniffer
Captures live traffic passing through interfaces
Shows packets on the wire
Why Use Packet Sniffer
Verify traffic arrival
Confirm source and destination IPs
Validate NAT behavior
Check ports and protocols
Capture Options
Select interface
Filter by source IP
Filter by destination IP
Filter by protocol or port
and more....
PCAP Files
Standard packet capture format
Can be opened in Wireshark
Used for advanced analysis or TAC support
Debug Flow
What is Debug Flow
Shows internal packet processing in FortiGate kernel
Explains why traffic is allowed or dropped
What Debug Flow Shows
Route lookup
Policy matching
NAT decision
Security profile inspection
Final allow or drop reason
When to Use Debug Flow
Packet reaches firewall but does not pass
Unexpected traffic drops
VPN or SD-WAN issues
Important Notes
CPU intensive tool
Always apply filters
Disable debug after use
Session List (diagnose sys session list)
What is a Session
One tracked connection in FortiGate
Represents active traffic flow
Purpose of Session List
View live traffic sessions
Verify policy and NAT usage
Session Information Displayed
Source IP and port
Destination IP and port
Incoming and outgoing interfaces
Policy ID
NAT details
Session Filtering
Filter by source IP
Filter by destination IP
Filter by port or protocol
Ping and Traceroute
execute ping
Tests basic connectivity from FortiGate
Verifies routing and interface status
execute traceroute
Displays path traffic takes to destination
Identifies where traffic stops
Why Use Firewall-Based Tests
Tests from firewall perspective
Bypasses client-side issues
Useful for routing validation
Log Analysis
Importance of Logs
Shows what firewall is doing
Explains security and traffic decisions
Forward Traffic Logs
Allowed traffic logs
Denied traffic logs
Policy and interface details
NAT information
Security Event Logs
Antivirus logs
Web Filter logs
IPS logs
Application Control logs
Use Cases
Troubleshooting user complaints
Security investigation
Compliance and auditing
CPU and Memory Diagnosis
Why Resource Monitoring is Important
High usage causes slowness and instability
Can lead to conserve mode
diagnose sys top
Real-time CPU usage
Memory consumption per process
Process Monitor (GUI)
Visual representation of system resources
Beginner-friendly monitoring
Conserve Mode
Triggered by critically high memory usage
New sessions are dropped
Existing sessions are preserved
Common Causes of High Resource Usage
Excessive logging
Heavy SSL inspection
Too many concurrent sessions
Attack or DoS traffic
Best Practices
Monitor resources regularly
Tune security profiles
Avoid unnecessary inspection
Choose appropriate hardware capacity