Fortigate - Revision history

Aleks at 09:11, 4 June 2025

2025-06-04T09:11:37Z

← Older revision		Revision as of 10:11, 4 June 2025
Line 4:		Line 4:

	== CLI Commands ==		== CLI Commands ==
	Ping - can also be used as nslookup		Ping - can also be used as nslookup<syntaxhighlight lang="bash">
	*exec ping <ip address or FQDN>		exec ping <ip address or FQDN>
			</syntaxhighlight>

	== FQDN addresses ==		== FQDN addresses ==

	Check for resolved IP addresses for all FQDN addresses in CLI:		Check for resolved IP addresses for all FQDN addresses in CLI:<syntaxhighlight lang="bash">
	*diagnose firewall fqdn list		diagnose firewall fqdn list
			</syntaxhighlight>

	==Add Bulk IPs to fortigate via CLI==		==Add Bulk IPs to fortigate via CLI==

2025-06-02T14:30:27Z

← Older revision		Revision as of 15:30, 2 June 2025
Line 28:		Line 28:
	end		end
	</syntaxhighlight>the session-ttl is in seconds. This can be changed back to the global default by setting it back to 0		</syntaxhighlight>the session-ttl is in seconds. This can be changed back to the global default by setting it back to 0

			== VPN Tunnel Troubleshooting CLI ==
			Use the following command in the CLI to test each phase 2 on a VPN tunnel:<syntaxhighlight lang="powershell">
			diagnose vpn ike log-filter dst-addr4 <ipaddress of VPN peer>
			diagnose debug application ike -1
			diagnose debug console timestamp enable
			diagnose debug enable

			diagnose debug disable
			</syntaxhighlight>

2025-01-28T09:37:16Z

← Older revision		Revision as of 10:37, 28 January 2025
Line 17:		Line 17:
	== Troubleshooting VPN connections ==		== Troubleshooting VPN connections ==
	info video for troubleshooting VPN connections https://www.youtube.com/watch?v=CXWoTZ5t8XI&t=2923s		info video for troubleshooting VPN connections https://www.youtube.com/watch?v=CXWoTZ5t8XI&t=2923s

			== TLS Session Timeout ==
			If no data is transferred for a TLS session seen by the firewall it will timeout and can cause a socket error on the application using the TLS connection. To fix this the TLS time to live timeout needs to be changed on the policy that allows the traffic. This needs to be done with a CLI command:<syntaxhighlight lang="powershell">
			config vdom
			edit <name of vdom>
			config firewall policy
			edit <policy number>
			set session-ttl 28800
			next
			end
			</syntaxhighlight>the session-ttl is in seconds. This can be changed back to the global default by setting it back to 0

2024-01-24T11:10:04Z

← Older revision		Revision as of 12:10, 24 January 2024
Line 14:		Line 14:
	==Add Bulk IPs to fortigate via CLI==		==Add Bulk IPs to fortigate via CLI==
	check this guide: https://community.fortinet.com/t5/FortiGate/Technical-Tip-Creation-and-addition-of-bulk-IP-address-objects/ta-p/241823		check this guide: https://community.fortinet.com/t5/FortiGate/Technical-Tip-Creation-and-addition-of-bulk-IP-address-objects/ta-p/241823

			== Troubleshooting VPN connections ==
			info video for troubleshooting VPN connections https://www.youtube.com/watch?v=CXWoTZ5t8XI&t=2923s

2023-11-15T20:32:02Z

3 revisions imported

← Older revision	Revision as of 21:32, 15 November 2023
(No difference)

2023-04-26T14:43:17Z

← Older revision		Revision as of 15:43, 26 April 2023
Line 11:		Line 11:
	Check for resolved IP addresses for all FQDN addresses in CLI:		Check for resolved IP addresses for all FQDN addresses in CLI:
	*diagnose firewall fqdn list		*diagnose firewall fqdn list

			==Add Bulk IPs to fortigate via CLI==
			check this guide: https://community.fortinet.com/t5/FortiGate/Technical-Tip-Creation-and-addition-of-bulk-IP-address-objects/ta-p/241823

2021-05-18T15:03:48Z

← Older revision		Revision as of 16:03, 18 May 2021
Line 1:		Line 1:

			== Addresses and Policies ==
			Make sure when adding any policy or address it is also added to the policy or address that you are trying to affect.

			== CLI Commands ==
			Ping - can also be used as nslookup
			*exec ping <ip address or FQDN>

	== FQDN addresses ==		== FQDN addresses ==

2021-05-18T14:22:27Z

Created page with " == FQDN addresses == Check for resolved IP addresses for all FQDN addresses in CLI: *diagnose firewall fqdn list"

New page

== FQDN addresses ==

Check for resolved IP addresses for all FQDN addresses in CLI:
*diagnose firewall fqdn list