piszczynski>Aleks No edit summary |
No edit summary |
||
| (4 intermediate revisions by the same user not shown) | |||
| Line 4: | Line 4: | ||
== CLI Commands == | == CLI Commands == | ||
Ping - can also be used as nslookup | Ping - can also be used as nslookup<syntaxhighlight lang="bash"> | ||
exec ping <ip address or FQDN> | |||
</syntaxhighlight> | |||
== FQDN addresses == | == FQDN addresses == | ||
Check for resolved IP addresses for all FQDN addresses in CLI: | Check for resolved IP addresses for all FQDN addresses in CLI:<syntaxhighlight lang="bash"> | ||
diagnose firewall fqdn list | |||
</syntaxhighlight> | |||
==Add Bulk IPs to fortigate via CLI== | ==Add Bulk IPs to fortigate via CLI== | ||
check this guide: https://community.fortinet.com/t5/FortiGate/Technical-Tip-Creation-and-addition-of-bulk-IP-address-objects/ta-p/241823 | check this guide: https://community.fortinet.com/t5/FortiGate/Technical-Tip-Creation-and-addition-of-bulk-IP-address-objects/ta-p/241823 | ||
== Troubleshooting VPN connections == | |||
info video for troubleshooting VPN connections https://www.youtube.com/watch?v=CXWoTZ5t8XI&t=2923s | |||
== TLS Session Timeout == | |||
If no data is transferred for a TLS session seen by the firewall it will timeout and can cause a socket error on the application using the TLS connection. To fix this the TLS time to live timeout needs to be changed on the policy that allows the traffic. This needs to be done with a CLI command:<syntaxhighlight lang="powershell"> | |||
config vdom | |||
edit <name of vdom> | |||
config firewall policy | |||
edit <policy number> | |||
set session-ttl 28800 | |||
next | |||
end | |||
</syntaxhighlight>the session-ttl is in seconds. This can be changed back to the global default by setting it back to 0 | |||
== VPN Tunnel Troubleshooting CLI == | |||
Use the following command in the CLI to test each phase 2 on a VPN tunnel:<syntaxhighlight lang="powershell"> | |||
diagnose vpn ike log-filter dst-addr4 <ipaddress of VPN peer> | |||
diagnose debug application ike -1 | |||
diagnose debug console timestamp enable | |||
diagnose debug enable | |||
diagnose debug disable | |||
</syntaxhighlight> | |||
Latest revision as of 10:11, 4 June 2025
Addresses and Policies
Make sure when adding any policy or address it is also added to the policy or address that you are trying to affect.
CLI Commands
Ping - can also be used as nslookup
exec ping <ip address or FQDN>
FQDN addresses
Check for resolved IP addresses for all FQDN addresses in CLI:
diagnose firewall fqdn list
Add Bulk IPs to fortigate via CLI
check this guide: https://community.fortinet.com/t5/FortiGate/Technical-Tip-Creation-and-addition-of-bulk-IP-address-objects/ta-p/241823
Troubleshooting VPN connections
info video for troubleshooting VPN connections https://www.youtube.com/watch?v=CXWoTZ5t8XI&t=2923s
TLS Session Timeout
If no data is transferred for a TLS session seen by the firewall it will timeout and can cause a socket error on the application using the TLS connection. To fix this the TLS time to live timeout needs to be changed on the policy that allows the traffic. This needs to be done with a CLI command:
config vdom
edit <name of vdom>
config firewall policy
edit <policy number>
set session-ttl 28800
next
end
the session-ttl is in seconds. This can be changed back to the global default by setting it back to 0
VPN Tunnel Troubleshooting CLI
Use the following command in the CLI to test each phase 2 on a VPN tunnel:
diagnose vpn ike log-filter dst-addr4 <ipaddress of VPN peer>
diagnose debug application ike -1
diagnose debug console timestamp enable
diagnose debug enable
diagnose debug disable