Addresses and Policies
Make sure when adding any policy or address it is also added to the policy or address that you are trying to affect.
CLI Commands
Ping - can also be used as nslookup
exec ping <ip address or FQDN>
FQDN addresses
Check for resolved IP addresses for all FQDN addresses in CLI:
diagnose firewall fqdn list
Add Bulk IPs to fortigate via CLI
check this guide: https://community.fortinet.com/t5/FortiGate/Technical-Tip-Creation-and-addition-of-bulk-IP-address-objects/ta-p/241823
Troubleshooting VPN connections
info video for troubleshooting VPN connections https://www.youtube.com/watch?v=CXWoTZ5t8XI&t=2923s
TLS Session Timeout
If no data is transferred for a TLS session seen by the firewall it will timeout and can cause a socket error on the application using the TLS connection. To fix this the TLS time to live timeout needs to be changed on the policy that allows the traffic. This needs to be done with a CLI command:
config vdom
edit <name of vdom>
config firewall policy
edit <policy number>
set session-ttl 28800
next
end
the session-ttl is in seconds. This can be changed back to the global default by setting it back to 0
VPN Tunnel Troubleshooting CLI
Use the following command in the CLI to test each phase 2 on a VPN tunnel:
diagnose vpn ike log-filter dst-addr4 <ipaddress of VPN peer>
diagnose debug application ike -1
diagnose debug console timestamp enable
diagnose debug enable
diagnose debug disable