I85PREP
⌘ K
FCSS Enterprise Firewall 7.6 study materials
FCSS Enterprise Firewall 7.6 study resources

FCSS Enterprise Firewall 7.6: Diagnostics and Troubleshooting

FCSS Enterprise Firewall 7.6 · Work through your exam, one topic at a time.

All guide sections

Diagnostics and Troubleshooting

Diagnostics and Troubleshooting

This domain tests a repeatable method: verify the interface and route, confirm the session exists, then trace the packet through policy and UTM. Expect questions on sniffer and debug flow syntax, and on interpreting CLI output rather than guessing.

Core rules

  • Sniffer. diagnose sniffer packet any '<filter>' 4 a - level 4 adds the interface name and a gives absolute timestamps. Levels: 1 header only, 3 includes the Ethernet payload, 6 the full payload with interface names.
  • Debug flow. diagnose debug flow filter addr <ip>, then diagnose debug flow trace start 100, then diagnose debug enable. Read the lines: iprope_in_check() check failed, drop means no route; check failed on policy 0 means no policy matched; denied by forward policy check means a UTM profile or policy action blocked it.
  • Sessions. diagnose sys session filter dst <ip>, diagnose sys session list, diagnose sys session clear; get system session status shows counts and setup rate.
  • Resources. get system performance status reports CPU, memory and uptime; diagnose sys top 2 30 and diagnose sys top-summary show heavy processes; memory pressure triggers conserve mode and new sessions fail.
  • Routing and HA. get router info routing-table all, get router info bgp summary, get router info ospf neighbor, diagnose sys ha status, diagnose sys ha checksum show.
  • Services and identity. diagnose debug rating for FortiGuard, diagnose autoupdate versions, diagnose firewall auth list, diagnose debug authd fsso list, and execute tac report before opening a case.

Worked example

A user cannot reach an HTTPS site. Flow debug shows iprope_in_check() check failed on policy 0, drop, so no policy matches - the address object excludes the source NAT range. After adding it, the trace shows denied by forward policy check, pointing at the web filter. With both fixed, the sniffer on the egress port shows the SYN leaving and no SYN-ACK returning, so the ISP is blocking the port. Reasoning: each output line narrows the failing stage, and the sniffer proves the direction of the failure.

Traps

Leaving debug running (call diagnose debug disable afterwards) and burning CPU; trace buffers too small so the interesting packet is overwritten; sniffing only the ingress interface after source NAT; assuming an empty session table means packets never arrived; forgetting diagnose debug console timestamp enable.