I85PREP
⌘ K
NSE 8 study materials
NSE 8 study resources

NSE 8: Troubleshooting for Complex Networks

NSE 8 · Work through your exam, one topic at a time.

All guide sections

Troubleshooting for Complex Networks

Troubleshooting for complex networks

The troubleshooting domain tests a repeatable method on FortiOS deployments where the fault may sit in routing, HA, VPN, SD-WAN, NAT, or inspection. The exam rewards evidence gathering and narrow scope, not random command output.

Rules for narrowing the fault

  • Define the flow: source IP, destination IP, protocol/port, VDOM, and expected path. Reproduce it and capture on both sides where possible.
  • Verify L1-L3 first: get system interface, get system arp, and diagnose ip arp list. Then check the route: get router info routing-table details <ip> and diagnose ip router lookup.
  • Confirm policy match and NAT with session tools: diagnose sys session filter, diagnose sys session list, and diagnose firewall iprope lookup. A session in the table does not prove the return path.
  • For IPsec, check diagnose vpn ike gateway list and diagnose vpn tunnel list; enable diagnose debug application ike -1 only with a filter, then disable it.
  • For HA, check get system ha status, diagnose sys ha status, and diagnose sys ha checksum show; a checksum mismatch explains why a secondary has different routes or policies.
  • For SD-WAN, inspect diagnose sys sdwan health-check and diagnose sys sdwan service; SLA failures can silently move traffic.

Worked example

After a DC failover, a branch loses ERP access. The branch tunnel is up, so check routing: get router info routing-table details 10.20.1.10 still points to the old hub next-hop, which is unreachable. diagnose vpn tunnel list shows the tunnel to the new hub, but BGP has not installed the new path. diagnose sniffer packet shows SYN leaving the branch, while the hub session table shows no return route. Reasoning: tunnel state is not the same as routing convergence. Clear or reset the BGP neighbor, verify advertised prefixes, and confirm the hub has a route back. If the session table shows the old NAT IP, check HA session synchronization and failover timing.

Traps that cost marks

  • Leaving diagnose debug enable running.
  • Sniffing without a filter and overwhelming the CPU.
  • Checking policy but not the return route.
  • Assuming “tunnel up” means “traffic flows.”
  • Ignoring MTU/MSS in IPsec or SD-WAN paths.
  • Troubleshooting from the wrong VDOM or mistaking an HA checksum mismatch for a licensing problem.