FortiGate Troubleshooting - Debug Flow with Examples 

Debug flow will help you troubleshoot the logic process the FortiGate takes when forwarding traffic.
We will go over some specifics on reading debug flow:
- Traffic direction
- Interfaces
- Routing
- Policy Matching
- Trace ID
- Session matching
- "No matching IPsec selector, drop" message
- "Allowed by Policy" message
- "reverse path check fail, drop" message
- "Denied by forward policy check (policy 0)" message
Debug Flow Command Review:
diag debug flow filter #view the current filter
diag debug flow filter clear #clear the debug flow filter
diag debug flow filter proto 1 #filter for protocol 1
diag debug flow filter addr x.x.x.x
diag debug console timestamp enable #enable timestamp in outputs
diag debug flow trace start x #how many packets to trace/debug
diag debug enable #enable the debug
diag debug disable #disable the debug
diag debug reset #reset all debug parameters (includes debug flow filter clear)
0:00 Overview
0:38 Debug Flow Filter
2:07 Example #1 - working example
4:45 Example #2 - non-working example
6:49 Example #3 - another non-working example

Наука