\n
<\/p>\n
Base system diagnostics<\/strong><\/h5>\nThe status screen in the web-based manager includes a high level overview of information such as the system time (that is important, for example, to have coherent error messages and log recording), CPU and memory usage, license information, and alerts, as we can see in the following screenshot:<\/p>\n
\n
![\"5_1\"](\"https:\/\/modern-workplace.uk\/\/wp-content\/uploads\/2013\/11\/5_1-1024x455.png\")
<\/a><\/p>\nAlthough this screen is useful for a rapid assessment of the situation, our diagnostic tools usually have to dig deeper. The first base command we will use in the CLI is\u00a0get system<\/span>. This command can open more than eighty information options, dedicated to the different features of the FortiGate units. Among the others, we are able to check counters related to performance, such as:<\/p>\n\n- Startup configuration errors with the\u00a0get system startup-error-log<\/span><\/em>\u00a0command.<\/li>\n
- Firewall traffic statistics related to the traffic with the\u00a0get system performance firewall statistics\u00a0<\/span><\/em>command<\/li>\n
- Firewall packet distribution statistics with the\u00a0get system performance firewall packet-distribution<\/em>\u00a0<\/span>command<\/li>\n
- Information about the most intensive CPU processes with the\u00a0get system performance top<\/span>, that will show a screen divided in columns, as we can see in the following screenshot:
\n <\/li>\n<\/ul>\n![\"5_2\"](\"https:\/\/modern-workplace.uk\/\/wp-content\/uploads\/2013\/11\/5_2.png\")
<\/a><\/p>\nAnother fundamental command we will use is\u00a0diagnose hardware<\/span>, which is used for problem-solving procedures related to certificates, devices, PCI, and system information. The devices menu is opened with the\u00a0diagnose hardware deviceinfo<\/span>, and includes a\u00a0disk<\/span>\u00a0option to recover information about internal disks (if present) and a\u00a0nic<\/span>\u00a0option to display data from network interfaces. The latter also shows on screen the errors and the drops related to network packets, as we can see in the following screenshot:<\/p>\n![\"5_3\"](\"https:\/\/modern-workplace.uk\/\/wp-content\/uploads\/2013\/11\/5_3.png\")
<\/a><\/p>\nTo have access to real-time information, we will use the\u00a0diagnose debug<\/span>\u00a0command. The\u00a0diagnose debug report<\/span>\u00a0is not a troubleshooting tool, but is used to create a report for the Fortinet technical support. We will talk about additional options for the\u00a0diagnose debug<\/span>\u00a0command later, in relation to TCP\/IP debugging.<\/p>\n
\n\n
Troubleshooting routing<\/strong><\/h5>\nThe tools that we will see in the following paragraphs will be required to troubleshoot the addressing and routing features of the TCP\/IP protocol. Before we proceed to explain the single tools and commands for troubleshooting, we can take advantage of a real-world suggestion. In order to perform the troubleshooting steps in a more comfortable way, it is often advisable to use a client for SSH and Telnet such as PuTTY (http:\/\/bit.ly\/1kyS98<\/a>), to launch two separate sessions on a FortiGate unit. One of the two consoles will be dedicated to watch the results of the debug commands. The second console will be dedicated to launch commands, such as ping and traceroute that we will use to trigger actions that will be visible in the first open console. In the following screenshot we have a\u00a0diagnose sniffer packet port1 icmp\u00a0<\/span>command running on the session opened to the left-hand side and an\u00a0execute ping<\/span>\u00a0command on the session opened on the right-hand side window:<\/p>\n![\"5_14\"](\"https:\/\/modern-workplace.uk\/\/wp-content\/uploads\/2013\/11\/5_14-1024x320.png\")
<\/a><\/p>\n
\n\n
Layer 2 and layer 3 TCP\/IP diagnostics<\/strong><\/h5>\nSome issues can be solved only by correcting the ARP table that associates IP and MAC addresses. Thediagnose ip arp list<\/span>\u00a0command shows the ARP cache as shown in the following screenshot:<\/p>\n![\"5_4\"](\"https:\/\/modern-workplace.uk\/\/wp-content\/uploads\/2013\/11\/5_4.png\")
<\/a><\/p>\n\n
The following commands are used to manage the ARP cache:<\/p>\n
\n- The\u00a0execute clear system arp table<\/span>\u00a0command to remove the ARP cache.<\/li>\n
- The\u00a0diagnose ip arp delete <interface name> <IP address><\/span>\u00a0command to remove a single ARP entry.<\/li>\n
- The\u00a0diagnose ip arp flush <interface name><\/span>\u00a0command to remove all entries associated with a single interface.<\/li>\n
- The\u00a0config system arp-table<\/span>\u00a0command to add a static ARP entry. This command requires two further commands:\n
\n- The\u00a0config system arp-table<\/span>\u00a0command<\/li>\n
- The\u00a0edit<\/span>\u00a0command to create a new entry and to modify an existing entry or to create a new one<\/li>\n<\/ul>\n<\/li>\n
- Three mandatory parameters are:\n
\n- set mac<\/span>, to configure a MAC address for the entry<\/li>\n
- set ip<\/span>, to configure an IP address for the entry<\/li>\n
- set interface<\/span>, to select the interface that is connected to the MAC and IP<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n
In the following screenshot we can see all the required steps to add the entry number\u00a03<\/span>\u00a0on our ARP cache with the following parameters:\u00a0ip 192.168.12.1<\/span>\u00a0with a\u00a0mac F0:DE:F1:E4:75:B9<\/span>\u00a0on the internal interface:<\/p>\n![\"5_5\"](\"https:\/\/modern-workplace.uk\/\/wp-content\/uploads\/2013\/11\/5_5.png\")
<\/a><\/p>\nThe use of a static ARP entry can be useful, for example, to resolve and prevent problems such as ARP poisoning. For more information you can read the article from\u00a0Corey Nachreiner<\/span>\u00a0:\u00a0Anatomy of an ARP Poisoning Attack<\/b>\u00a0available athttp:\/\/www.watchguard.com\/infocenter\/editorial\/135324.asp<\/a>.<\/span><\/p>\nWe can now take care of layer 3, especially from the point of view of routing. As in any device that manages networking, the most used command (included in the ICMP protocol) is the ping command. A FortiGate unit supports two kinds of ping commands:\u00a0execute ping <IP address><\/span>\u00a0and a command dedicated to modify the behavior of the ping command,\u00a0execute ping-options<\/span>, that includes parameters such as:<\/p>\n\n- data-size<\/span>: To select the datagram size in bytes (between 0 and 65507)<\/li>\n
- interval<\/span>: To set a value in seconds between two pings<\/li>\n
- repeat-count<\/span>: To select the number of pings to send<\/li>\n
- source<\/span>: To specify a source interface (default value is auto-select)<\/li>\n
- view-settings<\/span>: Used to show the current ping options<\/li>\n
- timeout<\/span>: To specify time out in seconds<\/li>\n<\/ul>\n
In the following screenshot we have modified some ping parameters and verified them with the\u00a0view-settings<\/span>\u00a0parameter:<\/p>\n
<\/a><\/p>\nAlthough this screen is useful for a rapid assessment of the situation, our diagnostic tools usually have to dig deeper. The first base command we will use in the CLI is\u00a0get system<\/span>. This command can open more than eighty information options, dedicated to the different features of the FortiGate units. Among the others, we are able to check counters related to performance, such as:<\/p>\n Another fundamental command we will use is\u00a0diagnose hardware<\/span>, which is used for problem-solving procedures related to certificates, devices, PCI, and system information. The devices menu is opened with the\u00a0diagnose hardware deviceinfo<\/span>, and includes a\u00a0disk<\/span>\u00a0option to recover information about internal disks (if present) and a\u00a0nic<\/span>\u00a0option to display data from network interfaces. The latter also shows on screen the errors and the drops related to network packets, as we can see in the following screenshot:<\/p>\n To have access to real-time information, we will use the\u00a0diagnose debug<\/span>\u00a0command. The\u00a0diagnose debug report<\/span>\u00a0is not a troubleshooting tool, but is used to create a report for the Fortinet technical support. We will talk about additional options for the\u00a0diagnose debug<\/span>\u00a0command later, in relation to TCP\/IP debugging.<\/p>\n \n The tools that we will see in the following paragraphs will be required to troubleshoot the addressing and routing features of the TCP\/IP protocol. Before we proceed to explain the single tools and commands for troubleshooting, we can take advantage of a real-world suggestion. In order to perform the troubleshooting steps in a more comfortable way, it is often advisable to use a client for SSH and Telnet such as PuTTY (http:\/\/bit.ly\/1kyS98<\/a>), to launch two separate sessions on a FortiGate unit. One of the two consoles will be dedicated to watch the results of the debug commands. The second console will be dedicated to launch commands, such as ping and traceroute that we will use to trigger actions that will be visible in the first open console. In the following screenshot we have a\u00a0diagnose sniffer packet port1 icmp\u00a0<\/span>command running on the session opened to the left-hand side and an\u00a0execute ping<\/span>\u00a0command on the session opened on the right-hand side window:<\/p>\n \n Some issues can be solved only by correcting the ARP table that associates IP and MAC addresses. Thediagnose ip arp list<\/span>\u00a0command shows the ARP cache as shown in the following screenshot:<\/p>\n \n The following commands are used to manage the ARP cache:<\/p>\n In the following screenshot we can see all the required steps to add the entry number\u00a03<\/span>\u00a0on our ARP cache with the following parameters:\u00a0ip 192.168.12.1<\/span>\u00a0with a\u00a0mac F0:DE:F1:E4:75:B9<\/span>\u00a0on the internal interface:<\/p>\n The use of a static ARP entry can be useful, for example, to resolve and prevent problems such as ARP poisoning. For more information you can read the article from\u00a0Corey Nachreiner<\/span>\u00a0:\u00a0Anatomy of an ARP Poisoning Attack<\/b>\u00a0available athttp:\/\/www.watchguard.com\/infocenter\/editorial\/135324.asp<\/a>.<\/span><\/p>\n We can now take care of layer 3, especially from the point of view of routing. As in any device that manages networking, the most used command (included in the ICMP protocol) is the ping command. A FortiGate unit supports two kinds of ping commands:\u00a0execute ping <IP address><\/span>\u00a0and a command dedicated to modify the behavior of the ping command,\u00a0execute ping-options<\/span>, that includes parameters such as:<\/p>\n In the following screenshot we have modified some ping parameters and verified them with the\u00a0view-settings<\/span>\u00a0parameter:<\/p>\n\n
\n <\/li>\n<\/ul>\n<\/a><\/p>\n<\/a><\/p>\n
\nTroubleshooting routing<\/strong><\/h5>\n
<\/a><\/p>\n
\nLayer 2 and layer 3 TCP\/IP diagnostics<\/strong><\/h5>\n
<\/a><\/p>\n\n
\n
\n
<\/a><\/p>\n\n
![\"5_6\"](\"https:\/\/modern-workplace.uk\/\/wp-content\/uploads\/2013\/11\/5_6.png\")
<\/a><\/p>\n![\"5_7\"](\"https:\/\/modern-workplace.uk\/\/wp-content\/uploads\/2013\/11\/5_7.png\")
<\/a><\/p>\n