Fortinet · FortiOS 7.4 · Lesson 6 of 12

Proof: debug flow tells you the policy, not your guess

Three engineers, three theories. One of them is right. diagnose debug flow prints the trace: which policy matched, SNAT, drop reason. The session table is the after-photo. Learn these two commands and you stop arguing in chat.

Updated 2026-08-18·18 min read·L2 primary·Quiz at end

After this page you can

Filter a flow without melting the CPU.
Read policy_id, SNAT, and drop in the trace.
Cross-check diagnose sys session list.
Turn debug off when you are done.

The ticket

Priya cannot reach pay-api VIP. Three policies look right. You need the line that says allowed by policy-20 or denied by ….

Quick interview answer

FortiOS packet debug: diagnose debug enable, diagnose debug flow filter …, diagnose debug flow trace start N. Filter by addr/port first — unfiltered flow on a busy box is an outage. Then diagnose sys session filter + list for the live 5-tuple and policy_id. Flow is the decision; session is the state.

Engineer reading a FortiGate debug flow trace — The trace is the referee. Chat is not.

Lab data · dummy only

FortiGate fgt-hq mgmt 10.10.10.1 · WAN 203.0.113.10 · LAN 10.20.30.0/24 · FortiManager 10.10.10.5 · FortiAnalyzer 10.10.10.6 · Priya 10.20.30.80 · branch peer WAN 198.51.100.10 · Azure VPN GW public 203.0.113.50 · AWS VGW public 203.0.113.60. RFC 5737. Not a customer.

Mental model

Flow = how this new packet is judged (policy, NAT, routing).
Session = the state that later packets ride.
If a session already exists, changing policy may do nothing until timeout / clear.

New vs existing

Clear the session after a policy fix or you will chase a ghost.

How to choose

One user, one dest: flow filter. “Is NAT happening?”: session list. “Did my new deny apply?”: clear session then flow.

Runbook

Side A — filter
Filter addr 10.20.30.80. Start 20 packets. Reproduce once.
Side B — read
Find allowed by policy / deny / SNAT IP.
Side C — session
Match policy_id. Then diagnose debug disable and diagnose debug flow trace stop.

Safe lab sequence

diagnose debug reset
diagnose debug flow filter addr 10.20.30.80
diagnose debug flow show function-name enable
diagnose debug console timestamp enable
diagnose debug flow trace start 20
diagnose debug enable
# reproduce once from Priya
diagnose debug disable
diagnose debug flow trace stop

diagnose sys session filter src 10.20.30.80
diagnose sys session list
# policy_id=3  proto=6  ...
diagnose sys session clear   # only the filtered ones, after you meant to

Four failures

1 · No filter on production

CPU spike. Always filter.

2 · Stale session

Policy changed, session did not.

3 · Asymmetric return

Flow allows, reply never comes back to this FGT. Session incomplete.

4 · Forgot to disable debug

The next night shift inherits a dying box.

How to prove it

Close only when

1) You pasted a trace with policy id. 2) Session matches. 3) Debug is off. 4) You cleared only if you needed a new decision.

Traps

You think	Trace says
VIP broken	denied by implicit policy — missing WAN-to-LAN
Routing broken	allowed by policy-3, SNAT to 203.0.113.10 — look downstream

FortiGate class series: FGT / FMG / FAZ · First day · Policy first match · SNAT vs VIP · Profiles + SSL · debug flow · IPsec S2S · SSL-VPN vs RA · SD-WAN SLA · VDOM · FGCP HA · Interview