# Proof: debug flow tells you the policy, not your guess

Source: https://ai.techclick.in/blog_fortigate_debug_flow_session
Markdown: https://ai.techclick.in/blog_fortigate_debug_flow_session.md
Publisher: Techclick Infosec Pvt Ltd

Find the real policy id and NAT with diagnose debug flow + diagnose sys session. Dummy Priya 10.20.30.80.

## The ticket

 Priya cannot reach pay-api VIP. Three policies look right. You need the line that says  allowed by policy-20  or  denied by … .

  Quick interview answer

 FortiOS packet debug:  diagnose debug enable ,  diagnose debug flow filter … ,  diagnose debug flow trace start N . Filter by addr/port first — unfiltered flow on a busy box is an outage. Then  diagnose sys session filter  +  list  for the live 5-tuple and  policy_id . Flow is the decision; session is the state.

  Hero · trace

 The trace is the referee. Chat is not.
  Lab data · dummy only
 FortiGate  fgt-hq  mgmt  10.10.10.1  · WAN  203.0.113.10  · LAN  10.20.30.0/24  · FortiManager  10.10.10.5  · FortiAnalyzer  10.10.10.6  · Priya  10.20.30.80  · branch peer WAN  198.51.100.10  · Azure VPN GW public  203.0.113.50  · AWS VGW public  203.0.113.60 . RFC 5737. Not a customer.

## Mental model

- Flow = how this new packet is judged (policy, NAT, routing).

- Session = the state that later packets ride.

- If a session already exists, changing policy may do nothing until timeout / clear.

  New vs existing

  New SYN → flow + policy
  Later packets → session
  Old session survives edit

 Clear the session after a policy fix or you will chase a ghost.

## How to choose

 One user, one dest: flow filter. “Is NAT happening?”: session list. “Did my new deny apply?”: clear session then flow.

## Runbook

- #### Side A — filter Filter addr 10.20.30.80. Start 20 packets. Reproduce once.

- #### Side B — read Find allowed by policy / deny / SNAT IP.

- #### Side C — session Match policy_id. Then diagnose debug disable and diagnose debug flow trace stop .

  Safe lab sequence  diagnose debug reset
diagnose debug flow filter addr 10.20.30.80
diagnose debug flow show function-name enable
diagnose debug console timestamp enable
diagnose debug flow trace start 20
diagnose debug enable
# reproduce once from Priya
diagnose debug disable
diagnose debug flow trace stop

diagnose sys session filter src 10.20.30.80
diagnose sys session list
# policy_id=3  proto=6  ...
diagnose sys session clear   # only the filtered ones, after you meant to

## Four failures

### 1 · No filter on production

 CPU spike. Always filter.

### 2 · Stale session

 Policy changed, session did not.

### 3 · Asymmetric return

 Flow allows, reply never comes back to this FGT. Session incomplete.

### 4 · Forgot to disable debug

 The next night shift inherits a dying box.

## How to prove it

  Close only when

 1) You pasted a trace with policy id. 2) Session matches. 3) Debug is off. 4) You cleared only if you needed a new decision.

## Traps

   You think  Trace says

  VIP broken  denied by implicit policy — missing WAN-to-LAN
  Routing broken  allowed by policy-3, SNAT to 203.0.113.10 — look downstream

## Knowledge check

   Judgment items. One best answer. Reasons send you back to the matching section.

       Q1
       Why filter debug flow?

           Fashion
           Unfiltered traces can spike CPU on a busy FortiGate
           Filter enables SNAT
           Filter creates VIPs

       Correct:  b . Failure 1.

       Q2
       Policy edit did nothing. First thought?

           Stale session — filter and clear / wait timeout
           Renumber all policy ids
           Disable FAZ
           Change WAN IP

       Correct:  a . Failure 2.

       Q3
       Which command shows the live NAT mapping?

           get system status
           diagnose sys session list
           execute factoryreset
           diagnose hardware deviceinfo nic

       Correct:  b . Session table.

       Q4
       After the capture you must…

           Leave debug on overnight
           diagnose debug disable and stop the trace
           Reboot FMG
           Delete the VIP

       Correct:  b . Failure 4.

       Q5
       Flow says allowed, user still broken. Next?

           Asymmetry / return path / server itself
           FortiOS cannot allow
           Always a VIP bug
           Delete implicit deny

       Correct:  a . Failure 3.

       Q6
       debug flow is best for…

           Historical 30-day reports
           The next N packets that match your filter
           Replacing FAZ
           HA election

       Correct:  b . Concept.

       Check answers
       Reset

  FortiGate class series:   FGT / FMG / FAZ  ·  First day  ·  Policy first match  ·  SNAT vs VIP  ·  Profiles + SSL  ·  debug flow  ·  IPsec S2S  ·  SSL-VPN vs RA  ·  SD-WAN SLA  ·  VDOM  ·  FGCP HA  ·  Interview

## Sources

- FortiOS 7.4 — Debugging the packet flow .
- FortiOS 7.4 CLI — diagnose debug flow / diagnose sys session .

 Related:  FortiGate session factory  ·  VPN series .

---
Cite this Techclick lesson with the source URL. Do not invent fees, batch dates, or job guarantees.
Browse all lessons: https://ai.techclick.in/blogs
AI index: https://ai.techclick.in/llms.txt