Prove FortiGate — five tickets, first tool, one field

Hero · 02:11 evidence desk

1. Why the desk exists

The session factory taught how FortiOS builds a flow. This page is the night shift. Five tickets. Each one has a first tool and a proof field. If you cannot name both, you are not ready to ask for a change window.

Concept: evidence is a field, not a feeling. Path: pick the instrument → filter → read one field → write the ticket sentence. Do: close all five tickets below without adding policy 15.

2. Three instruments

Pre-train the three words before the tickets. You will use all three tonight. You will start with only one.

Feel · Packet → Session → Verdict → Proof

3. First-tool decision

Flowchart first. Read the diamond, then the prose.

Feel · Session / Flow / Logs

4. How to choose

Primary source for the session column: FortiOS Administration Guide — Using a session table. Primary source for the flow column: Debugging the packet flow plus Using the debug flow tool. Primary source for the log column: FortiOS Log Message Reference — Log message fields.

5. Side A / B / C — the three tools

Hard words, then the commands. Tickets come next. Every step cites one official page.

Side A — session table (isolate)

Source: Using a session table. FortiOS places an entry in the session table for each traffic session that passes through a security policy. The CLI supports filters so you show only the data you need.

1. State VDOM and HA role

   get system status and, if clustered, get system ha status. An empty table on the standby is not a missing policy.

2. Arm the filter — this is not a list

   diagnose sys session filter src 10.10.20.45. Official options also include dst, dport, proto, proto-state, policy, vd (−1 matches all VDOMs), and clear.

3. List and read the proof fields

   diagnose sys session list. Quote proto_state, policy_id, orig-tuple, reply-tuple, NAT hooks. TCP proto_state=01 is SYN seen — not established. 11 is the established pair operators look for after a fix.

4. GUI twin (optional show-back)

   FortiView Sessions, or Security Fabric → Physical Topology → Metrics → Sessions. Same 5-tuple. Do not open Firewall Policy from this screen to add 15.

FGT-LAB # diagnose sys session filter src 10.10.20.45
session filter:
        vd: 0
        proto: any
        src: 10.10.20.45-10.10.20.45
        dst: any
filter applied.

FGT-LAB # diagnose sys session list
session info: proto=6 proto_state=01 duration=48 expire=3552 timeout=3600
  orig-tuple: 10.10.20.45:51990 -> 198.51.100.80:443
  reply-tuple: 198.51.100.80:443 -> 203.0.113.20:18422
  hook=post dir=org act=snat 10.10.20.45:51990->203.0.113.20:18422
  policy_id=14 pol_idx=0
  npu_state=00000000
  total: 1 session listed

Side B — diagnose debug flow (isolate, risky)

Source: Debugging the packet flow (CLI) and Using the debug flow tool (GUI). Packet-flow debug is a CLI-first instrument. The GUI path is Network → Diagnostics → Debug Flow.

1. Filter first — official keys

   IPv4: diagnose debug flow filter with addr, saddr, daddr, port, sport, dport, proto, vd, or clear. IPv6 uses filter6. GUI Basic filter = addr / port / proto. GUI Advanced = saddr / sport / daddr / dport / proto.

2. Enable, name functions, start N packets

   Official sequence: diagnose debug enable → diagnose debug flow filter addr 10.10.20.45 → diagnose debug flow show function-name enable → diagnose debug flow trace start 100. GUI: click Start debug flow. Messages are real-time.

3. Read the official-style lines

   Look for received a packet, allocate a new session, find a route, Allowed by Policy-N: SNAT. Silence after a reproduce is also evidence — the packet never hit this VDOM, or the session is NP-offloaded.

4. Stop is part of isolate

   diagnose debug flow trace stop, then disable / reset. GUI: Stop debug flow, then Save as CSV if you need the file. Add the Function column (Configure Table) when you want fw_forward_handler next to the message.

FGT-LAB # diagnose debug enable
FGT-LAB # diagnose debug flow filter addr 10.10.20.45
FGT-LAB # diagnose debug flow show function-name enable
FGT-LAB # diagnose debug flow trace start 100
id=20085 trace_id=17 func=print_pkt_detail msg="vd-root:0 received a packet(proto=6, 10.10.20.45:51990->198.51.100.80:443) from port2."
id=20085 trace_id=17 func=resolve_ip_tuple msg="allocate a new session-00000e90"
id=20085 trace_id=17 func=fw_forward_handler msg="Allowed by Policy-14: SNAT"
FGT-LAB # diagnose debug flow trace stop
FGT-LAB # diagnose debug disable
FGT-LAB # diagnose debug reset

Side C — Log & Report (history)

Source: Log message fields. In the GUI you view logs in the Log & Report pane (formatted). Raw format is a download you open in a text editor. A traffic log is type="traffic" subtype="forward".

1. Open Forward Traffic, filter the 5-tuple

   Log & Report → Forward Traffic. Filter source 10.10.20.45, destination, service HTTPS. You are looking for a row that already exists — not a live session.

2. Quote the official fields

   action (example in the reference: close; you will also see accept / deny / ip-conn). policyid. sessionid. trandisp / transip if NAT. utmaction is “Security action performed by UTM.” utmref is the UTM reference number — follow it into Security Events.

3. If utmaction is not allow, open Security Events

   Web Filter, IPS, Antivirus — whichever profile the policy attached. The traffic log can say the firewall accepted while UTM blocked. That is not a missing accept rule.

6. Five tickets

Each card is the same contract: first tool, proof field, ticket sentence, what you do not do. Lab 5-tuple: 10.10.20.45 → 198.51.100.80:443, SNAT 203.0.113.20.

T1 — HTTPS allowed, handshake never finishes

Hypothesis: policy already accepts. TCP is not established. The Side A CLI card is this ticket. SNAT hook is present. Reply tuple exists. Handshake is one-way.

Ticket sentence: Policy 14 already matched. proto_state=01 — SYN seen, not established. Adding policy 15 will not finish TCP. Isolate the return path / server SYN-ACK. Change-control only with an owner if the SNAT pool or return route is wrong.

T2 — “It was blocked ten minutes ago”

History, not live. The Side C portal is this ticket. Official fields: type=traffic subtype=forward, action, policyid, srcip, dstip, srcintf, dstintf.

Ticket sentence: Forward Traffic shows action=deny policyid=0 for this 5-tuple — implicit deny, not a broken session. Next isolate is the interface pair on that log row. Change-control is one new policy on the right srcintf/dstintf, not a clone of 14 on the old pair.

T3 — Filter + list is empty, user is clicking now

Use Side B. Confirm you are on the HA primary and the correct VDOM first. Then filter addr 10.10.20.88, trace start 100, reproduce, read, stop.

If you get vd-root received a packet … from port2 and then a deny or no route — the packet arrived; the verdict is on the next line. If you get nothing, the packet never hit this VDOM (wrong box, wrong VLAN, or you are on standby). That silence is the proof. Do not add a policy for a packet that never arrived.

T4 — Policy accept, page is a FortiGuard block

Established TCP plus a block page is UTM, not a missing accept. Official traffic-log example includes utmaction="allow" and utmref=0-220586. Your row will show a non-allow UTM action and a utmref you follow.

Ticket sentence: Firewall accepted (policyid=14, session established). utmaction is the block. Change-control is the Web Filter / IPS profile or an override — not policy 15.

T5 — Debug flow is empty on production HTTPS

Fortinet: flow monitoring does not work for traffic offloaded to NP6 or NP7. Official options: test with ICMP (not offloaded), or temporarily disable NP6 fastpath / disable NP7 offloading on the firewall policy that accepts the traffic.

Ticket sentence: Empty HTTPS flow is not proof the packet missed the box. Session npu_state shows offload. Retest ICMP with a tight filter, or an approved offload disable, then stop debug. Leaving flow on is forbidden.

7. After the capture

Once the first tool has spoken, the runtime path is short. You do not start a second dangerous tool because you are curious.

1. Paste the field

   One line in the ticket: instrument + field + 5-tuple + VDOM + HA role.

2. Turn dangerous things off

   diagnose debug flow trace stop → disable → reset. GUI: Stop debug flow. Confirm no leftover filter if you will hand the box to day shift (diagnose sys session filter clear is a filter clear — not a session flush).

3. Decide isolate vs change-control

   A read is isolate. A new policy, NAT pool, profile change, or NP disable on a production policy is change-control: one owner, one reversible edit, same 5-tuple retest.

4. Retest the same tuple

   Success is proto_state=11 (or the user transaction) plus, if UTM was in play, utmaction=allow. Green HA and a green dashboard widget are not the retest.

Proof · field then checkmark

8. Traps and proof

Sources

• FortiOS Administration Guide 8.0.0 — Debugging the packet flow (CLI filter keys, trace start/stop, FAZ/FortiCloud warning, NP6/NP7 exception, sample “Allowed by Policy-3: SNAT”)
• FortiOS Administration Guide 8.0.0 — Using the debug flow tool (Network → Diagnostics → Debug Flow; Basic/Advanced filters; Start / Stop / Save as CSV; Function column)
• FortiOS Administration Guide 7.4.0 — Using a session table (diagnose sys session list / filter options including proto-state, policy, vd; Physical Topology → Sessions)
• FortiOS Administration Guide — FortiView Sessions
• FortiOS Log Message Reference 8.0.0 — Log message fields (Log & Report formatted view; type=traffic subtype=forward; action, policyid, utmaction, utmref)
• FortiOS CLI Reference — diagnose sys (session filter / proto-state)

Related: FortiGate session factory · FortiGate troubleshooting command center · FortiGate interview · Policies and NAT · FortiGate interview hub