Guide · free to read

FortiGate diagnose commands worth knowing.

Exam NSE4_FGT_AD-7.6 Written and maintained by Grindstone Prep Last updated 14 September 2026

FortiGate troubleshooting routinely comes down to the CLI, not the GUI. Resource exhaustion, packet-flow tracing, SD-WAN link selection, and VPN tunnel negotiation all expose far more useful detail through diagnose commands than any GUI page shows. Below is a working set of those commands, organized by what you’re actually trying to figure out, not an alphabetical dump — pulled from Fortinet’s own FortiOS 7.6 CLI Troubleshooting Cheat Sheet, which is worth bookmarking on its own.

Is the box itself the problem?

Before you touch a single policy, rule out the FortiGate’s own resources.

• get system performance status — the fastest resource snapshot: CPU state breakdown, memory usage, and session counts in one screen. Start here.
• diagnose sys top {s} {n} {i} — a per-process view: process name, PID, state, and CPU and memory usage for each running process, refreshed every s seconds for i iterations. This is the command to reach for once get system performance status tells you something is consuming resources but not what. While it’s running, Shift+C sorts the list by highest CPU usage and Shift+M sorts it by highest memory usage — that’s the current FortiOS 7.6 cheat sheet’s own answer, and it’s worth knowing cold rather than guessing mid-troubleshoot, since older or unofficial material floating around the internet sometimes names a different key for the same action.
• diagnose hardware sysinfo conserve — checks whether the device has entered conserve mode, and shows exactly how close memory usage is to the thresholds that trigger it. Fortinet’s default red threshold — the point where FortiGate forces itself into conserve mode — is 88% of total RAM; the exact number is configurable, but 88% is what you’ll see on an unmodified device.

Is the packet actually getting where you think it is?

• diagnose sniffer packet <interface> '<filter>' <verbose> <count> <a|l> — the built-in packet sniffer. <filter> is a standard tcpdump-style expression (for example, a host and port); <verbose> controls how much of each packet is printed; <count> caps how many packets to capture; the trailing a or l selects absolute or relative timestamps. Use this when you need to see whether traffic is arriving on an interface at all, before you start debugging policy logic.
• diagnose debug flow filter <filter>, then diagnose debug enable, then diagnose debug flow trace start <n> — the debug flow tool, and the order matters: set the filter first (so you’re not staring at every session on the box), enable debugging, then start the trace for n lines of output. This traces a single session through every stage of FortiGate’s processing — routing lookup, policy match, NAT, and so on — which is the fastest way to find which stage is dropping or mishandling a session you can reproduce on demand.

Why did SD-WAN pick that link?

Troubleshooting SD-WAN behavior almost always comes down to understanding why a rule selected the link it did, not just what SD-WAN is conceptually — which means the useful skill is reading these outputs, not reciting the concept.

• diagnose sys sdwan health-check status — shows the live health-check results (packet loss, latency, jitter) FortiGate is using to judge each member link’s quality right now. If a link looks unhealthy in a health check, this is where that judgment is coming from.
• diagnose sys sdwan service4 (or service6 for IPv6) — shows how the SD-WAN rules themselves are currently evaluated in the control plane.
• diagnose firewall proute list — shows the SD-WAN policy routes actually installed in the data plane, including hit counts. If a session isn’t taking the link you expect, this is the command that shows which policy route it actually matched.

Is the VPN tunnel actually up?

A tunnel that won’t come up almost always traces back to one of two phases — IPsec has two phases, and the commands below map directly onto them.

• diagnose vpn ike gateway list — Phase 1 (IKE) status: whether the gateway negotiation itself has completed.
• diagnose vpn tunnel list — Phase 2 status: whether the actual IPsec SAs (the tunnels carrying traffic) are up, and their traffic selectors.
• get vpn ipsec tunnel summary — a shorter summary view of the same tunnels, useful as a first check before drilling into either of the two commands above.

How to actually use this

1. Pull the cheat sheet yourself — it covers far more than the commands above (HA, switch-controller, wireless, logging, and more), organized by category, and it’s the fastest way to find a command you half remember the name of.
2. Actually run these against a lab FortiGate or FortiGate VM rather than just reading about them. Recognizing a command’s output during a live incident is a different skill than recognizing its description on a page, and only hands-on practice builds it.
3. The cheat sheet is versioned to FortiOS 7.6. If you’re studying against a different point release or a newer major version, check the version selector on the Fortinet Document Library page before assuming a command or a default value (like the 88% conserve-mode threshold) is unchanged.

Sources

Every command and every number above was checked against one of these Fortinet 7.6 pages. They are free to open, with no account, and checking them is the point of listing them:

• FortiOS 7.6 CLI Troubleshooting Cheat Sheet — the primary source for nearly every command above, including the Shift+C and Shift+M sort keys.
• Checking CPU and memory resources — the Administration Guide’s own resource page, where get system performance top is documented.
• Conserve mode — conserve mode and its default thresholds, including the 88% figure.
• Debugging the packet flow — the Administration Guide’s treatment of the debug flow tool.

Every practice question we publish carries the Fortinet page it was written from, the same way this guide does. You can see fifteen of them, scored by blueprint domain, in the free readiness assessment — it is drawn from the same NSE 4 bank this guide’s subject belongs to, no account, nothing recorded. How they are written is set out on the methodology page, and the catalog says which exams are on sale today.

← All guides