= Fortigate debug and diagnose commands complete cheat sheet
Yuri Slobodyanyuk <admin@yurisk.info>
v1.0, 2020-09-01
:homepage: https://yurisk.info


NOTE: To enable debug set by any of the commands below, you need to run *diagnose debug enable*. This is assumed and not reminded any further.
NOTE: To disable and stop immediately any debug, run *dia deb res* which is short for *diagnose debug reset*.


== IPSEC VPN debug

.IPSEC VPN Debug
[cols=2*,options="header"]
|===
|Command
|Description

| *diagnose vpn ike log-filter <parameter>* 
a| Filter VPN debug messages using various parameters:  

* `list`  Display the current filter.
* `clear` Erase the current filter.
* `name` Phase1 name to filter by.
* `src-addr4`/`src-addr6`   IPv4/IPv6 source address range to filter by.
* `dst-addr4`/`dst-addr6`   IPv4/IPv6 destination address range to filter by.
* `src-port` Source port range
* `dst-port`  Destination port range
* `vd`  Index of virtual domain. -1 matches all.
* `interface` Interface that IKE connection is negotiated over.
* `negate` Negate the specified filter parameter.


|*diagnose debug application ike -1*
| Enable IPSec VPN debug, shows phase 1 and phase 2 negotiations (for IKEv1) and everything for IKEv2. 
"-1" sets the verbosity level to maximum, any other number will show less output.

|*diagnose vpn ike gateway flush name <vpn_name>*
|Flush (delete) all SAs of the given VPN peer only.

|*get vpn ipsec tunnel details* 
| Detailed info about the tunnels: Rx/Tx packets/bytes, IP addresses of the peers, algorithms used, detailed selectors info, lifetime.

|*get vpn ipsec stats tunnel*
| Short general statistics about tunnels: number, kind, number of selectors, state

|*get vpn ipsec tunnel summary* 
| Short statistics per each tunnel: number of selectors up/down, number of packets Rx/Tx.


|*get vpn ipsec stats crypto*
| Statistics of the crypto component (ASIC/software) of the Fortigate: encryption algorithm, hasshing algorithm.





|===