Documentation
Getting started
Every tool follows the same shape: fill in what you know about the traffic or the device, read the generated CLI, copy it, paste it into a session. There is no build step, no account, and no server round-trip — the generators are plain JavaScript running in the tab you have open.
Field values are kept in your browser's local storage so a refresh doesn't wipe your work. Clearing site data clears them.
Pick your firmware train first
Command syntax drifts between majors. Confirm what you're actually connected to before you copy anything — mismatched syntax on a production box costs you the maintenance window.
get system status | grep Version
Version: FortiGate-100F v7.4.4,build2662,240918 (GA.M)| Area | Note |
|---|---|
diagnose debug flow | Stable across 7.0–7.6. The show iprope option is the main addition in later builds. |
config system sdwan | Replaced the older virtual-wan-link block. On 7.0 and later use sdwan. |
set ike-version 2 | Unchanged, but IKEv2-only defaults differ between trains — always set it explicitly. |
execute log filter | Field names vary slightly by log category. Set the category first. |
What we store
Nothing. Field values live in memory and in your browser's local storage. There is no analytics on tool inputs, and configs you paste into the analyser tools are parsed locally — the text never leaves the page.
You can prove this: open the tools, disconnect from the network, and keep using the site. Everything keeps working — the fonts are self-hosted too.
Reading debug flow output
The flow trace prints one block per packet. These are the lines that answer most questions:
| Line | What it means |
|---|---|
allocate new session | First packet of a new session. The policy lookup below it is the one that matters. |
find a route | Shows the chosen gateway and egress interface, before policy evaluation. |
Denied by forward policy check | No matching policy, or the match is a deny. Check the interface pair and the service. |
reverse path check fail | Asymmetric routing — the return route doesn't point back out the ingress interface. |
enter IPsec tunnel | Traffic matched a phase 2 selector and is being encapsulated. |
If you see no output at all, the traffic is not reaching the firewall — go back to a sniffer capture before you touch policy.
Sniffer verbosity levels
| Level | Prints | Use when |
|---|---|---|
1 | Header only | Confirming a flow exists |
2 | Header + payload | Inspecting a protocol handshake |
3 | + ethernet header | MAC-level problems |
4 | Header + interface name | Default. Proving ingress and egress |
5 | + payload + interface | Full picture on a quiet box |
6 | Everything | Rarely. It is expensive |
Always set a packet count. 0 runs until you interrupt it, and on a busy firewall the console output alone can hurt.
IPsec phase mismatch table
| Symptom in the IKE debug | Usual cause |
|---|---|
no SA proposal chosen | Encryption, integrity or DH group mismatch in phase 1 |
probable pre-shared key mismatch | PSK differs — often trailing whitespace from a pasted ticket |
peer SA proposal not match local policy | Phase 2 selectors don't line up |
INVALID_ID_INFORMATION | Peer ID mismatch, commonly when one side is behind NAT |
retransmit / no response | UDP 500 or 4500 blocked in the path |
Paste the raw debug into the IPsec error decoder and it will do this matching for you.
Disclaimer
FortiTools is an independent project. It is not affiliated with, endorsed by, or supported by any vendor, and the generated output is offered without warranty. Review every command before you run it — you are still the engineer on the change ticket.