FortiGate Troubleshooting - Debug Flow with Examples

Debug flow will help you troubleshoot the logic process the FortiGate takes when forwarding traffic.
We will go over some specifics on reading debug flow:
Traffic direction
Interfaces
Routing
Policy Matching
Trace ID
Session matching
"No matching IPsec selector, drop" message
"Allowed by Policy" message
"reverse path check fail, drop" message
"Denied by forward policy check (policy 0)" message

Debug Flow Command Review:

diag debug flow filter #view the current filter
diag debug flow filter clear #clear the debug flow filter
diag debug flow filter proto 1 #filter for protocol 1
diag debug flow filter addr x.x.x.x
diag debug console timestamp enable #enable timestamp in outputs
diag debug flow trace start x #how many packets to trace/debug
diag debug enable #enable the debug
diag debug disable #disable the debug
diag debug reset #reset all debug parameters (includes debug flow filter clear)



0:00 Overview
0:38 Debug Flow Filter
2:07 Example #1 - working example
4:45 Example #2 - non-working example
6:49 Example #3 - another non-working example