Troubleshooting
Latest
Each note follows the same arc: the symptom, how to confirm the root cause, and the fix.
An IPsec tunnel that won't come up is almost always a proposal mismatch — encryption, authentication, DH group or lifetime not agreeing. How to tell Phase 1 from Phase 2, read the "no proposal chosen" debug, compare both sides in one table, and align them (plus why lifetime rarely blocks the tunnel).
Open the walkthrough →The four most-reported FortiClient SSL-VPN errors, each mapped to the layer that failed — -14 credentials, -8 lockout, -20199 reachability, -5029 TLS — with the client-side fix and the FortiGate-side check for each.
Open the fixes →The built-in GUI/CLI toolbox, the two commands that crack most cases (debug flow + sniffer), and a section per issue — connectivity, policy, VPN, performance, DNS & routing — each with the copy-ready command, a sample of the output, and the insight that makes it click.
Open the playbook →Fortinet's recommended response to the FortiBleed credential-exposure campaign, as an actionable runbook — terminate sessions and reset credentials, enforce MFA, upgrade and enforce PBKDF2, validate the config, check logs, and lock down management access.
Open the checklist →Traffic to a service behind an FQDN firewall address object drops intermittently when the DNS record's TTL is 0 and the resolver round-robins its answers — the FortiGate's cached IP set and the client's connection drift apart. Why it happens, how to prove it, and why raising the TTL fixes it.
Open the walkthrough →