Fortigate 100E: Correct way to use Management Interface

Hi,

The first thing I would do is to check the status of the management interface and see if it has been configured correctly in terms of the management protocols that need to be enabled along with its associated IP address, subnet mask etc. This can be checked under Network >> Interfaces on the GUI.

Then, I would check that there are no trusted hosts configured. 

Failing that, just for testing purposes, I would enable Local Traffic Log under Log & Report >> Log Settings. The local traffic log includes management traffic and it will provide you with more information during the testing process.

Next, I would proceed to running a sniffer. On the CLI, run the following command:

diag sniffer packet [management-interface-goes-here] 'host [ip adddress that you test from goes here]' 6

Moreover, under Network >> Packet Capture, you can set a filter to capture the interesting traffic which you can then analyse on Wireshark.

For deeper troubleshooting, you can also run a debug by following the instructions below:

diag debug disable

diag debug flow trace stop

diag debug flow filter clear

diag debug reset

diag debug flow filter addr [ip address you test from goes here]

diagnose debug flow show console enable diagnose debug flow show function-name enable diagnose debug console timestamp enable

diag debug flow trace start 100

diag debug enable

Once you have collected the output of the above ensure that debugging is disabled:

diag debug disable

diag debug flow trace stop

diag debug flow filter clear

diag debug reset

Provided that local traffic logging was enabled at the very start, you should also be able to see more information on the resulting log.

Feel free to post the outputs of all of the above here along with a diagram of your topology as well if possible so we can assist you further.