Technical Tip : Gathering Diagnostics on FortiGate over an SSH session

[pehret]

Description

This article describes how to collect debug or diagnostic commands, it is recommended to connect to the FortiGate using SSH so that is possible tp easily capture the output to a log file. The instructions below explain how to enable SSH access and connect using the popular SSH client PuTTY.

Scope

FortiGate.

Solution

1. Make sure that SSH is enabled on the interface connected to.
   
   1. Network -> Interfaces, Choose the desired interface and select ' Edit '.
      
      
   2. Make sure to check 'SSH' next to 'Administrative Access', then choose 'OK' to save changes.

Enable SSH admin access on the interface From CLI:

config system interface
    edit <interfacename>
        set allowaccess ssh -> If there are already existing ping or HTTPS make sure to include 'set allowaccess ping https ssh'.
    next
end

Example:

Discovery-kvm81 # config system interface

Discovery-kvm81 (interface) # edit port2

Discovery-kvm81 (port2) # set allowaccess ping https ssh  --> ping and https are already existing protocols added ssh

Discovery-kvm81 (port2) # end

2. Download an SSH client such as PuTTy (using PuTTy is explained in the following steps).

3. Launch PuTTY and:

   1. Putty Configuration -> Session: Specify IP and port (usually port 22), Connection Type: SSH.

   2. Go to 'Session -> Logging' and under 'session logging', enable 'printable output'.

   3. Choose a location for the log file under 'Log file name'.

   4. Select Open to connect to FortiGate.

4. Log into the FortiGate, and execute the CLI commands.

5. Close PuTTY (or disable logging) and attach the log file to the ticket.

Related article:

Technical Tip: How to create a log file of a session using PuTTY