FortiGate
FortiGate Next Generation Firewall utilizes purpose-built security processors and threat intelligence security services from FortiGuard labs to deliver top-rated protection and high performance, including encrypted traffic.
keithli_FTNT
Staff
Staff

Description
This article describes troubleshooting with built-in FortiOS hardware diagnostic commands. 

As described in the related article 'RMA Note: HQIP - Hardware Quick Inspection Package', HQIP can perform tests on a number of hardware elements. While it does not detect all hardware malfunctions, tests for the most common hardware problems are performed.

Traditionally hardware diagnostic requires users to download the HQIP image, then load the image on the device before the tests can be performed. Starting in FortiOS 5.4 with FortiGate E-Series models, HQIP tests are built into FortiOS itself. This allows users the convenience of performing hardware diagnostics without needing find the HQIP image and reloading the firmware image.

Note that no HQIP images will be produced for FortiGate E-Series and above that support built-in HQIP commands. Conversely, for units that require an HQIP image, continue using their designated HQIP images. See the "Running an HQIP Test" attachment to the
related article 'RMA Note: HQIP - Hardware Quick Inspection Package' article for details.

Precautions & Preparations

  • Plan to be local to the firewall to perform this test, since console access is recommended and select tests require the use of loop-back cables and re-cabling of the current device.
  • Make sure to have a good backup of the configuration file.
  • Have a backup of the current firmware image in case a full recovery of the system is required.
  • Perform a factory reset before running the test if possible to get the most accurate results. ('# execute factoryreset')
  • Enable logging of the console output before the test begin.
  • The 'Running an HQIP Test' attachment to the related article 'RMA Note: HQIP - Hardware Quick Inspection Package' article has information about wiring the device, console connection, hardware, TFTP server, and connecting to the device. Reference the link if unfamiliar with the aforementioned operations.

What can be tested?

From the CLI, run the following command to list all the hardware test items supported on the device. This command does not execute the actual tests:

# diag hardware test info

Typically, the output will show test cases under these categories:
  • BIOS
  • System
  • USB
  • Button
  • CPU
  • Memory
  • Network
  • Disk
  • LED
  • WiFi

What the HQIP test does not do:
  • Detect all hardware malfunctions. Tests for the most common hardware problems are performed.
  • Diagnose issues that cause a device to reboot or be unstable.
  • Detect software configuration errors, OS bugs, or OS Kernel Crash issues (one type of OS bug).
  • Diagnose devices with multiple Hard Drives.

Running the test


The built-in hardware diagnostic commands give users the flexibility to run the entire suite of test cases, a group of test cases, or a single test case. Options for performing hardware tests are found under the following command tree:
 
# diagnose hardware test
 
Running the entire test suite

There will be interactive prompts throughout the test, so users are advised to remain at the console during the duration of the test. To run the test suite:
 
# diagnose hardware test suite all

One of the first prompts will advise the users to connect the Ethernet cable:
 
# diag hardware test suite all

- Please connect ethernet cables:

[WAN - Any of PORT1...PORT4]
 
Note that devices that support switch mode and interface mode will display different cable connection instructions based on the current mode that the device is running.

Continue on with the rest of the test cases and monitor the console for interactive prompts.

When the test is complete, a Test Report will be displayed, showing cases that Passed, Failed or Skipped (N/A). Save this output for reference.

Running one test category or a single test case

When running a test category, simply input the chosen category and select enter. For example, to test System:
 
# diag hardware test system

.....
========================= Fortinet Hardware Test Report =========================
SYSTEM
  CPU Configuration Check....................................... PASS
  Memory Configuration Check.................................... PASS
  Storage Configuration Check................................... PASS
  Network Configuration Check................................... PASS
========================= Fortinet Hardware Test PASSED ========================

 When running a single test case, input the category followed by the test case:
 
# diag hardware test system cpu-config
.....
==============Fortinet Hardware Test Report=======
SYSTEM 
CPU Configuration check................................ PASS
=======Fortinet Hardware Test PASSED ===============
 
After the test

If the test shows a failure, the next step is to work with the Technical Assistance Center by opening an RMA ticket. Verify whether the device is still under warranty. Depending on the symptoms that initially lead the test and the results of the test, they may want to verify that it is not a false positive. Attach the HQIP report to the support ticket for speedy analysis of the hardware problem.
If the factory reset of the firewall was done, then reload the configurations after the test is completed.
 

FAQ
Why doesn’t my FortiGate have the commands listed above?

The built-in HQIP commands are only supported on FOS 5.4 and above, on E-Series or newer appliance models. Ensure that the FortiGate meets these criteria.

Is there a non-interactive mode for running the test suite?

No. However, the test suite typically only takes a few minutes. If time is a concern, consider testing a group of test cases or single case instead.

Will the disk tests overwrite any of my disk data?

No, the disk tests will only do I/O on the disk filesystem but it won’t overwrite the data.

What are the options pcba, stress and rack-burn-in when running 'diagnose hardware test suite'?
These commands are for manufacturing uses and are not recommended for the end-users. Do not perform these tests as they may take very long to run.

 

Related Articles

RMA Note: HQIP - Hardware Quick Inspection Package

Contributors