Technical Tip: Unable to run debug command

btey · ‎08-24-2022

Description

This article describe the configuration to verify if administrator could not run debug commands in FortiGate CLI.

In some environments, administrator can be restricted to perform debug/diagnostic but still allowed to perform configuration.

Scope

FortiGate 6.4

Solution

If the 'Unknown action 0' error appears when running the debug command as below:

diagnose debug application sslvpn -1
Unknown action 0

Check the user admin profile using the following command:

show full system accprofile

The administrator will not be allowed to run the diagnostic commands if 'system-diagnostics' is set to disable.

To allow the administrator to have right to perform diagnostic:

(Only super admin can change this setting).

config system accprofile
set system-diagnostics enable
end

Note:
From FortiOS 7.4.2, the cli command to modify this option was changed to:

config system accprofile
set cli-diagnose enable
end