Troubleshooting Tip: FTM-Push notification configured but not working

[Renante_Era]

Description	This article describes the process of initial ftm-push troubleshooting.
Scope	FortiGate, FortiToken.
Solution	The following are troubleshooting tips that need to perform post after configuring the FortiToken mobile push notification, but unable to log in after tapping 'Approve' on the FortiToken Mobile Apps. Check if FTM and PING are enabled in the Administrative Access of the wan interface under Network - > Interfaces. Verify the server-ip address set in ftm-push and ensure that the status is enabled. In general, use 0.0.0.0 unless one has a specific reason to specify the public IP address. Keep in mind that specifying a public IP address in server-ip might impact ftm-push fail-over when the device encountered an ISP issue. show full system ftm-push Note the server-port from the output of the above command and ensure that there is no overlapping port issue under Policy & Objects - > Virtual IPs. Update that port if necessary. For instance, if port forwarding is configured under Virtual IPs for port 4433, and there are no conflicts for 20443, then use the following commands: config system ftm-push     set server-port 20443 end Verify that the server-port is not blocked in local-in-policy. show full firewall local-in-policy If the FortiGate is using internal DNS and DNS server replies to a different IP than the Public IP, change the ftm-push config to the Public IP instead of the domain name. Testing the name resolution: execute ping <Domain Name> If the resolution is different from the Public IP, then adapt the config: config system ftm-push     set server <Public IP> end Run debug flow and ensure that the message 'iprope_in_check() check failed, drop' is not seen, which might indicate that the inbound ftm-push traffic is blocked due to Trusted Hosts configured under System - > Administrators. diagnose debug reset diagnose debug flow filter clear diagnose debug console timestamp enable diagnose debug flow show iprope enable diagnose debug flow filter addr  x.x.x.x <- where x.x.x.x is the corresponding public IP address for ftm-push. dignose debug flow filter port yyy <- where yyy is the port number assigned to server-port in ftm-push. diagnose debug flow trace start 99 diagnose debug enable Next, test ftm-push, and disable debug flow after completion with the following commands: diagnose debug reset diagnose debug disable If the issue persists after following the above steps, then gather the following debug logs and create a ticket. diagnose debug reset diagnose debug application ftm-push -1 diagnose debug enable Finally, test ftm-push, and disable debug flow once done using the following commands: diagnose debug reset diagnose debug disable