This article describes a list of the commands when encountering a ZTNA tagging issue that involves FortiGate, EMS, and FortiClient.
Scope
FortiGate FortiOS 7.0.12+. EMS version - 7.0.7+. FortiClient version7.0.7+.
Solution
On the FortiGate:
get system status get system performance status di sys session stat get system ha diag debug console timestamp enable diag endpoint filter show-large-data yes diag debug app fcnacd -1 diagnose debug duration 120 diag debug enable diagnose firewall dynamic list diag test app fcnacd 2 diag test app fcnacd 7 diag endpoint record list
diag test app wad 2200
diag test app wad 194
diag test app wad 101
diag wad debug enable category all
diag endpoint ztna-shm list
diag debug disable di de crashlog read
On the FortiClient:
FortiClient UIDs (from the About page).
FortiClient Diagnostic logs (for that specific client which should have enough logs for 1-2 days - based on file size).
On the EMS: Collect these logs preferably when debug mode is enabled on EMS but that times-out in 30 minutes so it is not always easy to catch:
