JAEN

FortiGate

diagnose vpn tunnel list

CautionVPN deep diagnostics

diagnose vpn tunnel list name <tunnel>

Shows SA details and counters; flush forces re-negotiation. Pair with IKE debug logs for root cause.

Examples

  • diagnose vpn tunnel flush name HQ-VPNRe-negotiate a tunnel
  • diagnose vpn tunnel list name HQ-VPNPhase 2 (SA) detail for one tunnel
  • diagnose vpn ike gateway list name HQ-VPNPhase 1 (IKE) state
  • get vpn ipsec tunnel summaryAll tunnels with state and traffic counters
  • diagnose debug application ike -1 diagnose debug enableShow IKE negotiation logs (run diagnose debug disable afterwards)

Syntax

diagnose vpn tunnel list [name t] / diagnose vpn ike gateway list

Key points

  • Compare rxp (received) and txp (sent) under stat: to spot traffic flowing in one direction only.
  • If dec: and enc: lines with SPIs are present, the phase 2 SA is up. If not, phase 2 has not come up.
  • flush forces renegotiation. Use it after fixing the configuration, not as a first diagnostic step.

When it does not work

  • no SA proposal chosen in the IKE log means the proposals do not match; probable pre-shared secret mismatch means the PSK differs.
  • Debug output continues until stopped. Always run diagnose debug disable and diagnose debug reset.

Before you run it

Flush briefly drops the tunnel.

Used when you see

Site-to-site VPN is down
3
Force a re-negotiation
See the whole flow →

Related commands

You can carry a laptop to the rack. Signal will not follow.

Check syntax standing in front of the hardware, with no connection at all. The app keeps 1,510 commands and 120 fix flows on your device. Free to install, no ads (some content is a one-time purchase).

Get it free on the App Store