Tracing packet flow on FortiGates with NP7 processors
To trace packet flow using the diagnose debug command on FortiGates with NP7 processors the traffic must not be offloaded to the NP7 processors. See the following sections for information about how to disable NP7 offloading in individual firewall policies or IPsec VPN tunnels:
You can also use ICMP traffic to check packet flow, since ICMP traffic is not offloaded to NP7 processors.
Example command sequence to check the packet flow after disabling NP7 offloading:
diagnose debug enable
diag debug flow filter clear
diagnose debug flow filter saddr <ip-address>
diagnose debug flow show function-name enable
diagnose debug flow trace start 100
diagnose debug flow trace stop