Kernaali ToolsFortiGate IKE Debug Shows No Output
Check VDOM, inherited filters, log-filter versus log filter syntax and whether a negotiation is actually starting.
Practical guideFortiGate Troubleshooting and Configuration Guides
Diagnose FortiGate VPNs, plan migrations, restrict local services and prepare changes with browser-local tools.
Start with silent IKE diagnostics or a new subnet with no VPN traffic. Each guide states its FortiOS scope and documentation check. Kernaali Tools is not affiliated with Fortinet.
18 tools and references
No matching tools
Try a shorter task name or clear the filters to see the full directory.
Troubleshooting / Common problems
FortiGate IPsec Up but a New Subnet Has No Traffic
Trace one new protected network through Child SA selectors, routing, policy, NAT and the destination host’s return path.
Practical guideFortiGate Conserve Mode: Diagnose Memory Pressure
Distinguish high memory use from an active conserve-mode event, collect bounded evidence, and avoid threshold or inspection bypass shortcuts.
Practical guideFortiGate “reverse path check fail, drop”: Routes and VDOMs
Diagnose RPF failure using the source address, incoming interface and kernel route; separate policy routing and inter-VDOM return paths.
Practical guideFortiGate “no proposal chosen”: IKE, ESP and DH Checks
Diagnose “peer SA proposal not match local policy” and “Negotiate SA Error”, including FortiOS 7.6.5 DH default changes, without enabling every cipher.
Practical guideFortiGate 40F/60F IPsec Traffic Stops on FortiOS 7.6.4
Check known issue 1206506 on FortiGate 4xF/6xF when IPsec stays up but stops passing traffic; distinguish documented fixes from a scoped offload workaround.
Practical guideConfiguration & CLI guides
FortiGate Local-In Policy: CLI and GUI by Version
Restrict traffic to the FortiGate itself, distinguish GUI support in 7.6.0 from 7.4.4 CLI configuration, and preserve management access.
Practical guideFortiGate IPsec Between Overlapping Subnets: NAT Planning
Plan distinct translated subnet identities, selectors, IP pools, VIPs and return paths when both FortiGate sites use the same IPv4 LAN prefix.
Practical guideMigrations
FortiGate IKEv1 to IKEv2 Site-to-Site Migration
Plan a coordinated route-based IPsec migration: peer identities, IKE and Child SA proposals, selectors, policies, verification and rollback.
Practical guideFortiGate Configuration Migration and config-error-log
Plan a different-model FortiGate replacement, map interfaces and inspect diagnose debug config-error-log read before accepting the migrated configuration.
Practical guideFortiClient IKEv2 EAP and Local-User Authentication Checks
Review PSK plus local-user EAP, “EAP identity request sent, no response”, group placement and the separate FortiClient Windows 7.4.4 IKEv1 change.
Practical guideTools & references
TCP MSS Calculator
Estimate TCP MSS and the payload budget after selected header options.
Calculator / generatorIPsec / ESP Overhead Calculator
Calculate ESP expansion for a specific packet, cipher and encapsulation model.
Calculator / generatorFortiGate Bulk Address Object Generator
Turn IPv4 hosts and CIDRs into FortiOS address objects, preview a batch, and copy or download the CLI configuration.
Calculator / generatorFortiGate Address Group Generator
Create an IPv4 address group snippet from existing object names.
Calculator / generatorFortiGate Service Object Generator
Generate a TCP or UDP destination-port service object for FortiOS.
Calculator / generatorIKEv2 Proposal Checker
Check a limited IKEv2 transform selection and understand its interoperability caveats.
Calculator / generatorCIDR List Comparison & Overlap Checker
Compare two IPv4 or IPv6 CIDR lists and get their exact intersection, differences, duplicates and containment relationships.
Calculator / generator