In high-throughput, HA active-passive scenarios, a mismatch between the data path MTU (often 9000+ for 10Gbps jumbo frames) and the default HA heartbeat MTU (1500) can cause critical HA packets to fragment. This leads to delays and timeouts, manifesting as intermittent packet loss and session drops. This is a common real-world issue post-upgrade where interface MTU settings might be overlooked.

When proxy-based UTM features (like SSL inspection and web filtering) are implicated, the most direct diagnostic is to examine the proxy engine’s health. `diagnose test application proxy 3` shows queue depth and transaction processing times per proxy worker, directly indicating if delays are in the inspection pipeline. This provides actionable data on whether the issue is due to traffic volume, complexity of inspection, or a resource bottleneck within the proxy processes.

Regular, predictable renegotiations point to a timer mismatch. If `autonegotiate` is disabled, the tunnel will not automatically rekey before the `negotiate-timeout` period expires, causing a hard disconnect. A 30-minute timeout aligns perfectly with the symptom. The issue appearing across different spokes points to a common hub configuration, not individual internet or spoke settings.

The `diagnose switch-controller switch get mac-table port ` command allows the FortiGate to query the managed FortiSwitch directly via the FortiLink tunnel and retrieve the hardware MAC address table from that specific switch port. This is crucial for layer 2 troubleshooting, as the FortiGate’s centralized view might be aggregated or cached.

FortiWeb processes rules within a policy in a top-down order. If a request matches a higher rule with a ‘Permit’ action, processing stops, and the subsequent ‘Block’ rule is never evaluated, even if it also matches. This is a common configuration oversight. Verification of rule order and potential conflicts is the most efficient first step.

FortiManager’s revision history tracks all changes per ADOM. The correct procedure is to navigate to the revision just prior to the accidental deletion, select the ‘Restore’ function for that specific revision. This allows you to revert only the state of the policy package (including the deleted policy) to that point in time, which can then be reviewed and installed, effectively restoring the lost policy without manual reconstruction.

SD-WAN rules influence the path selection *after* the FortiGate has performed a route lookup. If a static (or dynamic) route for the destination subnet has a specific egress interface (or lower distance) defined, that route decision happens first and overrides the SD-WAN rule. Checking and correcting the ‘Interface Preference’ in the relevant static route is a critical step in SD-WAN troubleshooting.

On newer firmware or certain platform defaults, the ‘ARP Reply’ setting for a VIP might be disabled. If the FortiGate does not respond to ARP requests for the VIP’s external IP address, the upstream router will not know where to send the packets, effectively making the VIP unreachable. The packet capture on the external interface would not even see the SYN packets if this were the case, but it’s a vital check for VIP accessibility issues post-migration.

RADIUS protocol uses a Message-Authenticator attribute and timestamps to prevent replay attacks. A significant time skew (typically >5 minutes) between the RADIUS client (FortiSwitch) and the RADIUS server (FortiAuthenticator) will cause the server to reject the authentication requests as invalid or replayed. The switch will interpret this as the server being unavailable. Checking and synchronizing NTP settings on the switch is the key fix.

In high-throughput, HA active-passive scenarios, a mismatch between the data path MTU (often 9000+ for 10Gbps jumbo frames) and the default HA heartbeat MTU (1500) can cause critical HA packets to fragment. This leads to delays and timeouts, manifesting as intermittent packet loss and session drops. This is a common real-world issue post-upgrade where interface MTU settings might be overlooked.0