Which command would you use to verify the status of an IPsec VPN tunnel on a FortiGate?

The diagnose vpn tunnel list command is the primary and most direct FortiOS CLI command used to verify the operational status of all configured IPsec VPN tunnels. It provides a concise summary that includes the tunnel name, its current state (up or down), and basic traffic counters for incoming and outgoing data. This command is essential for initial troubleshooting and status verification of IPsec VPN connections on a FortiGate device.

B. get vpn ipsec status is not a valid FortiOS command. The get command is used to display configuration settings, not dynamic operational status.

C. diagnose ipsec status is not a valid FortiOS command. The correct syntax requires a different command structure, such as diagnose vpn....

D. show crypto ipsec sa is a command syntax used on Cisco IOS/ASA devices to display security associations, not on FortiGate devices running FortiOS.

1. Fortinet FortiOS CLI Reference 7.4.0: The diagnose vpn tunnel list command is documented as the method to "List all IPsec tunnels." This official reference confirms its function for displaying the status of IPsec tunnels.

Source: Fortinet Document Library

"FortiOS CLI Reference 7.4.0

" page 2291.

2. Fortinet FortiOS IPsec VPN Guide 7.4.0: This guide repeatedly uses diagnose vpn tunnel list in its troubleshooting sections to check if a tunnel has been successfully established.

Source: Fortinet Document Library

"IPsec VPN for FortiOS 7.4.0

" Troubleshooting section

"Verifying the tunnel is up."

3. Fortinet Cookbook - IPsec VPN troubleshooting: This official guide details common troubleshooting steps and lists diagnose vpn tunnel list as a fundamental command to check the tunnel's status.

Source: Fortinet Cookbook

"IPsec VPN troubleshooting

" Step 1: "Check if the IPsec tunnel is up."