Which diagnostic command can you use to show the SD-WAN rules, interface information, and state?

The diagnose sys sdwan service command is the most comprehensive tool for viewing the operational status of SD-WAN rules. It provides a detailed output listing each configured SD-WAN rule (also known as a service). For every rule, it displays the associated SD-WAN members (interfaces), their current state (alive or dead), priority, and the performance metrics being measured against the Service Level Agreement (SLA). This single command effectively shows the rules, the interfaces they use, and the real-time state of those interfaces in the context of each rule, directly addressing all aspects of the question.

diagnose sys sdwan route-tag-list: This command is used specifically to display the BGP route tags that are being used for SD-WAN rule matching, not the rules or interface states themselves.

diagnose sys sdwan member: This command lists all configured SD-WAN members and their individual status but does not show which specific SD-WAN rules are using them.

diagnose sys sdwan neighbor: This command is used in ADVPN deployments to show the status of dynamically discovered VPN neighbors (spokes) and is not for general SD-WAN rule inspection.

1. Fortinet FortiOS 7.0.0 SD-WAN Administration Guide, Page 111, Section: Troubleshooting SD-WAN. The guide states, "The diagnose sys sdwan service command displays a list of all SD-WAN services, and the members that are used by each service." The example output clearly shows rules, members, and their status.

2. Fortinet FortiOS 7.0.0 CLI Reference, Page 1990, Section: diagnose sys sdwan service. This document defines the command's purpose as "List all SD-WAN services" and provides an example output that includes the service ID (rule), members (interfaces), and their status (mode, alive).

3. Fortinet FortiOS 7.0.0 SD-WAN Administration Guide, Page 113, Section: diagnose sys sdwan member. This section clarifies that the member command shows the status of all members but does not link them to specific services (rules).

4. Fortinet FortiOS 7.0.0 SD-WAN Administration Guide, Page 115, Section: diagnose sys sdwan route-tag-list. This reference confirms the command is for viewing BGP route tags used in SD-WAN.