Diagnostic tools

This section provides the purpose, elements, and actions performed on the Diagnostic tools pages.

Purpose

The Gateway Diagnostics section provides tools to test gateway reachability, capture packets, trace paths, check connectivity, view active sessions and interface stats, manage services, run built-in diagnostics, audit spoke gateways for symmetric routing and AZ affinity issues, and download tracelogs.

Elements

Ping, Packet Capture, Traceroute, Tracepath, and Connectivity sub-tabs or tools, each with run controls and results panels for testing reachability and paths.
Active Sessions, Interface Stats, Services, Diagnostics, and Tracelog sub-tabs or tools, each with run/refresh controls and results panels for viewing gateway status and history.
Capability Audit For group: Symmetric Routing and AZ Affinity audit tools. Selecting either tool disables the Gateway Instance selector, since each tool selects its own gateway or gateway group scope.

Actions

Network Test Tools

Run Ping

To test gateway reachability with ping:

Go to Diagnostics > Diagnostic Tools > Gateway Diagnostics.
Select the Ping tab.
Select Interface (default: Use Route Table) and enter Destination (IP / Host Name).
Click Run to start the ping test. Use Reset to clear the form.
Review the Results panel for reachability and round-trip time.

The Results panel shows ping output and time details.

Parameter Details

CoPilot Parameter Name	Description
Interface	Selects interface for ping, traceroute, tracepath, or capture.
Destination (IP / Host Name)	Target IP or hostname for ping, traceroute, tracepath.
Results	Shows reachability, hop details, path/MTU, or test results.
Packet table	Time, Interface, Source IP, Destination, Protocol, etc. (Packet Capture).
Active Sessions	Orig S-IP, Orig D-IP, Proto, State, Reply fields.
Service Name / Status	Gateway service and running state.
Check Name / Status	Diagnostic test name and result.
Log Type / Download	Trace log type and download option.

Run Packet Capture

To capture packets on a gateway interface:

Go to Diagnostics > Diagnostic Tools > Gateway Diagnostics.
Select the Packet Capture tab.
Set Interface, IP / Host Name, Port, Duration, and Packet Length as needed. Click Run.
Use Download PCAP File to save captured packets. Optionally, use Filter, Columns, Export, or Search on the packet table.

The packet table shows Time, Interface, Source IP, Destination, Protocol, and other fields.

Run Traceroute

To trace the path from the gateway to a target:

Go to Diagnostics > Diagnostic Tools > Gateway Diagnostics.
Select the Traceroute tab.
Select Interface and enter Destination (IP/Host Name). Click Run.
Review the Results panel for hop details (IP, hostname, time). Use Reset to clear.

The Results panel shows hop-by-hop path details.

Run Tracepath

To check path and MTU to a target:

Go to Diagnostics > Diagnostic Tools > Gateway Diagnostics.
Select the Tracepath tab.
Select Interface and enter Destination (IP/Host Name). Click Run.
Review the Results panel for path and MTU details. Use Reset to clear.

The Results panel shows path and MTU information.

Run Connectivity Test

To check reachability for common services:

Go to Diagnostics > Diagnostic Tools > Gateway Diagnostics.
Select the Connectivity tab.
Enter HostName, Port, and select Protocol (TCP/UDP). Click Run.
Review the Results panel for DNS, HTTPS, and IP reachability. Use Reset to clear.

The Results panel shows test results for the target.

Gateway Status Tools

View Active Sessions

To view live traffic sessions on the gateway:

Go to Diagnostics > Diagnostic Tools > Gateway Diagnostics.
Select the Active Sessions tab.
Click Run to retrieve the latest active session data for the selected gateway.

The Active Sessions table displays current traffic sessions (Orig S-IP, Orig D-IP, Proto, State, etc.).

View Interface Stats

To view real-time interface counters:

Go to Diagnostics > Diagnostic Tools > Gateway Diagnostics.
Select the Interface Stats tab.
Review the Interface table (packets, errors) and Graph view (bandwidth).

The page shows interface counters and bandwidth use.

View Gateway Services

To view gateway service status:

Go to Diagnostics > Diagnostic Tools > Gateway Diagnostics.
Select the Services tab.
Review the Service list. Use Restart for a service if supported.

The Service list shows each service and its status.

Run Gateway Diagnostics

To run built-in gateway diagnostic checks:

Go to Diagnostics > Diagnostic Tools > Gateway Diagnostics.
Select the Diagnostics tab.
Optionally toggle Include Controller to include Controller-side checks.
Click Run to start tests, or use its dropdown to Show Last Diagnostics Result or Submit To Support instead.
Review the output console for findings.

The output console shows the diagnostic result text.

Download Tracelog

To collect and download gateway logs:

Go to Diagnostics > Diagnostic Tools > Gateway Diagnostics.
Select the Tracelog tab.
Review the Log list and click Download to save the selected log file.

The Log list shows available trace log files.

Capability Audit

Run Symmetric Routing Audit

To audit spoke gateways for symmetric routing issues:

Go to Diagnostics > Diagnostic Tools > Gateway Diagnostics.
Under Capability Audit For, select Symmetric Routing.
Click Run. The tool audits every spoke gateway group with Symmetric Routing enabled (no gateway selection is required). Use Cancel to stop an in-progress run, or Reset to clear the results.
Review the summary (Status, Gateways Audited, Gateways Passed, Gateways with Issues) and the Gateways with Issues section for route-table-level findings and remediation guidance.

If no spoke gateways have Symmetric Routing enabled, the tool shows an empty state instead of results.

Parameter Details

CoPilot Parameter Name	Description
Status	Overall audit status: In Progress, Complete, or Partially Completed.
Gateways Audited	Number of spoke gateway groups audited.
Gateways Passed	Number of audited gateway groups with no findings.
Gateways with Issues	Number of audited gateway groups with findings, each listed with its route tables of concern and remediation guidance.

Run AZ Affinity Audit

To audit a pair of peered gateway groups for AZ affinity issues:

Go to Diagnostics > Diagnostic Tools > Gateway Diagnostics.
Under Capability Audit For, select AZ Affinity.
Select Gateway Group 1, then select Gateway Group 2 from the gateway groups peered with it (AWS only).
Click Run. Use Reset to clear the selections and results.
Review the findings, or the success message if no issues are found.

Parameter Details

CoPilot Parameter Name	Description
Gateway Group 1 / Gateway Group 2	Selects the peered AWS gateway groups to audit.
Findings	Route table or subnet AZ affinity issues found between the two gateway groups, with remediation guidance.

Purpose

The Connectivity Diagnostics section provides tools to view connection logs, IPsec Security Association details, IPsec service status, configuration, security policy details, run connectivity analysis, and reset connections.

Elements

Connection selector: In addition to Gateway Instance, selects the connection (site2cloud tunnel) to run tools against.
Logs, Security Association Details, IPsec Service, Configuration, Security Policy Details, Analysis, and Reset Connection sub-tabs or panels, each with viewer/run controls and results.

Actions

View Connection Logs

To view connection logs:

Go to Diagnostics > Diagnostic Tools > Connectivity Diagnostics.
Select the Logs tab.
Use Enable/Disable next to Verbose Logging to turn detailed IPsec logging on or off for the gateway instance (confirm the warning dialog; this can disrupt tunnels and trigger a failover). Click Run to retrieve the current log.
Review the Log viewer. Use Search to filter by keywords.

The log viewer shows log entries and timestamps.

Parameter Details

CoPilot Parameter Name	Description
Connection	Selects the connection to run the tool against.
Verbose Logging	Enables or disables detailed IPsec logging for the gateway instance (Logs).
Log Entry / Timestamp	Log message and time (Logs).
Peer IP / SPI / Status	SA peer, SPI, state (Security Association Details).
Status / Restart	IPsec service state and restart option.
Tunnel Settings / Local and Remote	IPsec and network settings.
Source / Destination / Action	Policy rules.
Issue Type / Recommendation	Analysis result and suggested fix.
Reset Option / Result	Reset action and status.

View Security Association Details

To view IPsec SA details:

Go to Diagnostics > Diagnostic Tools > Connectivity Diagnostics.
Select the Security Association Details tab.
Review the SA table (Peer IP, SPI, Status). Click Refresh to reload SA status.

View or Restart IPsec Service

To view or restart the IPsec service:

Go to Diagnostics > Diagnostic Tools > Connectivity Diagnostics.
Select the IPsec Service tab.
Review Service status. Use Restart if supported.

View Configuration

To view IPsec and tunnel settings:

Go to Diagnostics > Diagnostic Tools > Connectivity Diagnostics.
Select the Configuration tab.
Review the Configuration list (tunnel parameters, local and remote settings).

View Security Policy Details

To view policies applied to the gateway:

Go to Diagnostics > Diagnostic Tools > Connectivity Diagnostics.
Select the Security Policy Details tab.
Review the Policy table (Source, Destination, Action).

Run Connectivity Analysis

To run automated connectivity analysis:

Go to Diagnostics > Diagnostic Tools > Connectivity Diagnostics.
Select the Analysis tab.
Click Run. Review Results for issue type and recommendation.

Reset Connection

To reset a connection’s tunnels:

Go to Diagnostics > Diagnostic Tools > Connectivity Diagnostics.
Select the Reset Connection tab.
Click Reset and confirm the warning dialog (resetting disrupts all tunnels of the selected connection). Review Status for the reset result.

Purpose

The BGP Diagnostics section allows you to run BGP commands and view output.

Elements

BGP Command tool with command field, Run button, and Output panel.

Actions

Run BGP Command

To run a BGP command:

Go to Diagnostics > Diagnostic Tools > BGP Diagnostics.
Enter the BGP command in the Command field. Click Run to execute.
Review Output for the command result.

The Output panel shows the BGP command result.

Parameter Details

CoPilot Parameter Name	Description
Command	BGP command to run.
Output	Command output.

Purpose

The Controller Diagnostics section provides tools to ping from the Controller, view services, command log, event log, run Controller diagnostics, and generate or download a configuration bundle.

Elements

Ping, Services, Command Log, Event Log, Diagnostics, and Configuration Bundle sub-tabs or tools, each with run/view and results panels.

Actions

Run Controller Ping

To test reachability from the Controller:

Go to Diagnostics > Diagnostic Tools > Controller Diagnostics.
Select the Ping tab.
Enter Host (IP / Host Name). Click Run.
Review Results for reachability data.

Parameter Details

CoPilot Parameter Name	Description
Host (IP / Host Name) / Results	Ping target and reachability data.
Service Name / Status	Controller service and state.
Command / Timestamp	Command text and run time.
Event Type / Timestamp	Event name and time.
Check Name / Result	Diagnostic test and outcome.
Generate Bundle / Download	Create and save diagnostics bundle.

View Controller Services

To view Controller service status:

Go to Diagnostics > Diagnostic Tools > Controller Diagnostics.
Select the Services tab.
Review the Service list (service name, status).

View Command Log

To view recent Controller commands:

Go to Diagnostics > Diagnostic Tools > Controller Diagnostics.
Select the Command Log tab.
Review the Command table (command, timestamp).

View Event Log

To view Controller events:

Go to Diagnostics > Diagnostic Tools > Controller Diagnostics.
Select the Event Log tab.
Review the Event table (event type, timestamp).

Run Controller Diagnostics

To run Controller diagnostic checks:

Go to Diagnostics > Diagnostic Tools > Controller Diagnostics.
Select the Diagnostics tab.
Click Run to start tests, or use its dropdown to Show Last Diagnostics Result or Submit To Support instead. Review the output console for findings.

Generate and Download Configuration Bundle

To create and download a diagnostics bundle:

Go to Diagnostics > Diagnostic Tools > Controller Diagnostics.
Select the Configuration Bundle tab.
Click Generate bundle to create the file. Click Download to save the bundle.

The bundle contains logs and system info.

Purpose

The UserVPN Diagnostics section provides tools to run UserVPN diagnostics, view session history, and view ELB status.

Elements

Diagnostics, Session History, and ELB Status sub-tabs or panels, each with run/view controls and results.

Actions

Run UserVPN Diagnostics

To run UserVPN diagnostic checks:

Go to Diagnostics > Diagnostic Tools > UserVPN Diagnostics.
Select the Diagnostics tab.
Optionally enter User’s Name to scope the check to a specific VPN user. Click Run to start checks. Review Results (diagnostic test, result).

Parameter Details

CoPilot Parameter Name	Description
User’s Name	Optional VPN user name to scope the diagnostic check to.
Diagnostic Test / Result	Type of check and outcome.
User / IP Address / Duration	Session user, IP, and length.
ELB Name / Status	Load balancer and health state.

View Session History

To view UserVPN session history:

Go to Diagnostics > Diagnostic Tools > UserVPN Diagnostics.
Select the Session History tab.
Review the Session table (user, IP address, duration).

View ELB Status

To view load balancer health for UserVPN:

Go to Diagnostics > Diagnostic Tools > UserVPN Diagnostics.
Select the ELB Status tab.
Review the ELB table (ELB name, status).

Purpose

The FireNet Diagnostics section runs FireNet diagnostic checks and displays results.

Elements

Diagnostics tool with a split Run button (Show Last Diagnostics Result / Submit To Support) and output console.

Actions

Run FireNet Diagnostics

To run FireNet diagnostic checks:

Go to Diagnostics > Diagnostic Tools > FireNet Diagnostics.
Select a Gateway Instance and the Diagnostics tab.
Click Run to start tests, or use its dropdown to Show Last Diagnostics Result or Submit To Support instead.
Review the output console for findings.

The output console shows the diagnostic result text.

Parameter Details

CoPilot Parameter Name	Description
Diagnostic Test	Type of FireNet check.
Result	Outcome.

Concepts & Architecture

Guides

Reference

Purpose

Elements

Actions

Parameter Details

Parameter Details

Parameter Details

Purpose

Elements

Actions

Parameter Details

Purpose

Elements

Actions

Parameter Details

Purpose

Elements

Actions

Parameter Details

Purpose

Elements

Actions

Parameter Details

Purpose

Elements

Actions

Parameter Details

​Purpose

​Elements

​Actions

​Parameter Details

​Parameter Details

​Parameter Details

​Purpose

​Elements

​Actions

​Parameter Details

​Purpose

​Elements

​Actions

​Parameter Details

​Purpose

​Elements

​Actions

​Parameter Details

​Purpose

​Elements

​Actions

​Parameter Details

​Purpose

​Elements

​Actions

​Parameter Details

Purpose

Elements

Actions

Parameter Details

Parameter Details

Parameter Details

Purpose

Elements

Actions

Parameter Details

Purpose

Elements

Actions

Parameter Details

Purpose

Elements

Actions

Parameter Details

Purpose

Elements

Actions

Parameter Details

Purpose

Elements

Actions

Parameter Details