Small Unit GUI PCAP How To

So a lot of people that have smaller units have noticed in the latest versions (5.4+) that the PCAP link is now gone. Well, this video will show you how to get to that page so that you can carry out PCAPs from the GUI. We know that not everyone is as good at the CLI interface as they would like to be and this is a good shortcut to help those in need when they are troubleshooting their FortiGate.


Having trouble configuring your Fortinet hardware or have some questions you need answered? Ask your questions in the comments below!!! Want someone else to deal with it for you? Get some consulting from Fortinet GURU!

Don't Forget To Buy Your Fortinet Hardware From The Fortinet GURU

11 thoughts on “Small Unit GUI PCAP How To

  1. Tried on my FWF60D running 5.4.7 and it doesn’t work. Getting : Error 403: Access denied. displayed in GUI itself.

    https://86.24.X.X/ng/page/p/firewall/sniffer/
    Any ideas?

    Thanks,

    • Interesting. Will load 5.4.7 on my FWF61E and see if it works. Would hate for them to remove it completely from the later builds.

    • Hi Augustas,
      check if your Fortigate unit has an integrated HDD,i guess that having the HDD is a precondition for packet capture to work.

      • Yeah, otherwise you have to output via CLI and hope the buffer can keep up (bigger environments will lose packets once it overruns the buffer which can cause you to lose important information)

  2. Verified to work on a 61E running 5.6.3.

    Thank you for the site, Mike. Keep up the great work!

  3. I just found this site (fortinetguru.com) and loving it too! Keep up the work Mike!
    I have a FW80CM unit running 5.6.3 and I get the 403 error code “Access denied” as mentioned above.
    Any suggestions?

    • Reuben,
      They yanked it on the later versions of code. Of course, they re-add it on the 6.0 firmware! (with the link and all)

      • Not True for 6.0.1 here on an ssd-less FG

        • The diskless ones have no where to store the pcaps. It doesn’t work or show at all on them.

          • Soooo what is the solution now? Should I buy an ssd and install it myself? or is there really no way to block/reserve some small amount of RAM and when that fills up just stop capturing. Or just post an warning message before?
            pcap was hidden but still available on our 3960E with 5.6.3 but no longer on 6.0.1

Leave a Reply

Name *
Email *
Website

This site uses Akismet to reduce spam. Learn how your comment data is processed.