You can use the diagnose span-sniffer packet command to sniff traffic on internal FortiGate 6000 or 7000 interfaces in the same way as using the diagnose sniffer packet command to sniff traffic on data or management interfaces. The diagnose span-sniffer packet syntax is similar to the diagnose sniffer packet command syntax. Internal FortiGate 6000 or 7000 interfaces includes internal switch ports (for example, sw:1-P1, sw:7-P4) and the DP processor (dp).

Command syntax for the packet sniffer part of the command is:

diagnose span-sniffer packet <interface> <filter> <verbose> <count> <timestamp> <frame-size>

The <filter> option does not work for internal switch (sw:) interfaces. You can work around this problem by using the default filter (which is "") and using grep to display the information you are looking for.

For example, use the following command to see echo request packets:

diagnose span-sniffer packet dp "" 4 | grep echo

The config vpn ssl settings option tunnel-addr-assigned-method is now available again in the FortiGate 6000 and 7000 CLI. This option had been removed in a previous release because setting this option to first-available and configuring multiple IP pools was found to reduce FortiGate 6000 and 7000 SSL VPN load balancing performance. However, some users may want the ability to use multiple IP pools for their SSL VPN configuration, even if performance is reduced. So the change has been reverted.

Rename the exclude-signatures setting's industrial option to ot.

config ips global
    set exclude-signatures {none | ot}
end