Short answer: FortiOS has no mtr. Use execute traceroute and execute ping, setting the source and interface first with the -options commands. For loss per hop from the internet towards your FortiGate or SD-WAN links, run a free online MTR.
Traceroute from the FortiGate CLI
execute traceroute-options source 192.168.1.99
execute traceroute-options device wan1
execute traceroute-options queries 5
execute traceroute-options view-settings
execute traceroute 8.8.8.8- By default the FortiGate picks the source and interface itself (
auto), which may not match the traffic you are troubleshooting. use-sdwan yesmakes traceroute follow your SD-WAN rules. Leave it off to test a single member link withdevice.- For IPv6, use
execute tracert6.
Measure packet loss with ping options
execute ping-options source 192.168.1.99
execute ping-options repeat-count 100
execute ping 8.8.8.8Ping the destination first. If it shows 0% loss, the path is fine. If it shows loss, ping the hops from your traceroute one by one to find where loss starts and continues. That is what MTR does automatically.
Outside-in test to your FortiGate
Use the HardcoreDebug MTR towards each WAN IP or your SSL-VPN or IPsec endpoint. Choose TCP and your SSL-VPN port, or ICMP if the interface allows ping. Running it against each ISP link is a quick way to show an ISP which side is dropping packets.
Confirm with a sniffer
If you suspect the FortiGate itself, check whether probes arrive and leave with the built-in sniffer:
diagnose sniffer packet any 'icmp and host 8.8.8.8' 4Frequently asked questions
Does FortiGate have an mtr command?
No. FortiOS has execute traceroute and execute ping. Set their source, interface and probe count with execute traceroute-options and execute ping-options, then combine them, or run an online MTR from outside to your FortiGate's WAN IP.
How do I traceroute from a specific FortiGate interface?
Run execute traceroute-options source <ip> or execute traceroute-options device <interface> first, then execute traceroute <host>. Check the current settings with execute traceroute-options view-settings.
How do I test an SD-WAN member link?
Set execute traceroute-options use-sdwan yes to follow SD-WAN rules, or set the device to the member interface to test that link only. Run an outside-in MTR to each WAN IP to compare ISPs.
How many probes should I send?
queries accepts 1 to 10 per hop for traceroute. For loss figures, use execute ping-options repeat-count 100 and ping the destination and the suspect hop.