FortiGate Packet Tracer — Simulate Firewall Policy Decisions

🔒 100% client-side — your configuration file is parsed entirely in this browser tab. Nothing is uploaded to any server.

FortiGate Packet Tracer

Simulate packet flow through FortiOS firewall policies

Device:

● Offline static analysis — no device access required

Verify FortiGate policies
before traffic hits the wire

Inspired by Cisco's Packet Tracer feature, this tool lets you upload a FortiGate backup config and simulate how a specific packet — defined by source IP, destination IP, port, and protocol — would be processed by the firewall. See exactly which policy matches, which security profiles apply, whether NAT is applied, and get a clear ALLOW or DENY verdict across all 6 pipeline stages. Optionally paste a live routing table to include OSPF, BGP, or RIP routes in the lookup.

Start Tracing ↓

Common use cases

🔍 Troubleshoot why traffic is being dropped

✓ Verify a new policy before deployment

🔄 Confirm SNAT / DNAT translations are correct

🔒 Audit which policy permits sensitive traffic

🏗 Test rule changes in a config backup safely

How FortiGate processes a packet — and how this tool mirrors it

🔌

Step 1

Ingress Interface

Source IP matched against interface subnets.

›

🗺

Step 2

Routing Lookup

Longest-prefix match to find egress interface.

›

🔄

Step 3

VIP / DNAT

Destination checked against VIPs before policy lookup.

›

📜

Step 4

Policy Walk

Top-down evaluation — first match wins.

›

🔃

Step 5

SNAT

Source translated if matched policy has NAT enabled.

›

🛡

Step 6

Security Profiles

UTM profiles applied — IPS, AV, Web Filter, App Control, SSL inspection and more.

How to use this tool

1

Export your FortiGate config

In FortiOS: System → Settings → Backup, or via CLI: execute backup config tftp <filename> <server> The file will have a .conf extension.
2

Upload the config file

Drag and drop the .conf file onto the upload area, or click to browse.
3

Optionally paste your live routing table

If your device uses dynamic routing (OSPF, BGP, RIP), the static routes in the backup may not reflect the live RIB. Paste the output of get router info routing-table into the Live Routing Table card and click Apply — the routing step will use it instead.
4

Define your test packet

Enter source IP & port, destination IP & port, and protocol. Use quick presets for common scenarios.
5

Read the results

Each pipeline step shows a pass/fail badge. Expand any step for full detail. Steps 4 and 6 auto-expand — policy walk shows every evaluated rule, security profiles show which UTM profiles would be applied.

What this tool covers

Firewall policy matching (all fields)
Source NAT — interface IP and IP pools
Destination NAT — VIP static & port-forward
Static routing & connected routes
Address objects: subnet, range, FQDN, wildcard, groups
Service objects & groups (35+ built-in services)
Disabled policy skipping
Negated source/destination address matching
Security profile visibility — IPS, AV, Web Filter, App Control, SSL/SSH, DNS, Email, DLP, WAF & more
Live routing table override — paste get router info routing-table to include OSPF/BGP/RIP routes

⚠ Known limitations

FQDN addresses cannot be resolved without DNS
Dynamic addresses (EMS/FortiCloud tags) require runtime state
Security profiles shown but not enforced — actual traffic still blocked/logged by the profile at runtime
SD-WAN rules are not simulated
Dynamic routing requires manual paste of get router info routing-table
Multi-VDOM: only the root VDOM is parsed

1. Load Configuration

📁

Drop your .conf file here
or click to browse

📡

Upload a config and define a test packet to see the simulation

Simulated Packet

Original

→

After NAT (egress)

→

Feedback & Suggestions

Found a bug, missing a feature, or just want to say something? Drop a comment below.

Name *

Email (optional)

Message *

✓ Thanks! Your comment is awaiting review.

Verify FortiGate policiesbefore traffic hits the wire

Verify FortiGate policies
before traffic hits the wire