What this article covers

Outlines CLI commands and physical layer testing procedures to troubleshoot optical power loss, signal degradation, and interface flapping on SFP, SFP+, and QSFP ports using Digital Optical Monitoring (DOM).

ScopeFortiGate firewall interfaces operating with optical SFP/SFP+/QSFP transceivers (1GbE, 10GbE, 25GbE, 40GbE, 100GbE).

Before using the CLI

Connector ConditionInspect and clean fibre ends using approved optical-cleaning click pens before reseating.
Known-Good OpticStage a Fortinet-certified replacement transceiver for side-by-side comparison testing.
Dual-Window SetupOpen Window 1 for interface adjustments and Window 2 for live link carrier state monitoring.

On-site workflow

01

Open Secondary SSH Window to monitor real-time interface carrier state

In Window 2, enable continuous link monitor status to capture every millisecond link-up and link-down transition.

# [WINDOW 2 - SECONDARY LIVE TELEMETRY]
diagnose netlink interface list <interface_name>
diagnose sys link-monitor status
02

Read transceiver DDM telemetry & optical threshold alarm flags

In Window 1, query transceiver Digital Diagnostic Monitoring (DDM). FortiOS flags status thresholds: ++ (High Alarm), + (High Warning), - (Low Warning), -- (Low Alarm / link loss imminent), and ? (DDM unsupported). RX optical power displaying -- (typically < -18 dBm) confirms physical fiber attenuation or severe contamination.

# [WINDOW 1 - HARDWARE OPTICAL AUDIT]
get system interface transceiver <interface_name>
diagnose hardware deviceinfo nic <interface_name>
# Interpret alarm flags: ++ (High Alarm), + (High Warn), - (Low Warn), -- (Low Alarm)
03

Inspect physical layer error counters (CRC, Runts, Alignments)

Audit hardware MAC error statistics. Growing CRC errors point directly to physical fiber bend, dirty ferrule, or failing transceiver optics.

diagnose hardware nic <interface_name>
# Check rx_crc_errors, rx_frame_errors, and tx_aborted_errors
04

Hardcode speed / duplex & toggle auto-negotiation

When connecting to third-party switches that fail IEEE auto-negotiation, explicitly configure fixed speed and duplex parameters.

config system interface
    edit <interface_name>
        set speed 10000full
        set auto-negotiation disable
    next
end
05

Execute single-variable physical component swap

Swap one physical variable at a time (Fiber patch lead -> Optic transceiver -> Switch port) while watching Window 2 for link stabilization.

# Watch Window 2 for carrier stability:
diagnose netlink interface list <interface_name> | grep -i state

Operational caution

Review before applying: Never look directly into an active optical connector. Changing interface speed or negotiation immediately drops link state. Coordinate maintenance windows when testing core trunk interfaces.
Next step

Preserve the hardware evidence

If the fault follows the optic or cable, replace that component. If it remains on one FortiGate port with known-good components, prepare an RMA evidence package.

Browse On-Site Tips Explore Ferrite workflows