Diagnose

CLI Guide | Forcepoint Appliances | v8.4.x


Action and Syntax	Details
Display the kernel ARP table for the selected module. arp [--module <email\|proxy\|web\|network-agent>]	Module: (optional) Enter email, proxy, web, or network-agent.
Display the current Ethernet card settings. Use ethtool to verify local network connectivity. ethtool --interface <interface> [--show-offload] [--module <email\|proxy\|web\|network-agent>]	Interface: The interface name. Use the "ifconfig" command to see valid interface options. Show-offload: (optional) Show the state of the protocol offload and other features. Module: (optional) Enter email, proxy, web, or network-agent. Example: (diagnose)# ethtool --interface p1
Display the status of the currently active network interfaces. Use ifconfig to troubleshoot network interface issues or to identify IP issues. ifconfig [--interface <interface>] [--module <email\|proxy\|web\|network-agent>]	Interface: (optional) Any existing interface. Module: (optional) Enter email, proxy, web, or network-agent. Example: (diagnose)# ifconfig --interface e1
Netcat (nc) attempts to read and write data across the network to the specified server using the specified protocol. Use netcat for functional tests of components and verification of connectivity. nc --protocol <tcp\|udp> --dest <ipv4_addr\|hostname> --port <port_number> --module [<email\|proxy\|web\|network-agent>]	If you are having problems loading a web page or are getting a block, this command can help determine the problem. If you see a reset coming from the proxy, you can determine which DOM/module it is coming from. Protocol: Uses the TCP or UDP protocol to read and write data. Dest: The IPv4 address or hostname of the server. Port: Port number of the server. Module: Enter email, proxy, web, or network-agent. Example: (diagnose)# nc --protocol tcp --dest 10.10.10.10 --port 22 --module email
Print network connections routing tables, interface statistics, and so on. netstat [--module <email\|proxy\|web\|network-agent>]	Module: (optional) Enter email, proxy, web, or network-agent. Example: (diagnose)# netstat --module web
Obtains DNS information for the specified host. Use nslookup to troubleshoot DNS resolution problems. nslookup --host <ipv4_address\|hostname> [--dns-server <ipv4_address\|hostname>] [--module <email\|proxy\|web\|network-agent>]	Host: The IPv4 address or hostname to be resolved. Dns-server: (optional) The IPv4 address or hostname of the DNS server. Module: (optional) Enter email, proxy, web, or network-agent. Example: (diagnose)# nslookup --host 10.10.10.10 --dns-server 20.20.20.20 --module proxy
Verify that a hostname or IP address exists and can accept requests from the selected module, and that DNS is resolving. Use ping and ping6 to test connectivity with the specified hostname or IP address. ping [--interface <c\|n\|p1\|p2\|e1\|e2>] --dest <ipv4_addr\|hostname> [--module <email\|proxy\|web\|network-agent>] ping6 [--interface <c\|n\|p1\|p2\|e1\|e2>] --dest <ipv6_addr\|hostname> [--module <email\|proxy\|web\|network-agent>]	Ctrl+C to quit. Dest: The IPv4 (ping) or IPv6 (ping6) IP address or hostname with which to test connectivity. Interface: (optional) The appliance interface. All valid interfaces can be usd including virtual interfaces. Module: (optional) If interface C, N, P1, P2, E1, or E2 is chosen, it will be converted to the virtual interface and a message explaining this will be output. Example: (diagnose)# ping --dest 10.10.10.10 --module proxy --interface eth0
Display the contents of the selected module's kernel IP routing table entries in numeric format. Use route and route6 in complex network environments to see if the environment is set up properly. route [--module <email\|proxy\|web\|network-agent>] route6 [--module <email\|proxy\|web\|network-agent>]	Module: (optional) Enter email, proxy, web, or network-agent. Example: (diagnose)# route --module network-agent
Display information about packets from the specified network interface, for packets matching the specified Boolean expression. Use tcpdump to determine whether all routing is occurring properly, to and from the interface. tcpdump --timeout <timeout value> [--file <filename>] [--interface <interface>] [--expression <filter expression>] [--location <filestore_alias>]	tcpdump is a packet analyzer. Tcpdump intercepts and displays packets being transmitted or received by the specified network interface. The output from tcpdump can help you determine whether all routing is occurring properly, to and from the interface. The output is verbose; it displays the data of each package in both hex and ASCII, and it includes a link-level header on each line. Timeout: The amount of time to run tcpdump before outputting results. File: (optional) Name of output file located in the filestore. Interface: (optional) Any existing interface. Interface will display in output as eth0 or eth1. Expression: (optional) A Boolean expression used to select the packets of interest. Location: (optional) Name of the filestore location. Example 1: To capture all TCP traffic to and from the proxy on port 8080, specify: "tcp port 8080" Example 2: To capture all TCP traffic to the site google.com, specify: "tcp and dst host google.com" Example 3: To capture all TCP traffic from a specific end-user machine, specify: "tcp and src host user.example.com" Note: You can enter a hostname if it is resolvable by a DNS server, but the output uses IP addresses.
Display all Linux processes that are currently running in the selected module. Use top to help diagnose CPU and memory issues. top [--module <email\|proxy\|web\|network-agent>]	Module: (optional) The appliance module. Example: (diagnose)# top --module proxy
Display the route used by packets to reach the specified destination. traceroute --dest <ipv4_addr\|hostname> [--module <email\|proxy\|web\|network-agent>] traceroute6 --dest <ipv6_addr\|hostname> [--module <email\|proxy\|web\|network-agent>]	If some machines are not receiving policy enforcement, or if traffic is not getting to the appliance, this displays the devices (or hops) that are between the machines that may be blocking access to the host. Use tcpdump to get a packet capture from each device. If you are having latency issues, traceroute can also help identify potential causes. Note: traceroute is of limited usefulness if an IP address is being spoofed. Module: (optional) The appliance module. Examples: (diagnose)# traceroute --dest www.mywebsite.com --module proxy (diagnose)# traceroute6 --dest 1234:5678::8765::4321 --module email
Tests connectivity with the specified URL (file download not supported). wget --url <url> [--module <email\|proxy\|web\|network-agent>]	Supports non-interactive download of web pages to help diagnose connectivity issues. Use wget, for example, if you have configured the proxy, but cannot access the Web. wget simulates the proxy going out and retrieving content at the specified URL. wget supports HTTP, HTTPS, and FTP. Module: (optional) The appliance module. Example: (diagnose)# wget --module email --url www.mywebsite.net
Tests connectivity between the specified URL and the proxy (file download not supported). wget-proxy --url <url> --proxy-ip <proxy_ip> --port <port> [--proxy-user <user_name>] [--module <email\|proxy\|web\|network-agent>]	Url: The URL of the website to which you want to test connectivity Proxy-ip: The proxy IP address. This is the IP address of the P1 interface on most appliance configurations. Port: The port on which the proxy expects traffic. 8080 is configured for HTTP by default. Proxy-user: (optional) The user name of the client, if required for authentication Module: (optional) The appliance module. Example: (diagnose)# wget-proxy --module web --port 8080 --proxy-ip 10.206.4.47 --url www.google.com --proxy-user myuser
Display the module's logging level status. get debugging --command <status> --module <proxy\|web\|email\|network-agent>	Command: status. Module: The appliance module. Example: (diagnose)# get debugging --command status --module proxy Debug log is disabled
Runs the Content Gateway content line command. get proxy content_line --type <read> --entry <config entry>	Type: The type of command you are sending to content line. "Read" is the only current option. Entry: Used with type option "read". This is the entry in the config that you are reading. Example: (diagnose)# get proxy content_line --entry proxy.config.lm.display_reset_alarm --type read Value for proxy.config.lm.display_reset_alarm: 1
Stops, starts, or restarts the Conent Gateway Policy Engine. get proxy policy_engine --command <status>	Command: The type of command you are sending to content line. "Status" is the only option at this time. Example: (diagnose)# get proxy policy_engine --command status PolicyEngine not registered with DSS manager.
Runs and network check against the Content Gateway. get proxy network_check	Example: (diagnose)# get proxy network_check
Retrieves information from the Policy Broker. get web policy_broker	Example: (diagnose)# get web policy_broker Unable to connect to the Policy Server!
Retrieves the status or enables/disables the caching of users. get web cache_users --command <status>	Command: Command to send. "Status" is the only option at this time. Example: (diagnose)# get web cache_users --command status CacheWISPUsers=on
Retrieves the status or enables/disables the User Group IP Precedence. get web usr_grp_ip_prec --command <status>	Command: Command to send. "Status" is the only option at this time. Example: (diagnose)# get web usr_grp_ip_prec --command status UserGroupIpPrecedence=false
Retrieves the list of log files that can be downloaded to a filestore. get email log_list
Retrieves the specified log file. get email log --alias <filestore alias> --file <filename>	Alias: Filestore location for the file. File: Name of file to download. Example: (diagnose)# get email log --alias liftp --file maillog
Runs the DIG command. get email dig_output --entry <ip_address\|domain name> --type <mx\|txt\|x>	Entry: Location to run DIG against. Type: Option to be passed to. Example: (diagnose)# get email dig_output --entry 10.206.6.13 --type mx
Downloads the PEM files to a filestore. get email pem --alias <filestore alias>	Alias: Filestore location for the file. Example: (diagnose)# get email pem --alias liftp