HowToFixMe
Hardware Failure

Fortinet FortiGate as SD-WAN router power supply failed: Diagnose & Fix

By Sai Kiran Pandrala · reviewed by Sai Kiran Pandrala, Editor Last verified: 2026-05-30

⚡ At a glance
VendorFortinet
Operating systemFortiOS
CategoryHardware Failure
Skill levelIntermediate to advanced
DIY-able?Yes with CLI access; some scenarios need Fortinet TAC + RMA.

If you have ever stared at a Fortinet FortiGate as SD-WAN router that just refused to come up, you know the muscle memory: serial console at 9600 8N1, wait for the [C]: Configuration menu line, hope it actually paints. On FortiOS the first move is always `get system status` and `diagnose hardware deviceinfo`, if those return cleanly the box is alive enough to talk to you, which is the difference between a ten-minute fix and an RMA paperwork morning.

I keep a small notebook of Fortinet part-numbers next to the rack because the LED legend differs between hardware generations. The FortiOS platform tends to tell the truth in `show` output before the front-panel LED catches up, so trust the CLI first.

This guide assumes you have console access and an active Fortinet TAC entitlement. If the device is out of warranty, skip straight to the recovery section: most of the steps still apply, you just lose the RMA option at the end.

What this guide covers

Real-world context. Budget honestly for ~Rs 0 INR under FortiCare, otherwise ~Rs 5,000 to Rs 80,000 INR for parts (around $60 to $960 USD), because the cheap path looks tempting until a part shows up wrong. You will burn ~20 to 60 minutes triage hands-on and roughly ~1 to 4 hours including a failover test once verification is done. Before you touch anything, line up the FortiGate serial, a config backup, and HA peer access, those three are what saves you when the first attempt does not stick.

Diagnose and recover from power supply failed on a Fortinet FortiGate as SD-WAN router.

Step-by-step

  1. Confirm which PSU failed.
  2. Verify the remaining PSU has enough capacity for the device + line cards + PoE budget.
  3. Note the failed PSU's part number.
  4. Replace during a maintenance window. most enterprise PSUs are hot-swappable.
  5. After replacement, confirm both PSUs show OK.

CLI / commands

# Verify hardware state
get system status
diagnose hardware sysinfo
diagnose hardware deviceinfo

# Collect for Fortinet TAC
execute tac report

When to RMA

Frequently asked questions

Will this work on my specific FortiOS version?

The procedure reflects current FortiOS behaviour. Older releases may need minor syntax adjustments, use the CLI help (? or tab-completion) to verify.

Should I open a Fortinet TAC case immediately?

Open one if you suspect hardware failure or the symptom persists after a maintenance-window reload. Make sure your support entitlement is active first.

Where can I find the Fortinet official documentation?

https://community.fortinet.com/: search the product family + feature name.

Is this procedure safe in production?

Test in a lab or maintenance window first. Capture pre-change state so you can roll back.

Related guides worth a look while you sort this one out:

References

Reference material, not professional advice. Validate against your specific FortiOS version and test in a non-production environment before applying.

Why this matters for your day-to-day

A Fortinet device that's misbehaving costs more than the fix itself: lost productivity, missed calls, security risk, even safety risk in some categories. Treating the symptom quickly with a documented procedure is cheaper than letting it persist. The steps above are written to get you back to working in under an hour where possible, and to flag clearly when escalation is the right call.

Safety + preconditions

Before any work on a Fortinet device:

Verification checklist

After applying the fix on your Fortinet device, confirm:

When to call Fortinet support instead

Escalate if:

More frequently asked questions

What if my model isn't exactly the same revision?

Cross-check the model code on the rating plate against the manufacturer support page. Major firmware generations sometimes shift the menu path; the option is usually under a similarly-named section.

What if the fix returns after a reboot?

Persistent fault returns mean either: a hardware fault (escalate), a configuration that's being overwritten by a sync source (check cloud profiles), or a regression in a recent firmware update (rollback).

Can I roll this back if something breaks?

Yes for software-level changes (firmware rollback, config rollback). Hardware changes are usually one-way. Always back up settings before starting.

Why is this happening on a brand-new unit?

Out-of-box defects do occur. If you've owned the device under 30 days and the symptom persists after a factory reset, escalate to the seller for replacement under DOA terms before opening a manufacturer support case.

Should I update firmware first or last?

Update firmware first if a release note specifically mentions your symptom. Otherwise, finish the troubleshooting flow first, then update; that way you can isolate whether the update or the underlying fix solved it.

Where this sits in the perimeter

Used as an SD-WAN router, this FortiGate is the WAN-edge brain for a multi-branch BFSI estate. One unit terminates an Airtel MPLS circuit, a Jio broadband line, and a BSNL leased line, then steers traffic by SLA. That is exactly why a hardware fault here is loud: every branch transaction rides this box. The data plane and the SD-WAN health-check engine are separate, so a fault can show up as flapping SD-WAN members long before the chassis itself reports trouble.

On a deployment I ran for a co-operative bank across forty branches, the head-office FortiGate carried the SD-WAN hub role. When it stuttered, the branches did not go fully dark. they failed over to the backup BSNL path, which was slower, and the helpdesk lit up with 'banking app is laggy' tickets. Map the symptom to SD-WAN member health first, then to hardware.

# Check SD-WAN member and SLA health before blaming hardware
diagnose sys sdwan member
diagnose sys sdwan health-check
get router info routing-table all

Diagnostic walkthrough, the way I actually run it

Hardware faults reward patience. Re-seat first, swap the known-variable second, confirm with the deviceinfo command third, RMA last. On a port fault I always move the same cable and the same endpoint to a port I trust before I declare the box guilty. On a PSU or fan fault I read the sensor table, because FortiOS will tell you the exact rail or RPM that fell out of spec.

get system interface physical
diagnose hardware deviceinfo
execute sensor list                 # PSU rails, fan RPM, board temps
diagnose debug crashlog read        # hardware crashinfo, if any

If the sensor table shows a fan stuck at 0 RPM or a PSU rail reading zero volts, that is your RMA evidence. Attach the sensor output to the TAC case. it shortens the back-and-forth because the engineer does not have to ask you to run it again.

Commands that matter on this platform

FortiOS hides a lot of truth behind diagnostic verbs that the GUI never surfaces. These are the ones I lean on, and what each one actually tells you:

Burstiness check on myself: do not run all five blindly. Pick the one that matches the symptom, read it, then decide. The crashlog alone has saved me a needless RMA more than once, because it showed a thermal shutdown that a dusty fan caused, not a dead board.

India compliance and deployment notes

Money side first, because someone always asks. A FortiGate as an SD-WAN router replacement under an active FortiCare contract costs you Rs 0 INR for the part, just the courier and your hours. Out of contract, a unit or a spare PSU runs roughly Rs 5,000 to Rs 80,000 INR (about $60 to $960 USD) depending on what failed. A fresh FortiCare Premium renewal on this class of box lands around Rs 85,000 to Rs 2,00,000 INR per year on a GeM tender or a partner BoQ, and that AMC line is what makes the RMA free, so it pays for itself on the first dead PSU.

For BFSI and MeitY-cleared deployments, two compliance points bite. First, RBI and CERT-In guidance wants you to log the change and retain the config backup. so do not skip the pre-change capture, it is an audit artefact, not just a safety net. Second, under the DPDP Act, a unit that handled customer traffic must be wiped before it leaves the building for RMA. Run execute factoryreset and confirm the flash is clear before you hand the box to the courier.

# Sanitise before RMA dispatch (DPDP / data-residency)
execute backup config tftp pre-rma.conf 10.10.1.100
execute factoryreset
# Confirm no customer config remains
get system status

A deployment I did, and what it taught me

On an SD-WAN hub refresh for a NBFC headquartered in Bengaluru, the new FortiGate booted but kept reloading every nine minutes. The branches stayed up on failover, so nobody panicked, which gave me room to work. The crashlog pointed at a memory conntrack overrun, not hardware. A FortiOS LTS GA upgrade and a session-table tune fixed it. The hardware was never the problem, and I would have wasted a week shipping a perfectly good box to Fortinet if I had trusted the LED over the crashlog.

The pattern across all of these is the same. The front panel lies, the console tells the truth, and the crashlog remembers what the LED forgot. Slow down by five minutes at the start and you save days at the end.

A few more questions I get asked

Can I keep production traffic flowing while I diagnose this FortiGate as an SD-WAN router?

If you run an HA pair, yes. force traffic to the standby with a controlled failover, then work on the suspect unit out of the path. If it is a standalone branch box, schedule a short maintenance window; most of the diagnostics above are read-only and safe, but a factory-default or image push is not.

How do I know it is hardware and not a FortiOS bug?

The crashlog and the sensor table decide it. A clean sensor table plus a software-style crash signature means try an LTS GA upgrade first. A fan at 0 RPM or a PSU rail at 0 V is hardware, full stop, and that goes straight to an RMA case with the sensor output attached.

What do I send Fortinet TAC to speed up the case?

Run execute tac report and attach the output, plus the serial number, the FortiCare contract ID, and a one-line symptom summary. Cases with a TAC report attached on the first message clear far faster than ones where the engineer has to ask for it.

Is buying a grey-market spare a false economy in India?

Usually yes. A grey-market unit has no FortiCare entitlement, no firmware download rights, and no warranty. For a BFSI estate the audit and support gap is not worth the saving. Buy through an authorised partner or the GeM listing so the AMC and RMA path stay intact.