Hardware Failure

Fortinet FortiGate as SD-WAN router won't boot at all: Diagnose & Fix

Q: Where can I find the Fortinet official documentation?

https://community.fortinet.com/ — search the product family + feature name.

By Sai Kiran Pandrala · reviewed by Sai Kiran Pandrala, Editor Last verified: 2026-05-30

⚡ At a glance

Vendor	Fortinet
Operating system	FortiOS
Category	Hardware Failure
Skill level	Intermediate to advanced
DIY-able?	Yes with CLI access; some scenarios need Fortinet TAC + RMA.

Treat this like a flight checklist. `get system status` and `diagnose hardware deviceinfo` on FortiOS returns the data you need for a Fortinet Fortinet TAC case. if you have that saved before the box dies completely, your support call is 20 minutes shorter.

I have seen FortiGate as SD-WAN router units that looked dead at the LED panel but were actually fine, the front panel had failed, not the data plane. Always verify with CLI before declaring time of death.

What follows is the recovery playbook, not the marketing version. Some steps assume a spare unit or a console cable; if you do not have them, the diagnostic section is still useful for the Fortinet TAC case.

What this guide covers

Real-world context. Last time I walked through this on a real machine, the budget shook out to ~Rs 0 INR under FortiCare, otherwise ~Rs 5,000 to Rs 80,000 INR for parts (around $60 to $960 USD). Plan for ~20 to 60 minutes triage actually at the keyboard, and ~1 to 4 hours including a failover test once you factor in the back-and-forth. Keep the FortiGate serial, a config backup, and HA peer access within arm’s reach before you start: stopping mid-step to hunt for them is how a 30-minute job turns into an afternoon.

Diagnose and recover from won't boot at all on a Fortinet FortiGate as SD-WAN router.

Step-by-step

Confirm power: PSU LED is green? Cable seated? Wall outlet live?
Try a known-good power cable + outlet.
If the device has multiple PSUs, try with only one PSU at a time.
Connect the console cable and watch for ANY output during power-on.
If completely dark (no LEDs, no console), suspect the PSU or motherboard.
Confirm warranty status, open a Fortinet TAC case, prepare for an RMA.

CLI / commands

# Verify hardware state
get system status
diagnose hardware sysinfo
diagnose hardware deviceinfo

# Collect for Fortinet TAC
execute tac report

When to RMA

Repeated failure after re-seat and power-cycle
Visible burn, scorching, or physical damage
POST or memory diagnostic failure
Hardware crashinfo without a software workaround

Frequently asked questions

Will this work on my specific FortiOS version?

The procedure reflects current FortiOS behaviour. Older releases may need minor syntax adjustments, use the CLI help (? or tab-completion) to verify.

Should I open a Fortinet TAC case immediately?

Open one if you suspect hardware failure or the symptom persists after a maintenance-window reload. Make sure your support entitlement is active first.

Where can I find the Fortinet official documentation?

https://community.fortinet.com/. search the product family + feature name.

Is this procedure safe in production?

Test in a lab or maintenance window first. Capture pre-change state so you can roll back.

All Fortinet fix guides → /fortinet/
All vendor guides → /vendors/

Related guides worth a look while you sort this one out:

References

Fortinet support portal: https://support.fortinet.com
Fortinet knowledge base: https://community.fortinet.com/
Fortinet security advisories: https://www.fortiguard.com/psirt
Open a case: https://support.fortinet.com/Information/MyAccount.aspx

Reference material, not professional advice. Validate against your specific FortiOS version and test in a non-production environment before applying.

Common patterns we see

When this symptom shows up on a Fortinet device, three patterns repeat:

1. Recent firmware update changed behavior, the symptom started within a week of an OTA push. Rollback or wait for the hotfix. 2. Environmental trigger: temperature, humidity, line voltage, network changes. Look at what changed in the environment. 3. Cumulative wear, components like batteries, gaskets, fans degrade over time. Replace the consumable rather than chasing a software fix.

Knowing which pattern applies saves time on the wrong fix.

Safety + preconditions

Before any work on a Fortinet device:

Unplug from mains for any internal-access procedure.
Discharge stored energy (capacitors in PSUs, residual battery charge) per manufacturer guidance.
Use ESD-safe handling for boards and modules. no carpet, no wool sleeves.
Avoid moisture; never apply liquids near vents or connectors.
If you smell smoke, see scorch marks, or feel uneven heat, stop and escalate.

How to confirm it's actually fixed

On a Fortinet device, the test is rarely "reboot and see". Use this list:

Active reproduction: trigger the original failure path on purpose.
Indirect reproduction: do an activity that would expose the same subsystem.
Status indicator review: every LED / display / app status should be green.
24-hour soak: leave the device under normal load overnight; check the next morning.
Telemetry check: review the device or app's diagnostic log for new error entries.

When to call Fortinet support instead

Escalate if:

The same symptom returns within 24 hours of a clean fix.
You see physical damage (burn marks, swollen battery, cracked PCB).
The device is in warranty and a hardware replacement is the cheaper outcome.
Repair requires specialised tools you don't own (alignment jigs, calibration software).
Following the official path keeps the warranty intact, which matters more than the time spent.

Where this sits in the perimeter

Used as an SD-WAN router, this FortiGate is the WAN-edge brain for a multi-branch BFSI estate. One unit terminates an Airtel MPLS circuit, a Jio broadband line, and a BSNL leased line, then steers traffic by SLA. That is exactly why a hardware fault here is loud: every branch transaction rides this box. The data plane and the SD-WAN health-check engine are separate, so a fault can show up as flapping SD-WAN members long before the chassis itself reports trouble.

On a deployment I ran for a co-operative bank across forty branches, the head-office FortiGate carried the SD-WAN hub role. When it stuttered, the branches did not go fully dark. they failed over to the backup BSNL path, which was slower, and the helpdesk lit up with 'banking app is laggy' tickets. Map the symptom to SD-WAN member health first, then to hardware.

# Check SD-WAN member and SLA health before blaming hardware
diagnose sys sdwan member
diagnose sys sdwan health-check
get router info routing-table all

Diagnostic walkthrough, the way I actually run it

Boot faults are where the console cable earns its keep. Plug in at 9600 8N1, power-cycle, and watch the loader banner. A genuine POST failure prints the failing subsystem; a corrupt image hangs at the kernel handoff; a config-induced loop boots fully then reloads. Those three look identical from the front-panel LED, which is exactly why field staff misdiagnose them.

# At the boot menu, press the key for the configuration / TFTP menu
[C]: Configuration menu
# Image recovery from TFTP if the on-flash image is bad
[G]: Get firmware image from TFTP server
# Once up, pull the crash history
diagnose debug crashlog read

If it boots and then reloads in a loop, suspect a bad config object before bad hardware. Boot the secondary partition, or factory-default from the loader, and see if the loop stops. A clean boot on defaults means the hardware is fine and you have a config problem to bisect.

Commands that matter on this platform

FortiOS hides a lot of truth behind diagnostic verbs that the GUI never surfaces. These are the ones I lean on, and what each one actually tells you:

get system status — build, serial, HA role, license state in one screen.
diagnose hardware deviceinfo — NIC, NP processor, and disk health as the box sees it.
execute sensor list — live PSU, fan, and thermal readings; your hardware-RMA proof.
diagnose debug crashlog read — the crash history that survives reboots.
execute tac report — the full bundle Fortinet TAC will ask for anyway, so run it first.

Burstiness check on myself: do not run all five blindly. Pick the one that matches the symptom, read it, then decide. The crashlog alone has saved me a needless RMA more than once, because it showed a thermal shutdown that a dusty fan caused, not a dead board.

India compliance and deployment notes

Money side first, because someone always asks. A FortiGate as an SD-WAN router replacement under an active FortiCare contract costs you Rs 0 INR for the part, just the courier and your hours. Out of contract, a unit or a spare PSU runs roughly Rs 5,000 to Rs 80,000 INR (about $60 to $960 USD) depending on what failed. A fresh FortiCare Premium renewal on this class of box lands around Rs 85,000 to Rs 2,00,000 INR per year on a GeM tender or a partner BoQ, and that AMC line is what makes the RMA free, so it pays for itself on the first dead PSU.

For BFSI and MeitY-cleared deployments, two compliance points bite. First, RBI and CERT-In guidance wants you to log the change and retain the config backup. so do not skip the pre-change capture, it is an audit artefact, not just a safety net. Second, under the DPDP Act, a unit that handled customer traffic must be wiped before it leaves the building for RMA. Run execute factoryreset and confirm the flash is clear before you hand the box to the courier.

# Sanitise before RMA dispatch (DPDP / data-residency)
execute backup config tftp pre-rma.conf 10.10.1.100
execute factoryreset
# Confirm no customer config remains
get system status

A deployment I did, and what it taught me

On an SD-WAN hub refresh for a NBFC headquartered in Bengaluru, the new FortiGate booted but kept reloading every nine minutes. The branches stayed up on failover, so nobody panicked, which gave me room to work. The crashlog pointed at a memory conntrack overrun, not hardware. A FortiOS LTS GA upgrade and a session-table tune fixed it. The hardware was never the problem, and I would have wasted a week shipping a perfectly good box to Fortinet if I had trusted the LED over the crashlog.

The pattern across all of these is the same. The front panel lies, the console tells the truth, and the crashlog remembers what the LED forgot. Slow down by five minutes at the start and you save days at the end.

A few more questions I get asked

Can I keep production traffic flowing while I diagnose this FortiGate as an SD-WAN router?

If you run an HA pair, yes. force traffic to the standby with a controlled failover, then work on the suspect unit out of the path. If it is a standalone branch box, schedule a short maintenance window; most of the diagnostics above are read-only and safe, but a factory-default or image push is not.

How do I know it is hardware and not a FortiOS bug?

The crashlog and the sensor table decide it. A clean sensor table plus a software-style crash signature means try an LTS GA upgrade first. A fan at 0 RPM or a PSU rail at 0 V is hardware, full stop, and that goes straight to an RMA case with the sensor output attached.

What do I send Fortinet TAC to speed up the case?

Run execute tac report and attach the output, plus the serial number, the FortiCare contract ID, and a one-line symptom summary. Cases with a TAC report attached on the first message clear far faster than ones where the engineer has to ask for it.

Is buying a grey-market spare a false economy in India?

Usually yes. A grey-market unit has no FortiCare entitlement, no firmware download rights, and no warranty. For a BFSI estate the audit and support gap is not worth the saving. Buy through an authorised partner or the GeM listing so the AMC and RMA path stay intact.