FortiGate 100F: Troubleshooting Intermittent SSH Connection Failures

Overview

SSH connections to a FortiGate 100F may fail or disconnect intermittently when Auvik uses Remote Terminal or CLI polling.

Common causes include Trusted Host restrictions, interface access settings, session timeouts, SSH compatibility, firewall policies, resource constraints, or unstable HA and routing paths.

Troubleshooting

1. Check Trusted Hosts

If the FortiGate administrator account has Trusted Hosts configured, confirm that every Auvik Collector egress IP is included.

Include the Collector’s translated or NATed IP address if traffic passes through NAT.

An authorized FortiGate administrator may temporarily remove the Trusted Host restriction as a controlled test if permitted by the organization’s security policy. Restore the restriction after testing.

2. Verify interface access

Confirm that the interface used by Auvik allows SSH:

config system interface
  edit <INTERFACE_NAME>
    set allowaccess ping ssh https snmp
  next
end

The interface must also be reachable from the Auvik Collector.

3. Review session timeouts

Long configuration collections may be interrupted if the administrative timeout is too short.

An authorized FortiGate administrator can review or adjust the timeout:

config system global
  set admintimeout 60
end

Use a timeout value that complies with your organization’s security policy.

4. Check SSH cipher and key-exchange compatibility

If the FortiGate is restricted to legacy or unusually limited SSH algorithms, the SSH handshake may fail.

Confirm that the FortiGate allows a modern, widely supported set of SSH ciphers and key-exchange algorithms compatible with the Auvik Collector.

5. Check device resources and security policies

Review the FortiGate for:

High CPU or memory utilization.
DoS protection or rate-limiting policies affecting management traffic.
IPS or security policies interrupting SSH sessions.
Concurrent-session limits or administrative session restrictions.

6. Check HA and routing

If the FortiGate is part of an HA pair:

Confirm Auvik is connecting to the intended management IP.
Confirm the active unit accepts SSH connections from the Collector.
Confirm the Collector has a stable route to the active unit.
If dedicated HA management interfaces are used, verify reachability and SSH access on those interfaces.

7. Review FortiGate SSH logs

An authorized FortiGate administrator can temporarily enable SSH debugging:

diagnose debug application sshd -1

Reproduce the connection failure, then stop debugging:

diagnose debug reset

Review the output for handshake failures, denied source addresses, authentication errors, or session termination.

If the issue continues

Provide Support with:

FortiGate model and FortiOS version.
Auvik site and Collector details.
FortiGate management IP used by Auvik.
Whether the device is part of an HA pair.
Whether NAT or a VPN exists between the Collector and FortiGate.
The approximate failure time, including time zone.
Relevant FortiGate SSH debug output with credentials and secrets removed.

Changes to Trusted Hosts, interface access, timeouts, SSH algorithms, HA settings, routing, and security policies must be performed by an authorized FortiGate administrator.

How can we help?