User can’t get online through IAG? My System Diagnostic Tools troubleshooting flow

I am George Fady, I am a technical support engineer in Sangfor.

When a user reports “I can’t access the internet,” IAG’s built-in diagnostic tools are almost always faster than guessing at a policy. My usual order:

• Internet Access Failure Troubleshooting - filter logs by the specific IP, protocol, and port, and let it tell you which module rejected the traffic and why, instead of reading through the full log manually.
  
  
• Bypass / Packet Drop List - temporarily enable this so packets that should be rejected by policy are released instead, while still being logged. This is how I confirm whether a specific rule is really the cause before touching the policy itself.
  
  
• Packet Capture Tools - when the rejection reason still isn’t clear from the log, a capture at the right point tells me whether the packet is even reaching IAG the way I expect.
  
  
• IAG Command Console - for anything the web console can’t surface directly.
  
  
• If none of that resolves it, that’s when I’d loop in Sangfor Care Services rather than keep guessing.
  
  
  
  

This order has turned a lot of “the internet is down” panics into a two-minute policy-log lookup. Question for the community: how often does step 1 alone solve it for you, versus needing to go further down the list?