Technical Tip: Verifying backend reachability Using FortiADC curl and packet analysis

Description

This article describes a simple method to verify TCP connectivity between FortiADC and backend servers using the 'execute curl' command and packet captures. The test confirms whether the backend service is reachable and responding on the expected ports.

Scope

FortiADC.

Solution

Connectivity test using FortiADC CLI 'curl' command and packet captures.

Example: Working backend service (port 80):

MB_LAB # execute curl 10.109.19.129:80
*   Trying 10.109.19.129:80...
* Connected to 10.109.19.129 (10.109.19.129) port 80
> GET / HTTP/1.1
> Host: 10.109.19.129
> User-Agent: curl/8.4.0
> Accept: */*
> 

Packet capture outputs below in a working scenario:

The output above indicates:

• A SYN -> SYN/ACK -> ACK -> HTTP GET request.

• The back-end service is reachable and responding normally.

• The TCP 3-way handshake is completed.

Example:
Incorrect port or service not listening (port 8080):

MB_LAB # execute curl 10.109.19.129:8080
*   Trying 10.109.19.129:8080...
* connect to 10.109.19.129 port 8080 failed: Connection refused
* Failed to connect to 10.109.19.129 port 8080 after 27 ms: Couldn't connect to server
* Closing connection
curl: (7) Failed to connect to 10.109.19.129 port 8080 after 27 ms: Couldn't connect to server

Packet capture outputs below. A non-working scenario:

The above indicates:

• Backend received SYN and returned RST, ACK.

• No service is listening on port 8080.

• TCP 3-way handshake is incomplete.
  
  

For instructions on how to create the filter for packet captures, refer to the following official document on Packet capture.

Related document:

execute curl