Technical Note: TCP traceroute behavior in Proxy mode
Description
While performing a tcp traceroute on a traffic inspected by profile in proxy mode you might get unexpected results.
The following command will perform the traceroute with TCP protocol on port 80.
Notes:
- IP addresses are intentionally obfuscated.
- The 10.10.10.10 is the internal IP of the FortiGate.
Solution
This is expected behavior. List of possible workarounds:
1) Use flow based mode
2) Use other port, that is not used in any proxy inspection profile
3) Use other protocol, that is not being proxied, e.g. UDP or ICMP
While performing a tcp traceroute on a traffic inspected by profile in proxy mode you might get unexpected results.
The following command will perform the traceroute with TCP protocol on port 80.
user@kvm03:~$ sudo traceroute -q 1 -T -p 80 www.fortinet.comActual path without proxy inspection:
traceroute to www.fortinet.com (13.56.33.144), 30 hops max, 60 byte packets
1 10.10.10.10 (10.10.10.10) 0.199 ms
2 ec2-13-56-33-144.us-west-1.compute.amazonaws.com (13.56.33.144) 0.174 ms
user@kvm03:~$
user@kvm03:~$ sudo traceroute -q 1 -T -p 80 www.fortinet.comThis applies to following inspections configured in proxy mode: Web filter, Antivirus, Data Leak Prevention, Anti-Spam, VoIP, Web Application Firewall
traceroute to 13.56.33.144 (13.56.33.144), 30 hops max, 60 byte packets
1 10.10.10.10 (10.10.10.10) 0.840 ms
2 x.x.x.x (x.x.x.x) 0.773 ms
3 x.x.x.x (x.x.x.x) 1.393 ms
4 x.x.x.x (x.x.x.x) 2.723 ms
5 x.x.x.x (x.x.x.x) 9.799 ms
6 x.x.x.x (x.x.x.x) 12.712 ms
7 ffm-bb3-link.telia.net (80.91.254.102) 165.381 ms
8 prs-bb3-link.telia.net (62.115.123.13) 165.013 ms
9 ldn-bb4-link.telia.net (62.115.114.228) 166.391 ms
10 nyk-bb3-link.telia.net (62.115.112.244) 93.870 ms
11 sjo-b21-link.telia.net (213.155.130.129) 163.137 ms
12 a100row-ic-300117-sjo-b21.c.telia.net (213.248.87.118) 179.177 ms
13 54.240.242.28 (54.240.242.28) 167.594 ms
14 54.240.242.127 (54.240.242.127) 169.147 ms
15 205.251.229.158 (205.251.229.158) 163.044 ms
16 *
17 *
18 *
19 *
20 *
21 ec2-13-56-33-144.us-west-1.compute.amazonaws.com (13.56.33.144) 168.771 suser@kvm03:~$
Notes:
- IP addresses are intentionally obfuscated.
- The 10.10.10.10 is the internal IP of the FortiGate.
Solution
This is expected behavior. List of possible workarounds:
1) Use flow based mode
2) Use other port, that is not used in any proxy inspection profile
3) Use other protocol, that is not being proxied, e.g. UDP or ICMP
