Technical Tip: Troubleshooting abnormal VIP Traffic on IDS logs

Description

This article describes the issue of abnormal VIP traffic appearing in IDS logs when SPAN is configured on an uplink switch to mirror traffic from the VDOM root VLAN 200 to a FortiGate configured as an IDS.

Scope

FortiGate.

Solution

Abnormal traffic destined for a FortiGate VIP may appear in the IDS logs when traffic is mirrored using SPAN.

In some cases, the IDS logs may show traffic being:

• Sent to the VIP address.

• SNATed to an address associated with the FortiGate.

• DNATed to the private IP address configured in the VIP.

• Received and inspected by the IDS FortiGate.

This can make it appear that the traffic is being incorrectly redirected to the VIP or that the VIP is causing the traffic to be sent to the IDS.

The following steps can be used to troubleshoot and identify the source of unexpected VIP traffic appearing in the IDS logs and determine whether the traffic is being forwarded or destined for the FortiGate itself.

1. Verify the SPAN configuration.

Verify that the upstream switch SPAN configuration is correctly configured and that the intended VLAN/interface traffic is being mirrored to the IDS FortiGate.

Confirm the SPAN source, destination interface, direction, and VLAN tagging.

2. Verify the VIP configuration.

Review the VIP configuration and confirm that the public and mapped addresses are configured correctly.

Also verify that legitimate VIP traffic matches the expected firewall policy.

3. Trace the traffic flow.

Use debug flow to determine how the FortiGate is processing the traffic:

diagnose debug flow show

The output can help determine whether the traffic is being forwarded through the FortiGate or is being treated as local traffic.

4. Capture the traffic.

Use the FortiGate packet sniffer to verify the traffic arriving on the IDS interface:

diagnose sniffer packet <interface> '<filter>' 4 0 l

Compare the packet capture with the IDS logs to confirm that the traffic is being received as expected through the SPAN interface.

5. Review local-in traffic.

If the traffic is destined for the FortiGate itself, review the local-in traffic logs.

Local-in policies apply to traffic destined for the FortiGate and do not affect legitimate traffic that is forwarded through the FortiGate to an internal server using a VIP.

If unwanted traffic is confirmed to be terminating on the FortiGate through a VIP, a local-in policy can be used to restrict that traffic.

When creating a local-in policy for a VIP, use the VIP public/pre-NAT address as the destination.

Logging.

If local-in traffic is not visible in the logs, verify that local-in logging is enabled:

config log setting
    set local-in-allow enable
    set local-in-deny-unicast enable
    set local-in-policy-log enable
end

For FortiOS versions where per-policy logging is supported, logging can also be enabled on the relevant local-in policy.