Troubleshooting Tip: How to troubleshoot packet drops issue on FortiGate when IPS profile is enabled

To troubleshoot packet drops on FortiGate firewalls, open up 3 CLI windows in the FortiGate and follow these steps:

CLI Window 1: Collect debug logs: Run the debug flow and IPS debug to collect debug logs for the specific port and protocol.

To reset the debug:

diagnose debug reset
diagnose debug disable

To enable the debug:

diagnose debug flow filter addr x.x.x.x <----- Input the client IP that is having an issue.
diagnose debug flow filter port x <----- Input the specific port that is having an issue.
diagnose debug flow show function-name enable
diagnose debug console timestamp enable
diagnose debug flow trace start 999
diagnose ips filter set "host x.x.x.x and tcp port x" <----- Input the specific client IP and port that is having an issue.
diagnose ips debug enable all

diagnose debug enable

To stop the debug:

diagnose debug disable

For more details on additional filtering options on the debug flow, refer to this article : 

Technical Tip: How to filter for IP addresses and address ranges in debug flow

For more details on additional filtering options on IPS debug, refer to this article :

Troubleshooting Tip: Collecting IPS engine related debugs

CLI Window 2: Capture the traffic flows: Use the sniffer command to capture traffic flows and identify any packet drops or anomalies.

diagnose sniffer packet any "host x.x.x.x and port x" 6 0 l <----- Input the specific client IP and port that is having an issue.

Note: If no traffic is seen on the capture, ensure that acceleration is disabled to appreciate the traffic on the sniffer:

config firewall policy

    edit 1

        set auto-asic-offload disable
    next

end

CLI Window 3: Collect IPS engine information, interface statistics, and attempt to find the client session in the session table.

fnsysctl date
diagnose autoupdate versions | grep -A5 "IPS"
diagnose netlink interface list

diagnose sys session filter dst x.x.x.x <----- Input the specific client IP.
diagnose sys session filter dport x <----- Input the specific port that is having an issue.
diagnose sys session list <----- Repeat this command 2-3 times when the issue is presenting.

Clear the session when it ends:

 
diagnose sys session filter clear

Other troubleshooting considerations to narrow down the issue further : 

1. Ensure that the FortiGate firewall is configured correctly, and the IPS and AV profiles are properly set up.
2. Narrow down other enabled existing features that may cause the issue by temporarily turning them off. 

Example(s) :

• Other UTM security profiles, including the antivirus profile.
• Traffic shaping policy.
• DOS policy.
• Local in policy.

3. Update the FortiOS to the latest patch version to have the latest IPS engine version, or update the IPS engine manually to the latest version. To update the IPS engine manually, follow the steps outlined in Technical Tip: How to manually upgrade the IPS Engine.

If further assistance is needed or for answers to inquiries, contact Fortinet Technical Support.

Related article:

Troubleshooting Tip: IPS engine new debug commands