Troubleshooting Tip: How to use the FortiGate sniffer and debug flow in presence of NP2 ports

This article describes how in FortiGates with NP2 interfaces, some traffic is offloaded at the hardware level. This means that the traffic should not reach the CPU (unless it is traffic destined for the FortiGate itself) and therefore will not be detected by a flow debugging command or a sniffer trace.

However, what will always be seen are the first packets of any new session establishment. For example, the SYN/SYN-ACK/ACK. Once the session is established, no further packets will be seen anymore as they will use the fast-path.

FortiGate with NP2 ports.

For troubleshooting purposes, and when packet capture or traffic flow inspection on a FortiGate is required, hardware acceleration can be bypassed on a specific port using the following command.

Be aware that this might affect performance and should only be used for troubleshooting purposes.

diagnose npu np2 fastpath-sniffer enable <port(s)_number>

This now shows all traffic for all sessions to/from this or those port(s) when using the sniffer or the diagnose debug flow commands

The command below will re-enable H/W offloading :

diagnose npu np2 fastpath-sniffer disable <port(s)_number>

Note that this is not saved in the configuration and will be lost after a reboot.

Related articles:

• Troubleshooting Tip: First steps to troubleshoot connectivity problems to or through a FortiGate with sniffer, debug flow, session list, routing table
• Technical Tip: Verifying and troubleshooting FortiGuard updates status and versions
• Technical Tip: Information about traffic log counters for NP2 or NP4 offloaded sessions