Troubleshooting Tip: Using Port Block Allocation IP pools to correlate packet captures taken before and after source NAT

Use Case:

When troubleshooting network issues, it can be useful to restrict the focus to a particular test client and test firewall policy and take packet captures on the firewall. On internal networks without NAT, the test client’s traffic can be easily isolated for packet capture using an IP address filter. However, filtering traffic on WAN interfaces performing NAT can be a challenge. 

In smaller enterprise environments, there is often only one public IP address available, and all Internet-bound traffic egresses the firewall using the same source IP address. Since only one IP address is used, the test traffic cannot be isolated using an IP address. Configuring a port block allocation (PBA) IP pool on a test policy makes it possible to filter for test traffic using a port range.

Example Configuration:

config firewall address

edit "h-10.255.108.20"

set subnet 10.255.108.20 255.255.255.255

next

end

config firewall ippool

edit "pba-198.51.100.11"

set type port-block-allocation

set startip 198.51.100.11

set endip 198.51.100.11

set num-blocks-per-user 1

next

end

config firewall policy

edit <index>

set name "Test Client Internet Access"

set srcintf "internal"
set dstintf "wan1"
set action accept
set srcaddr "h-10.255.108.20"
set dstaddr "all"
set schedule "always"
set service "ALL"
set logtraffic all
set auto-asic-offload disable
set nat enable
set ippool enable
set poolname "pba-198.51.100.11"

next

end

When this configuration is applied and the test policy is placed above the existing internet policy, all internet TCP and UDP traffic from the example client 10.255.108.20 will be NATted with a predictable range of source ports.

After creation, identify the assigned source ports using the command 'diagnose firewall ippool list pba'.

diagnose firewall ippool list pba
user 10.255.108.20, 198.51.100.11, 5117-5244, idx=0, use=16

 Note:

• The test firewall policy must be moved above the existing Internet policy.
• if another IP pool is already configured for the same external IP address, it is not possible to configure an overlapping PBA IP pool.
• The starting source port for port block allocation IP pools is not configurable in v7.4 and earlier, but the range typically begins with 5117.
• In FortiOS v7.6.0 and later, the port range for PBA ippools is configurable, see Custom port ranges for PBA and FPR IP pools.

TCP & UDP traffic:

Perform packet captures in the CLI using the internal IP address for the LAN interface, and 'portrange' for the WAN interface.

diagnose sniffer packet internal 'host 10.255.108.20' 6 2000 l

diagnose sniffer packet wan1 'portrange 5117-5244' 6 2000 l

ICMP Echo traffic (Ping):

ICMP Echo Identifier is analogous to TCP and UDP ports for ICMP Echo (ping) traffic. The built-in libpcap-style options FortiOS provides cannot filter by this value directly, but a custom filter checking the 5th and 6th byte of icmp packets can be used to achieve the same effect, see below.

diagnose sniffer packet internal 'host 10.255.108.20' 6 2000 l
diagnose sniffer packet wan1 'icmp[4:2]>=5177 and icmp[4:2]<=5244' 6 2000 l

Debug flow does not require PBA IP pool:

Another commonly used troubleshooting tool is debug flow. This tool supports filtering directly based on the existing internal IP address and does not require any PBA ippool to capture both directions.

diagnose debug flow filter addr 10.255.108.20

diagnose debug enable

diagnose debug flow trace start 2

id=65308 trace_id=5 msg="vd-root:0 received a packet(proto=1, 10.255.108.20:278->1.1.1.2:2048) tun_id=0.0.0.0 from internal. type=8, code=0, id=278, seq=0."
id=65308 trace_id=5 msg="allocate a new session-00005e08"
id=65308 trace_id=5 msg="find a route: flag=04000000 gw-198.51.100.1 via wan1"
id=65308 trace_id=5 msg="gnum-100004, use addr/intf hash, len=3"
id=65308 trace_id=5 msg="Allowed by Policy-4: SNAT"
id=65308 trace_id=5 msg="SNAT 10.255.108.20->198.51.100.11:5142"
id=65308 trace_id=6 msg="vd-root:0 received a packet(proto=1, 1.1.1.2:5142->198.51.100.11:0) tun_id=0.0.0.0 from wan1. type=0, code=0, id=5142, seq=0."
id=65308 trace_id=6 msg="Find an existing session, id-00005e08, reply direction"
id=65308 trace_id=6 msg="DNAT 198.51.100.11:0->10.255.108.20:278"
id=65308 trace_id=6 msg="find a route: flag=00000000 gw-10.255.108.20 via internal"
id=65308 trace_id=6 msg="Trying to offloading session from wan1 to internal, skb.npu_flag=00000000 ses.state=00000204 ses.npu_state=0x00000001"
id=65308 trace_id=6 msg="state=00000204, state2=00000001, npu_state=00000001"

To stop the debug:

diagnose debug reset

diagnose debug disable

Related articles:

Technical Tip: How Port Block Allocation Works in FortiGate

Troubleshooting Tip: Advanced filters for FortiOS packet capture