Skip to main content
s_rowe
s_rowe
New Member
February 17, 2014
Question

dirty_handler / no matching session

  • February 17, 2014
  • 2 replies
  • 5673 views
Hey all, Getting an error from debug outbput: ...fw-dirty_handler..." no session matched" ... We have multiple clients sending the same type of traffic to a single public IP address using destination NAT using the interface IP (so 1 to 1 NAT). Works fine until there are multiple simultaneous sessions established. I thought there would be an easy answer but i cant find anything on those messages in either the kb or on the forum. Hopefully an easy answer/solution. Thanks, Shannon

    2 replies

    romanr
    romanr
    New Member
    February 17, 2014
    Hi, what kind of traffic is this? Some traffic, which is free of port identifiers (like GRE or ESP) will always make troubles if you want to translate more then 1 ip on the inside to only one ip on the outside... br, Roman
    s_rowe
    s_roweAuthor
    New Member
    February 17, 2014
    Hi Roman, Thanks for your reply. It is eftpos / point of sale transaction traffic. TCP using the ephemeral ports. Not recognized by FortiOS as a " service" . Thanks, Shannon
    romanr
    romanr
    New Member
    February 18, 2014
    Hi, NAT with TCP should normally not be a problem. Can you post a bit more details of how you configured your policies? Also some more detailed output to the traffic (like sniffer dump and " diag debug flow" output, when this is happening). If you connect your inside to one public ip - you would normally use source NAT and so either an ip pool or the firewalls ip. br, Roman
    Terms & ConditionsAccessibility statement