FG not sending logs to FAZ
Hi there
I have several FGs already sending logs to a FAZ, over ipsec connections, but I am having issues adding a new FW.
The logging is configured using the correct source-ip address, I have successfully checked sending pings from the FG to the FAZ using the source-ip option, and diag sniffer shows the flow of packets, albeit with RSTs in the flow. The FG definition is added to the FAZ, still, the FG reports it can't communicate with the FAZ.
config log fortianalyzer setting set status enable set source-ip 192.168.24.1 set server 192.168.40.15 set reliable enable end
MIN-FW-001 # exec log fortianalyzer test-connectivity Failed to get FAZ's status.
The sniffer flow from the test-connectivity command:
MIN-FW-001 # diag sniffer packet any "host 192.168.40.15" 4 interfaces=[any] filters=[host 192.168.40.15] 1303.708288 ipsec_CT out 192.168.24.1.1364 -> 192.168.40.15.514: syn 4266655446 1303.724212 ipsec_CT in 192.168.40.15.514 -> 192.168.24.1.1364: syn 1201754132 ack 4266655447 1303.724493 ipsec_CT out 192.168.24.1.1364 -> 192.168.40.15.514: ack 1201754133 1303.726584 ipsec_CT out 192.168.24.1.1364 -> 192.168.40.15.514: psh 4266655447 ack 1201754133 1303.742509 ipsec_CT in 192.168.40.15.514 -> 192.168.24.1.1364: ack 4266655740 1303.745975 ipsec_CT in 192.168.40.15.514 -> 192.168.24.1.1364: psh 1201756905 ack 4266655740 1303.746874 ipsec_CT out 192.168.24.1.1364 -> 192.168.40.15.514: ack 1201754133 1313.722355 ipsec_CT out 192.168.24.1.1364 -> 192.168.40.15.514: fin 4266655740 ack 1201754133 1313.738176 ipsec_CT in 192.168.40.15.514 -> 192.168.24.1.1364: fin 1201756914 ack 4266655741 1313.738539 ipsec_CT out 192.168.24.1.1364 -> 192.168.40.15.514: rst 4266655741
Any ideas? Why the RST packets?
As the RST breaks the session, diag debug flow shows 'no session matched' messages after the RSTs appear.
Thanks
