New Member

Question

Fortigate blocked TCP packets with PSH flag.

Forum|Forum|6 years ago
February 13, 2020
9 replies
27433 views

Hello community!

Does someone have any idea what is the issue?

PSH flag in TCP packets is rarely used in common life, but our NMEA-to-IP converter is using this.

Fortigate did not allow it to pass and did not logged it as a blocked.

Session was successfully established - SYN, SYN-ACk and ACK passing through firewall,

but PSH-ACK did not want to pass.

I have played with auto-asic-offload config, np-acceleration and inspection proxy/flow mode it did not help.

Wireshark capture:

Config:

Firewall (158) # show

config firewall policy

    edit 158

        set name "IT Manager to Nmea converter"

        set uuid fa3c5914-cca8-51e9-819d-57551413207d

        set srcintf "vsw.port16"

        set dstintf "GPS"

        set srcaddr "all"

        set dstaddr "all"

        set action accept

        set schedule "always"

        set service "ALL"

        set profile-protocol-options "NMEA"

        set ssl-ssh-profile "NMEA"

        set logtraffic all

        set fsso disable

    next

end

Aleksandr

PSH.png

6.2

Yurisk

SuperUser

I wouldn't be sure the reason is PSH flag, as it is a valid flag in TCP sessions, and I see it regularly passing FGs without a problem. I'd suggest :

1. Making sure it arrives at the FG and is indeed being dropped by it:

FG# dia sniffer packet any 'Ip of oustide host receiving the connection' 4

And see if the same packet enters and leaves the FG or just enters it.

2. If the above shows packet arrives but doesnt leave the FG, run debug flow to see why:

diag debug reset

diag debug flow filter addr <ip of outside host receiving the connection>

diag debug flow show function-name enable

diag debug flow trace start 100

Then initiate the connection and post the result.

yurisk.info - all things Fortinet blog, no ads

PolikarpovAuthor

New Member

Thank you Yuri for prompt and detailed help!

Sniffer shows the packet is receiving by FG, but it does not go out.

The result of debug below:

[size="1"]id=20085 trace_id=1043 func=print_pkt_detail line=5501 msg="vd-root:0 received a packet(proto=6, 192.168.202.3:2000->10.49.41.150:56976) from GPS. flag [.], seq 611704, ack 1946171203, win 2920"[/size] id=20085 trace_id=1043 func=resolve_ip_tuple_fast line=5581 msg="Find an existing session, id-098026bf, reply direction" id=20085 trace_id=1043 func=npu_handle_session44 line=1139 msg="Trying to offloading session from GPS to vsw.port16, skb.npu_flag=00000000 ses.state=00140386 ses.npu_state=0x00000001" id=20085 trace_id=1043 func=fw_forward_dirty_handler line=449 msg="state=00140386, state2=00000001, npu_state=00000001" id=20085 trace_id=1043 func=av_receive line=305 msg="send to application layer" [size="1"]id=20085 trace_id=1044 func=print_pkt_detail line=5501 msg="vd-root:0 received a packet(proto=6, 10.49.41.150:56976->192.168.202.3:2000) from local. flag [.], seq 1946171203, ack 611741, win 65535"[/size] id=20085 trace_id=1044 func=resolve_ip_tuple_fast line=5581 msg="Find an existing session, id-098026bf, original direction" [size="1"]id=20085 trace_id=1045 func=print_pkt_detail line=5501 msg="vd-root:0 received a packet(proto=6, 192.168.202.3:2000->10.49.41.150:56976) from GPS. flag [.], seq 611741, ack 1946171203, win 2920"[/size] id=20085 trace_id=1045 func=resolve_ip_tuple_fast line=5581 msg="Find an existing session, id-098026bf, reply direction" id=20085 trace_id=1045 func=npu_handle_session44 line=1139 msg="Trying to offloading session from GPS to vsw.port16, skb.npu_flag=00000000 ses.state=00140386 ses.npu_state=0x00000001" id=20085 trace_id=1045 func=fw_forward_dirty_handler line=449 msg="state=00140386, state2=00000001, npu_state=00000001" id=20085 trace_id=1045 func=av_receive line=305 msg="send to application layer"

I have temporary put old Cisco 1841 between these networks and problem disappeared.

Is there any chance to get this packet passing through Fortigate?

Aleksandr

Snif_2.png

Yurisk

SuperUser

Strange indeed, in the FG sniffer if you look 3 lines above where 192.168.202.3 returns ACk it also gets blocked (and no PSH flag), seems like FG drops any returning traffic from 192.168.202 except SYN+ACK. On the other hand the traffic is strange as well - first 4 packets establish successfully TCP session, then instead of using this session, the host 10.49 again sends SYN out of the blue ...

if it is some SCADA/IOT irregular traffic FG may have problems statefully understanding it.

Is it in proxy mode (I see it is, have you tried FLow mode instead?)? Do you have some fancy VIP/NAT ? What does profile do (why custom, not "default")

set profile-protocol-options "NMEA" ?

yurisk.info - all things Fortinet blog, no ads

beacher66

New Member

Hey

Anyone solved this Problem with PSH packet block. I have same issu now...

THX for help

Beat

boneyard

Valued Contributor

good chance you have a different issue because as mentioned before PSH is a quite normal TCP option and gets allowed all the time. please perform the troubleshooting above to show your exact issue and start a new thread then.

also if you want a quicker answer work with Fortinet support, they can guide you through the troubleshooting and work with you on the actual device and traffic.