Skip to main content
Moosi
Moosi
New Member
August 13, 2023
Solved

FortiGate SFTP auto backup with zero kb size

  • August 13, 2023
  • 2 replies
  • 2885 views

8628992.pngHi

I have set up automatic backup to a sftp server (move it transfer), scheduled backup works well and the file is transferring to the server as well. But unfortunately the file's size is zero KB.

Tried manual backup to sftp server by using execute backup command in the cli, but result is same.

Firewall has multiple vdom.

Attached the captured packet screenshot for the reference

 

Thnaks inadvance

 

 

Best answer by Anonymous_User

Hi @Moosi 

 

Thank you for updating your query.

 

As per the issue, description SFTP backup schedule back works well however transferred file size is zero.

 

May I know which SFTP platform are you using and what is FortiOS version?

Did you try backup on a different platform? 

 

In the syn packet, we see the MSS 1460 and server-side MSS 1380. For the highlighted data transfer we are not receiving any ack packet from the server side.

 You can reduce the MSS on the FortiGate to avoid fragmentation. 

 

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Setting-TCP-MSS-value/ta-p/194518

 

Please follow below reference link to understand the TCP mss behavior 

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Behavior-of-TCP-MSS-setting-under-system-interface/ta-p/221376

 

 

Regards
Priyanka


- Have you found a solution? Then give your helper a "Kudos" and mark the solution

 

 

 

 

2 replies

A
Anonymous_UserAnswer
Contributor III
August 13, 2023

Hi @Moosi 

 

Thank you for updating your query.

 

As per the issue, description SFTP backup schedule back works well however transferred file size is zero.

 

May I know which SFTP platform are you using and what is FortiOS version?

Did you try backup on a different platform? 

 

In the syn packet, we see the MSS 1460 and server-side MSS 1380. For the highlighted data transfer we are not receiving any ack packet from the server side.

 You can reduce the MSS on the FortiGate to avoid fragmentation. 

 

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Setting-TCP-MSS-value/ta-p/194518

 

Please follow below reference link to understand the TCP mss behavior 

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Behavior-of-TCP-MSS-setting-under-system-interface/ta-p/221376

 

 

Regards
Priyanka


- Have you found a solution? Then give your helper a "Kudos" and mark the solution

 

 

 

 

Moosi
MoosiAuthor
New Member
August 16, 2023

Hi @Anonymous

Thanks for the reply

 

SFTP Platform:Move it transfer

FortiOS version:7.2.4

 I tried backup on different platform (ftp server) and it is working fine.

Should i reduce MSS or MTU?

Modifications to MTU or MSS affect the network or user sessions?

A
Anonymous_User
Contributor III
August 16, 2023

Hi @Moosi 

 

When you tried backup on a different platform what was the MSS value you observed in the syn and syn+ack packet?

 

When you reduce MSS on the Fortigate it will rewrite the MSS value in the TCP syn packet.

 From the syn+ack packet, we are observing the MSS of server 1380.

To avoid fragmentation you can reduce the MSS in policy. 

Since you will be making changes in the policy configuration in this case session might be marked dirty for the re-evaluation.

 

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Dirty-session/ta-p/197748

 

 

Regards
Priyanka


- Have you found a solution? Then give your helper a "Kudos" and mark the solution

 

Moosi
MoosiAuthor
New Member
October 17, 2023

@Anonymous 

Thanks for your advise and suggestion.

To avoid fragmentation, we matched the FortiGate MSS value to the  SFTP server value 1380 on the firewall port where the backup trafiic is generating.

 

config system interface
    edit "mgmt2"
        set tcp-mss 1380
    next

Terms & ConditionsAccessibility statement