Skip to main content
kimsw
kimsw
Visitor III
October 30, 2024
Solved

Issue regarding decrypted mirror traffic

  • October 30, 2024
  • 1 reply
  • 1291 views

Hi,

When SSL-decrypted HTTPS traffic is sent to a mirror port and analyzed using Wireshark on a server connected

to that port, unusual packet patterns are observed.

 

wireshark.png

 

 

 

 

wan port IP : 1.235.10.153
destination IP : 54.84.14.5
source IP : 172.30.0.162

 

It seems like there is wrong with hand shake process, and when I monitor this traffic with Zeek, either the request body or the response body always shows 0.

 

Is there something wrong with my FortiGate configurations, or is this expected situation for mirrored traffic?

I need your assist.

 

Thanks.

Best answer by AnthonyH

Hello kimsw,

 

Could you run a sniffer using the following commands and attach the results here:
diag sniffer packet any 'host 172.30.162 and host 54.84.14.5' 4 0 l

Additionally, could try disable auto-asic-offloading on the firewall policy that is decrypt traffic and review the wireshark logs again?
config firewall policy
edit <id>
set auto-asci-offloading disable
end

1 reply

AnthonyH
Staff
AnthonyHAnswer
Staff
November 2, 2024

Hello kimsw,

 

Could you run a sniffer using the following commands and attach the results here:
diag sniffer packet any 'host 172.30.162 and host 54.84.14.5' 4 0 l

Additionally, could try disable auto-asic-offloading on the firewall policy that is decrypt traffic and review the wireshark logs again?
config firewall policy
edit <id>
set auto-asci-offloading disable
end

    kimsw
    kimswAuthor
    Visitor III
    November 4, 2024

    At first, it wasn't working well, so I tried setting "set auto-asic-offloading disable" after finding some information, but when I checked the TCPDUMP, it was the same.

     

    As I continued testing afterwards, I realized that previously I had been checking the TCPDUMP on the Linux server receiving mirrored traffic, but it was different from the TCPDUMP collected on the FortiGate.The FortiGate was sending traffic normally after setting "set auto-asic-offloading disable".

     

    In the end, the problem was resolved.

    The cause turned out to be that the Linux server was running on a virtual machine, so I learned that both the FortiGate's offloading and the VM's NIC offloading needed to be disabled together to properly receive the traffic.

     

    Thank you.

    Terms & ConditionsCookie settingsAccessibility statement