Live monitoring question

Forum|Forum|8 years ago
November 30, 2017
4 replies
9288 views

Good morning all!

I'm looking for a way to perform live monitoring on our 100e box. What I am looking to do is determine what traffic (ports, destination IP, status, etc.) is being generated by a specific IP in real time. Example:

Phone traffic generated by a single phone, IP address 192.X.X.X. Pull up the monitor, filter by that IP address, and then plug the phone in and watch what traffic pops up.

I am looking to isolate the VoIP traffic to a single policy and vlan, but our phones are being picked up as different applications. IE SIP for some, UDP/XXXX for others, and RingCentral for others.

Any thoughts on how to do this with a 100e?

Thanks!

packetpusher

New Member

With most fortigates you can do packet sniffing as follows:

di sniff packet any "host A and host B"

For details, ref. http://kb.fortinet.com/kb/viewContent.do?externalId=11186

Also, in your case you can perform a packet capture as follows:

Go to System > Network > Packet Capture. For details ref. http://cookbook.fortinet.com/packet-capture/

Finally, you can see the traffic in FortiView, Logs, FortiCloud, and etc.

emnoc

New Member

You can enable logging on the fwpolicy

You can use cli diag sniffer packet , but keep in mind traffic that's off_loaded might not display in the capture

AdvntrhikeAuthor

New Member

Good morning and thank you for the replies!

The recommendations come close to what I am looking for, but I am either missing something or I'm not interpreting the data correctly. I'm expecting to be able to see the traffic that is blocked, or if traffic is going to a port that is not currently open rather than just the traffic that is flowing.

Example: Configuring a physical desk phone for RingCentral

If the firewall is configured for 'any any' then the phone will be provisioned and everything works correctly.

If the firewall is configured with a VoIP policy limiting the source address to only the phones IP address range and the recommended ports from RingCentral, the phone will hit the provisioning server on RingCentral's side, but the line will never register.

VoIP policy is first with RingCentral's recommended settings: https://success.ringcentral.com/articles/RC_Knowledge_Article/9233

Internet policy is second with DNS, HTTP, and HTTPS as recommend in the cookbook: http://cookbook.fortinet.com/creating-security-policies/

Deny all policy is third.

As this is the only device currently on this network (new configuration) I can easily flip between the two and see the phone pick up the line or drop the line, but I'm not seeing where the traffic is being blocked when comparing the two sessions. What I can't figure out is what traffic is different between the dedicated VoIP/Internet policies and the "Allow anything at all times crap I don't know what I'm doing so I'll open everything and pray" policy.

I hate to admit it, but I prefer WatchGuard's Traffic Monitor. Red, blue, green is much easier to pick out the problem areas.....

Sign up

Login with SSO

Login to the community

Login with SSO