Skip to main content
suthomas1
suthomas1
New Member
June 30, 2014
Question

traffic drop

  • June 30, 2014
  • 3 replies
  • 14902 views
Hi, I am looking for some command ( on CLI ) to see the conversation between two hosts. I am aware of the diag command , but will it show what packets are dropped by the firewall between those two hosts? eg. if host A talks to host B on port 2601 & assume the firewall is not yet allowing this port between them, how can we know if this port is dropped due to no policy in place. Thanks in advance.[size=2][/size][size=3][/size]

    3 replies

    emnoc
    emnoc
    New Member
    June 30, 2014
    If their' s no policy it should be drop. To answer your question, what diag command are you referencing? To give you an ideal of one way to monitor; diag debug reset diag debug flow filter port 2601 diag debug flow show console enable diag debug flow trace start 100 diag debug en Than you will have a trace message similar to this; id=36870 trace_id=398 msg=" vd-root received a packet(proto=6, 14.16.111.202:23747->19.1.15.78:2601) from wan1." id=36870 trace_id=398 msg=" allocate a new session-3bb092a8" id=36870 trace_id=398 msg=" find a route: gw-19.1.15.78 via wan2" id=36870 trace_id=398 msg=" Denied by forward policy check" id=36870 trace_id=399 msg=" vd-root received a packet(proto=6, 14.16.111.202:23747->19.1.15.78:2601) from wan1." id=36870 trace_id=399 msg=" allocate a new session-3bb094eb" id=36870 trace_id=399 msg=" find a route: gw-19.1.15.78 via wan2" id=36870 trace_id=399 msg=" Denied by forward policy check" Since no fwpolicy was inplace , the packets are denied by the forward policy check
    suthomas1
    suthomas1Author
    New Member
    July 4, 2014
    Thank you for the reply. Considering that i do not know the port involved, do we have some similar command to trace communication between two IP' s and find out if any required ports are being dropped by firewall for not being in policy or for any other reasons. Appreciate the help.
    emnoc
    emnoc
    New Member
    July 4, 2014
    Sure just change the diag debug flow to a filter of the addr involved
    diag debug reset diag debug flow filter addr x.x.x.x diag debug flow show console enable diag debug flow trace start 100 diag debug en
    Suggestion, do a diag debug flow filter ? to see what filters you can apply diag debug is your friend. Alternative ( for general monitoring ) you can see what traffic is coming to your host using the diag sniffer command You can using diag sys session and filters to look at session to your host
    Terms & ConditionsAccessibility statement
    Thought Leadership Security Summit. Outpace New Threats with AI - enhanced defense. Tuesday, Septmeber 15, 8:30 AM - 2:30 PM PT. The Golf Club at Newcastle, WA.
    Fortinet Flag the Hack. Wednesday, August 26, 9:00 AM - 5:00 PM ET, COSM, Atlanta, GA.