vpn ssl slow through Fortigate

Forum|Forum|1 year ago
October 26, 2024
2 replies
1019 views

Hi all

Here is my situation. At home, I use Fortigate 100D (FW 6.2.16) behind my box which forward all traffic to the Fortigate.

In recent weeks, when home working with vpn-ssl to entreprise vpn server, my flow has collapsed, and it is the Forti at home that is causing the problem, I have no problem if I plug into one of the ports available on the box and bypass home Fortigate.
I don't see any recent changes on home Forti that could explain the problem. The output rules are without filtering or inspections.
Wireshark captures I made show tons of TCP Retransmission mainly in the server -> client direction and Dup ACK in the other direction.

All your suggestions will be appreciated

SSL-VPN

salemneaz

Staff

Hi,

Can you run debug flow while you are trying to use to debug flow to identify the traffic flow through the Firewall.

di de dis
di de reset
di de flow filter addr <SSLVPN-Client's Real IP>
di de flow filter port <SSL-VPN-Port>
di de console timestamp en
di de flow trace start 999
di de en

To stop the debug use the command given below;

di de dis
di de reset

DarvidAuthor

New Member

Hi Salem,

Where should I put the result ? There is 3000 lines.

2024-10-26 19:10:15 id=20085 trace_id=4081 func=print_pkt_detail line=5688 msg="vd-root:0 received a packet(proto=6, 192.168.210.21:37268->2xx.xxx.xxx.xxx:443) from dmz. flag [.], seq 2966239105, ack 3095364758, win 1041"
2024-10-26 19:10:15 id=20085 trace_id=4081 func=resolve_ip_tuple_fast line=5768 msg="Find an existing session, id-000dc3f7, original direction"
2024-10-26 19:10:15 id=20085 trace_id=4081 func=__ip_session_run_tuple line=3425 msg="SNAT 192.168.210.21->192.168.1.10:37268"
2024-10-26 19:10:15 id=20085 trace_id=4082 func=print_pkt_detail line=5688 msg="vd-root:0 received a packet(proto=6, 192.168.210.21:37268->2xx.xxx.xxx.xxx:443) from dmz. flag [.], seq 2966239252, ack 3095364758, win 1041"
2024-10-26 19:10:15 id=20085 trace_id=4082 func=resolve_ip_tuple_fast line=5768 msg="Find an existing session, id-000dc3f7, original direction"
2024-10-26 19:10:15 id=20085 trace_id=4082 func=__ip_session_run_tuple line=3425 msg="SNAT 192.168.210.21->192.168.1.10:37268"
2024-10-26 19:10:15 id=20085 trace_id=4083 func=print_pkt_detail line=5688 msg="vd-root:0 received a packet(proto=6, 192.168.210.21:37268->2xx.xxx.xxx.xxx:443) from dmz. flag [.], seq 2966239373, ack 3095364758, win 1041"
2024-10-26 19:10:15 id=20085 trace_id=4083 func=resolve_ip_tuple_fast line=5768 msg="Find an existing session, id-000dc3f7, original direction"
2024-10-26 19:10:15 id=20085 trace_id=4083 func=__ip_session_run_tuple line=3425 msg="SNAT 192.168.210.21->192.168.1.10:37268"
2024-10-26 19:10:15 id=20085 trace_id=4084 func=print_pkt_detail line=5688 msg="vd-root:0 received a packet(proto=6, 192.168.210.21:37268->2xx.xxx.xxx.xxx:443) from dmz. flag [.], seq 2966239569, ack 3095364758, win 1041"
2024-10-26 19:10:15 id=20085 trace_id=4084 func=resolve_ip_tuple_fast line=5768 msg="Find an existing session, id-000dc3f7, original direction"
2024-10-26 19:10:15 id=20085 trace_id=4084 func=__ip_session_run_tuple line=3425 msg="SNAT 192.168.210.21->192.168.1.10:37268"

...

Thanks helping

David

Sign up

Login with SSO

Login to the community

Login with SSO