Technical Tip: Interface unknown-0 in traffic logs

[aneshcheret]

Description

This article describes possible root causes of having logs with interface 'unknown-0'.

 

Scope

FortiGate.

Solution

Generally, such a log message is created when a packet comes to a FortiGate or FortiOS and it can't find an existing session for it, although it is expected that it should already be in place.
For example, when FortiGate receives a TCP FIN packet, and there is no session, this packet can match.

There are several scenarios when such a log message can be generated:

1. When an interface (virtual or physical) status changes (add/del/up/down).
   It triggers a routing table update, which flushes the 'dev' info of the related sessions due to re-routing. Such sessions will later timeout if there is no following-up packet after the flush.
   While they are being removed from the session table logs with the 'unknown-0' src/dst interface is generated.
   
   
2. These log messages are also known to be seen when a packet comes to a FortiGate and FortiOS and can't find an existing session for it, although it is expected that it has to be in place.
   Below are two examples of such scenarios:

• When FortiGate receives a TCP FIN packet, and there is no session, this packet can match.
  An example of such a scenario can be a TCP session removed from the session table after the 'session-ttl' value is expired for it. In case the session is removed earlier than the client closed it, the client may still try to use it.
  As FortiGate will not expect to receive any TCP packets except TCP SYN triggering the creation of a new session, all other packets will be dropped due to an 'implicit deny' policy (ID 0) match, and an 'unknown-0' log message will be generated.
• Another valid example of such log messages is when a session is removed from the session table because the destination server closed it. In such case, if for any reason the client still sends packets related to the removed session, packets are dropped due to an 'implicit deny' policy (ID 0) match, and an 'unknown-0' log message is generated.

In both examples, ‘No Session Match’ messages are seen in the debug flow logs.

Related articles:

Technical Tip: 'No Session Match' error and halfclose timer

Technical Tip: Traffic logs with no interface details (interface unknown-0)