FortiGate
FortiGate Next Generation Firewall utilizes purpose-built security processors and threat intelligence security services from FortiGuard labs to deliver top-rated protection and high performance, including encrypted traffic.
slautenschlager

Description


This article describes how to use the built-in packet capture feature in FortiOS from the GUI interface.

Solution


On the 5.6 firmware branch, the unit needs a disk and logging to disk has to be enabled.
Since the firmware version 6.0.2, this restriction has been removed.

Here is the Step-by-Step guide to capturing packets from GUI:
- Go to Network -> Packet Capture and create a new filter.
- It's possible to use the following URL to access the packet capture page: https://[management-IP]/ng/page/p/firewall/sniffer/
Substitute the management-IP with the correct IP to access the FortiGate.
- Below shows the Packet Capture interface:

 

The option to capture the packet based on interface and filter by hosts, ports or VLANs will be proposed.
In the example above 100 packets would be captured based on the selected filters:

IP address 10.205.1.206 and port 80,443 on interface port3.
If 'Enable Filters' is not selected, all packets on the selected interface will be captured.

Results.

 
 
The capture will stop automatically once it reached the maximum packet size defined in the settings.
Download the PCAP file and view it with a suitable viewer, Wireshark, for example.
 
 
 
Notes.
Packet capture can tell you what is happening on the network at a low level. This can be very useful for troubleshooting problems, such as:
- Finding missing or lost traffic/packets.
- Locating ARP problems such as broadcast storm sources and sources.
- Confirming which address a computer is using on the network if there are multiple addresses or are on multiple networks.
- Confirming that routing is working as expected.
- A particular type of packet is having problems, such as UDP, which is commonly used for streaming video.


Limitations:

- Can not select interface as "any" at the time of packet capture. 

- Less than or equal to 10,000 packets can be captured in one packet capture filter.

msanjaypadma_0-1646763493505.png

 

On Fortigate Version 7.2+ this option can be found under : Network > Diagnostics

 

ethomollari_0-1662633861516.png

-Click On Start Capture and you can see live flow of packets

-You can stop the capture and save the file in pcap format, readable by Wireshark 

 

ethomollari_1-1662634118311.png

 

Useful links:

Fortinet Documentation
https://help.fortinet.com/fos50hlp/56/Content/FortiOS/fortigate-networking/Troubleshooting/Packet%20...
https://docs.fortinet.com/document/fortigate/5.6.0/cookbook/640812/packet-capture