FortiGate
FortiGate Next Generation Firewall utilizes purpose-built security processors and threat intelligence security services from FortiGuard labs to deliver top-rated protection and high performance, including encrypted traffic.
smayank
Staff
Staff
Article Id 339480
Description

This article describes verifying if the UDP port is unreachable when troubleshooting the Syslog server.

Scope FortiGate.
Solution

Telnet protocol can be used to check TCP connectivity for IP and port but In the case of UDP Telnet cannot be used.

 

For example: If taking sniffers for Syslog connectivity in the below way.

 

diag sniffer packet any ' host x.x.x.x and port 514 ' 6 0 a 

 

It shows traffic is egressing out from the interface but does not show any reply as UDP is unreliable.

If the UDP port is customized on the Syslog server it sends ICMP code 3 'UDP port domain unreachable'.

 

Below is the partial output of the sniffer command:

 

20:07:43.057814 IP 10.30.55.254.52193 > 10.30.55.44.syslog: SYSLOG local7.notice, length: 169
20:08:27.594271 IP 10.30.55.254.52193 > 10.30.55.44.syslog: SYSLOG local7.notice, length: 109
20:08:47.054824 IP 10.30.55.44 > 10.30.55.254: ICMP 10.30.55.44 udp port domain unreachable, length 87

 

When applying the sniffer always, add the ICMP filter with the SYS log IP address and port in the below way.


diagnose sniffer packet any ' (host x.x.x.x and port 514) or (host x.x.x.x and icmp)' 6 0 a --> Where x.x.x.x is the server IP address.