Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
R1chou
New Contributor

Can't reach external remote server on specific port

Hello,

 

I'm trying to connect thru MSTSC to a remote server on port 3432 (I don't manage this server or the firewall)

I have a rule that's allow me to access all ports (from lan to wan)

When I use policy lookup it shows me that rule.

I tried to create a specific rule for this specific server and specific port but it doesn't change anything.

 

When I try to reach this server from my personnal connection I can connect to it.

 

How could I troubleshoot to be sure that everything is ok on my site ?

 

Regards,

3 REPLIES 3
Patel
New Contributor III

Hello,

 

Looking at what you mentioned, it looks like you are already allowing the traffic to flow through the FortiGate.

If the server is on the Internet, then please check if you have NAT enabled on the policy.

 

Furthermore, you can use the following commands to sniff the traffic on the FortiGate and confirm if the FortiGate is allowing the traffic and NATing it properly or not.

 

diagnose sniffer packet any "host <destination IP> and port 3432" 4 0 l

 

If everything looks good on the FortiGate side, then it would be a nice idea to check sniff the traffic on the destination side and see if they are receiving it or not.

 

Regards,

Kavin

 

R1chou
New Contributor

Hi Kavin,

 

Yes, Nat is enabled.

Just tried your commande, here is the result (it tried 4 times and then stopped) :

 

# diagnose sniffer packet any "host X.X.X.X and port 3432" 4 0 l
interfaces=[any]
filters=[host X.X.X.X and port 3432]
2021-06-25 08:22:58.218131 port5 in Y.Y.Y.Y.54804 -> X.X.X.X.3432: syn 3033647415
2021-06-25 08:22:58.218316 wan1 out Z.Z.Z.Z.54804 -> X.X.X.X.3432: syn 3033647415
2021-06-25 08:22:59.233239 port5 in Y.Y.Y.Y.54804 -> X.X.X.X.3432: syn 3033647415
2021-06-25 08:22:59.233278 wan1 out Z.Z.Z.Z.54804 -> X.X.X.X.3432: syn 3033647415

 

X.X.X.X = remote server

Y.Y.Y.Y = my private ip address

Z.Z.Z.Z = ours public ip address

Patel
New Contributor III

Hello,

> 2021-06-25 08:22:58.218316 wan1 out Z.Z.Z.Z.54804 -> X.X.X.X.3432: syn 3033647415

Looking at this output, it looks like the SYN packet was sent out using the correct public IP address.

I would recommend to check the traffic on the other side or with your ISP as I don't think FortiGate is causing an issue with the traffic.

 

Regards,

Kavin

Announcements

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Labels
Top Kudoed Authors