FG200A I Don't see traffic flowing when doing a diag sniffer packet on interface wan1

[heskez]

Hi there, 

When i execute a "diag sniffer packet wan1" I don't see any traffic. 

wan1 is in a separate Vdom. 

Communication is working and the firewall rule has log option activated. 

The FW is an oldie FG200A. What's wrong here?

Best r,

E

[emnoc]

The cli command diag debug flow with the filters applied would be your starting point. Maybe the traffic is drop before hitting wan1 ( uRPF, deny-action,etc...)

[heskez]

Thanks, Executed without filters I do see some "general traffic" something what I wouldn't expect within this Vdom. But I don't see the traffic I'd like to see. 

[emnoc]

Than your host is not hitting the firewall. You can bypass the firewall if your traffic is allowed or deny would result in a match in  trace.

I would do it again & with filters  for either src dst address or port and re-evaluate.

Ken

[heskez]

Thanks Ken, I've tried your suggestion. However, even with filters I'm not able to discover the hosts I'm looking for neither the traffic. I've also looked into the Fortianalyzer and shows me the same results. So no traffic and no hosts I'm looking for. A Thing I forgot to mention, I'm looking for VOICE traffic.

"I was able to see the VOICE traffic before"

Best,

E

[emnoc]

1>

The diag sniffer packet,  shows  no traffic

2>

The diag debug flow, shows no traffic

That means that traffic is NOT going thru your fortigate.What does a trace route show between the 2 hosts involved?

Are the two hosts involved on  the same local subnet ?

Ken

[heskez]

Hi Ken, 

1> and 2> yes and yes. Although I agree with your opinion traffic is not hitting the firewall in theory, I'm confused.

Why? People are calling :) The ip softphones are physically connected via a switch to the firewall. Scary isn't it?

Best,

E