Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
pmh
New Contributor III

FortiGate - sessions with destination 255.255.255.255

Hi there!

 

We have some "session issues" at one of our locations. Our ISP informs us that we are generating a high amount of sessions from our FortiGate, so high that their modem is not able to keep up and effectively more or less kills off the internet access at the site. Quote: "and caused the TCP spoofer to stop working correctly due to a session count of over 4100"

 

According to our FortiGate at the location the session count is not extreme at all - around 800 - 1600 with a rate between 5 - 30 sessions pr. second. 

 

The only high-sessioner I can find is a unit producing around 40000 sessions per 24 hrs, but not much traffic. 

 

The destination on these sessions are 255.255.255.255 (see attached img.)

 

image.png

 

Could this be the cause of our problems? I'm not 100% sure what it means by destination 255.255.255.255 so if someone could enlighten me on that, very much thanks to you.

 

-PM

4 REPLIES 4
Anthony_E
Community Manager
Community Manager

Hello PM,


Thank you for using the Community Forum. I will seek to get you an answer or help. We will reply to this thread with an update as soon as possible.


Thanks,

Anthony-Fortinet Community Team.
Irfan_FTNT
Staff
Staff

Hi @pmh,

Thanks for using the Community Forum. '255.255.255.255' as a destination means the it is sending broadcast via UDP port 12345. 

Can you please tell us more about the source 172.29.6.10? Is it an end system/intermediate system/etc?

Thanks,
Irfan
pmh
New Contributor III

Hi, 

The 172.29.6.10 device is a multimedia server broadcasting internally on the 172.29.6.0/24 net. As far I understand how a firewall works, none of the sessions from my screen shot are passing the firewall - and on to the ISP's equipment, but as they insist that the problem is coming somewhere from this subnet, and this is the only unit producing any amount of sessions worth mentioning I thought I had to check with some who actually know what they are talking about. 

 

Thanks for your reply

 

-PM

rosatechnocrat
Contributor II

You can check the configuration of the interface. If you are sure that this broadcast traffic does not require forwarding, then you can disable forward-broadcast under the interface configuration. 

 

 

Sample configuration below. Default configuration is set broadcast-forward disable , but check if you have enabled, then please disable it. 

 

 

FW01-ROSA-DC01 (port2) # show full | grep forward
set arpforward enable
set broadcast-forward disable
set l2forward disable
set vlanforward disable
set stpforward disable
set netbios-forward disable

FW01-ROSA-DC01 (port2) #

 

Rosa Technocrat -- Also on YouTube---Please do Subscribe
Rosa Technocrat -- Also on YouTube---Please do Subscribe
Labels
Top Kudoed Authors