FortiGate - sessions with destination 255.255.255.255

[pmh]

Hi there!

We have some "session issues" at one of our locations. Our ISP informs us that we are generating a high amount of sessions from our FortiGate, so high that their modem is not able to keep up and effectively more or less kills off the internet access at the site. Quote: "and caused the TCP spoofer to stop working correctly due to a session count of over 4100"

According to our FortiGate at the location the session count is not extreme at all - around 800 - 1600 with a rate between 5 - 30 sessions pr. second. 

The only high-sessioner I can find is a unit producing around 40000 sessions per 24 hrs, but not much traffic. 

The destination on these sessions are 255.255.255.255 (see attached img.)

Could this be the cause of our problems? I'm not 100% sure what it means by destination 255.255.255.255 so if someone could enlighten me on that, very much thanks to you.

-PM

[Anthony_E]

Hello PM,

Thank you for using the Community Forum. I will seek to get you an answer or help. We will reply to this thread with an update as soon as possible.

Thanks,

[Irfan_FTNT]

Hi @pmh,

Thanks for using the Community Forum. '255.255.255.255' as a destination means the it is sending broadcast via UDP port 12345. 

Can you please tell us more about the source 172.29.6.10? Is it an end system/intermediate system/etc?

[pmh]

Hi, 

The 172.29.6.10 device is a multimedia server broadcasting internally on the 172.29.6.0/24 net. As far I understand how a firewall works, none of the sessions from my screen shot are passing the firewall - and on to the ISP's equipment, but as they insist that the problem is coming somewhere from this subnet, and this is the only unit producing any amount of sessions worth mentioning I thought I had to check with some who actually know what they are talking about. 

Thanks for your reply

-PM

[rosatechnocrat]

You can check the configuration of the interface. If you are sure that this broadcast traffic does not require forwarding, then you can disable forward-broadcast under the interface configuration. 

Sample configuration below. Default configuration is set broadcast-forward disable , but check if you have enabled, then please disable it. 

FW01-ROSA-DC01 (port2) # show full | grep forward
set arpforward enable
set broadcast-forward disable
set l2forward disable
set vlanforward disable
set stpforward disable
set netbios-forward disable

FW01-ROSA-DC01 (port2) #