FortiGate - sessions with destination 255.255.255.255
We have some "session issues" at one of our locations. Our ISP informs us that we are generating a high amount of sessions from our FortiGate, so high that their modem is not able to keep up and effectively more or less kills off the internet access at the site. Quote: "and caused the TCP spoofer to stop working correctly due to a session count of over 4100"
According to our FortiGate at the location the session count is not extreme at all - around 800 - 1600 with a rate between 5 - 30 sessions pr. second.
The only high-sessioner I can find is a unit producing around 40000 sessions per 24 hrs, but not much traffic.
The destination on these sessions are 255.255.255.255 (see attached img.)
Could this be the cause of our problems? I'm not 100% sure what it means by destination 255.255.255.255 so if someone could enlighten me on that, very much thanks to you.
The 172.29.6.10 device is a multimedia server broadcasting internally on the 172.29.6.0/24 net. As far I understand how a firewall works, none of the sessions from my screen shot are passing the firewall - and on to the ISP's equipment, but as they insist that the problem is coming somewhere from this subnet, and this is the only unit producing any amount of sessions worth mentioning I thought I had to check with some who actually know what they are talking about.
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.