Fortigate 60E blocks keepalive messages

[FedeS]

Hello,

my company has a web service that sends keepalive messages every 20seconds, the web server is out of our network, it is on Azure Cloud.

If i send keepalive from my network the messages I sent don't arrive on the server

If i send keepalive out of my network (with a notebook connected to my phone), I can see the keepalive messages on the server.

To sniff the traffic on the sever I used wireshark.

On the firewall I can't see the keppalives going through.

Thank you!

[syordanov]

Hello FedeS,

To narrow down the problem, first step is do do a sniffer for the keepalive messages on the FortiGate, use the sniffer bellow :

---

diagnose sniffer packet any " host x.x.x.x " 4 0 l <---- replace x.x.x.x with the IP address of web service

---

This will show is the traffic is received on FortiGate and forwarded to the ISP/WAN interface.
Additionally , you could check the session list if the session is created using the commands bellow :

---

diag sys session filter dst XXXXX.XXXXX.XXXX.XXXX <---- destination IP/web servuce

diag sys session filter dport XXX <----

diag sys session list

---

Best regards,

Fortinet

[FedeS]

Hi Syordanov and thanks for your reply!

In wireshark I see clearly when a packet is keepalive or not

Is there a way to see them clearly also on Fortigate? 

With traffic sniffer I can see psh and ack, and I suppose they are keepalive messages

Thank you!

[syordanov]

Hello FedeS,

Is this Wireshark output taken on FortiGate or clould provider?

Did you get the output from the session list? From there we can see if the session is created/allowed on FortiGate.

I think this TCP Kee-Alive is for already established session, which means that the 3 way handshake is established.

Best regards,

Fortinet

[FedeS]

Hi syordanov, the wireshark output is taken on local client 192.168.x.154 (the client that sent the keepalive messages).

The image below shows output from "session filter dst x.x.x.x" and "session list"

I modified the ip addresses, I hope it's clear anyway

Thank you!

[dingjerry_FTNT]

Hi @FedeS ,

It seems that the Keepalive packets are using port 50007 talking to the web server port 443.

So if you can see such packets in the sniffer packet capture on FGT, that means we can see them on FGT.

Since FGT 60E is NP6LITE-based, you may need to disable the "auto-asic-offload" setting in the relevant firewall policy to see packets in the outputs of the sniffer packet capture.

[FedeS]

Hi dingjerry_FTNT,

how can I see if my FGT is NP6LITE-based?

Where is the "auto-asic-offload" setting? 

Thank you!

[dingjerry_FTNT]

Hi @FedeS ,

1) "how can I see if my FGT is NP6LITE-based?"

Run this command, you will tell:

# diagnose hardware deviceinfo nic <interface_name>

For example, if you have wan1 interface:

diagnose hardware deviceinfo nic wan1

It may show something as below:

Description :FortiASIC NP6XLITE Adapter
Driver Name :FortiASIC NP6XLITE Driver

2) "Where is the "auto-asic-offload" setting? "

config firewall policy

edit <policy_ID>   // It most likely is policy ID #1 according to the output of session list you provided

set auto-asic-offload disable

end

Once you are done with the sniffer capture, enable the setting again.

[FedeS]

Hi dingjerry_FTN, below the output after the command:
"diagnose hardware deviceinfo nic wan1"  

After disablig auto-asic-offload, I still didn't see keepalive messages on the webserver.

The strange thing is that I don't even see packets blocked by the firewall.

Could I try with the debug commands?

Thank you!

[dingjerry_FTNT]

Hi @FedeS ,

Disabling ASIC offloading is NOT to fix the issue (Although it may fix the issue if the issue is due to NPU offloading).  It is to allow us to see the packets in sniffer packets capture on FGT.

So next step for you is to run the sniffer packet capture on FGT for the keepalive packets.

Do the keepalive packets use a special port?  Does it use port 52076?

If you have the port info, run the following sniffer packet capture:

diag sniffer packet any 'host x.x.x.x and port 52076' 4   //  x.x.x.x is the server IP, and you may change the port if it is using another one

If you don't know what port, run the following:

diag sniffer packet any 'host x.x.x.x and host y.y.y.y' 4  // x.x.x.x is the server IP and y.y.y.y is the client IP