Fortigate 60E blocks keepalive messages

[FedeS]

Hello,

my company has a web service that sends keepalive messages every 20seconds, the web server is out of our network, it is on Azure Cloud.

If i send keepalive from my network the messages I sent don't arrive on the server

If i send keepalive out of my network (with a notebook connected to my phone), I can see the keepalive messages on the server.

To sniff the traffic on the sever I used wireshark.

On the firewall I can't see the keppalives going through.

Thank you!

[syordanov]

Hello FedeS,

From the provided output the session is created(3 way hand shake) and we have 2 way direction traffic.

My suggestion like dingjerry_FTNT:

1) Disable the offloading on FW rule No1:

2) Run a sniffer like  on SSH1:

---

diagnose sniffer packet any " port 52076" 4 0 l

---

3) On SSH No2:

---

diag sys session filter dst XXXXX.XXXXX.XXXX.XXXX <---- destination IP/web service

diag sys session filter dport 52076<----

diag sys session list

diag sys session clear

diag sys session list

---

With point No3 you will list the session and then clear it , meanwhile SSH No1 will capture the new TCP handshake  / traffic to/from server.

If there is UTM profile on rule No1 like APP control , IPS or any other , to create a separate rule on top of the ruleset only for the affected source/destination or disable them on the rule.

Thank you!

Best regards,

Fortinet