Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
fortinetforumfiokom
New Contributor II

Fortigate send UDP 8014 packets on WAN interface even though the security fabric is not enabled

Hi!

I have a public IPV4 pool. I use 3 independent vdoms with 1-1 public IP on their WAN interface. I just noticed that the fortigate regulary sending UDP 8014 packets from each WAN interface to the broadcast adress of the IP pool. On the WAN interfaces only ping is enabled for admin access.    

 

PakcetCapture.png

 

If it is not enabled, why is it sending these packets? Is this a bug or a "hidden" feature?

 

Device: FortiGate201F

Firmware: v7.4.3 build2573 

Thank you.

1 Solution
smaruvala

Hi, 

 

For testing purpose can you run the below mentioned command and verify? 

 

FortiGate-VM64 # config system csf
FortiGate-VM64 (csf) # set log-unification disable
FortiGate-VM64 (csf) # next
FortiGate-VM64 (csf) # end

 

Regards,

Shiva

 

View solution in original post

7 REPLIES 7
smaruvala
Staff
Staff

Hi,

 

- Can you provide the output of the "diagnose test application csfd 1" and "show full-configuration system csf"? 

 

Regards,

Shiva

fortinetforumfiokom

Here there are:

 

FG201F (global) # show full-configuration system csf

config system csf
set status enable
set uid "9834...77e716"
set upstream ''
set upstream-port 8013
set group-name "UTIBER_FABRIC"
set group-password ENC ICq66bfHYo...4L6ujJxzt7uw==
set accept-auth-by-cert enable
set log-unification enable
set authorization-request-type serial
set fabric-workers 2
set downstream-access disable
set configuration-sync local
set fabric-object-unification local
config trusted-list
edit "FEVM010000086520"
set authorization-type certificate
set certificate "-----BEGIN CERTIFICATE-----
MIIDwjCCAqqgAwI...MlToysP
-----END CERTIFICATE-----
"
set action accept
set index 1
next
end
set forticloud-account-enforcement enable
set file-mgmt enable
set file-quota 0
set file-quota-warning 90
end

FG201F (global) #

 

FG201F (global) # diagnose test application csfd 1

Dump CSF daemon info
group name: UTIBER_FABRIC
group pwd: *
status: Active
accept auth by cert: y
forticloud account enforcement: y

Upstream info
N/A

Downstream info
device total: 1

# 1
sn: FEVM010000086520
id: 61
ip: 192.168.50.128
port: 38994
status: link-ok SSL-ok hello-ok auth-ok
no response: 0
SLBC member: n

 

 

smaruvala

Hi, 

 

For testing purpose can you run the below mentioned command and verify? 

 

FortiGate-VM64 # config system csf
FortiGate-VM64 (csf) # set log-unification disable
FortiGate-VM64 (csf) # next
FortiGate-VM64 (csf) # end

 

Regards,

Shiva

 

fortinetforumfiokom

HI, 

After changing log-unification to disable state the UDP 8014 brodacasts have been stopped on the WAN side. 

I tried to see what log-unification is for, but i do not understand it. Quickly found only this: log-unification.png

 

What is this for?

What it means:  "broadcast of discovery messages for log unification"?

If I "disable" it won't work on the LAN side either? What do I lose if I disable it? On the WAN side, what is the point of broadcasting any messages?

 

Regards,

Zoltán

smaruvala

Hi,

 

The feature is designed to broadcast on every interface to find neighboring fabric members so that the MAC addresses can be learned and logging can be unified.
You have the command "set configuration-sync local". Hence this feature is not required.

 

Regards,

Shiva

saneeshpv_FTNT

Hi @fortinetforumfiokom ,

 

The UDP port 8014 traffic is by default allowed in your FortiGate Local In Policy and this is an open Fortigate Incoming Port for the Security Fabric connection. 

 

Refer to this article 

https://docs.fortinet.com/document/fortigate/6.4.0/ports-and-protocols/303168/fortigate-open-ports

 

Enabling/Disabling Service on the interface will not have any effect on this traffic.

 

Best Regards,

Saneesh

fortinetforumfiokom

Hi @saneeshpv_FTNT!

 

I think this is not a local in  problem but a local out problem. What is the point of fortigate sending a security fabric broadcast message on the WAN side for whatever reason? 

 

Regards,

Zoltán

Announcements

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Labels
Top Kudoed Authors