I have a list of < 300 IP numbers that I know about. We're not using DHCP, so there should be no addresses outside of those 300. I am really curious if there is any traffic going to IP numbers that I don't know about. If there is it could indicate something that is broken, or a hacker trying to discover something. This is obviously would work only on internal ports.
Any ideas?
Solved! Go to Solution.
Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
You can create an Address Group with all the known IPs you have in your subnet and create two firewall polices. On the first firewall policy allow access by specifying this group as Source. Clone the same rule and put it below and this time allow all the IP range for that subnet. On the second firewall policy enable "Log Allowed Traffic: All Sessions". This way you can verify if the second policy is used by any other IP (outside of the address group) and what traffic are they generating.
Hi tumming,
Could you please let me know if IP numbers means Protocol numbers ?
Sniffer command has options which are mentioned in the below link
https://docs.fortinet.com/document/fortigate/6.2.15/cookbook/680228/performing-a-sniffer-trace-cli-a...
Please let me know if you have any additional queries.
Regards
Nagaraju.
No, I meant IP addresses. We call them IP numbers here. I had already rtfm'd and could not find an answer, hence my posting here.
tom
You can create an Address Group with all the known IPs you have in your subnet and create two firewall polices. On the first firewall policy allow access by specifying this group as Source. Clone the same rule and put it below and this time allow all the IP range for that subnet. On the second firewall policy enable "Log Allowed Traffic: All Sessions". This way you can verify if the second policy is used by any other IP (outside of the address group) and what traffic are they generating.
Yes! This looks like what I'm asking for. I already know how to create address groups from the command line, and I can write a simple script to automate creating the command. Then just cut'n paste into the cli. Easy peasy!
I'm going to run this by some other folks here first. If I mess up, I could break things badly.
Thanks for the answer, and actually reading the question! :)
tom
Hi @tumming,
Do you mean IP address? If that, you can try this command "diag sniffer packet any "host X.X.X.X" 4 0 l" (replace X.X.X.X with your desired IP).
Regards,
Minh
That would work for an individual IP address. What I need is something like "diag sniffer packet not "long list of ip addresses"..
Hi @tumming,
You can sniff any IP addresses. Please refer to https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-Packet-Capture-on-FortiOS-GUI/ta-p/1...
Regards,
I have almost 300 IP addresses. That solution would only work for onesies twosies.
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
User | Count |
---|---|
1710 | |
1093 | |
752 | |
447 | |
231 |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.