Live monitoring question

[Advntrhike]

Good morning all!

I'm looking for a way to perform live monitoring on our 100e box.  What I am looking to do is determine what traffic (ports, destination IP, status, etc.) is being generated by a specific IP in real time. Example:

Phone traffic generated by a single phone, IP address 192.X.X.X.  Pull up the monitor, filter by that IP address, and then plug the phone in and watch what traffic pops up.

I am looking to isolate the VoIP traffic to a single policy and vlan, but our phones are being picked up as different applications.  IE SIP for some, UDP/XXXX for others, and RingCentral for others.

Any thoughts on how to do this with a 100e?

Thanks!

[packetpusher]

With most fortigates you can do packet sniffing as follows: 

di sniff packet any "host A and host B" 

For details, ref. http://kb.fortinet.com/kb/viewContent.do?externalId=11186

Also, in your case you can perform a packet capture as follows:

Go to System > Network > Packet Capture. For details ref. http://cookbook.fortinet.com/packet-capture/

Finally, you can see the traffic in FortiView, Logs, FortiCloud, and etc.

[emnoc]

You can  enable logging on  the fwpolicy

You can use cli  diag sniffer packet  , but keep in mind traffic that's off_loaded might not display in the  capture

[Advntrhike]

Good morning and thank you for the replies!

The recommendations come close to what I am looking for, but I am either missing something or I'm not interpreting the data correctly.  I'm expecting to be able to see the traffic that is blocked, or if traffic is going to a port that is not currently open rather than just the traffic that is flowing.

Example:  Configuring a physical desk phone for RingCentral

If the firewall is configured for 'any any' then the phone will be provisioned and everything works correctly. 

If the firewall is configured with a VoIP policy limiting the source address to only the phones IP address range and the recommended ports from RingCentral, the phone will hit the provisioning server on RingCentral's side, but the line will never register.

VoIP policy is first with RingCentral's recommended settings: https://success.ringcentral.com/articles/RC_Knowledge_Article/9233

Internet policy is second with DNS, HTTP, and HTTPS as recommend in the cookbook: http://cookbook.fortinet.com/creating-security-policies/

Deny all policy is third.

As this is the only device currently on this network (new configuration) I can easily flip between the two and see the phone pick up the line or drop the line, but I'm not seeing where the traffic is being blocked when comparing the two sessions.  What I can't figure out is what traffic is different between the dedicated VoIP/Internet policies and the "Allow anything at all times crap I don't know what I'm doing so I'll open everything and pray" policy.

I hate to admit it, but I prefer WatchGuard's Traffic Monitor.  Red, blue, green is much easier to pick out the problem areas.....

[emnoc]

Hmm,  can't you just span the traffic at the  device and see the differences?  Also if this SIP or just pure VoIP , I would 1st review with  protocol and ports are using  ( static or dynamic  ) and then monitor those and any differences

e.g

Does the SIP device initialize on 5060 or 5061 ?  tcp or udp ? Voice bearer channels what dynamic port range doe the traffic run in? What if any fallback ?

Stuff like that,  than you can  further drill in  and run detail analysis once you know who it works ( i.e before you place it behind the firewall )

And lastly, within in VoIP policy at the client ( hard or soft ) , can you hardcode most parameters and not rely on dynamic?

just my 2ct thoughts.

Ken