We have a Fortigate 200D running the 5.0 firmware.
When I use the Packet Capture, I notice some odd behaviour that I do not understand and wanted to know if this is normal or is there a problem.
I select the Packet Capture option via the GUI. System > Network > Packet Capture
I create a new packet capture and select my criteria. Sometimes I filter certain hosts and then start the capture.
When I attempt to generate some traffic to one of the hosts in the capture criteria, I do not see all of the packets. Particular examples include the following:
[ol]I should point out that the firewall is a termination point for an IPSEC VPN tunnel and represents the far end of the link.
In the diagram below, I'm trying to capture packets between the Remote LAN and the Fortigate 20D on an interface called "user_vlan" which represents the subnet of the Remote LAN.
<Me><Local LAN><Fortigate> <IPSEC VPN> <Fortigate 20D><Remote LAN "user_vlan">
Connectivity is all fine and working, I just don't understand why the packet capture doesn't capture ALL of the packets I expect it to.
Darren.
Solved! Go to Solution.
Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
Hello,
This is expected when you have hardware acceleration in place.......... only the initial handshake is seen, rest of the traffic is offloaded to ASIC, and does not reach the CPU. Please see the below KB
http://kb.fortinet.com/kb/microsites/search.do?cmd=displayKC&docType=kc&externalId=FD30043
http://kb.fortinet.com/kb/microsites/search.do?cmd=displayKC&docType=kc&externalId=FD36466
Regards
Hello,
This is expected when you have hardware acceleration in place.......... only the initial handshake is seen, rest of the traffic is offloaded to ASIC, and does not reach the CPU. Please see the below KB
http://kb.fortinet.com/kb/microsites/search.do?cmd=displayKC&docType=kc&externalId=FD30043
http://kb.fortinet.com/kb/microsites/search.do?cmd=displayKC&docType=kc&externalId=FD36466
Regards
Thanks for the very quick reply. I think this is probably what is happening. I will try out the commands.
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
User | Count |
---|---|
1536 | |
1029 | |
749 | |
443 | |
210 |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.