Packet Flow - Application Layer

[EDYInfras]

Hey All.

We wanted to change our ZyXel Firewall with a FortiGate 100E, but had/have problems with our software which blocked our change. Maybe some of you can help is with debugging.

Our problem is following.

We have a webserver in our dmz which connects on tcp port 2000 on our application server in our lan.

Our policies allow all traffic from the dmz to lan and back, we have no AV profiles attached to these policies, but wenn our webserver connects to the application server, the connection and session will be dropped after a few seconds.

The servers can ping each other and we can make file transfer via smb/cifs without any troubles.

We debugged the flow and it seems that the packets are going through the AV and into the application layer inside the firewall, but we cannot trace these layer, because of missing skills from us.

Here are our configs and logs, maybe some of you might know how to debug further.

xx.xx.195.103 -> our webserver in the dmz with vlan id 2

xx.xx.95.103 -> our application server in our lan

Debug Flow:

id=20085 trace_id=428 func=print_pkt_detail line=4793 msg="vd-root received a packet(proto=6, xx.xx.195.103:49600->xx.xx.95.103:2000) from VLAN2. flag , seq 1049650250, ack 0, win 8192"
id=20085 trace_id=428 func=init_ip_session_common line=4944 msg="allocate a new session-002602ae"
id=20085 trace_id=428 func=vf_ip_route_input_common line=2586 msg="find a route: flag=04000000 gw-xx.xx.95.103 via lan"
id=20085 trace_id=428 func=fw_forward_handler line=697 msg="Allowed by Policy-82: AV"
id=20085 trace_id=428 func=av_receive line=265 msg="send to application layer"
id=20085 trace_id=429 func=print_pkt_detail line=4793 msg="vd-root received a packet(proto=6, xx.xx.195.103:49600->xx.xx.95.103:2000) from VLAN2. flag [.], seq 1049650251, ack 3290055479, win 4106"
id=20085 trace_id=429 func=resolve_ip_tuple_fast line=4857 msg="Find an existing session, id-002602ae, original direction"
id=20085 trace_id=429 func=npu_handle_session44 line=1028 msg="Trying to offloading session from VLAN2 to lan, skb.npu_flag=00000000 ses.state=00110306 ses.npu_state=0x00000000"
id=20085 trace_id=429 func=av_receive line=265 msg="send to application layer"
id=20085 trace_id=430 func=print_pkt_detail line=4793 msg="vd-root received a packet(proto=6, xx.xx.195.103:49600->xx.xx.95.103:2000) from local. flag , seq 1434555326, ack 0, win 14600"
id=20085 trace_id=430 func=resolve_ip_tuple_fast line=4857 msg="Find an existing session, id-002602ae, original direction"
id=20085 trace_id=431 func=print_pkt_detail line=4793 msg="vd-root received a packet(proto=6, xx.xx.195.103:49600->xx.xx.95.103:2000) from VLAN2. flag [.], seq 1049650251, ack 3290055479, win 4106"
id=20085 trace_id=431 func=resolve_ip_tuple_fast line=4857 msg="Find an existing session, id-002602ae, original direction"
id=20085 trace_id=431 func=npu_handle_session44 line=1028 msg="Trying to offloading session from VLAN2 to lan, skb.npu_flag=00000000 ses.state=00110306 ses.npu_state=0x00000000"
id=20085 trace_id=431 func=av_receive line=265 msg="send to application layer"

Policy 82: DMZ-> LAN

config firewall policy
    edit 82
        set uuid eb8c4db0-1199-51e7-9a44-f4b22f4a3b2c
        set srcintf "VLAN2"
        set dstintf "lan"
        set srcaddr "all"
        set dstaddr "all"
        set action accept
        set schedule "always"
        set service "ALL"
        set logtraffic all
    next
end

Policy 76: LAN -> DMZ

config firewall policy
    edit 76
        set uuid c650f470-1076-51e7-4b71-ab53cdb8e7ea
        set srcintf "lan"
        set dstintf "VLAN2"
        set srcaddr "all"
        set dstaddr "all"
        set action accept
        set schedule "always"
        set service "ALL"
        set utm-status enable
        set logtraffic all
    next
end

[kilrathi]

I realize this is a 1yr old post but this fit a problem we were having exactly.  I figured it out so i wanted to post my results here.  

We're running a Fortigate 60E with v5.4

Here's the command I ran in order to make the firewall stop running packets through the application layer even though i had all the application layer stuff turned off.

----

config system settings

set sip-helper disable set sip-nat-trace disable set default-voip-alg-mode kernel-helper-based

end

config system session-helper

show

#I found the session for voip and deleted it.  (Mine was #13)

delete 13

end

config voip profile edit default config sip set status disable end end

execute reboot

----

After my system came back up my debugging no longer shows packets being "send to application layer".

I found pieces of this information throughout google searches, but the most useful website was this one:

https://www.3cx.com/community/threads/fortigate-sip-alg-disable-steps-5-2-firmware-and-above.47694/

Hope this helps someone.