Packet Flow debug

[tim_frodermann]

Hi,

not 100% sure I'm in the right forum. Anyway, I was running a debug of the packet flow because I have a problem to solve where an IP-Phone would not connect to a telephone system via tftp and over a Site 2 Site VPN.

In the debug there was a line that I don't understand:

id=20085 trace_id=251 func=__ip_session_run_tuple line=2574 msg="run helper-tftp(dir=original)"

There is something with tftp . What is happening here exactly?

The whole part looks like that:

id=20085 trace_id=251 func=print_pkt_detail line=4378 msg="vd-root received a packet(proto=17, 192.168.20.200:1024->192.168.100.101:69) from VPNtunnel. "

id=20085 trace_id=251 func=init_ip_session_common line=4527 msg="allocate a new session-002732de"

id=20085 trace_id=251 func=vf_ip4_route_input line=1596 msg="find a route: flags=00000000 gw-192.168.100.101 via dmz"

id=20085 trace_id=251 func=fw_forward_handler line=670 msg="Allowed by Policy-16:"

id=20085 trace_id=251 func=__ip_session_run_tuple line=2574 msg="run helper-tftp(dir=original)"

For clarification: "VPNtunnel" is the name of the VPN Tunnel Interface. The telephone system's network has a connection to the  Fortigate's dmz interface.

No connection is ever made and the telephone system admins say there never was a connection from the phone. I was wondering: Could it be that sme tftp service or shaper or whatever on the Fortigate is messing with the tftp connection of the phone?

What is helper-tftp?

Many thanks in advance!

Bye,

Tim

[Christopher_McMullan]

Hello Tim,

Session helpers generally assist traffic through a firewall when the protocol itself doesn't include a mechanism for dealing with security rules (ACLs, especially for inbound traffic) or address translation. This is from page 2012 of the FortiOS Handbook for OS 5.2 (available at docs.fortinet.com):

"

Trivial File Transfer Protocol (TFTP) session helper (tftp) To accept TFTP sessions you must add a security policy with service set to any or to the TFTP pre-defined service (which listens on UDP port number 69). The TFTP session helper also listens on UTP port number 69. TFTP initiates transfers on UDP port 69, but the actual data transfer ports are selected by the server and client during initialization of the connection. The tftp session helper reads the transfer ports selected by the TFTP client and server during negotiation and opens these ports on the firewall so that the TFTP data transfer can be completed. When the transfer is complete the tftp session helper closes the open ports.

"

It's likely not necessary over a VPN connection, but since the policy's service is set to TFTP or 'ALL', the helper is being applied. You can do two things: (i) change the port the session helper listens on; or (ii) delete the session helper.

config system session-helper

show //--find the helper for TFTP by ID number; in my case, it's 5; here's a snippet from my output:

edit 5 set name tftp set protocol 17 set port 69 next

So, you could change the port the helper listens on, effectively disabling it:

edit 5

set port 65535

end

Or else, you could delete the helper:

delete 5

end