Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
kalysta
New Contributor

Problem with custom services

Fortigate 100D running v5.0,build0292 (GA Patch 9)

 

I have created two custom services TCP 9100 and UDP 47808. I created two different policies one policy using each of the custom services. The firewall is blocking both of the services. The only way I can get the traffic through is to change the policy to allow all services. I even tried all allow ALL_UDP but upd/47808 was still being blocked. Currently I do have AV and IPS security profiles assigned to the policies, but I did try disabling all security services and the traffic was still being blocked. I have several other policies that are using custom services. The firmware was upgraded prior to any policies or services being created on this firewall. In other words, a firmware upgrade has not been done between the creation of the policies using custom services that are working and the creation of the policies using custom service that are not working. Any help would be greatly appreciated.

 

Below is a copy of the policies that aren't working

edit 13 set srcintf "port1" set dstintf "SSN300" set srcaddr "10.18.21.55" "172.30.128.17" "172.30.120.17" set dstaddr "10.69.1.119" "10.69.1.120" set action accept set schedule "always" set service "UDP-47808" set logtraffic all set capture-packet enable set comments "LGH\'s Siemens server to CSC panels"

 

edit 14 set srcintf "Aesynt370" set dstintf "port1" set srcaddr "Aesynt_Devices" set dstaddr "10.69.0.19" set action accept set schedule "always" set service "TCP_9100" set utm-status enable set logtraffic all set comments "Aesynt devices to printer" set av-profile "default" set ips-sensor "protect_client" set profile-protocol-options "default"

1 Solution
ashukla_FTNT
Staff
Staff

If you check the custom service from CLI do you see :0 after portrnage

 

config firewall service custom edit "TCP_9100" set tcp-portrange 9100:0

If you see portrange 9100:0 it is a problem. 

Either from cli just set tcp-portrange 9100

Of in Webui in source port start make it blank insted or 0.

View solution in original post

18 REPLIES 18
kalysta

ashukla wrote:

To find out why firewall is dropping it, run the flow level debug:

 

diag debug enable diag debug flow filter dport 9100 diag debug flow show console enable diag debug flow trace start 200

 

start the traffic and after capturing the output disable the debug

diag debug disable

 

Post the output

 

Below is the output. I don't know why its referencing Policy 0. The policy is also below. It's a different number than my previous ports because I separated out tcp/udp/9100

 

edit 18 set srcintf "Aesynt370" set dstintf "port1" set srcaddr "Aesynt_Devices" set dstaddr "10.69.0.19" set action accept set schedule "always" set service "TCP_9100" "UDP-9100" "SNMP" set utm-status enable set logtraffic all set comments "Aesynt devices to printer" set av-profile "default" set ips-sensor "protect_client" set profile-protocol-options "default" next

 

Output of debug:

 

id=13 trace_id=1 msg="vd-root received a packet(proto=6, 10.69.1.74:56278->10.69.0.19:9100) from Aesynt370. flag , seq 2906141963, ack 0, win 8192" id=13 trace_id=1 msg="allocate a new session-01467199" id=13 trace_id=1 msg="find a route: flags=00000000 gw-10.69.1.33 via port1" id=13 trace_id=1 msg="use addr/intf hash, len=4" id=13 trace_id=1 msg="Denied by forward policy check (policy 0)" id=13 trace_id=2 msg="vd-root received a packet(proto=6, 10.69.1.74:56278->10.69.0.19:9100) from Aesynt370. flag , seq 2906141963, ack 0, win 8192" id=13 trace_id=2 msg="allocate a new session-014671a7" id=13 trace_id=2 msg="find a route: flags=00000000 gw-10.69.1.33 via port1" id=13 trace_id=2 msg="use addr/intf hash, len=4" id=13 trace_id=2 msg="Denied by forward policy check (policy 0)" id=13 trace_id=3 msg="vd-root received a packet(proto=6, 10.69.1.74:56278->10.69.0.19:9100) from Aesynt370. flag , seq 2906141963, ack 0, win 8192" id=13 trace_id=3 msg="allocate a new session-014671be" id=13 trace_id=3 msg="find a route: flags=00000000 gw-10.69.1.33 via port1" id=13 trace_id=3 msg="use addr/intf hash, len=4" id=13 trace_id=3 msg="Denied by forward policy check (policy 0)" id=13 trace_id=4 msg="vd-root received a packet(proto=6, 10.69.1.74:56283->10.69.0.19:9100) from Aesynt370. flag , seq 3562697345, ack 0, win 8192" id=13 trace_id=4 msg="allocate a new session-014671ef" id=13 trace_id=4 msg="find a route: flags=00000000 gw-10.69.1.33 via port1" id=13 trace_id=4 msg="use addr/intf hash, len=4" id=13 trace_id=4 msg="Denied by forward policy check (policy 0)" id=13 trace_id=5 msg="vd-root received a packet(proto=6, 10.69.1.74:56283->10.69.0.19:9100) from Aesynt370. flag , seq 3562697345, ack 0, win 8192" id=13 trace_id=5 msg="allocate a new session-014671f7" id=13 trace_id=5 msg="find a route: flags=00000000 gw-10.69.1.33 via port1" id=13 trace_id=5 msg="use addr/intf hash, len=4" id=13 trace_id=5 msg="Denied by forward policy check (policy 0)" id=13 trace_id=6 msg="vd-root received a packet(proto=6, 10.69.1.74:56283->10.69.0.19:9100) from Aesynt370. flag , seq 3562697345, ack 0, win 8192" id=13 trace_id=6 msg="allocate a new session-0146723b" id=13 trace_id=6 msg="find a route: flags=00000000 gw-10.69.1.33 via port1" id=13 trace_id=6 msg="use addr/intf hash, len=4" id=13 trace_id=6 msg="Denied by forward policy check (policy 0)" id=13 trace_id=7 msg="vd-root received a packet(proto=6, 10.69.1.74:56288->10.69.0.19:9100) from Aesynt370. flag , seq 2330396767, ack 0, win 8192" id=13 trace_id=7 msg="allocate a new session-01467265" id=13 trace_id=7 msg="find a route: flags=00000000 gw-10.69.1.33 via port1" id=13 trace_id=7 msg="use addr/intf hash, len=4" id=13 trace_id=7 msg="Denied by forward policy check (policy 0)" id=13 trace_id=8 msg="vd-root received a packet(proto=6, 10.69.1.74:56288->10.69.0.19:9100) from Aesynt370. flag , seq 2330396767, ack 0, win 8192" id=13 trace_id=8 msg="allocate a new session-0146726a" id=13 trace_id=8 msg="find a route: flags=00000000 gw-10.69.1.33 via port1" id=13 trace_id=8 msg="use addr/intf hash, len=4" id=13 trace_id=8 msg="Denied by forward policy check (policy 0)" id=13 trace_id=9 msg="vd-root received a packet(proto=6, 10.69.1.74:56288->10.69.0.19:9100) from Aesynt370. flag , seq 2330396767, ack 0, win 8192" id=13 trace_id=9 msg="allocate a new session-0146727c" id=13 trace_id=9 msg="find a route: flags=00000000 gw-10.69.1.33 via port1" id=13 trace_id=9 msg="use addr/intf hash, len=4" id=13 trace_id=9 msg="Denied by forward policy check (policy 0)" id=13 trace_id=10 msg="vd-root received a packet(proto=6, 10.69.1.74:56294->10.69.0.19:9100) from Aesynt370. flag , seq 3413926227, ack 0, win 8192" id=13 trace_id=10 msg="allocate a new session-014672da" id=13 trace_id=10 msg="find a route: flags=00000000 gw-10.69.1.33 via port1" id=13 trace_id=10 msg="use addr/intf hash, len=4" id=13 trace_id=10 msg="Denied by forward policy check (policy 0)" id=13 trace_id=11 msg="vd-root received a packet(proto=6, 10.69.1.74:56294->10.69.0.19:9100) from Aesynt370. flag , seq 3413926227, ack 0, win 8192" id=13 trace_id=11 msg="allocate a new session-014672e0" id=13 trace_id=11 msg="find a route: flags=00000000 gw-10.69.1.33 via port1" id=13 trace_id=11 msg="use addr/intf hash, len=4" id=13 trace_id=11 msg="Denied by forward policy check (policy 0)" id=13 trace_id=12 msg="vd-root received a packet(proto=6, 10.69.1.74:56294->10.69.0.19:9100) from Aesynt370. flag , seq 3413926227, ack 0, win 8192" id=13 trace_id=12 msg="allocate a new session-014672f2" id=13 trace_id=12 msg="find a route: flags=00000000 gw-10.69.1.33 via port1" id=13 trace_id=12 msg="use addr/intf hash, len=4" id=13 trace_id=12 msg="Denied by forward policy check (policy 0)" id=13 trace_id=13 msg="vd-root received a packet(proto=6, 10.69.1.74:56300->10.69.0.19:9100) from Aesynt370. flag , seq 1097075618, ack 0, win 8192" id=13 trace_id=13 msg="allocate a new session-01467330" id=13 trace_id=13 msg="find a route: flags=00000000 gw-10.69.1.33 via port1" id=13 trace_id=13 msg="use addr/intf hash, len=4" id=13 trace_id=13 msg="Denied by forward policy check (policy 0)" id=13 trace_id=14 msg="vd-root received a packet(proto=6, 10.69.1.74:56300->10.69.0.19:9100) from Aesynt370. flag , seq 1097075618, ack 0, win 8192" id=13 trace_id=14 msg="allocate a new session-01467339" id=13 trace_id=14 msg="find a route: flags=00000000 gw-10.69.1.33 via port1" id=13 trace_id=14 msg="use addr/intf hash, len=4" id=13 trace_id=14 msg="Denied by forward policy check (policy 0)"

ashukla_FTNT
Staff
Staff

If you check the custom service from CLI do you see :0 after portrnage

 

config firewall service custom edit "TCP_9100" set tcp-portrange 9100:0

If you see portrange 9100:0 it is a problem. 

Either from cli just set tcp-portrange 9100

Of in Webui in source port start make it blank insted or 0.

rwpatterson
Valued Contributor III

ashukla wrote:

If you check the custom service from CLI do you see :0 after portrnage

 

config firewall service custom edit "TCP_9100" set tcp-portrange 9100:0

If you see portrange 9100:0 it is a problem. 

Either from cli just set tcp-portrange 9100

Of in Webui in source port start make it blank insted or 0.

Is this correct?

Bob - self proclaimed posting junkie!
See my Fortigate related scripts at: http://fortigate.camerabob.com

Bob - self proclaimed posting junkie!See my Fortigate related scripts at: http://fortigate.camerabob.com
ashukla_FTNT

rwpatterson wrote:

ashukla wrote:

If you check the custom service from CLI do you see :0 after portrnage

 

config firewall service custom edit "TCP_9100" set tcp-portrange 9100:0

If you see portrange 9100:0 it is a problem. 

Either from cli just set tcp-portrange 9100

Of in Webui in source port start make it blank insted or 0.

Is this correct?

Yes it is right. If source port start range is left to 0 it will show up as 9100:0 which causes the problem. It should be 1.

In future releases we will not see the option for source port at all as are hardly anyone restricting the source port.

rwpatterson
Valued Contributor III

OK

 

Thank you

Bob - self proclaimed posting junkie!
See my Fortigate related scripts at: http://fortigate.camerabob.com

Bob - self proclaimed posting junkie!See my Fortigate related scripts at: http://fortigate.camerabob.com
jb_kalm

ashukla wrote:

 

Yes it is right. If source port start range is left to 0 it will show up as 9100:0 which causes the problem. It should be 1.

In future releases we will not see the option for source port at all as are hardly anyone restricting the source port.

@ashukla - Will it remain an option in the CLI at least? It seems we actually make use of the source port range in some of our custom services.

 

Thanks,

 

jb

kalysta

ashukla wrote:

If you check the custom service from CLI do you see :0 after portrnage

 

config firewall service custom edit "TCP_9100" set tcp-portrange 9100:0

If you see portrange 9100:0 it is a problem. 

Either from cli just set tcp-portrange 9100

Of in Webui in source port start make it blank insted or 0.

That was the problem! Thank you so much!

ede_pfau
Esteemed Contributor III

This is how is should look like in the WebGUI.


Ede

"Kernel panic: Aiee, killing interrupt handler!"
Ede"Kernel panic: Aiee, killing interrupt handler!"
Jan_Scholten
Contributor

The problem with custom services is fixed in 5.0.10

0250556 When creating a new custom service, the low source port initial value is incorrect

Labels
Top Kudoed Authors