Problem with custom services

[kalysta]

Fortigate 100D running v5.0,build0292 (GA Patch 9)

I have created two custom services TCP 9100 and UDP 47808. I created two different policies one policy using each of the custom services. The firewall is blocking both of the services. The only way I can get the traffic through is to change the policy to allow all services. I even tried all allow ALL_UDP but upd/47808 was still being blocked. Currently I do have AV and IPS security profiles assigned to the policies, but I did try disabling all security services and the traffic was still being blocked. I have several other policies that are using custom services. The firmware was upgraded prior to any policies or services being created on this firewall. In other words, a firmware upgrade has not been done between the creation of the policies using custom services that are working and the creation of the policies using custom service that are not working. Any help would be greatly appreciated.

Below is a copy of the policies that aren't working

edit 13 set srcintf "port1" set dstintf "SSN300" set srcaddr "10.18.21.55" "172.30.128.17" "172.30.120.17" set dstaddr "10.69.1.119" "10.69.1.120" set action accept set schedule "always" set service "UDP-47808" set logtraffic all set capture-packet enable set comments "LGH\'s Siemens server to CSC panels"

edit 14 set srcintf "Aesynt370" set dstintf "port1" set srcaddr "Aesynt_Devices" set dstaddr "10.69.0.19" set action accept set schedule "always" set service "TCP_9100" set utm-status enable set logtraffic all set comments "Aesynt devices to printer" set av-profile "default" set ips-sensor "protect_client" set profile-protocol-options "default"

[kalysta]

ashukla wrote:

To find out why firewall is dropping it, run the flow level debug:

diag debug enable diag debug flow filter dport 9100 diag debug flow show console enable diag debug flow trace start 200

start the traffic and after capturing the output disable the debug

diag debug disable

Post the output

Below is the output. I don't know why its referencing Policy 0. The policy is also below. It's a different number than my previous ports because I separated out tcp/udp/9100

edit 18 set srcintf "Aesynt370" set dstintf "port1" set srcaddr "Aesynt_Devices" set dstaddr "10.69.0.19" set action accept set schedule "always" set service "TCP_9100" "UDP-9100" "SNMP" set utm-status enable set logtraffic all set comments "Aesynt devices to printer" set av-profile "default" set ips-sensor "protect_client" set profile-protocol-options "default" next

Output of debug:

id=13 trace_id=1 msg="vd-root received a packet(proto=6, 10.69.1.74:56278->10.69.0.19:9100) from Aesynt370. flag , seq 2906141963, ack 0, win 8192" id=13 trace_id=1 msg="allocate a new session-01467199" id=13 trace_id=1 msg="find a route: flags=00000000 gw-10.69.1.33 via port1" id=13 trace_id=1 msg="use addr/intf hash, len=4" id=13 trace_id=1 msg="Denied by forward policy check (policy 0)" id=13 trace_id=2 msg="vd-root received a packet(proto=6, 10.69.1.74:56278->10.69.0.19:9100) from Aesynt370. flag , seq 2906141963, ack 0, win 8192" id=13 trace_id=2 msg="allocate a new session-014671a7" id=13 trace_id=2 msg="find a route: flags=00000000 gw-10.69.1.33 via port1" id=13 trace_id=2 msg="use addr/intf hash, len=4" id=13 trace_id=2 msg="Denied by forward policy check (policy 0)" id=13 trace_id=3 msg="vd-root received a packet(proto=6, 10.69.1.74:56278->10.69.0.19:9100) from Aesynt370. flag , seq 2906141963, ack 0, win 8192" id=13 trace_id=3 msg="allocate a new session-014671be" id=13 trace_id=3 msg="find a route: flags=00000000 gw-10.69.1.33 via port1" id=13 trace_id=3 msg="use addr/intf hash, len=4" id=13 trace_id=3 msg="Denied by forward policy check (policy 0)" id=13 trace_id=4 msg="vd-root received a packet(proto=6, 10.69.1.74:56283->10.69.0.19:9100) from Aesynt370. flag , seq 3562697345, ack 0, win 8192" id=13 trace_id=4 msg="allocate a new session-014671ef" id=13 trace_id=4 msg="find a route: flags=00000000 gw-10.69.1.33 via port1" id=13 trace_id=4 msg="use addr/intf hash, len=4" id=13 trace_id=4 msg="Denied by forward policy check (policy 0)" id=13 trace_id=5 msg="vd-root received a packet(proto=6, 10.69.1.74:56283->10.69.0.19:9100) from Aesynt370. flag , seq 3562697345, ack 0, win 8192" id=13 trace_id=5 msg="allocate a new session-014671f7" id=13 trace_id=5 msg="find a route: flags=00000000 gw-10.69.1.33 via port1" id=13 trace_id=5 msg="use addr/intf hash, len=4" id=13 trace_id=5 msg="Denied by forward policy check (policy 0)" id=13 trace_id=6 msg="vd-root received a packet(proto=6, 10.69.1.74:56283->10.69.0.19:9100) from Aesynt370. flag , seq 3562697345, ack 0, win 8192" id=13 trace_id=6 msg="allocate a new session-0146723b" id=13 trace_id=6 msg="find a route: flags=00000000 gw-10.69.1.33 via port1" id=13 trace_id=6 msg="use addr/intf hash, len=4" id=13 trace_id=6 msg="Denied by forward policy check (policy 0)" id=13 trace_id=7 msg="vd-root received a packet(proto=6, 10.69.1.74:56288->10.69.0.19:9100) from Aesynt370. flag , seq 2330396767, ack 0, win 8192" id=13 trace_id=7 msg="allocate a new session-01467265" id=13 trace_id=7 msg="find a route: flags=00000000 gw-10.69.1.33 via port1" id=13 trace_id=7 msg="use addr/intf hash, len=4" id=13 trace_id=7 msg="Denied by forward policy check (policy 0)" id=13 trace_id=8 msg="vd-root received a packet(proto=6, 10.69.1.74:56288->10.69.0.19:9100) from Aesynt370. flag , seq 2330396767, ack 0, win 8192" id=13 trace_id=8 msg="allocate a new session-0146726a" id=13 trace_id=8 msg="find a route: flags=00000000 gw-10.69.1.33 via port1" id=13 trace_id=8 msg="use addr/intf hash, len=4" id=13 trace_id=8 msg="Denied by forward policy check (policy 0)" id=13 trace_id=9 msg="vd-root received a packet(proto=6, 10.69.1.74:56288->10.69.0.19:9100) from Aesynt370. flag , seq 2330396767, ack 0, win 8192" id=13 trace_id=9 msg="allocate a new session-0146727c" id=13 trace_id=9 msg="find a route: flags=00000000 gw-10.69.1.33 via port1" id=13 trace_id=9 msg="use addr/intf hash, len=4" id=13 trace_id=9 msg="Denied by forward policy check (policy 0)" id=13 trace_id=10 msg="vd-root received a packet(proto=6, 10.69.1.74:56294->10.69.0.19:9100) from Aesynt370. flag , seq 3413926227, ack 0, win 8192" id=13 trace_id=10 msg="allocate a new session-014672da" id=13 trace_id=10 msg="find a route: flags=00000000 gw-10.69.1.33 via port1" id=13 trace_id=10 msg="use addr/intf hash, len=4" id=13 trace_id=10 msg="Denied by forward policy check (policy 0)" id=13 trace_id=11 msg="vd-root received a packet(proto=6, 10.69.1.74:56294->10.69.0.19:9100) from Aesynt370. flag , seq 3413926227, ack 0, win 8192" id=13 trace_id=11 msg="allocate a new session-014672e0" id=13 trace_id=11 msg="find a route: flags=00000000 gw-10.69.1.33 via port1" id=13 trace_id=11 msg="use addr/intf hash, len=4" id=13 trace_id=11 msg="Denied by forward policy check (policy 0)" id=13 trace_id=12 msg="vd-root received a packet(proto=6, 10.69.1.74:56294->10.69.0.19:9100) from Aesynt370. flag , seq 3413926227, ack 0, win 8192" id=13 trace_id=12 msg="allocate a new session-014672f2" id=13 trace_id=12 msg="find a route: flags=00000000 gw-10.69.1.33 via port1" id=13 trace_id=12 msg="use addr/intf hash, len=4" id=13 trace_id=12 msg="Denied by forward policy check (policy 0)" id=13 trace_id=13 msg="vd-root received a packet(proto=6, 10.69.1.74:56300->10.69.0.19:9100) from Aesynt370. flag , seq 1097075618, ack 0, win 8192" id=13 trace_id=13 msg="allocate a new session-01467330" id=13 trace_id=13 msg="find a route: flags=00000000 gw-10.69.1.33 via port1" id=13 trace_id=13 msg="use addr/intf hash, len=4" id=13 trace_id=13 msg="Denied by forward policy check (policy 0)" id=13 trace_id=14 msg="vd-root received a packet(proto=6, 10.69.1.74:56300->10.69.0.19:9100) from Aesynt370. flag , seq 1097075618, ack 0, win 8192" id=13 trace_id=14 msg="allocate a new session-01467339" id=13 trace_id=14 msg="find a route: flags=00000000 gw-10.69.1.33 via port1" id=13 trace_id=14 msg="use addr/intf hash, len=4" id=13 trace_id=14 msg="Denied by forward policy check (policy 0)"

[ashukla_FTNT · Accepted solution]

If you check the custom service from CLI do you see :0 after portrnage

config firewall service custom edit "TCP_9100" set tcp-portrange 9100:0

If you see portrange 9100:0 it is a problem. 

Either from cli just set tcp-portrange 9100

Of in Webui in source port start make it blank insted or 0.

[rwpatterson]

ashukla wrote:

If you check the custom service from CLI do you see :0 after portrnage

config firewall service custom edit "TCP_9100" set tcp-portrange 9100:0

If you see portrange 9100:0 it is a problem. 

Either from cli just set tcp-portrange 9100

Of in Webui in source port start make it blank insted or 0.

Is this correct?

[ashukla_FTNT]

rwpatterson wrote:

ashukla wrote:

If you check the custom service from CLI do you see :0 after portrnage

config firewall service custom edit "TCP_9100" set tcp-portrange 9100:0

If you see portrange 9100:0 it is a problem. 

Either from cli just set tcp-portrange 9100

Of in Webui in source port start make it blank insted or 0.

Is this correct?

Yes it is right. If source port start range is left to 0 it will show up as 9100:0 which causes the problem. It should be 1.

In future releases we will not see the option for source port at all as are hardly anyone restricting the source port.

[rwpatterson]

OK

Thank you

[jb_kalm]

ashukla wrote:

Yes it is right. If source port start range is left to 0 it will show up as 9100:0 which causes the problem. It should be 1.

In future releases we will not see the option for source port at all as are hardly anyone restricting the source port.

@ashukla - Will it remain an option in the CLI at least? It seems we actually make use of the source port range in some of our custom services.

Thanks,

jb

[kalysta]

ashukla wrote:

If you check the custom service from CLI do you see :0 after portrnage

config firewall service custom edit "TCP_9100" set tcp-portrange 9100:0

If you see portrange 9100:0 it is a problem. 

Either from cli just set tcp-portrange 9100

Of in Webui in source port start make it blank insted or 0.

That was the problem! Thank you so much!

[ede_pfau]

This is how is should look like in the WebGUI.

[Jan_Scholten]

The problem with custom services is fixed in 5.0.10

0250556 When creating a new custom service, the low source port initial value is incorrect