Hi I have a internal network which I have NATED with ( using a different firewall) a public IP and allowed the same in Fortigate.
Network --->Other Firewall NAT--> Forigate.
Fortigate rule is like -Source -- NATED IP
Destination - Any
Service - http /https
The problem is the internal machines are not able to connect to the outside network ( in my case http/https).
when I sniff the packet I got the output like below.
syn -- syn ack -- and immediately client sends reset.
7.252024 amc-sw1/2 out 203.XX.205.XX.11049 -> 115.112.5.6.80: syn 1627055449
7.268554 amc-sw1/2 in 115.112.5.6.80 -> 203.XX1.205.XX.11049: syn 3001641008 ack 1627055450 7.268576 amc-sw1/2 out 203.XX.205.XX.11049 -> 115.112.5.6.80: rst 1627055450
Can anyone help me to sort this out? What could be the problem here causing the reset?
thanks
Nihas
Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
I would diag debug flow matching the client and port, inspect the firewall policy for ips-sensor , ssl-inspections etc..
Your flow captures looks like a client is in AWS and this traffic is coming inbound. Is this not correct? if so I would assume the web-server is hidden been the other firewall (FORTIGATE ) and you would have a DNAT or PORT-forwrd .
Can you confirm is this is the case? or provide a topology?
e.g
(client __ internet ------>Network --->Other Firewall NAT--> Forigate )
And lastly if my suspicions is correct, can you provide the vip-config and firewall policy config?
PCNSE
NSE
StrongSwan
Thanks Emnoc and Sorry for the late reply.
Your flow captures looks like a client is in AWS and this traffic is coming inbound. Is this not correct? if so I would assume the web-server is hidden been the other firewall (FORTIGATE ) and you would have a DNAT or PORT-forwrd .
There is a slight difference in the scenario. We have a client who has a dedicated firewall ( Palo Alto) and is directly connected to the external firewall which is a Fortigate one. ie,The gateway of PALO ALTO is our Forigate firewall.
Connectivity is just like below Machines ( NATED with PA interface IP,ie 203.XX.205.XX-) --->Palo Alto-->Eth0( 203.XX.205.XX--this is a public IP) -->Fortigate ( No NAT, Policy Source- 203.XX.205.XX-& Destination Any)--> Internet Router-->Internet
I found out the reason for the unusual TCP hand shake, the reason behind the issue is there was another policy in place which was using the same public IP ( 203.XX.205.XX) as a NAT IP ( IP pool) in Fortigate.
The issue got fixed by removing the pool IP from the particular rule and deleted the same,
In simple words there was an IP conflict in the network. One was being used for NAT and the same was using in palo alto interface as well.
:)
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
User | Count |
---|---|
1688 | |
1086 | |
752 | |
446 | |
226 |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.