Traffic logs/Bandwidth usage - dont trust them

[luca_caligari]

We made this test: 1) all policy Logging Options - Log all Sessions 2) setup two syslogd server 3) activated forticloud 4) from Internet computer executed FTP get versus a FTP server in our internal LAN (configured using VIP NAT) behind fortigate 60D v5.0,build0252 (GA Patch 5). Transferred one file size 670.347.264 byte in about 50 minutes. logs in Fortigate memory and in syslogd related to these traffic are only 6 and total fields sentbyte, rcvdbyte are less then 500.000. The same in Forticloud where first top traffic of the day is another host with 6Mb in/out. There is NO log or report about the 600Mb traffic passed thrugh the Fortigate. We open a ticket to TAC Fortinet and their reply is : " There is nothing wrong with what you observed. The session is defined by when it was initiated and when it was over, it does not give you the information what exactly you have been doing - uploading/downloading and how big was the file you transferred/downloaded. " . These means (for me) that you cant know the Bandwidth usage. All traffic related report you could get from Fortigate or Forticloud or other you may build on logs are quite incorrect. Regards

[romanr]

This depends on a couple of things: Your traffic was most likely processed by the NPU (NPlite in this case). FortiASIC network processors don' t deliver any kind of traffic statistics to its sessions, so proper traffic logging or monitoring is not available with traffic, that is processed from the FortiASIC fastpath! If you want proper traffic monitoring, then you need to deactivate the fastpath. The easiest way to do this is just activate whatever UTM feature and you will have proper stats and logging! br, Roman

[luca_caligari]

Hi romanr, thanks for replying me. Let me understand in deep. I just download and read fortigate-hardware-accel-50.pdf and found: " Except for the NP6, network processors do not count offloaded packets, and offloaded packets are not logged by traffic logging and are not included in traffic statistics and traffic log reports." Gotcha! This is my problem and you are quite right! I suppose Fortigate 60D has NO npu because all NPU related commands return no info: TPITV # get hardware npu legacy list No npu ports are found TPITV # get hardware npu np1 list Couldn' t open device /dev/iscp1nat TPITV # get hardware npu np2 list TPITV # get hardware npu np4 list ID Model Slot Interface TPITV # get hardware status Model name: FortiGate-60D ASIC version: CP0 ASIC SRAM: 64M CPU: FortiSOC2 Number of CPUs: 1 RAM: 1843 MB Compact Flash: 12850 MB /dev/sda Hard disk: 12800 MB /dev/sda USB Flash: not available I executed: diagnose sys session list | grep -f npu getting many npu info with offload NOT 0 meaning they are offloaded by nplite and not logged due this reason. Then I executed: diagnose npu nplite fastpath disable diagnose sys session clear now all npu info offload are 0 and executing huge ftp logs contains all byte tranferred. Fortigate CPU usage stay less 10% during all FTP meaning to me ther are no side effect disabling NPU (NPlite). The fastpath disable remains until reboot fortigate because is not a permanent change. Again you are quite right writing " just activate whatever UTM feature" because this cause NPU dont be able to fasthpath traffic ...... give me one suggestion: the less performance impact I will have is enabling the UTM feature application controll " default" (monitor all application) on all policies ? Many many thanks ciao Luca

[romanr]

Hi, ahhh ... you digged into it really fast :)! If you don' t need any utm feature and just want to disable offloading to the NPU there is a switch in the policy config (only on the CLI): set auto-asic-offload disable With this you can set traffic to be offloaded or not on a per-policy-base and don' t need to use utm features! This should have the least performance impact! br, Roman