I am trying to troubleshoot a problem but I am new to Fortinet and apparently I don't know how to use the Log & Report section of my firewall. I am trying - and failing - to RDP to a VM in Azure. So, I decided to have a look on the firewall to see if the problem might be there. But, I can find no traffic at all from my workstation to any ip address on the internet on port 3389 or to the ip address of the VM. I checked the "Forward Traffic" node and I do see traffic - from my workstation and other machines - but nothing dealing with my RDP traffic. Am I even looking in the right place?
Thanks
Bert
Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
Hi buddy, sorry for bumping the thread, but have got this sorted if not would love to list down the points.
https://dltutuapp.com/tutuapp-download/ https://showbox.run/ https://kodi.software/
Regards,
M.Smith
Unfortunately, yours is the only reply I have received so far so, no, I am nowhere near to resolving this. I have even had another problem surface when I tried to deploy a 3CX server and indications are that it is a firewall configuration issue. With no way of monitoring traffic on the FortiNet, I have no way of figuring out what the problem is. I am on the verge of getting rid of the FortiNet and going back to something I can work with. Even the old TMG software that Microsoft used to have had near-real time monitoring facilities that were very easy to use making troubleshooting network issues simple :(
Bert
If the policy(s) carrying the traffic are configured to show all logs and not just security logs, you should see something.
What model of Fortigate? Some of the smaller models only have limited ability to keep logs if they don't have disk.
Also - you might want to do some packet captures - doable by CLI:
https://kb.fortinet.com/kb/documentLink.do?externalId=11186
Worst case you can always open a ticket with TAC for assistance with issues, they are generally very helpful.
The package capture looks like what I need. It would be nice if they could be formatted a bit better. :(
Bert
FWIW your starting point is not the log but the flow.
Logs is good , but you need to match the traffic flow to a policy 1st and ensure logging is set.
If you do not match a policy, than the traffic flow never hit the firewall
clid "diag debug flow" is where I would start
diag debug reset
diag debug en
diag debug flow show function-name enable
diag debug flow fliter dport 3389
diag debug flow trace start 10 Afterwards diag debug disable diag debug reset Doing the above proves the packet reach or did not reach the firewall, shows the policyid# and the action taken 3U17002315 # id=20085 trace_id=1 func=print_pkt_detail line=5333 msg="vd-root:0 received a packet(proto=6, 192.168.1.112:56957->6.6.6.6:3389) from internal. flagPCNSE
NSE
StrongSwan
This guide can be used by both MyFordBenefits Retirees and MyFordBenefits US Employees interested in logging in to MyFordBenefits Ford Motor Company. https://my-ford-benefits.live/
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
User | Count |
---|---|
1698 | |
1092 | |
752 | |
446 | |
228 |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.