Using Fortinet Logs

[Bert1]

I am trying to troubleshoot a problem but I am new to Fortinet and apparently I don't know how to use the Log & Report section of my firewall.  I am trying - and failing - to RDP to a VM in Azure.  So, I decided to have a look on the firewall to see if the problem might be there.  But, I can find no traffic at all from my workstation to any ip address on the internet on port 3389 or to the ip address of the VM.  I checked the "Forward Traffic" node and I do see traffic - from my workstation and other machines - but nothing dealing with my RDP traffic.  Am I even looking in the right place?

Thanks

Bert

[medekom]

Hi buddy, sorry for bumping the thread, but have got this sorted if not would love to list down the points.

https://dltutuapp.com/tutuapp-download/ https://showbox.run/  https://kodi.software/

[Bert1]

Unfortunately, yours is the only reply I have received so far so, no, I am nowhere near to resolving this.  I have even had another problem surface when I tried to deploy a 3CX server and indications are that it is a firewall configuration issue.  With no way of monitoring traffic on the FortiNet, I have no way of figuring out what the problem is.  I am on the verge of getting rid of the FortiNet and going back to something I can work with.  Even the old TMG software that Microsoft used to have had near-real time monitoring facilities that were very easy to use making troubleshooting network issues simple :(

Bert

[BWiebe]

If the policy(s) carrying the traffic are configured to show all logs and not just security logs, you should see something.

What model of Fortigate?  Some of the smaller models only have limited ability to keep logs if they don't have disk.

Also - you might want to do some packet captures - doable by CLI:

https://kb.fortinet.com/kb/documentLink.do?externalId=11186

Worst case you can always open a ticket with TAC for assistance with issues, they are generally very helpful.

[Bert1]

The package capture looks like what I need.  It would be nice if they could be formatted a bit better.  :(

Bert

[emnoc]

FWIW your starting point is not the log but the flow.

Logs is good  ,  but you need to match the traffic flow to a policy 1st and ensure logging is set.

If you do not match a policy, than the traffic flow never hit the firewall

clid "diag debug flow"  is where I would start

 diag debug reset

 diag debug en

 diag debug flow  show function-name enable

 diag debug flow fliter dport 3389

 diag debug flow  trace start 10 Afterwards   diag debug disable diag debug reset Doing the above proves the packet reach or did not reach the firewall, shows the policyid# and the action taken 3U17002315 # id=20085 trace_id=1 func=print_pkt_detail line=5333 msg="vd-root:0 received a packet(proto=6, 192.168.1.112:56957->6.6.6.6:3389) from internal. flag , seq 1145722695, ack 0, win 65535"id=20085 trace_id=1 func=init_ip_session_common line=5493 msg="allocate a new session-000fe46e"id=20085 trace_id=1 func=vf_ip_route_input_common line=2590 msg="find a route: flag=04000000 gw-1x.x.x..129 via wan1"id=20085 trace_id=1 func=fw_forward_handler line=749 msg="Allowed by Policy-1: SNAT"id=20085 trace_id=1 func=__ip_session_run_tuple line=3239 msg="SNAT 192.168.1.112->1xx.xxx.xx.160:56957"id=20085 trace_id=2 func=print_pkt_detail line=5333 msg="vd-root:0 received a packet(proto=6, 192.168.1.112:56957->6.6.6.6:3389) from internal. flag , seq 1145722695, ack 0, win 65535" So much details in the above. I know it was allowed by policyid#1, what and if nat was taken, the next hop, it's a SYN and so on. In your case your policy is bad or bad snat or the AWS security group is not correct for inbound-rule. Once you get a diag debug flow, you would be better position to know what to explore next. Ken Felix 

[sharanupa]

 This guide can be used by both MyFordBenefits Retirees and MyFordBenefits US Employees interested in logging in to MyFordBenefits Ford Motor Company. https://my-ford-benefits.live/