Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
koehland
New Contributor

loopback as source for FortiGuard

Hi!

Starting version 5.2 there is 'source-ip' included within 'config system fortiguard'.

I tried specifiing IP of loopback interface (which I'm using for management and logging) but the FG still uses IP of interface 'internal'.

 

Any idea?

 

Thanks!

 

Andreas

11 REPLIES 11
emnoc
Esteemed Contributor III

How did you determine this ?

 

Also to recheck did you ensure the loopback is in your default vdom "root" or the management vdom?

 

Can you execute a ping from that source interface to the fortiguard?

 

 

PCNSE 

NSE 

StrongSwan  

PCNSE NSE StrongSwan
koehland
New Contributor

Hi - thanks for your reply!

Yes - the loopback is within management vdom and fortiguard services are reachable via PING.

FGT60C (root) # execute ping-options source <loopback-address>

FGT60C (root) # execute ping service.fortiguard.net PING guard.fortinet.net (208.91.112.198): 56 data bytes 64 bytes from 208.91.112.198: icmp_seq=0 ttl=45 time=169.7 ms 64 bytes from 208.91.112.198: icmp_seq=4 ttl=45 time=169.6 ms

--- guard.fortinet.net ping statistics --- 5 packets transmitted, 5 packets received, 0% packet loss round-trip min/avg/max = 169.6/169.8/170.3 ms

 

But a sniffer for HTTPS traffic results in a source-ip different to the loopback.

The outgoing interface (in my configuration a ipsec vpn) is the same for both (ping and https).

[size="1"]FGT60C (root) # diagnose sniffer packet any 'port 443' 4 interfaces=[any] filters=[port 443][/size]

25.294676 <name-of-tunnel> out <ip-internal-interface>.2460 -> 96.45.33.89.443: syn 2615744967 25.301772 <name-of-tunnel> out <ip-internal-interface>.2461 -> 208.91.112.68.443: syn 1102060009

 

For any other service using the loopback as source it is working perfect.

FGT60C (global) # get system source-ip status The following services force their communication to use a specific source IP address:

service=NTP source-ip=<loopback-address> service=DNS source-ip=<loopback-address> service=Fortiguard source-ip=<loopback-address> service=Syslog #2 source-ip=<loopback-address> service=Alert Email source-ip=<loopback-address>

=======finished getting system source-ip status=======

emnoc
Esteemed Contributor III

 Will mine is the following;

 

  get system source-ip status The following services force their communication to use a specific source IP address: service=Fortiguard source-ip=x.x.x.x =======finished getting system source-ip status======= 15KDFG (global) #

 

 

I would do a diag sniffer packey any "host <loopback address >" and see the traffic generated  by the loopback an execute update-now

 

 

PCNSE 

NSE 

StrongSwan  

PCNSE NSE StrongSwan
fvelazquez

Hello,

 

Did you solve your issue? I have the same problem when configuring a TACACS server. I want the firewall to use another IP with the source-ip command but in the sniffer it is showing some other address. Did you manage to handle it?

 

Thank you very much in advance!,

 

Kind Regards,

 

 

fvelazquez

Hello, Did you solve the issue? I have the same problem when configuring a TACACS server. I want the firewall to use another IP with the source-ip command but in the sniffer it is showing some other address. Did you manage to handle it? Thank you very much in advance!,

 

Kind Regards,..

emnoc
Esteemed Contributor III

How are  you testing ? if you are using the diagnostic test command for AAA-tacacs it WILL NOT USE THE  DEFINE source-address in the test.

 

 

PCNSE 

NSE 

StrongSwan  

PCNSE NSE StrongSwan
fvelazquez

Actually yes I am using the diagnostic test command, but did not know it would not use the defined source-ip. I do not know if there is a similar way to show that traffic is generated from the declared source ip command.

 

Thank you very much for your answer,

 

Best Regards, 

emnoc
Esteemed Contributor III

Just  run a diag sniffer packet any "host x.x.x.x and port 49" where x.x.x.x is your   expected source-ip

 

PCNSE 

NSE 

StrongSwan  

PCNSE NSE StrongSwan
fvelazquez

Thank you very much for your reply! I did not explain correctly my concern. The command you show me would show any generated traffic from the source IP pointing the port, but I want to know if there is a way to generate that traffic, like in the GUI test for TACACS in order to show, the source ip is working. Maybe only bu creating a new user to authenticate with tacacs will show that source ip is actually working but probably there is another way.

 

Again thank you very much in advance for the answer!,

 

Regards,

 

Announcements

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Labels
Top Kudoed Authors