loopback as source for FortiGuard

[koehland]

Hi!

Starting version 5.2 there is 'source-ip' included within 'config system fortiguard'.

I tried specifiing IP of loopback interface (which I'm using for management and logging) but the FG still uses IP of interface 'internal'.

Any idea?

Thanks!

Andreas

[emnoc]

How did you determine this ?

Also to recheck did you ensure the loopback is in your default vdom "root" or the management vdom?

Can you execute a ping from that source interface to the fortiguard?

[koehland]

Hi - thanks for your reply!

Yes - the loopback is within management vdom and fortiguard services are reachable via PING.

FGT60C (root) # execute ping-options source <loopback-address>

FGT60C (root) # execute ping service.fortiguard.net PING guard.fortinet.net (208.91.112.198): 56 data bytes 64 bytes from 208.91.112.198: icmp_seq=0 ttl=45 time=169.7 ms 64 bytes from 208.91.112.198: icmp_seq=4 ttl=45 time=169.6 ms

--- guard.fortinet.net ping statistics --- 5 packets transmitted, 5 packets received, 0% packet loss round-trip min/avg/max = 169.6/169.8/170.3 ms

But a sniffer for HTTPS traffic results in a source-ip different to the loopback.

The outgoing interface (in my configuration a ipsec vpn) is the same for both (ping and https).

[size="1"]FGT60C (root) # diagnose sniffer packet any 'port 443' 4 interfaces=[any] filters=[port 443][/size]

25.294676 <name-of-tunnel> out <ip-internal-interface>.2460 -> 96.45.33.89.443: syn 2615744967 25.301772 <name-of-tunnel> out <ip-internal-interface>.2461 -> 208.91.112.68.443: syn 1102060009

For any other service using the loopback as source it is working perfect.

FGT60C (global) # get system source-ip status The following services force their communication to use a specific source IP address:

service=NTP source-ip=<loopback-address> service=DNS source-ip=<loopback-address> service=Fortiguard source-ip=<loopback-address> service=Syslog #2 source-ip=<loopback-address> service=Alert Email source-ip=<loopback-address>

=======finished getting system source-ip status=======

[emnoc]

 Will mine is the following;

  get system source-ip status The following services force their communication to use a specific source IP address: service=Fortiguard source-ip=x.x.x.x =======finished getting system source-ip status======= 15KDFG (global) #

I would do a diag sniffer packey any "host <loopback address >" and see the traffic generated  by the loopback an execute update-now

[fvelazquez]

Hello,

Did you solve your issue? I have the same problem when configuring a TACACS server. I want the firewall to use another IP with the source-ip command but in the sniffer it is showing some other address. Did you manage to handle it?

Thank you very much in advance!,

Kind Regards,

[fvelazquez]

Hello, Did you solve the issue? I have the same problem when configuring a TACACS server. I want the firewall to use another IP with the source-ip command but in the sniffer it is showing some other address. Did you manage to handle it? Thank you very much in advance!,

Kind Regards,..

[emnoc]

How are  you testing ? if you are using the diagnostic test command for AAA-tacacs it WILL NOT USE THE  DEFINE source-address in the test.

[fvelazquez]

Actually yes I am using the diagnostic test command, but did not know it would not use the defined source-ip. I do not know if there is a similar way to show that traffic is generated from the declared source ip command.

Thank you very much for your answer,

Best Regards, 

[emnoc]

Just  run a diag sniffer packet any "host x.x.x.x and port 49" where x.x.x.x is your   expected source-ip

[fvelazquez]

Thank you very much for your reply! I did not explain correctly my concern. The command you show me would show any generated traffic from the source IP pointing the port, but I want to know if there is a way to generate that traffic, like in the GUI test for TACACS in order to show, the source ip is working. Maybe only bu creating a new user to authenticate with tacacs will show that source ip is actually working but probably there is another way.

Again thank you very much in advance for the answer!,

Regards,