packet process

[Jai_Kishore]

Hi All,

The command "dia deb flow" which is very usefull to troubleshoot.Is there any command to check that the packet is processed by UTM features (AV,IPS,App_Ctrl,DLP...etc) at a time.

Regards,

Jai Kishore

[emnoc]

The  diag debug flow command should show you that also for most UTMs features.

Ken

[Christopher_McMullan]

The syntax is usually:

id=13 trace_id=1 func=fw_forward_handler line=664 msg="Allowed by Policy-1: AV SNAT"

id=13 trace_id=1 func=av_receive line=255 msg="send to application layer"

-or-

id=13 trace_id=3349 func=fw_forward_handler line=664 msg="Allowed by Policy-24: SNAT" id=13 trace_id=3349 func=ids_receive line=237 msg="send to ips"

SNAT/DNAT may or may not be present, signifying that NAT is being applied to the traffic.

For UTM, we use AV and 'application layer' as shorthand for proxy-based UTM, and 'send to ips' for flow-based inspection.

They don't necessarily mean that AV or IPS are specifically enabled for any one policy. In my case, this output was generated using a proxy-based webfilter profile, and indeed an IPS sensor for the second example.