replay packet drop

[vvserpent]

I have a 400A and running 4.0 MR4 P18 software. It is a new installation, as I don' t know what kind of traffic across the 400A. I configured " all-to-all" firewall rule and log all traffic to the FortiAnalyzer. On FortiAnalyzer, I found alot of " no sesssion matched" / " replay packet,drop" message. As there is no IPS / AV enabled, I have no idea what triggered the traffic drop... Anyone can tell me what wrong on my 400A ?

[ede_pfau]

hi, this might be IPsec VPN traffic not being answered. Does the Event Log show any VPN activity (only if VPN event logging is enabled)? BTW, there is no FOS 4.0 MR4, you probably meant 4.3.18. Is there any 4.3.18? Last time I checked latest version was 4.3.17. Anyway, FOS version does not matter here...

[emnoc]

Ede yes it exist ( MR3 Patch 18 ) . Thanks to selective and me on PM, he updated me that p18 ) was out. Op, if this is vpn-ipsec related, what are you connecting to? Another fortigate or cisco?

[vvserpent]

Hi, There is no VPN connection yet. From the log message, the " replay packet(allow_err),drop" traffic is FTP service. itime=1409901317 date=2014-09-05 time=00:17:47 timestamp=1409901467 vd=ABCDE pri=warning type=traffic subtype=other app=N/A app_cat=N/A app_type=N/A carrier_ep=N/A device_id=FG400AXXXXXXX dst=192.168.xxx.35 dst_country=Reserved dst_int=port4 dst_port=21 dstname=192.168.xxx.35 dtime=1409876267 duration=5 group=N/A identidx=0 log_id=7 msg=" replay packet(allow_err), drop" perip_drop=0 perip_name=N/A policyid=1 profilegroup=N/A proto=6 rcvd=0 rule=1 sent=0 service=FTP shaper_drop_rcvd=0 shaper_drop_sent=0 shaper_rcvd_name=N/A shaper_sent_name=N/A SN=31670 src=10.0.xxx.68 src_country=Reserved src_int=port3 src_port=4588 srcname=10.0.xxx.68 status=deny subapp=N/A subappcat=N/A Regards, Jacky

[TuncayBAS]

please print follow code config system global get