Hi all
Here is my situation. At home, I use Fortigate 100D (FW 6.2.16) behind my box which forward all traffic to the Fortigate.
In recent weeks, when home working with vpn-ssl to entreprise vpn server, my flow has collapsed, and it is the Forti at home that is causing the problem, I have no problem if I plug into one of the ports available on the box and bypass home Fortigate.
I don't see any recent changes on home Forti that could explain the problem. The output rules are without filtering or inspections.
Wireshark captures I made show tons of TCP Retransmission mainly in the server -> client direction and Dup ACK in the other direction.
All your suggestions will be appreciated
Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
Hi,
Can you run debug flow while you are trying to use to debug flow to identify the traffic flow through the Firewall.
di de dis
di de reset
di de flow filter addr <SSLVPN-Client's Real IP>
di de flow filter port <SSL-VPN-Port>
di de console timestamp en
di de flow trace start 999
di de en
To stop the debug use the command given below;
di de dis
di de reset
Hi Salem,
Where should I put the result ? There is 3000 lines.
2024-10-26 19:10:15 id=20085 trace_id=4081 func=print_pkt_detail line=5688 msg="vd-root:0 received a packet(proto=6, 192.168.210.21:37268->2xx.xxx.xxx.xxx:443) from dmz. flag [.], seq 2966239105, ack 3095364758, win 1041"
2024-10-26 19:10:15 id=20085 trace_id=4081 func=resolve_ip_tuple_fast line=5768 msg="Find an existing session, id-000dc3f7, original direction"
2024-10-26 19:10:15 id=20085 trace_id=4081 func=__ip_session_run_tuple line=3425 msg="SNAT 192.168.210.21->192.168.1.10:37268"
2024-10-26 19:10:15 id=20085 trace_id=4082 func=print_pkt_detail line=5688 msg="vd-root:0 received a packet(proto=6, 192.168.210.21:37268->2xx.xxx.xxx.xxx:443) from dmz. flag [.], seq 2966239252, ack 3095364758, win 1041"
2024-10-26 19:10:15 id=20085 trace_id=4082 func=resolve_ip_tuple_fast line=5768 msg="Find an existing session, id-000dc3f7, original direction"
2024-10-26 19:10:15 id=20085 trace_id=4082 func=__ip_session_run_tuple line=3425 msg="SNAT 192.168.210.21->192.168.1.10:37268"
2024-10-26 19:10:15 id=20085 trace_id=4083 func=print_pkt_detail line=5688 msg="vd-root:0 received a packet(proto=6, 192.168.210.21:37268->2xx.xxx.xxx.xxx:443) from dmz. flag [.], seq 2966239373, ack 3095364758, win 1041"
2024-10-26 19:10:15 id=20085 trace_id=4083 func=resolve_ip_tuple_fast line=5768 msg="Find an existing session, id-000dc3f7, original direction"
2024-10-26 19:10:15 id=20085 trace_id=4083 func=__ip_session_run_tuple line=3425 msg="SNAT 192.168.210.21->192.168.1.10:37268"
2024-10-26 19:10:15 id=20085 trace_id=4084 func=print_pkt_detail line=5688 msg="vd-root:0 received a packet(proto=6, 192.168.210.21:37268->2xx.xxx.xxx.xxx:443) from dmz. flag [.], seq 2966239569, ack 3095364758, win 1041"
2024-10-26 19:10:15 id=20085 trace_id=4084 func=resolve_ip_tuple_fast line=5768 msg="Find an existing session, id-000dc3f7, original direction"
2024-10-26 19:10:15 id=20085 trace_id=4084 func=__ip_session_run_tuple line=3425 msg="SNAT 192.168.210.21->192.168.1.10:37268"
...
Thanks helping
David
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
User | Count |
---|---|
1696 | |
1091 | |
752 | |
446 | |
228 |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.