| Description | This article describes how to capture traffic on a physical interface for a chassis-based FortiGate. |
| Scope | FortiGate 6000F, 7000E, and 7121F. |
| Solution |
A feature is available on chassis-based FortiGates (6000F, 7000E, and 7121F) that allows the administrator to capture traffic at the ISF (integrated Switch Fabric) level. This means that traffic can be captured before leaving the FortiGate at the physical level. This also applies to traffic entering the FortiGate. This feature will activate the interface f-mirror for the selected physical interface on the dataplane.
The following are the elements involved when packets enter a 6000F device:
1. Packet on the fiber. 2. Handled by SFP. 3. Handled by DP (distribution processor). 4. Forwarded by ISF to FPC. 5. Goes to NP6 on FPC and eventually on the host CPUs.
Capture for regular packet capture gives packets that are handled by CPUs. See Troubleshooting Tip: Using the FortiOS built-in packet sniffer for more information.
This article will demonstrate how to capture traffic at the physical level with the prefix 'sw:'.
This can have a number of benefits: - It is easier to ensure the traffic is properly transmitted from ISF to FPC and vice versa. - It is easier to ensure the traffic is properly transmitted from ISF to SFP. - It provides a view of the entire flow even when it's offloaded on FPC. This information is not visible in a regular packet sniff because it's not handled by the CPU hosts.
For example: Traffic is going to be captured on port25 at ISF Level for vlan1062.
Command to be used:
diagnose sniffer packet sw:port25 '(vlan 1062 and tcp) or (vlan 1062 and tcp)' 4 0 l
In FortiOS 7.2.x and 7.4.x, the command has been changed to the following:
diagnose span-sniffer packet sw:port25 '(vlan 1062 and tcp) or (vlan 1062 and tcp)' 4 0 l
The following information will display in the terminal window:
[MBD ] 2023-07-03 14:39:43.803130 f-mirror -- port25 out 802.1Q vlan#1062 P0 10.0.59.79.31436 -> 10.0.62.10.80: psh 1026859065 ack 207576893
PSH TCP packets are usually offloaded, but can be shown with the feature above.
In addition, this command can be run without a filter. All traffic reaching port25 will displayed upon doing so.
It is highly recommended to use a traffic filter to prevent CPUs in the MBD from being overloaded by the mirrored traffic.
diagnose sniffer packet sw:port25 '' 4 0 l
In FortiOS 7.2.x and 7.4.x, the command has been changed to the following:
diagnose span-sniffer packet sw:port25 '' 4 0 l
Consequently, traffic from vlan 1059 and 1062 will be displayed:
[MBD ] 2023-07-03 15:56:01.605795 f-mirror -- port25 out 802.1Q vlan#1062 P0 10.0.59.26.28513 -> 10.0.62.13.5247: udp 469
Please note that only one physical port can be mirrored at a time. |
