Hot!Policy Counter not working

Author
Abed ALR
Bronze Member
  • Total Posts : 34
  • Scores: 0
  • Reward points: 0
  • Joined: 2016/05/11 07:20:42
  • Status: offline
2019/08/20 00:20:15 (permalink)
0

Policy Counter not working

Hi
 
Fortigate 800D
v5.6.4
 
Configuration:
 
External Public IP addresses range in configured as a secondary range on one of the fortigate interfaces.
We took one IP from that range and configured it as a Virtual Server LB to 4 internal servers exists behind another interface.
See topology attached.
 
Then we configured 2 policies:
1- from interface 1 to interface 2 to IP 2.2.2.1. (2.2.2.1 as IP address object , NOT virtual server)
2- from interface 2 to interface 3 to the virtual server 2.2.2.1
 
we see counter/policy hits on policy number 2
but we don't see counter/policy hits on policy number 1
 
we thought at first that we don't need policy 1 , but after deleting it , no one was able to connect to the virtual server.
 
So policy 1 is necessary but it is not showing counter and no logs showing in fortianalyzer/diag debug regading policy 1
 
should the counter work and maybe this is a bug ?
or it should not work ...
 
Can anyone explain this to me ?
 
Thanks
 
 

Attached Image(s)


Thanks
#1

6 Replies Related Threads

    OneOfUs
    Bronze Member
    • Total Posts : 30
    • Scores: 6
    • Reward points: 0
    • Joined: 2019/07/16 06:32:59
    • Status: offline
    Re: Policy Counter not working 2019/08/21 05:51:55 (permalink)
    0
    Verify you have "All Sessions" logged on the policy
     
    From the CLI:
    diagnose sys session filter policy <policy id>
    diagnose sys session list
     
    If sessions open indefinitely they will not show up in the logs, you can force the sessions to close by using:
    diagnose sys session clear
     
    However, make sure you have a filter set otherwise you will clear all sessions.
     
     
    #2
    Abed ALR
    Bronze Member
    • Total Posts : 34
    • Scores: 0
    • Reward points: 0
    • Joined: 2016/05/11 07:20:42
    • Status: offline
    Re: Policy Counter not working 2019/08/21 06:01:00 (permalink)
    0
    Hi,
     
    The log is set to log all session.
    And regarding the diagnose command it shows total session 0
     
    FGT1 # diagnose sys session list
    total session 0

    Thanks
    #3
    OneOfUs
    Bronze Member
    • Total Posts : 30
    • Scores: 6
    • Reward points: 0
    • Joined: 2019/07/16 06:32:59
    • Status: offline
    Re: Policy Counter not working 2019/08/21 06:17:59 (permalink)
    0
    Run this using the source IP address you are testing connections from and it should help you identify which policies the traffic is hitting:
     
    diagnose debug reset
    diagnose debug enable
    diagnose debug flow show console enable
    diagnose debug flow filter addr <source ip>
    diagnose debug flow trace start 100

    To stop the debug:
    diagnose debug disable
    diagnose debug reset
    #4
    Abed ALR
    Bronze Member
    • Total Posts : 34
    • Scores: 0
    • Reward points: 0
    • Joined: 2016/05/11 07:20:42
    • Status: offline
    Re: Policy Counter not working 2019/08/21 06:28:38 (permalink)
    0
    Hi
     
    Thank you, but I know all of this.
    And as I mentioned earlier: "and no logs showing in fortianalyzer/diag debug regading policy 1"
    So logs are not even displayed in the diag debug
     
    Also notice that I'm running v5.6 , So '"diagnose debug flow show console enable"' is not gonna work there
     

    Thanks
    #5
    OneOfUs
    Bronze Member
    • Total Posts : 30
    • Scores: 6
    • Reward points: 0
    • Joined: 2019/07/16 06:32:59
    • Status: offline
    Re: Policy Counter not working 2019/08/21 06:55:46 (permalink)
    0
    Flow and sessions/logs are not the same, excluding the show console command the rest will work as displayed.
     
    If you are not seeing the traffic in the flow then it is being handled by the NPU.  You can turn off NPU offloading in the policy to make sure you can see the traffic in the flow.
     
    Another tool to use is: diagnose sniffer
     
    #6
    Abed ALR
    Bronze Member
    • Total Posts : 34
    • Scores: 0
    • Reward points: 0
    • Joined: 2016/05/11 07:20:42
    • Status: offline
    Re: Policy Counter not working 2019/08/21 07:03:40 (permalink)
    0
    I know how the diag debug works , I know how sniffer works.. I tested all this stuff before writing this post
     
    As I said before , it is not displaying any log regarding policy 1
    So logs regarding policy 1 is not displayed in any place ...
     
    My basic question, have you encountered this issue in your environment ?
     
    It is a little bit confusing configuration thats why I suspect this is a bug with this kind of configuration ..
     

    Thanks
    #7
    Jump to:
    © 2019 APG vNext Commercial Version 5.5