Hot!Using Fortinet Logs

Author
Bert1
New Member
  • Total Posts : 4
  • Scores: 0
  • Reward points: 0
  • Joined: 2019/09/05 18:27:52
  • Status: offline
2019/09/05 18:33:46 (permalink)
0

Using Fortinet Logs

I am trying to troubleshoot a problem but I am new to Fortinet and apparently I don't know how to use the Log & Report section of my firewall.  I am trying - and failing - to RDP to a VM in Azure.  So, I decided to have a look on the firewall to see if the problem might be there.  But, I can find no traffic at all from my workstation to any ip address on the internet on port 3389 or to the ip address of the VM.  I checked the "Forward Traffic" node and I do see traffic - from my workstation and other machines - but nothing dealing with my RDP traffic.  Am I even looking in the right place?
 
Thanks
 
Bert
#1

5 Replies Related Threads

    medekom
    New Member
    • Total Posts : 2
    • Scores: 0
    • Reward points: 0
    • Joined: 2019/09/11 08:12:10
    • Status: offline
    Re: Using Fortinet Logs 2019/09/11 08:18:32 (permalink)
    0
    Hi buddy, sorry for bumping the thread, but have got this sorted if not would love to list down the points.
    post edited by medekom - 2019/09/11 13:18:59

    Regards,
    M.Smith
    #2
    Bert1
    New Member
    • Total Posts : 4
    • Scores: 0
    • Reward points: 0
    • Joined: 2019/09/05 18:27:52
    • Status: offline
    Re: Using Fortinet Logs 2019/09/11 09:33:17 (permalink)
    0
    Unfortunately, yours is the only reply I have received so far so, no, I am nowhere near to resolving this.  I have even had another problem surface when I tried to deploy a 3CX server and indications are that it is a firewall configuration issue.  With no way of monitoring traffic on the FortiNet, I have no way of figuring out what the problem is.  I am on the verge of getting rid of the FortiNet and going back to something I can work with.  Even the old TMG software that Microsoft used to have had near-real time monitoring facilities that were very easy to use making troubleshooting network issues simple :-(
     
    Bert
    #3
    BWiebe
    Silver Member
    • Total Posts : 80
    • Scores: 1
    • Reward points: 0
    • Joined: 2012/06/07 07:54:42
    • Status: offline
    Re: Using Fortinet Logs 2019/09/11 12:43:09 (permalink)
    0
    If the policy(s) carrying the traffic are configured to show all logs and not just security logs, you should see something.
     
    What model of Fortigate?  Some of the smaller models only have limited ability to keep logs if they don't have disk.
     
    Also - you might want to do some packet captures - doable by CLI:
    https://kb.fortinet.com/kb/documentLink.do?externalId=11186
     
    Worst case you can always open a ticket with TAC for assistance with issues, they are generally very helpful.
    #4
    Bert1
    New Member
    • Total Posts : 4
    • Scores: 0
    • Reward points: 0
    • Joined: 2019/09/05 18:27:52
    • Status: offline
    Re: Using Fortinet Logs 2019/09/12 17:10:27 (permalink)
    0
    The package capture looks like what I need.  It would be nice if they could be formatted a bit better.  :-(
     
    Bert
    #5
    emnoc
    Expert Member
    • Total Posts : 5239
    • Scores: 347
    • Reward points: 0
    • Joined: 2008/03/20 13:30:33
    • Location: AUSTIN TX AREA
    • Status: online
    Re: Using Fortinet Logs 2019/09/12 20:43:15 (permalink)
    0
    FWIW your starting point is not the log but the flow.
     
     
    Logs is good  ,  but you need to match the traffic flow to a policy 1st and ensure logging is set.
     
    If you do not match a policy, than the traffic flow never hit the firewall
     
    clid "diag debug flow"  is where I would start
     
     diag debug reset
     diag debug en
     diag debug flow  show function-name enable
     diag debug flow fliter dport 3389
     diag debug flow  trace start 10
     
    Afterwards 
     
     diag debug disable
     diag debug reset
     
    Doing the above proves the packet reach or did not reach the firewall, shows the policyid# and the action taken
     
    3U17002315 # id=20085 trace_id=1 func=print_pkt_detail line=5333 msg="vd-root:0 received a packet(proto=6, 192.168.1.112:56957->6.6.6.6:3389) from internal. flag , seq 1145722695, ack 0, win 65535"
    id=20085 trace_id=1 func=init_ip_session_common line=5493 msg="allocate a new session-000fe46e"
    id=20085 trace_id=1 func=vf_ip_route_input_common line=2590 msg="find a route: flag=04000000 gw-1x.x.x..129 via wan1"
    id=20085 trace_id=1 func=fw_forward_handler line=749 msg="Allowed by Policy-1: SNAT"
    id=20085 trace_id=1 func=__ip_session_run_tuple line=3239 msg="SNAT 192.168.1.112->1xx.xxx.xx.160:56957"
    id=20085 trace_id=2 func=print_pkt_detail line=5333 msg="vd-root:0 received a packet(proto=6, 192.168.1.112:56957->6.6.6.6:3389) from internal. flag , seq 1145722695, ack 0, win 65535"
     
    So much details in the above. I know it was allowed by policyid#1, what and if nat was taken, the next hop, it's a SYN and so on.
     
    In your case your policy is bad or bad snat or the AWS security group is not correct for inbound-rule. Once you get a diag debug flow, you would be better position to know what to explore next.
     
    Ken Felix
     

    PCNSE,  NSE , Forcepoint ,  StrongSwan Specialist
    #6
    Jump to:
    © 2019 APG vNext Commercial Version 5.5