{"id":4760,"date":"2020-08-19T07:38:49","date_gmt":"2020-08-19T07:38:49","guid":{"rendered":"https:\/\/pariswells.com\/blog\/?p=4760"},"modified":"2020-08-19T07:38:49","modified_gmt":"2020-08-19T07:38:49","slug":"fortigate-logging","status":"publish","type":"post","link":"https:\/\/pariswells.com\/blog\/research\/fortigate-logging","title":{"rendered":"Fortigate Logging"},"content":{"rendered":"

Flow Trace<\/h4>

Now I will show a flow trace from my computer to\u00a04.2.2.2<\/code><\/p>

diagnose debug reset \r\ndiagnose debug flow filter saddr 10.22.22.122 \r\ndiagnose debug flow filter daddr 10.100.1.1 \r\ndiagnose debug flow show function-name enable\r\ndiagnose debug enable \r\ndiagnose debug flow trace start 100\u00a0\u00a0#display the next 100 packets, after that, disable the flow: \r\n\r\nWhen complete, you can disable manually with<\/em>\r\n\r\ndiagnose debug disable<\/pre>
\"2020-04-23_12-14-48\"<\/p>
 <\/p>
The output, it will show you what interface the connection came in on, because of the function-name enable<\/code>\u00a0you will see NAT, Routing, etc, IPS, offloading to NPU and SPUs, etc.<\/p>
Sessions<\/h4>
You can also see the sessions using the following commands<\/p>
diagnose sys session filter clear\r\ndiagnose sys session filter dst 4.2.2.2\r\ndiagnose sys session filter dport 53\r\ndiagnose sys session list\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 #show the session table with the filter just set<\/pre>
Use the filter that work for you from a\u00a0source<\/code>\u00a0or\u00a0destination<\/code>\u00a0as well as ports<\/p>
\"2020-04-23_12-22-53\"<\/p>
 <\/p>
With this filter, you can clear the sessions based on the filter you created by issuing the\u00a0diagnose sys session clear<\/code>\u00a0NOTE: Without the filter in place, you will clear ALL sessions on the FortiGate.\u00a0 It is always a good habit to run\u00a0diag sys session filter ?<\/code>\u00a0to list the filter you have configured.<\/p>
Packet Capture<\/h4>
You can either use the GUI or the CLI to run packet captures.<\/p>
diagnose sniffer packet any 'host 8.8.8.8' 4 4 l \r\ndiagnose sniffer packet any 'host 8.8.8.8 and dst port 53' 4 10 a \r\ndiagnose sniffer packet wan1 'dst port (80 or 443)' 2 50 l \r\n\r\n<\/pre>
The verbosity is controlled by the following:<\/p>
verbose:\r\n1: print header of packets\r\n2: print header and data from ip of packets\r\n3: print header and data from ethernet of packets (if available)\r\n4: print header of packets with interface name\r\n5: print header and data from ip of packets with interface name\r\n6: print header and data from ethernet of packets (if available) with intf name\r\ncount: number of packets\r\ntime-format:<\/pre>
a: UTC time\r\nl: local time<\/pre>
You can use the GUI by going to\u00a0Network<\/code>\u00a0then\u00a0Packet Capture<\/code>\u00a0then\u00a0Create<\/code> .\u00a0<\/p>
\"2020-04-23_12-36-04\"<\/p>","protected":false},"excerpt":{"rendered":"
Flow TraceNow I will show a flow trace from my computer to\u00a04.2.2.2diagnose debug reset diagnose debug flow filter saddr 10.22.22.122 diagnose debug flow filter daddr 10.100.1.1 diagnose […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-4760","post","type-post","status-publish","format-standard","hentry","category-research"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t