#Troubleshooting# Critical App Server visibility in Online Users Asset List
#Troubleshooting# Critical App Server 10.60.24.4 visible in Top Users Traffic Ranking report but can't search it and visible in Online Users Asset List*Product: NGAF
*Version: 8.0.26
*1. Introduction
1.1 Scenario
Deployed an NGAF between the customer's existing FortiGate firewall and Core Switch with virtual wire mode.
Configured virtual wire mode with 2 zones which is LAN & WAN zone where the LAN zone is connected to the core switch and WAN zone is connected to FortiGate firewall.
Critical App Server 10.60.24.4 is connected to the LAN zone. Configured user authentication and selected LAN zone as authentication zone in Authentication Policy.
The issue we are facing is that a Critical App Server 10.60.24.4 which only appears and is visible in traffic ranking top users by traffic report but in online users asset list we can't search it as 10.60.24.4 is not appear and visible in online users asset list.
*2. Diagnosis
2.1 Findings
1. In the traffic ranking, there is no outbound traffic for the critical app server (10.60.24.4).
2. Captured packet filter by the server IP 10.60.24.4 and both internal & external interface when the server is pinging 8.8.8.8. There is only ICMP reply packet which prove that there is no outbound traffic.
3. Captured packet filter by the firewall IP 10.60.19.132 when the critical app server is pinging 10.60.19.132. However, there is only ICMP reply packet which prove that there is no outbound traffic.
4. From the traceroute result from server IP 10.60.24.4 and one of the online user IP 10.60.26.31 to 8.8.8.8, they are both going through same hop.
2.2 Screenshot
Packet for eth2 when pinging 8.8.8.8
Packet for eth3 when pinging 8.8.8.8
Packet for any port when pinging firewall 10.60.19.132
Traceroute
2.3 Next Step
As the NGAF firewall device is deployed in virtual wire mode that will not affect the routing, please proceed to check the configuration on the Core Switch.
*3. Solutions3.1 SuggestionsKindly check for the following items settings. (Please refer to the network diagram attachment below when checking)
1. Double confirm that there is no cable connected from Core Switch and FortiGate Firewall directly.
2. Verify if there is any PBR configured in the Core Switch that will affect the routing to the traffic of 10.60.24.4.
3. Verify that there is no redundant Core Switch inter-connected to the main Core Switch to avoid the 10.60.24.4 traffic flow and route to the redundant Core Switch.
4. If none of the above is configured, kindly connect a PC to the main Core Switch and mirror the traffic of the port connected to the NGAF firewall and 10.60.24.4 for packet capturing.
5. You may refer to the following link for how to mirror the traffic of the port for Cisco Catalyst Switches User.
https://www.cisco.com/c/en/us/support/docs/switches/catalyst-6500-series-switches/10570-41.html
Great sharing. thank you very much. this is very helpful. Hi bro, congratulations, your post has been marked as "Featured". informative .. Useful & informative Great job, very informative informative Thank you very much for the information ... :handshake Great job, very informative Last edited by Farina Ahmed 14 Mar 2023 15:05.
I think this article is very well describe and a very good example of how troubleshooting cases should be written with examples and screenshots plus using troubleshooting commands. But I would suggest that with pictures also add some wording that what is happening in these steps and why you perform such steps.