#Troubleshooting# Critical App Server visibility in Online Users Asset List

JokerAce Lv1Posted 17 May 2022 23:56

#Troubleshooting# Critical App Server visible in Top Users Traffic Ranking report but can't search it and visible in Online Users Asset List

*Product: NGAF

*Version: 8.0.26

*1. Introduction

1.1 Scenario

Deployed an NGAF between the customer's existing FortiGate firewall and Core Switch with virtual wire mode.

Configured virtual wire mode with 2 zones which is LAN & WAN zone where the LAN zone is connected to the core switch and WAN zone is connected to FortiGate firewall.

Critical App Server is connected to the LAN zone. Configured user authentication and selected LAN zone as authentication zone in Authentication Policy.

The issue we are facing is that a Critical App Server which only appears and is visible in traffic ranking top users by traffic report but in online users asset list we can't search it as is not appear and visible in online users asset list.

*2. Diagnosis

2.1 Findings

1. In the traffic ranking, there is no outbound traffic for the critical app server (
2. Captured packet filter by the server IP and both internal & external interface when the server is pinging There is only ICMP reply packet which prove that there is no outbound traffic.
3. Captured packet filter by the firewall IP when the critical app server is pinging However, there is only ICMP reply packet which prove that there is no outbound traffic.
4. From the traceroute result from server IP and one of the online user IP to, they are both going through same hop.

2.2 Screenshot

Packet for eth2 when pinging


Packet for eth3 when pinging


Packet for any port when pinging firewall




2.3 Next Step

As the NGAF firewall device is deployed in virtual wire mode that will not affect the routing, please proceed to check the configuration on the Core Switch.

*3. Solutions
3.1 Suggestions
Kindly check for the following items settings. (Please refer to the network diagram attachment below when checking)

1. Double confirm that there is no cable connected from Core Switch and FortiGate Firewall directly.

2. Verify if there is any PBR configured in the Core Switch that will affect the routing to the traffic of

3. Verify that there is no redundant Core Switch inter-connected to the main Core Switch to avoid the traffic flow and route to the redundant Core Switch.

4. If none of the above is configured, kindly connect a PC to the main Core Switch and mirror the traffic of the port connected to the NGAF firewall and for packet capturing.

5. You may refer to the following link for how to mirror the traffic of the port for Cisco Catalyst Switches User.



Like this topic? Like it or reward the author.

Creating a topic earns you 5 coins. A featured or excellent topic earns you more coins. What is Coin?

Enter your mobile phone number and company name for better service. Go

jetjetd Lv5Posted 18 May 2022 00:44
Great sharing. thank you very much. this is very helpful.
Sangfor Jojo Lv5Posted 20 May 2022 14:01
Hi bro, congratulations, your post has been marked as "Featured".
kmrnliaqat Lv3Posted 01 Jun 2022 18:22
informative ..
Raja Azkar Lv2Posted 21 Jun 2022 15:20
Useful & informative
regidorreyes Lv5Posted 25 Jun 2022 22:18
Great job, very informative
Imran Tahir Lv4Posted 29 Jul 2022 12:41
Faisal P Posted 08 Oct 2022 22:58
Thank you very much for the information ...
IPS_len Lv2Posted 14 Nov 2022 14:10
Great job, very informative
Farina Ahmed Lv5Posted 13 Mar 2023 15:40
Last edited by Farina Ahmed 14 Mar 2023 15:05.

I think this article is very well describe and a very good example of how troubleshooting cases should be written with examples and screenshots plus using troubleshooting commands. But I would suggest that with pictures also add some wording that what is happening in these steps and why you perform such steps.