#Troubleshooting# Critical App Server visibility in Online Users Asset List
  

JokerAce Lv1Posted 17 May 2022 23:56

#Troubleshooting# Critical App Server 10.60.24.4 visible in Top Users Traffic Ranking report but can't search it and visible in Online Users Asset List

*Product: NGAF

*Version: 8.0.26

*1. Introduction

1.1 Scenario

Deployed an NGAF between the customer's existing FortiGate firewall and Core Switch with virtual wire mode.

Configured virtual wire mode with 2 zones which is LAN & WAN zone where the LAN zone is connected to the core switch and WAN zone is connected to FortiGate firewall.

Critical App Server 10.60.24.4 is connected to the LAN zone. Configured user authentication and selected LAN zone as authentication zone in Authentication Policy.

The issue we are facing is that a Critical App Server 10.60.24.4 which only appears and is visible in traffic ranking top users by traffic report but in online users asset list we can't search it as 10.60.24.4 is not appear and visible in online users asset list.


*2. Diagnosis

2.1 Findings

1. In the traffic ranking, there is no outbound traffic for the critical app server (10.60.24.4).
2. Captured packet filter by the server IP 10.60.24.4 and both internal & external interface when the server is pinging 8.8.8.8. There is only ICMP reply packet which prove that there is no outbound traffic.
3. Captured packet filter by the firewall IP 10.60.19.132 when the critical app server is pinging 10.60.19.132. However, there is only ICMP reply packet which prove that there is no outbound traffic.
4. From the traceroute result from server IP 10.60.24.4 and one of the online user IP 10.60.26.31 to 8.8.8.8, they are both going through same hop.


2.2 Screenshot

Packet for eth2 when pinging 8.8.8.8



Packet for eth3 when pinging 8.8.8.8



Packet for any port when pinging firewall 10.60.19.132



Traceroute



2.3 Next Step

As the NGAF firewall device is deployed in virtual wire mode that will not affect the routing, please proceed to check the configuration on the Core Switch.


*3. Solutions
3.1 Suggestions
Kindly check for the following items settings. (Please refer to the network diagram attachment below when checking)

1. Double confirm that there is no cable connected from Core Switch and FortiGate Firewall directly.

2. Verify if there is any PBR configured in the Core Switch that will affect the routing to the traffic of 10.60.24.4.

3. Verify that there is no redundant Core Switch inter-connected to the main Core Switch to avoid the 10.60.24.4 traffic flow and route to the redundant Core Switch.

4. If none of the above is configured, kindly connect a PC to the main Core Switch and mirror the traffic of the port connected to the NGAF firewall and 10.60.24.4 for packet capturing.

5. You may refer to the following link for how to mirror the traffic of the port for Cisco Catalyst Switches User.
    https://www.cisco.com/c/en/us/support/docs/switches/catalyst-6500-series-switches/10570-41.html








822416283bc5f2a27f.png (568.6 KB, Downloads: 990)

822416283bc5f2a27f.png

885786283bc9a8d222.png (568.6 KB, Downloads: 994)

885786283bc9a8d222.png

11526283bd3b0c94a.png (568.6 KB, Downloads: 998)

11526283bd3b0c94a.png

Like this topic? Like it or reward the author.

Creating a topic earns you 5 coins. A featured or excellent topic earns you more coins. What is Coin?

Enter your mobile phone number and company name for better service. Go

Alizaan Lv2Posted 04 Jun 2023 21:13
  
Thanks for sharing
Emjay Lv1Posted 29 May 2023 15:39
  
Thanks for sharing this helpful post. easy to understand
Zonger Lv4Posted 23 Mar 2023 04:23
  
This is great share. Very helpful
Pilita Lv2Posted 21 Mar 2023 17:20
  
well written and interesting also
RobertonY Lv2Posted 21 Mar 2023 17:18
  
This can be helpful to other users.
MarioC Lv2Posted 21 Mar 2023 17:15
  
demonstrates a deep understanding of the topic
Lilia Lv2Posted 21 Mar 2023 17:12
  
Very engaging and interesting.
Cesar Lv2Posted 21 Mar 2023 17:10
  
easy to read and understand, with a clear and concise writing style that flows smoothly from one idea to the next.
Josepina31 Lv2Posted 21 Mar 2023 17:07
  
The article is innovative, providing new insights and perspectives on the topic that have not been explored before.
CptArmando Lv2Posted 21 Mar 2023 17:03
  
The article provides a comprehensive analysis of the topic at hand, covering all relevant aspects in detail.