#Troubleshooting# Critical App Server visibility in Online Users Asset List
  

JokerAce Lv1Posted 17 May 2022 23:56

#Troubleshooting# Critical App Server 10.60.24.4 visible in Top Users Traffic Ranking report but can't search it and visible in Online Users Asset List

*Product: NGAF

*Version: 8.0.26

*1. Introduction

1.1 Scenario

Deployed an NGAF between the customer's existing FortiGate firewall and Core Switch with virtual wire mode.

Configured virtual wire mode with 2 zones which is LAN & WAN zone where the LAN zone is connected to the core switch and WAN zone is connected to FortiGate firewall.

Critical App Server 10.60.24.4 is connected to the LAN zone. Configured user authentication and selected LAN zone as authentication zone in Authentication Policy.

The issue we are facing is that a Critical App Server 10.60.24.4 which only appears and is visible in traffic ranking top users by traffic report but in online users asset list we can't search it as 10.60.24.4 is not appear and visible in online users asset list.


*2. Diagnosis

2.1 Findings

1. In the traffic ranking, there is no outbound traffic for the critical app server (10.60.24.4).
2. Captured packet filter by the server IP 10.60.24.4 and both internal & external interface when the server is pinging 8.8.8.8. There is only ICMP reply packet which prove that there is no outbound traffic.
3. Captured packet filter by the firewall IP 10.60.19.132 when the critical app server is pinging 10.60.19.132. However, there is only ICMP reply packet which prove that there is no outbound traffic.
4. From the traceroute result from server IP 10.60.24.4 and one of the online user IP 10.60.26.31 to 8.8.8.8, they are both going through same hop.


2.2 Screenshot

Packet for eth2 when pinging 8.8.8.8

275186283bdbb05432.png

Packet for eth3 when pinging 8.8.8.8

572696283bdf0cc319.png

Packet for any port when pinging firewall 10.60.19.132

412046283be0cba8b3.png

Traceroute

900406283be637d451.png


2.3 Next Step

As the NGAF firewall device is deployed in virtual wire mode that will not affect the routing, please proceed to check the configuration on the Core Switch.


*3. Solutions
3.1 Suggestions
Kindly check for the following items settings. (Please refer to the network diagram attachment below when checking)

1. Double confirm that there is no cable connected from Core Switch and FortiGate Firewall directly.

2. Verify if there is any PBR configured in the Core Switch that will affect the routing to the traffic of 10.60.24.4.

3. Verify that there is no redundant Core Switch inter-connected to the main Core Switch to avoid the 10.60.24.4 traffic flow and route to the redundant Core Switch.

4. If none of the above is configured, kindly connect a PC to the main Core Switch and mirror the traffic of the port connected to the NGAF firewall and 10.60.24.4 for packet capturing.

5. You may refer to the following link for how to mirror the traffic of the port for Cisco Catalyst Switches User.
    https://www.cisco.com/c/en/us/support/docs/switches/catalyst-6500-series-switches/10570-41.html

837456283c1cb3ed81.png







822416283bc5f2a27f.png
885786283bc9a8d222.png
11526283bd3b0c94a.png

Like this topic? Like it or reward the author.

Creating a topic earns you 5 coins. A featured or excellent topic earns you more coins. What is Coin?

Enter your mobile phone number and company name for better service. Go

jetjetd Lv5Posted 18 May 2022 00:44
  
Great sharing. thank you very much. this is very helpful.
Sangfor Jojo Lv4Posted 20 May 2022 14:01
  
Hi bro, congratulations, your post has been marked as "Featured".
kmrnliaqat Lv3Posted 01 Jun 2022 18:22
  
informative ..
Raja Azkar Lv2Posted 21 Jun 2022 15:20
  
Useful & informative
regidorreyes Lv4Posted 25 Jun 2022 22:18
  
Great job, very informative
Imran Tahir Lv4Posted 29 Jul 2022 12:41
  
informative
Faisal P Lv8Posted 08 Oct 2022 22:58
  
Thank you very much for the information ...
IPS_len Lv2Posted 14 Nov 2022 14:10
  
Great job, very informative