0

I have a fortigate 40F with an lan1 to lan4 configured as an hardware switch (lan).

I would like to capture switched traffic between hosts, even if it's not in the same IP subnet than the lan configuration.

I have tried

diagnose sniffer packet lan

but it only return broadcast STP trafic

interfaces=[lan]
filters=[none]
1.4294199540 BPDU 'lan2' stp 802.1w, rapid stp, flags [proposal, agreement], bridge-id 8000....
1.4294199560 BPDU 'lan1' stp 802.1w, rapid stp, flags

When I specify a physical interface, it return nothing since there is no ip addres assigned:

diagnose sniffer packet lan1
interfaces=[lan1]
filters=[none]
pcap_lookupnet: lan1: no IPv4 address assigned

I've tried to enable ips-sniffer-mode but didn't changed anything

config system interface
    edit lan
        set ips-sniffer-mode enable
    next
end
Improve this question
4
  • I used to do that on the GUI, but I think you need to specify the switch group, not a physical interface.
    – Zac67 ♦
    Jun 14, 2022 at 10:36
  • Thank you, I think I already tried that but maybe some settings were wrong.
    – Golgot
    Jun 15, 2022 at 20:49
  • Fortigate 40F is a layer 3 firewall and you want to capture traffic on layer 2, switched networks between two hosts? How do you direct layer 2 switched traffic to fortigate 40F firewall? can you verify the switched traffic between those two hosts pass through fortigate 40F?
    – hakkican
    Oct 27, 2022 at 8:42
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can post and accept your own answer.
    – Ron Maupin ♦
    Nov 19, 2022 at 22:59

2 Answers 2

Reset to default
1

Fortigate can only capture traffic that hits the CPU. If packets are switched by an internal hardware switch you will not see them in the capture.

That’s why you see the STP BPDUs that are sent and processed by the kernel, a.k.a. “CPU” to distinguish it from hardware forwarding plane, be it a hardware switch or NPU ASIC.

You should be able to see more traffic that are flowing between subnets, as packets should be routed either between a hardware switch interface (‘lan’) and another interface, or between two VLANs on a hardware switch, therefore the kernel will see them, thus the capture.

However even in this case, Fortigate may accelerate the session by its NP ASIC (on a 40F it’s on a SoC chip), thus you will be able to see session setup and teardown packets like TCP SYN and FIN sequences, but nothing in between. Occasionally you may see some more packets that hit the CPU as the session may be deaccelerated, and then accelerated again.

There is a way around this by setting the ‘set auto-asic-offload disable’ on a firewall policy which allows traffic between L3 interfaces. That would not help to catch traffic which is entirely switched by a hardware switch, as the firewall won’t see such packets at all.

Improve this answer
4
  • I needed to capture traffic between two hosts on internal network and I got an explanation telling switched network traffic on layer 2 can not be captured by layer 3 firewall and in order to capture this traffic switched network traffic should be directed to firewall. How can it be done?
    – hakkican
    Oct 27, 2022 at 8:48
  • Consider moving one of those hosts to a different VLAN on a switch. Make a firewall the default gateway for those VLANs thus traffic between hosts will hit the firewall. Or you can consider implementing some switch port mirroring technique like SPAN which allows capturing all packets on a switch port and directing to some monitoring device for example a firewall. That would require another physical connection for the mirrored traffic between the switch and the firewall.
    – Mindaugas Kubilius
    Oct 27, 2022 at 13:02
  • Moving servers around for just troubleshooting does not look rational.What you mean is creating a vlan and make firewall gateway of this vlan and move these two hosts to that vlan right? What do you mean by pyhsical connections for this port mirroring technique? Is this port mirroring called vlan routing?
    – hakkican
    Oct 31, 2022 at 6:07
  • en.wikipedia.org/wiki/Port_mirroring
    – Mindaugas Kubilius
    Oct 31, 2022 at 10:12
0

If I understand you correctly, you have created an hardware switch on the FortiGate and connected multiple devices on this devices. Now, you would like to capture all packages from a devices, connected to one of the port on the FortiGate.

The easiest way is to do that over the Admin GUI. Network->Packet Capture->Create New->"Select Interface"->Right Click on the Entry->"Start"

(Picture Upload is not working, Error on Serverside )

The Packet Capture record all incoming packages on the port.

I hope that help.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.