sniffer 和 debug flow
sniffer 和 debug flow 復制模板，直接修改IP即可使用： diagnose sys session filter clear diagnose sys session filter proto 6 diagnose sys session filter dport 3389 diagnose sys session filter dst 119.100.1.200 diagnose sys session clear diagnose debug flow filter clear diagnose debug flow filter addr 13.33.231.17 diagnose debug flow filter proto 17 diagnose debug flow filter sport 1263 diagnose debug flow show console enable diagnose debug flow show function-name enable diagnose debug flow trace start 10 diagnose debug enable diagnose sys session filter proto 1 diagnose sys session filter dst 202.106.1.100 diagnose sys session clear diagnose sniffer packet any "host 202.106.1.100 and icmp" 4 diagnose sys session filter proto 1 diagnose sys session filter d 202.106.1.100 diagnose sys session clear diagnose debug flow filter addr 10.100.151.1 diagnose debug flow filter proto 1 diagnose debug flow show function-name enable diagnose debug flow trace start 10 diagnose debug enable diagnose sniffer packet any "host 111.204.123.112 or host 192.168.30.167 and !port 22345 and !port 44300" 4 diagnose sniffer packet any "host 114.114.114.114 and icmp" 4 diagnose sniffer packet any "host 111.204.123.112 and !port 22 and !port 45328" 4 diagnose sniffer packet any "port 161 and host 111.204.123.116 or host 192.168.168.1" 4 ----------------------------
GUI優化腳本：
config system settings
set inspection-mode flow
set gui-multiple-utm-profiles enable
set gui-allow-unnamed-policy enable
set gui-multiple-interface-policy enable
end
config system global
set admintimeout 30
set language simch
set timezone 55
set revision-backup-on-logout enable
end
--------------------
IPsec VPN黑洞路由腳本：
config firewall address
edit "Private_IP_10.0.0.0/8"
set allow-routing enable
set subnet 10.0.0.0 255.0.0.0
next
edit "Private_IP_172.16.0.0/12"
set allow-routing enable
set subnet 172.16.0.0 255.240.0.0
next
edit "Private_IP_192.168.0.0/16"
set allow-routing enable
set subnet 192.168.0.0 255.255.0.0
next
end
config firewall addrgrp
edit "LAN_Private_IP_Group"
set member "Private_IP_10.0.0.0/8" "Private_IP_172.16.0.0/12" "Private_IP_192.168.0.0/16"
set allow-routing enable
next
end
config router static
edit 0
set distance 254
set blackhole enable
set dstaddr "LAN_Private_IP_Group"
next
end
--------------------------
//說明介紹//
Sniffer抓包命令使用：
diagnose sniffer packet any "host 192.168.200.102 and icmp" 4
關於sniffer抓包需注意：如果數據已經被NP加速了，則可能sniffer抓不出來，為了准確的抓到數據，可能需要注意調整一下NP加速和已經建立好的Session： sniffer注意1：在相關的VPN業務流量的策略下臨時關閉NP加速（抓包完畢再打開NP加速）： FGT # config firewall policy FGT (policy) # edit 1 （假設業務相關策略的策略ID為1） FGT (1) # set auto-asic-offload disable FGT (1) # end 這樣所有與策略相關的數據處理會全部走CPU，因此sniffer才可以完整的抓到數據流。 sniffer注意2：對於已經建立起來的會話（數據已經走了NP處理），即便關閉了 NP，也抓不到包，因此需先將此session過濾出來然后再清除掉這條session，讓其再新建就抓到包了： FGT#diagnose sys session filter dst 192.168.200.102 （過濾 目的IP） FGT#diagnose sys session filter proto 1 （過濾協議 1：ICMP 其中包括了ping） FGT#diagnose sys session clear （清除過濾后的Session） FGT# diagnose sys session filter clear //清除session過濾條件 FGT#diagnose sys session filter dst 192.168.200.102 （過濾 目的IP） FGT#diagnose sys session filter proto 6 （過濾協議 6: TCP） FGT#diagnose sys session filter dport 443 （過濾 TCP Port 443端口） FGT#diagnose sys session clear （清除過濾后的Session） FGT#diagnose sys session filter src 192.168.200.102 （過濾 源IP） FGT#diagnose sys session filter proto 6 （過濾協議 6: TCP） FGT#diagnose sys session filter dport 443 （過濾 TCP Port 443端口） FGT#diagnose sys session clear （清除過濾后的Session） FGT# diagnose sys session filter clear //清除session過濾條件 FGT#diagnose sys session filter dst 192.168.200.102 （過濾 目的IP） FGT#diagnose sys session filter proto 17 （過濾協議 17: UDP） FGT#diagnose sys session filter dport 500 （過濾 UDP Port 500端口） FGT#diagnose sys session clear （清除過濾后的Session） FGT# diagnose sys session filter clear //清除session過濾條件 最后開啟抓包，FortiGate抓包命令如下： FGT#diagnose sniffer packet any "host 192.168.200.102 and icmp" 4 FGT#diagnose sniffer packet any "host 218.203.193.18 and esp” 4 FGT#diagnose sniffer packet any "port 500 or port 4500 and host 1.1.1.1" 4 FGT#diagnose sniffer packet any "host 10.101.2.2 or host 111.204.123.112 and port 22" 4 FGT#diagnose sniffer packet any "host 60.31.254.5 and port 53" 4 FGT#diagnose sniffer packet any "host 192.168.118.57 and icmp" 4 FGT#diagnose sniffer packet any "port 9999" 4 ----------------------------
Debug Flow的使用：
Debug Flow 通常用於定位調試穿過或訪問FortiGate數據流的處理過程，如果不通，可以使用debug flow協助定位，非常好用的數據流分析工具。
Debug flow的命令解析： #diagnose debug flow filter addr x.x.x.x //過濾某個IP #diagnose debug flow show console enable //在串口上顯示trace內容 #diagnose debug flow show function-name enable //顯示功能模塊名稱 #diagnose debug flow trace start 999 //開啟debug flow trace並顯示999條debug信息 #diagnose debug enable //開啟debug命令 #diagnose debug flow trace stop //關閉debug flow trace #diagnose debug flow filter clear //清除過濾條件 #diagnose debug disable //關閉debug命令 #diagnose debug reset //重置所有的debug命令 最關鍵的Debug flow的過濾條件，舉例： 1.過濾ping流量 #diagnose debug flow filter proto 1 改變相應的proto就可以過濾相應的協議流量 proto 1 為ICMP協議 proto 6 為TCP協議 proto 17 為UDP協議 2.過濾某個IP的ping流量 #diagnose debug flow filter addr 192.168.1.100 #diagnose debug flow filter proto 1 過濾192.168.1.100的ping流量 3.過濾某個端口號 #diagnose debug flow filter port 8080 過濾port為8080的流量 4.過濾某個IP的Port8080流量 #diagnose debug flow filter addr 192.168.1.100 #diagnose debug flow filter port 8080 過濾192.168.1.100的port8080的流量 5.過濾源端口/目的端口 #diagnose debug flow filter sport 80 ----->過濾源端口80 // #diagnose debug flow filter dport 25 ----->過濾目的端口25 6.過濾源IP/目的IP #diagnose debug flow filter saddr x.x.x.x -----> 過濾源IP x.x.x.x // #diagnose debug flow filter daddr y.y.y.y ----->過濾目的IP y.y.y.y 常用debug flow舉例1：抓取10.10.10.100且ICMP的流量 diagnose debug flow filter addr 101.231.244.193 diagnose debug flow filter proto 1 diagnose debug flow show console enable diagnose debug flow show function-name enable diagnose debug flow trace start 10 diagnose debug enable 常用debug flow舉例2：抓取10.10.10.100且TCP端口為10443的流量 diagnose debug flow filter addr 10.10.10.100 diagnose debug flow filter proto 6 diagnose debug flow filter port 10443 diagnose debug flow show console enable diagnose debug flow show function-name enable diagnose debug flow trace start 10 diagnose debug enable 常用debug flow舉例3：抓取10.10.10.100且UDP端口為500的流量 diagnose debug flow filter addr 10.10.10.100 diagnose debug flow filter proto 17 diagnose debug flow filter port 500 diagnose debug flow show console enable diagnose debug flow show function-name enable diagnose debug flow trace start 10 diagnose debug enable 常用的debug flow復制粘貼腳本： diagnose sys session filter dst 10.3.10.1 diagnose sys session filter proto 1 diagnose sys session clear diagnose debug flow filter addr 10.3.10.1 diagnose debug flow filter proto 1 diagnose debug flow show console enable diagnose debug flow show function-name enable diagnose debug flow trace start 10 diagnose debug enable diagnose sys session filter dst 10.255.16.114 diagnose sys session clear diagnose debug flow filter addr 10.255.16.114 diagnose debug flow filter proto 6 diagnose debug flow filter port 443 diagnose debug flow show console enable diagnose debug flow show function-name enable diagnose debug flow trace start 100 diagnose debug enable // diagnose debug flow filter port 53 diagnose debug flow filter proto 17 diagnose debug flow filter port 80 // diagnose debug flow filter addr 103.17.88.71 diagnose debug flow filter proto 6 diagnose debug flow filter port 57720 diagnose debug flow show console enable diagnose debug flow show function-name enable diagnose debug flow trace start 10 diagnose debug enable diagnose sys session filter src 172.40.1.252 diagnose sys session clear diagnose debug flow filter addr 124.89.90.125 diagnose debug flow filter proto 17 diagnose debug flow show console enable diagnose debug flow show function-name enable diagnose debug flow trace start 10 diagnose debug enable diagnose sys session filter dst 116.90.243.115 diagnose sys session clear diagnose debug flow filter addr 222.92.132.166 diagnose debug flow filter proto 6 diagnose debug flow filter port 3134 diagnose debug flow show console enable diagnose debug flow show function-name enable diagnose debug flow trace start 6 diagnose debug enable diagnose debug flow filter addr 192.168.1.1 diagnose debug flow filter proto 17 diagnose debug flow show console enable diagnose debug flow show function-name enable diagnose debug flow trace start 6 diagnose debug enable diagnose sys session filter src 172.40.1.252 diagnose sys session clear diagnose sys session filter policy 5 diagnose sys session list diagnose debug flow filter addr 58.18.31.148 diagnose debug flow filter proto 17 diagnose debug flow filter port 161 diagnose debug flow show console enable diagnose debug flow show function-name enable diagnose debug flow trace start 10 diagnose debug enable ------------------------
CPU/MEM 過高，查看進程，以及臨時Kill進程命令: 查看進程，並kill進程命令： diag sys top-summary diagnose sys top 5 33 diagnose sys kill 9 <PID> --------------------
IPsec VPN隧道起不來的問題定位：
首先，sniffer抓包確認UDP 500/4500 雙方通信是否正常
diagnose sniffer packet any "host 116.6.100.241 and ( port 500 or port 4500)" 4
diagnose sniffer packet any "host 202.106.1.35 and ( port 500 or port 4500)" 4
//IP換成對方公網IP
UDP 500 或 UDP 4500 這兩個端口是IPsec VPN協商協議IKE會使用的端口，一定要互通要通暢，否則VPN無法正常建立，確認互通正常在進行下一步定位
然后，通過日志，debug app ike 確認問題是出在第一階段還是第二階段
diagnose vpn ike log-filter name ipsec_wuxian1 // 第一階段名稱
diagnose vpn ike log-filter dst-addr4 124.65.148.86 //IP換成對方公網IP
diagnose debug application ike -1
diagnose debug enable
注意事項：debug app ike的時候要注意，自己不要主動發起連接，需要把第一階段/第二階段的自動協商關閉
注意一：可能需要關掉一階段第二階段的自動協商
如果是5.6之后的版本，只需要一條命令就可以完全關閉自己的主動發起的IKE連接請求：
config vpn ipsec phase1-interface
edit VPN-P1（第一階段名稱）
set passive-mode enable //永遠不主動發起IKE請求，即便使用流量觸發，也不主動發起
next
end
如果是舊版本(5.2/5.4)則需要分別關閉第一階段和第二階段的自動協商：
BJLab-240D # config vpn ipsec phase1-interface
BJLab-240D (phase1-interface) # edit VPN-P1（第一階段名稱）
BJLab-240D (VPN) # set auto-negotiate disable
BJLab-240D (VPN) # end
BJLab-240D # config vpn ipsec phase2-interface
BJLab-240D (phase1-interface) # edit VPN-P2 （第二階段名稱）
BJLab-240D (VPN) # set auto-negotiate disable
BJLab-240D (VPN) # end
注意二：有時候需要重置IPsec VPN的連接（請謹慎使用，所有的VPN都會重新連接IKE，一般不需要使用這個命令）
diagnose vpn ike restart //重新主動發起連接
diagnose vpn tunnel reset //重置第二階段
diagnose vpn ike restart
diagnose vpn ike gateway clear
重置IPsec VPN通道，有VDOM的情況下：
FG200D4615810562 # config vdom
FG200D4615810562 (vdom) # edit root
FG200D4615810562 (root) # diagnose vpn tunnel reset
FG200D4615810562 (root) # diagnose vpn ike restart
查看IPsec VPN狀態命令：
diagnose vpn ike gateway list
diagnose vpn tunnel list
----------------------
常用的debug application命令： debug L2TP VPN命令： diagnose debug application l2tp -1 diagnose debug enable debug SSL VPN命令： diagnose debug application sslvpn -1 diagnose debug enable debug IPsec VPN命令： # diagnose debug console timestamp enable # diagnose debug application ike -1 # diagnose debug enable # diagnose debug application ike 0 // 關閉debug # diagnose debug disable //關閉debug # diagnose debug reset //關閉debug debug Radius/TACACS+認證命令： diagnose test authserver radius radius-server user 1 123456 diagnose test authserver tacacs+ tacacs-server user1 123456 diagnose debug application fnbamd -1 diagnose debug enable debug LDAP認證命令： diagnose test authserver ldap ldap-server user1 123456 diagnose debug application fnbamd -1 diagnose debug enable debug fortguard更新命令： execute update-now diagnose debug application update -1 diagnose debug enable 關閉debug命令： # diagnose debug disable # diagnose debug reset --------------------------
查看接口錯包以及接口MAC地址： # diagnose netlink device list # get hardware nic wan1 Driver Name :Fortinet NP4Lite Driver Version :1.0.1 Admin :up Current_HWaddr 08:5b:0e:6f:d9:76 Permanent_HWaddr 08:5b:0e:6f:d9:76 Status :up Speed :100 Duplex :Full Host Rx Pkts :3095836 Host Rx Bytes :432192732 Host Tx Pkts :773199 Host Tx Bytes :125268953 Rx Pkts :4389000 Rx Bytes :1112122188 Tx Pkts :1888066 Tx Bytes :251656337 rx_buffer_len :2048 Hidden :No cmd_in_list : 0 promiscuous : 1 enabled 802.1x : 0 authorized : 0 mac bypass : 0 -----------------------------
L2TP/PPTP VPN配置腳本：
config vpn l2tp
set status enable
set eip 172.16.252.254
set sip 172.16.252.200
set usrgrp "Guest-group"
end
config vpn pptp
set status enable
set eip 172.16.253.254
set sip 172.16.253.200
set usrgrp "Guest-group"
end
config firewall policy
edit 0
set srcintf "wan1"
set dstintf "any"
set srcaddr "all"
set dstaddr "all"
set action accept
set schedule "always"
set service "ALL"
set nat enable
next
end
config user local
edit "guest"
set type password
set passwd 1q2w3e4r
next
end
L2TP Over IPsec 配置腳本：
config vpn l2tp
set status enable
set eip 172.16.254.254
set sip 172.16.254.200
set usrgrp "Guest-group"
end
config firewall policy
edit 0
set srcintf "wan1"
set dstintf "any"
set srcaddr "all"
set dstaddr "all"
set action accept
set schedule "always"
set service "ALL"
set nat enable
next
end
config user local
edit "guest"
set type password
set passwd 1q2w3e4r
next
end
config vpn ipsec phase1-interface
edit "L-O-I"
set type dynamic
set interface "port1"
set keylife 3600
set peertype any
set psksecret 1q2w3e4r
next
end
config vpn ipsec phase2-interface
edit "L-O-I"
set phase1name "L-O-I"
set pfs disable
set encapsulation transport-mode
set l2tp enable
set keylifeseconds 3600
next
end
config firewall policy
edit 0
set name "L2TP_Over_IPsec"
set srcintf "L-O-I"
set dstintf "any"
set srcaddr "all"
set dstaddr "all"
set action accept
set schedule "always"
set service "ALL"
set nat enable
next
end
--------------------------
設備flash里OS查看以及系統常用命令： 升級版本時會保留升級前的版本和配置文件在非活動分區（‘Active列’的‘No’對應的） FGT90D3Z14014233 # diagnose sys flash list 查看當前運行版本和配置文件所在分區 Partition Image TotalSize(KB) Used(KB) Use% Active 1 FGT90D-5.04-FW-build1011-151221 253871 37344 15% No 2 FGT90D-5.02-FW-build701-151203 253871 33078 13% Yes 3 ETDB-1.00000 1388840 4456 0% No Image build at Dec 3 2015 04:50:38 for b0701 FGT90D3Z14014233 # “Partition”列 1是primary分區 2是secondary分區 “Active”列 yes對應是每次啟動時用的版本和配置文件分區 FGT90D3Z14014233 # exec set-next-reboot ？ <primary/secondary> partition FGT90D3Z14014233 # exec set-next-reboot primary（或secondary，注意不同情況下此處輸入的不一樣）；將啟動分區改更為primary分區（分區1） FGT90D3Z14014233 # exec reboot ；用primary分區（分區1）的版本和配置文件重啟設備-----回退到升級前的版本和配置文件 BJFG300D # get system admin list username local device vdom profile remote started admin ssh SE25(FSW):60.247.121.248:22 root super_admin 192.168.118.25:51208 2016-12-02 09:57:15 FG100D3G13828247 # diagnose sys tcpsock 0.0.0.0:10400->0.0.0.0:0->state=listen err=0 sockflag=0x8 rma=0 wma=0 fma=0 tma=0 0.0.0.0:10401->0.0.0.0:0->state=listen err=0 sockflag=0x8 rma=0 wma=0 fma=0 tma=0 0.0.0.0:10402->0.0.0.0:0->state=listen err=0 sockflag=0x8 rma=0 wma=0 fma=0 tma=0 FG100D3G13828247 # diagnose hardware deviceinfo disk Disk Internal ref: 255 29.8GB type: SSD [ATA 32GB SATA Flash] dev: /dev/sda Disk SYSTEM(boot) ref: 1.9GB type: USB [FORTINET 67_V060324_002] dev: /dev/sdb partition ref: 247.0MB, 208.0MB free mounted: N label: dev: /dev/sdb1(boot) start: 0 partition ref: 247.0MB, 197.0MB free mounted: Y label: dev: /dev/sdb2(boot) start: 0 partition ref: 19 1.3GB, 1.3GB free mounted: Y label: 0BEC4ED9705DC13A dev: /dev/sdb3 start: 0 Total available disks: 2 Max SSD disks: 1 Available storage disks: 0 # diag hardware smartctl /dev/sda -a 查看Flash損耗 100D的負載如何，記錄一下下面的命令的輸出 get sys status get sys perf status（執行5次） get hard status exec disk list sho log disk set sho log disk filter diag sys session full-stat（執行5次） diag sys top (運行1分鍾) diag vpn tunnel list # get hardware status # get system status # get system performance status # diagnose sys flash list # diagnose autoupdate versions # diagnose hardware sysinfo memory # diagnose hardware sysinfo shm # diagnose debug crashlog read # diagnose hardware deviceinfo disk # diagnose sys session stat # diagnose sys top 5 40 (press "q" to quit the sys top) # diagnose sys top-summary (press "q" to quit the sys top) # get hardware memory # diagnose hardware sysinfo memory # diag hardware sysinfo slab # fnsyctl df -h # execute log delete-all ------------------
link-monitor配置：
FOS 5.4中的網關檢測功能：
config system link-monitor
edit "LT"
set srcintf "wan1"
set server 222.249.171.217
set gateway-ip 222.249.171.217
set interval 3
end
------------------------
IPS進程定位命令： 2) Enable memory tracking. diag ips memory track-size 1536 1792 diag ips memory track enable 3) run following commands: get sys status diag autoupdate version get sys per status diag sys top-summary "-n 30 -i 5 -s mem" diag sys top 99 5 diag hard sys mem diag hard sys shm diag hardware sysinfo slab diag ips memory status diag ips memory track-print diag ips session content diag ips session performance diag ips session status diag ips session content diagnose ips raw status diag test application ipsmonitor 3 diag test application ipsmonitor 1 Please also collect the output of these diagnose commands: # fnsysctl df -h Find the process id of ips engine daemon, then run these commands: # fnsysctl cat /proc/[process id]/status # fnsysctl cat /proc/[process id]/maps # fnsysctl cat /proc/[process id]/smaps # fnsysctl cat /proc/[process id]/statm ------------------
命令行grep過濾查看使用：
FGVM000000091991 # show full-configuration | grep 10000
set database-overflow-max-lsas 10000
FGVM000000091991 # show full-configuration | grep -f 10000
config router ospf
set abr-type standard
set auto-cost-ref-bandwidth 1000
set bfd disable
set database-overflow disable
set database-overflow-max-lsas 10000 <---
set database-overflow-time-to-recover 300
set default-information-metric 10
set default-information-metric-type 2
set default-information-originate disable
set default-information-route-map ''
set default-metric 10
set distance 110
set distance-external 110
set distance-inter-area 110
set distance-intra-area 110
set distribute-list-in ''
set restart-mode none
set restart-period 120
set rfc1583-compatible disable
set router-id 0.0.0.0
set spf-timers 5 10
end
------------------
常用系統排錯命令，CPU/MEM過高：
# get system status
# get system performance status
# diagnose hardware sysinfo memory
MemTotal: 995012 kB
MemFree: 376716 kB
HighTotal: 0 kB
HighFree: 0 kB
LowTotal: 995012 kB
LowFree: 376716 kB
# diagnose hardware sysinfo slab
kmem_cache 80 80 248 5 5 1 0 : 252 126
tcp_session 106 416 960 45 104 1 622 : 124 62
ip_session 98 148 896 37 37 1 1024 : 124 62
tcp_open_request 20 20 192 1 1 1 38 : 252 126
ip_dst_cache 126 312 320 26 26 1 195 : 124 62
ip_fib_hash 23 112 32 1 1 1 0 : 252 126
arp_cache 15 15 256 1 1 1 0 : 252 126
# diagnose sys top 10
Run Time: 1 days, 18 hours and 55 minutes
1U, 0N, 0S, 99I; 3951T, 2633F
ipsengine 453 S < 0.9 1.8
ipsengine 454 S < 0.4 1.8
reportd 81 S 0.0 3.5
miglogd 64 S 0.0 1.5
miglogd 118 S 0.0 1.1
pyfcgid 6619 S 0.0 0.8
pyfcgid 6620 S 0.0 0.8
pyfcgid 6621 S 0.0 0.8
pyfcgid 6617 S 0.0 0.8
httpsd 5319 S 0.0 0.7
cmdbsvr 45 S 0.0 0.7
newcli 6594 S 0.0 0.7
httpsd 6390 S 0.0 0.6
ipshelper 75 S < 0.0 0.6
httpsd 66 S 0.0 0.5
wad 404 S 0.0 0.5
httpsd 116 S 0.0 0.5
newcli 6624 R 0.0 0.4
newcli 6592 S 0.0 0.4
forticron 76 S 0.0 0.4
模塊名字 進程號 狀態 CPU MEM
shift + P 按照CPU使用率排序
shift + M 按照MEM使用率排序
Ctrl + C 中斷
FG200D3915803188 # diagnose sys top-summary
CPU [|||||||||||||||||||| ] 50.0%
Mem [||||||||||||| ] 34.0% 1353M/3951M
Processes: 20 (running=1 sleeping=96)
PID RSS ^CPU% MEM% FDS TIME+ NAME
* 400 17M 0.0 0.4 30 00:01.50 scanunitd [x3]
401 14M 0.0 0.4 19 00:00.60 urlfilter
670 12M 0.0 0.3 14 00:00.10 ovrd
35 3M 0.0 0.1 5 00:00.00 mrvl3135_worker
45 29M 0.0 0.7 12 00:35.18 cmdbsvr
51 13M 0.0 0.3 89 00:01.10 zebos_launcher [x12]
6332 11M 0.0 0.3 35 00:00.00 iked
63 12M 0.0 0.3 12 00:00.00 uploadd
64 60M 0.0 1.5 55 00:38.76 miglogd [x2]
65 12M 0.0 0.3 8 00:00.00 kmiglogd
66 34M 0.0 0.9 19 00:05.30 httpsd [x4]
68 12M 0.0 0.3 8 00:00.00 getty
69 147M 0.0 3.7 107 13:55.58 ipsmonitor [x4]
72 12M 0.0 0.3 11 00:00.00 merged_daemons
73 13M 0.0 0.3 12 00:00.10 fnbamd
74 12M 0.0 0.3 12 00:00.20 fclicense
76 17M 0.0 0.4 22 00:00.20 forticron
77 14M 0.0 0.4 15 00:00.98 forticldd
78 13M 0.0 0.4 39 00:00.19 authd [x3]
79 13M 0.0 0.3 19 00:00.00 foauthd
FG200D3915803188 # diagnose sys top-summary "-n 100"
CPU [|||||||||||||||||||| ] 50.0%
Mem [||||||||||||| ] 34.0% 1353M/3951M
Processes: 46 (running=1 sleeping=96)
PID RSS ^CPU% MEM% FDS TIME+ NAME
* 400 17M 0.0 0.4 30 00:01.50 scanunitd [x3]
401 14M 0.0 0.4 19 00:00.60 urlfilter
670 12M 0.0 0.3 14 00:00.10 ovrd
35 3M 0.0 0.1 5 00:00.00 mrvl3135_worker
45 29M 0.0 0.7 12 00:35.18 cmdbsvr
51 13M 0.0 0.3 89 00:01.10 zebos_launcher [x12]
6332 12M 0.0 0.3 35 00:00.00 iked
63 12M 0.0 0.3 12 00:00.00 uploadd
64 60M 0.0 1.5 55 00:38.76 miglogd [x2]
65 12M 0.0 0.3 8 00:00.00 kmiglogd
66 34M 0.0 0.9 19 00:05.40 httpsd [x4]
68 12M 0.0 0.3 8 00:00.00 getty
69 147M 0.0 3.7 107 13:56.40 ipsmonitor [x4]
72 12M 0.0 0.3 11 00:00.00 merged_daemons
73 13M 0.0 0.3 12 00:00.10 fnbamd
74 12M 0.0 0.3 12 00:00.20 fclicense
76 17M 0.0 0.4 22 00:00.20 forticron
77 14M 0.0 0.4 15 00:00.98 forticldd
78 13M 0.0 0.4 39 00:00.19 authd [x3]
79 13M 0.0 0.3 19 00:00.00 foauthd
80 12M 0.0 0.3 9 00:00.12 httpclid
81 140M 0.0 3.6 16 00:12.38 reportd
83 14M 0.0 0.4 32 00:00.10 voipd
399 22M 0.0 0.6 606 07:35.60 wad [x3]
398 12M 0.0 0.3 48 00:00.25 proxyd [x2]
88 14M 0.0 0.4 13 00:35.36 updated
6617 48M 0.0 1.2 13 00:00.44 pyfcgid [x5]
91 13M 0.0 0.3 13 00:00.37 snmpd
92 13M 0.0 0.3 21 00:00.60 dhcpd
94 12M 0.0 0.3 16 00:00.60 ntpd
95 44M 0.0 1.1 19 00:01.23 sshd [x6]
96 12M 0.0 0.3 10 00:00.00 telnetd
97 12M 0.0 0.3 13 00:00.80 quard
98 12M 0.0 0.3 10 00:00.30 alertmail
99 14M 0.0 0.4 28 00:09.36 dnsproxy
103 13M 0.0 0.3 11 00:00.20 eap_proxy
104 16M 0.0 0.4 16 00:00.10 fgfmd
105 16M 0.0 0.4 23 00:00.90 cw_acd
108 12M 0.0 0.3 12 00:00.00 wpad_ac
109 12M 0.0 0.3 13 00:00.10 fortilinkd
110 14M 0.0 0.4 19 00:00.50 cu_acd
111 12M 0.0 0.3 11 00:00.10 swctrl_authd
112 12M 0.0 0.3 13 00:00.00 flcfgd
113 764K 0.0 0.0 13 00:00.00 usbmuxd
114 12M 0.0 0.3 11 00:00.00 fsd
115 12M 0.0 0.3 11 00:00.00 radius-das
FG200D3915803188 # diagnose sys top-summary "-s mem -i 60 -n 10"
CPU [|||||||||||||||||||| ] 50.0%
Mem [||||||||||||| ] 34.0% 1368M/3951M
Processes: 10 (running=1 sleeping=96)
PID RSS CPU% ^MEM% FDS TIME+ NAME
* 69 147M 0.0 3.7 107 14:00.60 ipsmonitor [x4]
81 140M 0.0 3.6 16 00:12.43 reportd
64 60M 0.0 1.5 55 00:38.97 miglogd [x2]
6617 56M 0.0 1.4 13 00:00.73 pyfcgid [x5]
95 44M 0.0 1.1 19 00:01.31 sshd [x6]
66 34M 0.0 0.9 19 00:05.27 httpsd [x4]
45 29M 0.0 0.7 12 00:35.18 cmdbsvr
399 22M 0.0 0.6 536 07:36.87 wad [x3]
400 17M 0.0 0.4 30 00:01.50 scanunitd [x3]
76 17M 0.0 0.4 22 00:00.20 forticron
-------------------------
# diagnose hardware sysinfo shm
SHM counter: 62032
SHM allocated: 38210422
SHM total: 3637624832
conservemode: 0 NO System/Proxy | 1 Proxy conserve mode | 2 System/Kernel conserve mode
shm last entered: n/a
system last entered: n/a
SHM FS total: 3715198976
SHM FS free: 3675385856
SHM FS avail: 3675385856
SHM FS alloc: 39813120
2 System/Kernel conserve mode
MEM LowTotal<1GB
Red : LowFree <20% LowTotal Green : LowFree >30% LowTotal
MEM LowTotal >= 1GB
Red : LowFree=200M Green : LowFree = 300M
Actions:
Proxies are bypassed
FortiGate configuration cannot be changed
1 Proxy conserve mode
# get system arp
# get system performance firewall statistics
# get system performance firewall packet-distribution
# get system session status
# get system session list
配置FortiManger管理：
config system central-management
set type fortimanager
set fmg "192.168.147.250"
set fmg-source-ip 101.1.1.2
end
----------------
FGT最常用命令 # config system global # set hostname “FGT-Master“ //設備命名 # set language simch //語言切換成簡體中文 # set timezone 55 //時區切換為（GMT+8） # set tcp-halfclose-timer 120 //TCP會話空閑時長調整 # set tcp-halfopen-timer 10 # set tcp-timewait-timer 1 # set udp-idle-timer 180 //UDP會話空閑時長調整 # end # config system session-ttl //TCP established空閑時長調整 # set default 3600 # end # get system status //查看系統狀態 # get router info routing-table all //查看路由表 # get system arp //查看ARP表 # diagnose ip address list //查看接口IP_list # get system performance status //查看設備運行性能狀態（CPU/MEM/新建/並發） # get system performance top //查看系統允許top進程 ---------------
config ips global
set sync-session-ttl disable
config system npu
set dedicated-management-cpu enable
set np6-cps-optimization-mode disable
// 單物理CPU（多核CPU），開啟優化后，性能提升30%，多個物理CPU（多核CPU），現實項目中不建議使用這條命令，提供了CPU的新建能力 ||NGFW優化
IPS/AV不能使用proxy和flow的混合使用
密碼恢復：
maintainer bcpbFG900D3917800436 bcpbFG1K2D3I17800162
報文亂序：
開啟了這個命令:
set delay-tcp-npu-session enable
config firewall policy
edit 141
set srcintf "VLAN4" "VLAN1010" "VLAN3000"
set dstintf "VLAN3"
set srcaddr "192.168.121.187"
set dstaddr "all"
set action accept
set schedule "always"
set service "ALL"
set delay-tcp-npu-session enable
set nat enable
set ippool enable
set poolname "58.213.19.157"
next
end
------------------------
FG100E4Q16003872 # get sys perf stat CPU states: 2% user 2% system 0% nice 96% idle 0% iowait 0% irq 0% softirq CPU0 states: 4% user 2% system 0% nice 94% idle 0% iowait 0% irq 0% softirq CPU1 states: 0% user 0% system 0% nice 100% idle 0% iowait 0% irq 0% softirq CPU2 states: 6% user 5% system 0% nice 89% idle 0% iowait 0% irq 0% softirq CPU3 states: 0% user 0% system 0% nice 100% idle 0% iowait 0% irq 0% softirq Memory: 3112996k total, 1182116k used (37%), 1857320k free (59%), 73560k freeable (2%) Average network usage: 317 / 284 kbps in 1 minute, 293 / 206 kbps in 10 minutes, 220 / 63 kbps in 30 minutes Average sessions: 364 sessions in 1 minute, 279 sessions in 10 minutes, 145 sessions in 30 minutes Average session setup rate: 26 sessions per second in last 1 minute, 18 sessions per second in last 10 minutes, 6 sessions per second in last 30 minutes Average NPU sessions: 0 sessions in last 1 minute, 0 sessions in last 10 minutes, 0 sessions in last 30 minutes Average nTurbo sessions: 0 sessions in last 1 minute, 0 sessions in last 10 minutes, 0 sessions in last 30 minutes Virus caught: 0 total in 1 minute IPS attacks blocked: 0 total in 1 minute Uptime: 4 days, 11 hours, 14 minutes
修改接口MTU TCP_MSS 查看接口MTU diagnose netlink interface list | grep mtu FG100E4Q16003872 # diagnose netlink interface list | grep mtu if=lo family=00 type=772 index=1 mtu=16436 link=0 master=0 if=dummy0 family=00 type=1 index=2 mtu=1500 link=0 master=0 if=nturbo_rx family=00 type=1 index=3 mtu=1500 link=0 master=0 if=nturbo_tx family=00 type=1 index=4 mtu=1500 link=0 master=0 if=dmz family=00 type=1 index=5 mtu=1500 link=0 master=0 if=mgmt family=00 type=1 index=6 mtu=1500 link=0 master=0 if=wan1 family=00 type=1 index=7 mtu=1500 link=0 master=0 if=wan2 family=00 type=1 index=8 mtu=1500 link=0 master=0 if=ha1 family=00 type=1 index=9 mtu=1500 link=0 master=0 if=ha2 family=00 type=1 index=10 mtu=1500 link=0 master=0 if=port1 family=00 type=1 index=11 mtu=1500 link=0 master=32 if=port2 family=00 type=1 index=12 mtu=1500 link=0 master=32 if=port3 family=00 type=1 index=13 mtu=1500 link=0 master=0 if=port4 family=00 type=1 index=14 mtu=1500 link=0 master=0 if=port5 family=00 type=1 index=15 mtu=1500 link=0 master=0 if=port6 family=00 type=1 index=16 mtu=1500 link=0 master=0 if=port7 family=00 type=1 index=17 mtu=1500 link=0 master=0 if=port8 family=00 type=1 index=18 mtu=1500 link=0 master=0 if=port9 family=00 type=1 index=19 mtu=1500 link=0 master=0 if=port10 family=00 type=1 index=20 mtu=1500 link=0 master=0 if=port11 family=00 type=1 index=21 mtu=1500 link=0 master=0 if=port12 family=00 type=1 index=22 mtu=1500 link=0 master=0 if=port13 family=00 type=1 index=23 mtu=1500 link=0 master=0 if=port14 family=00 type=1 index=24 mtu=1500 link=0 master=0 if=port15 family=00 type=1 index=25 mtu=1500 link=0 master=0 if=port16 family=00 type=1 index=26 mtu=1500 link=0 master=0 if=npu0_vlink0 family=00 type=1 index=27 mtu=15324 link=0 master=0 if=npu0_vlink1 family=00 type=1 index=28 mtu=15324 link=0 master=0 if=modem family=00 type=512 index=29 mtu=1500 link=0 master=0 if=root family=00 type=772 index=30 mtu=16436 link=0 master=0 if=ssl.root family=00 type=65534 index=31 mtu=1500 link=0 master=0 if=BOND1 family=00 type=1 index=32 mtu=1500 link=0 master=0 if=vsw.BOND1 family=00 type=1 index=33 mtu=1500 link=0 master=0 if=qtn.BOND1 family=00 type=1 index=34 mtu=1500 link=0 master=0 if=VLAN100 family=00 type=1 index=35 mtu=1500 link=0 master=0 if=VLAN200 family=00 type=1 index=36 mtu=1500 link=0 master=0 if=VLAN901 family=00 type=1 index=37 mtu=1500 link=0 master=0 if=VLAN12 family=00 type=1 index=38 mtu=1500 link=0 master=0 if=VLAN13 family=00 type=1 index=39 mtu=1500 link=0 master=0 if=lan family=00 type=1 index=40 mtu=1500 link=0 master=0 if=vsys_ha family=00 type=772 index=41 mtu=16436 link=0 master=0 if=port_ha family=00 type=1 index=42 mtu=1496 link=0 master=0 if=vsys_fgfm family=00 type=772 index=43 mtu=16436 link=0 master=0 if=tun_fgfm family=00 type=65534 index=44 mtu=1492 link=0 master=0 if=B family=00 type=768 index=45 mtu=1438 link=0 master=0 FG100E4Q16003872 # config system interface FG100E4Q16003872 (interface) # edit wan1 FG100E4Q16003872 (wan1) # set tcp-mss 1452 FG100E4Q16003872 (wan1) # end FG100E4Q16003872 # config firewall policy FG100E4Q16003872 (policy) # edit 1 FG100E4Q16003872 (1) # set tcp-mss-sender 1452 FG100E4Q16003872 (1) # set tcp-mss-receiver 1452 FG100E4Q16003872 (1) # end https://live.paloaltonetworks.com/t5/Learning-Articles/TCP-MSS-adjustment-for-IPSec-traffic/ta-p/74988 https://live.paloaltonetworks.com/t5/Configuration-Articles/How-to-Verify-MTU-Size-Exceeded/ta-p/58989 https://live.paloaltonetworks.com/t5/Management-Articles/How-to-Improve-Performance-for-IPSec-Traffic/ta-p/53301
清除策略匹配統計計數： To show the statistics of policy <policy_id>: # diag firewall iprope show 100004 <policy_id> For example: # diag firewall iprope show 100004 2 idx=2 pkts/bytes=1732/262451 To clear the statistics for this policy: # diag firewall iprope clear 100004 2 # diag firewall iprope show 100004 2 idx=2 pkts/bytes=0/0
Link-monitor配置：
config system link-monitor
edit "Monitor_WAN1_DX"
set srcintf "wan1"
set server "www.189.cn"
set gateway-ip 116.228.1.25
set source-ip 116.228.1.26
set failtime 3
set recoverytime 3
next
edit "Monitor_WAN2"
set srcintf "wan2"
set server "www.10010.com"
set gateway-ip 210.13.66.117
set source-ip 210.13.66.118
set failtime 3
set recoverytime 3
next
end
報文亂序：
TCP 亂序
config firewall policy
edit 1
set name "TO_Internet_Policy"
set srcintf "port11"
set dstintf "port9"
set srcaddr "all"
set dstaddr "all"
set action accept
set schedule "always"
set service "ALL"
set logtraffic all
set delay-tcp-npu-session enable
set nat enable
next
end
B1026 : possible packet out-of-order with NP6 during TCP session establishment - (new CLI)
[ History ]
- Issue was first reported by Bouygues Telecom with a FortiGate-3950B (NP4)
- Further testing was made with a FortiGate-1500D (NP6) where the problem can still be reproduced in the lab (FortiOS 5.4 GA)
- As suggested, opening a bug to track the issue.
[ Problem Description ]
When the host interface is busy (packets queuing in the FIFO), it is possible that the 3rd tcp session establishment ack received from the client is transmitted to the server
after data packets. This may or may not cause an issue to the server depending on the cases :
1) one single DATA segment managed to sneak before the 3rd handshake ACK :
Since the segment relative sequence number is 1 (just like the 3rd ack packet), it may be seen by the server as a TCP handshake 3rd ack containing data (piggyback).
When the real 3rd ack then arrives, it is considered as a duplicate ack but does not cause real problem to the application.
Note : If a stateful firewall exists between the FortiGate and the server, this may be a problem and generate a Reset causing the failure of the TCP session.
2) more than 1 DATA segments manage to sneak before the 3rd handshake ACK :
If 2 data packets sneak, the sequence number for the second packet is higher than 1 (depending on data length from the the first packet). In this scenario, the server may not consider the
tcp session handshake to be completed and sends a reset causing the session to fail.
These 2 scenario were observed and reproduced in the lab using traffic stressers.
It is not systematic to all sessions and require a busy host.
Reason for TCP handshake ACK out-of-order :
The reason for these scenario is explained in attached document "NP6_OOO_on_busy_CPU_v2.pdf"
Please note this document is for internal use only.
[ Diagram ]
See Diagram.png
[ Reproduction Scenario ]
This is reproduction from the lab run by Vincent.
Use an FortiGate-1500D running 5.4 GA with 4 ports where :
- 2 ports Port39 and Port36 are used to generate http 21k traffic (11K session per seconds, 2Gbps) passing through a UTM/IPS policy from an avalanche
=> The only goal of this traffic is to create a busy host interface condition.
- 2 ports Port33 and Port38 with a firewall only policy connected to avalanche generating SIP traffic.
=> SIP is chosen here because it allows to have the client sending more than 1 DATA packets immediately after the client has sent its 3rd ACK handshake packet.
A Breaking Point is used as a 'network probe' receiving traffic on the FortiGate server side from the switch configured with SPAN port.
Attached pcap files 'client.pcap' and 'server.pcap' are extracted from the breaking point in lab testing.
Other trace
[ Attached files ]
- NP6_OOO_on_busy_CPU_v2.pdf : Explanation of the cause
Lab files/traces with FortiGate-1500D :
- Diagram.png
- NPI_default.spf : Avalanche test file
- config_1500D_nturbo_ips_cps.conf : FortiGate configuration
- vince-mirror.bpt : Breacking point test file (used to capture mirrored traffic from the switch)
- client.pcap : pcap extracted from the switch port mirror, client side
- server.pcap : pcap extracted from the switch port mirror, server side
[ Expected Behavior ]
Fortigate should not create out-of-order packet during the TCP handshake.
所有報文亂序：
config port-cpu-map
edit "port9"
set cpu-core "3"
next
edit "port11"
set cpu-core "3"
next
end
FG900D3915800574 # get hardware status Model name: FortiGate-900D ASIC version: CP8 ASIC SRAM: 64M CPU: Intel(R) Xeon(R) CPU E3-1225 v3 @ 3.20GHz Number of CPUs: 4 RAM: 16065 MB Compact Flash: 1925 MB /dev/sda Hard disk: 244198 MB /dev/sdb USB Flash: not available Network Card chipset: FortiASIC NP6 Adapter (rev.) G900D3915800574 # get system performance status CPU states: 0% user 0% system 0% nice 100% idle 0% iowait 0% irq 0% softirq CPU0 states: 0% user 0% system 0% nice 100% idle 0% iowait 0% irq 0% softirq CPU1 states: 0% user 0% system 0% nice 100% idle 0% iowait 0% irq 0% softirq CPU2 states: 0% user 0% system 0% nice 100% idle 0% iowait 0% irq 0% softirq CPU3 states: 0% user 0% system 0% nice 100% idle 0% iowait 0% irq 0% softirq Memory: 16450708k total, 3300036k used (20%), 13150672k free (80%) Average network usage: 49 / 4 kbps in 1 minute, 46 / 1 kbps in 10 minutes, 46 / 0 kbps in 30 minutes Average sessions: 49 sessions in 1 minute, 35 sessions in 10 minutes, 32 sessions in 30 minutes Average session setup rate: 0 sessions per second in last 1 minute, 0 sessions per second in last 10 minutes, 0 sessions per second in last 30 minutes Average NPU sessions: 1 sessions in last 1 minute, 0 sessions in last 10 minutes, 0 sessions in last 30 minutes Average nTurbo sessions: 0 sessions in last 1 minute, 0 sessions in last 10 minutes, 0 sessions in last 30 minutes Virus caught: 0 total in 1 minute IPS attacks blocked: 0 total in 1 minute Uptime: 1 days, 19 hours, 20 minutes
異常不建立會話的日志：
看到不建立會話的異常包的日志，比如SYN+ACK/FIN+ACK等等，或RPF檢查失敗的日志。
config log setting
set log-invalid-packet enable
end
config log disk filter
set severity warning
set forward-traffic enable
end
date=2018-02-08 time=21:14:13 logid=0000000007 type=traffic subtype=forward level=warning vd=root srcip=124.124.125.27 srcport=46311 srcintf="port24" dstip=133.133.133.122 dstport=80 dstintf=unknown-0 proto=6 action=deny policyid=0 dstcountry="Japan" srccountry="India" trandisp=noop service="HTTP" duration=0 sentbyte=0 rcvdbyte=0 sentpkt=0 msg="no session matched"
date=2018-02-08 time=21:49:19 logid=0000000007 type=traffic subtype=forward level=warning vd=root srcip=124.124.124.255 srcport=15062 srcintf="port24" dstip=133.133.133.122 dstport=80 dstintf=unknown-0 sessionid=2095719319 proto=6 action=deny policyid=0 dstcountry="Japan" srccountry="India" trandisp=noop service="HTTP" duration=0 sentbyte=0 rcvdbyte=0 sentpkt=0 msg="reverse path check fail(bad src),drop"
mantis：0473183
丟棄的數據包也建立會話，並且保持30s。某些時候可以緩解某些ddos攻擊。
config system settings
set ses-denied-traffic enable
end
BJFG300D (settings) # set ses-denied-traffic
enable Include denied sessions in the session table.
disable Do not add denied sessions to the session table.
BJFG300D (global) # get | grep sess
auth-session-limit : block-new
av-failopen-session : disable
block-session-timer : 30
proxy-re-authentication-mode: session
reset-sessionless-tcp: disable
strict-dirty-session-check: enable
sandbox new包 可能需要翻牆： http://192.241.194.166/downloader Technical Note: Technical support on customization on various Fortinet products http://kb.fortinet.com/kb/microsites/microsite.do?cmd=displayKC&docType=kc&externalId=FD33500 Custom IPS signatures from Fortinet Customizing reports generated by FortiGate 會話長連接： Technical Note : Changing the TCP session TTL (time to live) on a FortiGate http://kb.fortinet.com/kb/microsites/search.do?cmd=displayKC&docType=kc&externalId=FD30171&sliceId=1&docTypeID=DT_KCARTICLE_1_1&dialogID=47234697&stateId=1%200%2047236305 Technical Note: Priority of session-ttl settings in FortiGate http://kb.fortinet.com/kb/microsites/search.do?cmd=displayKC&docType=kc&externalId=FD37296&sliceId=1&docTypeID=DT_KCARTICLE_1_1&dialogID=47234747&stateId=1%200%2047236355 Technical Note: Session TTL values and Policy RST for Sessions http://kb.fortinet.com/kb/microsites/search.do?cmd=displayKC&docType=kc&externalId=FD36001&sliceId=1&docTypeID=DT_KCARTICLE_1_1&dialogID=47234747&stateId=1%200%2047236355
光模塊功率：
查看光纖光衰，光模塊功率。
FG3K2D3Z17800004 # get sys interface transceiver
Interface port5: SFP/SFP+
Vendor Name: Axcen Photonics
Part No. : AXXE-5886-05B1
Serial No. : AX16430003258
Interface port6: SFP/SFP+
Vendor Name: OEM
Part No. : DEM-431TX
Serial No. : H08LA0039
Interface port7: SFP/SFP+
Vendor Name: OEM
Part No. : SFP-T-F
Serial No. : F80T061
Interface port8: SFP/SFP+
Vendor Name: OEM
Part No. : SFP-GE-T
Serial No. : CSGETG40333
Interface port17: SFP/SFP+
Vendor Name: Axcen Photonics
Part No. : AXXE-5886-05B1
Serial No. : AX15190014113
Interface port18: SFP/SFP+
Vendor Name: Axcen Photonics
Part No. : AXXE-5886-05B1
Serial No. : AX15190014090
Interface port19: SFP/SFP+
Vendor Name: Axcen Photonics
Part No. : AXXE-5886-05B1
Serial No. : AX15190014109
Interface port25: SFP/SFP+
Vendor Name: OPLINK
Part No. : TPP1XGDS0E000E2
Serial No. : 7331850
Optical Optical Optical
SFP/SFP+ Temperature Voltage Tx Bias Tx Power Rx Power
Interface (Celsius) (Volts) (mA) (dBm) (dBm)
------------ ----------- --------- --------- --------- --------
port5 32.5 3.31 6.07 -1.8 -1.4
port6 35.4 3.23 6.10 -1.8 -2.5
port7 N/A N/A N/A N/A N/A
port8 N/A N/A N/A N/A N/A
port17 34.0 3.31 5.78 -1.9 -1.0 +
port18 33.8 3.32 7.43 -1.9 -1.8
port19 34.1 3.30 6.27 -1.8 -1.3
port25 23.0 3.27 5.18 -2.6 -1.7
++ : high alarm, + : high warning, - : low warning, -- : low alarm, ? : suspect.
FGT1KD3915801542 # execute sensor list 1 CPU VCCP alarm=0 value=1.7743 threshold_status=0 2 PVDDQ alarm=0 value=1.52 threshold_status=0 3 DDR VTT alarm=0 value=0.768 threshold_status=0 4 CPU VCORE alarm=0 value=1.776 threshold_status=0 5 NCT 3VDD alarm=0 value=3.36 threshold_status=0 6 NCT VCC3 alarm=0 value=3.312 threshold_status=0 7 NCT 3VSB_HM alarm=0 value=3.312 threshold_status=0 8 NCT CPU_Vtt alarm=0 value=1.008 threshold_status=0 9 NCT VBAT alarm=0 value=3.168 threshold_status=0 10 PCB Temp. alarm=0 value=28 threshold_status=0 //主板溫度 11 D1 alarm=0 value=42 threshold_status=0 12 D2 alarm=0 value=40 threshold_status=0 13 TR3 alarm=0 value=27 threshold_status=0 14 DTS CPU alarm=0 value=53 threshold_status=0//CPU溫度 15 CPU Core 0 alarm=0 value=54 threshold_status=0//CPU core溫度 16 CPU Core 1 alarm=0 value=52 threshold_status=0 17 CPU Core 2 alarm=0 value=54 threshold_status=0 18 CPU Core 3 alarm=0 value=51 threshold_status=0 19 Sys Fan 1 alarm=0 value=3200 threshold_status=0//主板上的風扇，轉速3200 20 Sys Fan 2 alarm=0 value=3200 threshold_status=0//主板上的風扇，轉速3200 21 Sys Fan 3 alarm=0 value=3200 threshold_status=0//主板上的風扇，轉速3200 22 PS1 Ambient Temp alarm=0 (scanning disabled) 23 PS1 Comp Temp alarm=0 (scanning disabled) 24 PS1 Fan 1 alarm=0 (scanning disabled)//沒有值，說明沒有該電源PS1風扇不轉或沒有沒有插電源 25 PS1 VIN alarm=0 (scanning disabled) 26 PS1 VOUT_12V alarm=0 (scanning disabled) 27 PS1 Status alarm=0 (not detected)//PS1模塊沒有插入 28 PS2 Ambient Temp alarm=0 value=33 threshold_status=0 29 PS2 Comp Temp alarm=0 value=35 threshold_status=0 30 PS2 Fan 1 alarm=0 value=12160 threshold_status=0// 電源PS2的風扇，轉速為12160 31 PS2 VIN alarm=0 value=230 threshold_status=0 32 PS2 VOUT_12V alarm=0 value=12.284 threshold_status=0 33 PS2 Status alarm=0//PS2電源模塊工作時長 Technical Note: Enable creation of TCP session on the firewall without checking for a SYN packet http://kb.fortinet.com/kb/microsites/search.do?cmd=displayKC&docType=kc&externalId=FD40929&sliceId=1&docTypeID=DT_KCARTICLE_1_1&dialogID=47234673&stateId=1%200%2047236281
diagnose log test 這個命令就能生成各種各樣的日志，包括攻擊
IPsec VPN證書認證失敗
IPsec VPN證書認證存在分片，對方無法正常重組IKE報文，拿到完整的證書內容：
IPS的session和內存的session進行TTL同步：
config ips global
set sync-session-ttl enable
end
ips的會話表查看：
dia ips session list
huayun.py
#!/usr/bin/env python # -*- coding:utf-8 -*- # Date: 2018 import re, getpass import string, time, winsound from telnetlib import Telnet def login(host, port, username, password): try: tn = Telnet(host, port, timeout=5) tn.read_until(b"login:") tn.write(username.encode('ascii') + b"\r\n") tn.read_until(b"Password:") tn.write(password.encode('ascii') + b"\r\n") tn.read_until(b"#") tn.write(b"\r\n") tn.read_until(b"#") tn.write(b"config global" + b"\n") tn.read_until(b"#") except Exception as e: raise return tn def get_system_status(tn): # 注意防火牆不能一次性輸出全部信息的情況 # 需要配置 config system console / set output standard 以避免這種情況 tn.write(b"get sys status\n") sysinfo = tn.read_until(b"#").decode('ascii') sysinfo = re.split(r'[\r]+', sysinfo) for line in sysinfo: if 'Version' in line: System_Info['platform'] = re.split(r'[\s]+', line)[2] System_Info['version'] = re.split(r'[\s]+', line)[3] if 'Serial-Number' in line: System_Info['serialNumber'] = re.split(r'[:]+', line)[1] continue if 'Virtual domain configuration' in line: System_Info['vdom'] = re.split(r'[:]+', line)[1] continue if 'Current HA mode' in line: System_Info['haMode'] = re.split(r'[:]+', line)[1] break def get_sys_cpuMem(tn): tn.write(b"get sys perf status\n") usage = tn.read_until(b"#").decode('ascii') if System_Info['version'][0:4] == 'v5.2' or System_Info['version'][0:4] == 'v5.4': cpuUsage = re.findall(r'CPU states:(.*)', usage)[0].strip(' ') cpuUsage = int(re.split(r'[\s\-\(\>\)]+', cpuUsage)[0].strip('%')) + int(re.split(r'[\s\-\(\>\)]+', cpuUsage)[2].strip('%')) memUsage = re.findall(r'Memory states: (.*) used', usage)[0].strip('%') return cpuUsage, memUsage if System_Info['version'][0:4] == 'v5.6': cpuUsage = re.findall(r'CPU states:(.*)', usage)[0].strip(' ') memUsage = re.findall(r'Memory: (.*)', usage)[0].rstrip('\r') cpuUsage = re.split(r'[\s\-\(\>\)]+', cpuUsage)[2].strip('%') memUsage = re.split(r'[\s]+', memUsage)[4].lstrip('(').rstrip('%),') return cpuUsage, memUsage if System_Info['version'][0:4] == 'v6.0': pass host = '10.139.130.72' port = '23' username = raw_input('Please input username: ') password = getpass.getpass('Please input password: ') System_Info = {'platform': '', 'serialNumber': '', 'version': '', 'vdom': '', 'haMode': ''} filetime = time.strftime('%Y%m%d-%Hh%Mm%Ss') f = open('ips_' + filetime + '.txt', 'w') """ 在python2.7.14, 3.6.4測試通過 """ if __name__ == '__main__': """ get_system_status(tn) 獲取防火牆型號的版本、vdom、是否HA等信息,以供后續模塊調用 注意 config system console / set output standard (缺省是more,可能導致不能期待出現 #號的情況) """ cpuhigh = 48 memhigh = 75 tn = login(host, port, username, password) get_system_status(tn) while True: cpuUsage, memUsage = get_sys_cpuMem(tn) print("CPU usage = %s, MEM usage = %s" % (cpuUsage, memUsage)) # tn.write(b"config global" + b"\n") tn.write(b"exec date" + b"\n") temp = tn.read_until(b"#").decode('ascii') tn.write(b"exec time" + b"\n") temp = temp + tn.read_until(b"#").decode('ascii') tn.write(b"get sys performance status" + b"\n") temp = temp + tn.read_until(b"#").decode('ascii') tn.write(b"get system session-info statistics" + b"\n") temp = temp + tn.read_until(b"#").decode('ascii') tn.write(b"diagnose ips session status" + b"\n") temp = temp + tn.read_until(b"#").decode('ascii') tn.write(b"diagnose ips memory status" + b"\n") temp = temp + tn.read_until(b"#").decode('ascii') f.write(temp + '\n') if int(cpuUsage) >= cpuhigh: tn.write(b"diagnose sys top 2 99" + b"\n") time.sleep(6) tn.write(b"q") cputemp = tn.read_until(b"#").decode('ascii') tn.write(b"dia ips session performance" + b"\n") cputemp = cputemp + tn.read_until(b"#").decode('ascii') tn.write(b"dia ips session list" + b"\n") cputemp = cputemp + tn.read_until(b"#").decode('ascii') tn.write(b"dia sys process trace 15705" + b"\n") # time.sleep(6) cputemp = cputemp + tn.read_until(b"#").decode('ascii') tn.write(b"dia sys process trace 15706" + b"\n") # time.sleep(6) cputemp = cputemp + tn.read_until(b"#").decode('ascii') f.write('cpu high //////////////////////////\n' + cputemp + '\n') if int(memUsage) >= memhigh: tn.write(b"diagnose sys top 2 99" + b"\n") time.sleep(6) tn.write(b"q") memtemp = tn.read_until(b"#").decode('ascii') tn.write(b"fnsysctl df -h" + b"\n") memtemp = memtemp + tn.read_until(b"#").decode('ascii') tn.write(b"dia ips memory status" + b"\n") memtemp = memtemp + tn.read_until(b"#").decode('ascii') tn.write(b"dia ips packet status" + b"\n") memtemp = memtemp + tn.read_until(b"#").decode('ascii') tn.write(b"dia ips session status" + b"\n") memtemp = memtemp + tn.read_until(b"#").decode('ascii') tn.write(b"fnsysctl cat /proc/15705/status" + b"\n") memtemp = memtemp + tn.read_until(b"#").decode('ascii') tn.write(b"fnsysctl cat /proc/15705/maps" + b"\n") memtemp = memtemp + tn.read_until(b"#").decode('ascii') tn.write(b"fnsysctl cat /proc/15705/smaps" + b"\n") memtemp = memtemp + tn.read_until(b"#").decode('ascii') tn.write(b"fnsysctl cat /proc/15706/status" + b"\n") memtemp = memtemp + tn.read_until(b"#").decode('ascii') tn.write(b"fnsysctl cat /proc/15706/maps" + b"\n") memtemp = memtemp + tn.read_until(b"#").decode('ascii') tn.write(b"fnsysctl cat /proc/15706/smaps" + b"\n") memtemp = memtemp + tn.read_until(b"#").decode('ascii') f.write('mem high //////////////////////////\n' + memtemp + '\n') tn.write(b"diagnose sys ha reset-uptime" + b"\n") break time.sleep(10) f.close()
testSMTP.py
#!/usr/bin/env python # -*- coding:utf-8 -*- # Author : Jerry Liu # Date: 2018 import getpass import smtplib try: sm = smtplib.SMTP('mail.fortinet.com', 25, timeout=3) except Exception as e: raise e try: emailpwd = getpass.getpass('Please input email password: ') authcode = sm.login('mliu', emailpwd) except smtplib.SMTPAuthenticationError as e: raise e msg = 'From: mliu@fortinet.com\n' \ 'To: mliu@fortinet.com; ftnt@qq.com\n' \ 'Subject: test python\n' \ 'HA failover just now !!!\n' \ 'HA failover just now !!!\n' tolist = ["mliu@fortinet.com", "ftnt@qq.com"] if authcode[0] == 235: sm.sendmail('mliu@fortinet.com', tolist, msg) else: sm.quit()
BJLab-240D-90-254 # fnsysctl df -h Filesystem Size Used Available Use% Mounted on rootfs 1.9G 78.8M 1.8G 4% / tmpfs 1.9G 78.8M 1.8G 4% / none 3.4G 1.3M 3.4G 0% /tmp none 3.4G 37.1M 3.4G 1% /dev/shm none 3.4G 16.6M 3.4G 0% /dev/cmdb /dev/sda1 247.9M 41.7M 193.4M 18% /data /dev/sda3 14.1G 52.5M 13.4G 0% /data2 /dev/sdb1 58.6G 17.6G 38.0G 32% /var/log
代理模式 TCP_OPTION選項設置： fgt-3700D-LAB # config system global fgt-3700D-LAB (global) # get | grep tcp reset-sessionless-tcp: disable tcp-halfclose-timer : 120 tcp-halfopen-timer : 10 tcp-option : enable tcp-timewait-timer : 1 fgt-3700D-LAB (global) # set tcp-option enable Enable TCP option. disable Disable TCP option. fgt-3700D-LAB (global) # set tcp-option enable Enable TCP option. disable Disable TCP option.
==================== End