View the exhibit: The client cannot connect to the HTTP web server. The administrator ran the FortiGate built-in sniffer and got the following output: What should be done next to troubleshoot the problem?
A.
Run a sniffer in the web server.
B.
Execute another sniffer in the FortiGate, this time with the filter "host 10.0.1.10".
C.
Capture the traffic using an external sniffer connected to port1.
Traffic is entering FG on port 3 but isnt leaving it on port 1, so problem lies on fortigate. External sniffer is a bogus answer and gives you no information. Only correct option is a debug flow (or simply check logs) to see why traffic is failing
It is not confirmed if traffic is egressing port1, all we see in the flow debug is inbound traffic from the host on port3 that wants to go to the web server out port1. Personally, I would sniff the web host to see if they are getting in. But I feel the answer Fortinet is looking for is what myutran and bluey say it is; D. the flow debug will confirm the traffic inbound on port3 and if it is egressing port1. the flow debug will also show us if the web server traffic is even entering the FG or being denied. Sniffers do not show deny traffic, only debugs do that.
It is simple , if you see the filters it says interface any, so this means that if the packet is leaving the Fortigate, we would be able to see it, but we are not.
So this means the packet is getting drop in the Fortigate, so we need the debug.
Debug flow will show why the Syn packet is not creating a new session
https://docs.fortinet.com/document/fortigate/6.2.3/cookbook/054688/debugging-the-packet-flow
A voting comment increases the vote count for the chosen answer by one.
Upvoting a comment with a selected answer will also increase the vote count towards that answer by one.
So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.
myutran
Highly Voted 5 years, 7 months agoPenn
5 years, 7 months agoBluey
5 years, 6 months agonotarussianagent
5 years, 4 months agocarroyoc
4 years, 11 months agojbernard
Most Recent 4 years, 11 months agoLevis
4 years, 11 months agomontonearm
5 years, 2 months ago