No_ofld_reason: block-by-ips redir-to-ipsĪbove session indicate traffic have been dropped by IPS, refer to last line.Building security into FortiOS | FortiGate / FortiOS 6.4.0 Misc=0 policy_id=2 auth_info=0 chk_client_info=0 vd=0 Tx speed(Bps/kbps): 0/0 rx speed(Bps/kbps): 0/0

Session info: proto=6 proto_state=11 duration=3 expire=29 timeout=3600 flags=00000000 socktype=0 sockport=0 av_idx=0 use=4Ĭlass_id=0 ha_id=0 policy_dir=0 tunnel=/ vlan_cos=0/255 It is also advised to run these debugs with extra caution preferably during low trafficĪbove debugging only require deeper investigation why it not hitting the correct policy, using session list able to provide quick view on which policy it is hitting.īelow example show SSH traffic coming from host 10.101.0.2 to destination 10.56.255.7, as visible highlighted in RED color indicate matching policy for firewall policy 2 (policy_id) and security policy 2 (ngfwid). You can also BPF filter for the PME debugs for specific trafficĭiagnose ips filter set 'host 10.10.1.1 and port 443' To debug on Security Policy which is handle by IPS, we need to use below debug In Policy-based mode firewall policy will split into 2 sections.ĬLI : config firewall consolidated policy.Īs policy split into 2 sections, when performing troubleshooting to check traffic is hitting on which policy by using debug flow (refer to FD30038 for detail command) will only able to show it hitting policy define in native policy. This article describes how to check policy matching for Policy-based operation mode.

Fortigate security