Fortigate Firewall Packet Flow - in depth for troubleshoot

[@Nomadic.Engineer19]

What a great explanation of Packet Flow. Loved it. Thank you.

[@JO-hp8nt]

Bro! You just saved me a good deal of time as I've been pondering why my custom signatures were not working like how so many people described on the web. Well with your indepth explanation, you made it so clear and gave me a vision and long story short, because the IPS doesn't kick in until after the session is added to the session table, other things could be blocking my packet before it hit the IPS. Which was the case. As soon as I create a policy and put it above all the others and pretty much made it wide open to test, bingo! I can't thank you enough for the work you did, this was wonderful.

[@SantoshSharma]

spread the words🤗

[@patricksigrist4831]

Great video. The main reason, why routing has to be done before the FW policy is, that the routing determines the involved interfaces, especially the egress interface which is key to determine the matching policy as we have the incoming (ingress) and outgoing (egress) interfaces, which are mandatory elements for a FW policy. This shows, that routing is key, also in terms of firewall policies. It's a good rule of thumb: "Always check the routing first" when dealing with weird firewall behaviors.

[@SantoshSharma]

perfect subscribe and share to support this channel

[@jonathandominguezrebollo6564]

I do agree. Destination interface is part of the tuple verification that firewall policy performs to find the firewall policy that matches the traffic. Regards!

[@shivanarayana4976]

Very nice explanation sir, sharing good knowledge

[@kirubakaran9357]

Sir it's my feedback Really cool and crystal clear session for upcoming TAC engineer of fortigate also information that your gathered show the effort of you thanks a lot sir........

[@JO-hp8nt]

I could not have said it any better myself.

[@hariprasad-uw2yn]

Brother, I always like your Video.No one should dislike it as far as Networking is concerned.

[@motorbazar8358]

Slow path process :- 1>DNAT , 2> Routing , 3> Policy , 4>SNAT .... 2nd Question answers :- if there will be no routing in that case.. no use of policy lookup .. so by doing routing lookup we are not much consuming CPU Utilization of firewall ... Thank u so much for explaining it :)

[@jonathandominguezrebollo6564]

If there is no route the traffic will be dropped from my understanding

[@nasirabbas2786]

Thanks sir, i was trying to understand fortigate packet flow from fortigate page itself but did'nt understand. Your way of explanation is easy to understand, super explanation. Again thanks sir!

[@govindjadhav5273]

Superb bro..well done. much helpful.

[@robertron5303]

Much appreciated, greetings from Vienna

[@samiyaanjum5145]

Awesome brother, great explanation, can you make another showing differences between application,dns and web filter. Explaining in detail when to use which filter. Can you explain how SDWAN rules can impact the SNAT selection in policy

[@stalinkoilraj9820]

good bro ! policy will be the first counter for all the traffic before it moves to NAT and Security

[@learnenglishvocabulary550]

Greeting, Technical_Scoop. extremely picturesque video. thanks. :)

[@saidsalehi4719]

The route is before Policy because after Routing, specify the Policy ,based on the outgoing interface

[@ManojKumar-lr3ky]

Wonderful bro its really very informative need more troubleshooting videos ...

[@jonathandominguezrebollo6564]

From Fortinet documentation. Security Processing Units (SPUs) includes NPUs and CPs. That means there are two types of SPUs, which are NPUs and CPs. Not sure if that is correct

[@urdhffkt]

Thank you sir, this video is very helpful

[@GauravSingh-ru4fl]

Wonderful Bro !!

[@jonathandominguezrebollo6564]

Do you have explaination about NTurbo and IPSA? I'm struggling trying to understand that feature.

[@AbhijitDas-lw9mh]

Fantastic explanation. Could you please share the traffic flow diagram which you explain here.

[@DovaBro]

Sir where in the picture is SD-WAN taking place?

[@swapnillande4427]

Very helpful 👍, thank you.

[@RohitPandey-ig7ht]

Great content!!

[@MsAruntiwari]

Great explanation. Thanks or this knowledge.

[@venkatreddy4345]

In the slow path it checks the DNAT, Routing , Policy Lookup, SNAT

[@kirubakaran9357]

25:10 What is slow path chkng proccess? 1 DNAT 2. ROUTING 3 POLICY 4 SNAT

[@beatsizedj]

You king sir! Thank you very much for this Video. If you would have had a good Microphone I would rate this Video 11/10!

[@sherkn]

Your Explanation was very deep, awezome video. I have a question for you, if i have an specific Firewalls rule at the end, saying ¨Deny any any", and prior that rules execute i have some other App rule (let say office365 for example) the Application control Will not be able to detect the Application because of the "deny" rule it Will not be able to complete the 3way handshake therefore there is no flow to catch? im Right?

[@SantoshSharma]

Cristian Silva u r right so its always recommend that deny deny at last and then all permit on above and if u creat rule for app with allow like allow youtube then it will do 3 way from that rule

[@ghanshyamtrilok7062]

how can i enroll for other videos

[@johnbruurmijn9178]

Love the video! Would it be possible to share the flow chart you made? Want to use it as my background, to have a quick peak when needed.

[@SantoshSharma]

thanks John, i lost it myself. my website was expired and was no plan to extend due to high cost. but renwed website , unfortuantely lost images.

[@anurag3v4]

Good explaination

[@safwatramadan7640]

Very helpful thanks 👏

[@yogeshwartripathi9018]

could you please focus on fast path steps in deep?

[@prashantakarmakar3111]

Hello Sir. Thank you for the content. But I have one question. Where is the DNAT happening for Fast Path?

[@SantoshSharma]

slow path

[@beatsizedj]

Just a Question. You said that every packet gets handeld first by the CPU. But not in the Case of DDos right? Then de SP would block it before passing the traffic to the CPU? Or other related IPS things?

[@SantoshSharma]

superb

[@vaibhavcavutur8839]

where does urpf happen in packet flow ?

[@jonathandominguezrebollo6564]

If you mean Reverse Path Forwarding... It takes place just after DoS policy validation.... before the IP header Integrity check, as far as I know

[@indiankid]

You gained a subsciber thanks for awesome content

[@mahendrazanje6242]

Awesome

[@Shubhontube]

Hi, Which command I should ran to check this flow of packets on my device

[@SantoshSharma]

diag debug check my another video on this

[@rosatechnocrat]

diag debug flow show iprope enable diagnose debug flow show function-name enable diag debug flow trace start 1000 diag debug enable You can also filter for specific IP address Flow by using - diag debug flow filter

[@vivekprajapati7911]

sir thanks ...

[@arian7472]

excellent

[@prabhakarshandilya6082]

Really nice

[@SantoshSharma]

Thanks, spread the words 🙏🏻🤗

[@ravikumarsinge5887]

Hello , Do you have full Forti gate videos , if nor here on other platform , Please let me know

[@SantoshSharma]

Sorry bro, no videos for now. but planning to make in near furure

[@sridhark2547]

Thank you

[@amitkumarsingh2176]

JAI SHREE RAM🙏

[@FranciscoSilva-kj8zt]

Hey, great video. It's possible to share the powerpoint or the images of this presentation. If i try to reach the source image, i got http 404. Thanks in advance.

[@paulvarges3323]

hello, do you share that power point doc?

[@SantoshSharma]

Go to my websiite to see this packet flow in image

[@gopalsrinivasa6267]

If Destination NAT is verified before security policy check then why in WAN to LAN security policy, under Destination Address Public IP is given. why cant we directly give Private IP address. My doubt is not only for Fortigate but also for other firewalls like Sonicwall & Paloalto also.

[@SantoshSharma]

Destination IP In fortigate is VIP. virtual IP. so in Fortigate its very easy. no confusion at all. packet flow helps you to tell which is happening when.

[@gopalsrinivasa6267]

@@SantoshSharma Hi thanks for your reply, Can you explain packet flow for Sonicwall.

[@ameeransar5297]

Pls share the flow chart

[@Mehsud2023]

sir please upload the flow chart in HD Format

[@monu836]

Are you teaching over the Skype or zoom

[@SantoshSharma]

Monu Gothwal What happend? I didn’t understand the question, if u want training , Please contact me on email [e-mail]

[@lokeshreddysura6836]

IPS LOGS, APP LOGS, WEBFILTER Logs are not visible kindly Share the screenshot.

[@hariprasad-uw2yn]

one dislike may be a child when his father watching the video the child could have click it.

[@SantoshSharma]

🤩🤩

[@kirubakaran9357]

25:11 Question Why routing before policy ? Ans Because in an Firewall it has lot of policies it means utilize cpu n latency so it will check first routing its ec and also it's crct path

[@toptalkers7980]

On the basis of routing firewall determine the egress interface and then the policy lookup is done for that flow. Without the egress information policy check won't take place

[@SantoshSharma]

@@toptalkers7980 i would say awesome answer

[@toptalkers7980]

@@SantoshSharma thank you sir

[@FRITTY12348546]

pls activate windows