Troubleshooting
This topic provides guidelines to help you resolve issues if your FortiWeb appliance is not behaving as you expect.
Keep in mind that if you cannot resolve the issue on your own, you can contact Fortinet
Technical Support .
See also
•
Tools
•
How to troubleshoot
•
Solutions by issue type
•
Resetting the configuration
•
Restoring firmware (“clean install”)
Tools
To locate network errors and other issues that may prevent connections from passing to or through the FortiWeb appliance, FortiWeb appliances feature several troubleshooting tools.
Troubleshooting methods and tips may use:
• the command line interface (CLI)
• the web UI
• external third-party tools
Some CLI commands provide troubleshooting information not available through the web UI; third-party tools on external hosts can test connections from perspectives that cannot be achieved locally.
See also
•
Ping & traceroute
•
Log messages
•
Diff
•
Packet capture
Ping & traceroute
If your FortiWeb appliance cannot connect to other hosts, try using ICMP (ping and traceroute
) to determine if the host is reachable or to locate the node of your network at which connectivity fails, such as when static routes are incorrectly configured. You can do this from the FortiWeb appliance using CLI commands.
Fortinet 663 FortiWeb 5.2 Patch 2 Administration Guide
For example, you might use ping to determine that 172.16.1.10 is reachable: execute ping 172.16.1.10
PING 172.16.1.10 (172.16.1.10): 56 data bytes
64 bytes from 172.16.1.10: icmp_seq=0 ttl=64 time=2.4 ms
64 bytes from 172.16.1.10: icmp_seq=1 ttl=64 time=1.4 ms
64 bytes from 172.16.1.10: icmp_seq=2 ttl=64 time=1.4 ms
64 bytes from 172.16.1.10: icmp_seq=3 ttl=64 time=0.8 ms
64 bytes from 172.16.1.10: icmp_seq=4 ttl=64 time=1.4 ms
--- 172.20.120.167 ping statistics ---
5 packets transmitted, 5 packets received, 0% packet loss round-trip min/avg/max = 0.8/1.4/2.4 ms or that 192.168.1.10 is not reachable: execute ping 192.168.1.10
PING 192.168.1.10 (192.168.1.10): 56 data bytes
Timeout ...
Timeout ...
Timeout ...
Timeout ...
Timeout ...
--- 192.168.1.10 ping statistics ---
5 packets transmitted, 0 packets received, 100% packet loss
If the host is not reachable, you can use traceroute to determine the router hop or host at which the connection fails: execute traceroute 192.168.1.10
traceroute to 192.168.1.10 (192.168.1.10), 32 hops max, 72 byte packets
1 192.168.1.2 2 ms 0 ms 1 ms
2 * * *
For more information on CLI commands, see the
FortiWeb CLI Reference
. For more information
on troubleshooting connectivity, see “Connectivity issues” on page 674 .
Both ping and traceroute require that network nodes respond to ICMP. If you have disabled responses to ICMP on your network, hosts may appear to be unreachable to ping and traceroute
, even if connections using other protocols can succeed.
Fortinet
Log messages
Log messages often contain clues that can aid you in determining the cause of a problem.
FortiWeb appliances can record log messages when errors occur that cause failures, upon significant changes, and upon processing events.
Depending on the type, log messages may appear in either the event, attack, or traffic logs. The
FortiWeb appliance must be enabled to record event, attack, and traffic log messages; otherwise, you cannot analyze the log messages for events of that type. To enable logging of different types of events, select Log&Report > Log Config > Other Log Settings.
664 FortiWeb 5.2 Patch 2 Administration Guide
During troubleshooting, you may find it useful to reduce the logging severity threshold for more verbose logs, to include more information on less severe events. To configure the severity threshold, go to Log&Report > Log Config > Global Log Settings.
Diff
You can compare backups of the core configuration file with your current configuration. This can be useful if, for example:
• A previously configured feature is no longer functioning, and you are not sure what in the configuration has changed.
• You want to recreate something configured previously, but do not remember what the settings were.
Difference programs can help you to quickly find all changes.
Figure 91:Configuration differences highlighted in WinMerge
Fortinet
There are many such difference-finding programs, such as WinMerge and the original diff . They can compare your configurations, line by line, and highlight parts that are new, modified, or deleted.
For instructions, see your difference program’s documentation.
See also
•
Backups
•
Establishing a system baseline
•
Determining the source of the problem
665 FortiWeb 5.2 Patch 2 Administration Guide
Fortinet
Packet capture
Packet capture, also known as sniffing or packet analysis, records some or all of the packets seen by a network interface (that is, the network interface is used in promiscuous mode). By recording packets, you can trace connection states to the exact point at which they fail, which may help you to diagnose some types of problems that are otherwise difficult to detect.
FortiWeb appliances have a built-in sniffer. Packet capture on FortiWeb appliances is similar to that of FortiGate appliances. To use the built-in sniffer, connect to the CLI and enter the following command: diagnose network sniffer packet [{any | <interface_name>}
[{none | '<filter_str>'} [{1 | 2 | 3} [<packets_int>]]]] where:
•
<interface_name>
is either the name of a network interface, such as port1, or enter any for all interfaces.
•
'<filter_str>'
is the sniffer filter that specifies which protocols and port numbers that you do or do not want to capture, such as 'tcp port 80', or enter none for no filters.
Filters use tcpdump syntax.
•
{1 | 2 | 3} is an integer indicating whether to display the network interface names, packet headers, and/or payloads for each packet that the network interface sends, receives, or sees:
•
1
— Display the packet capture timestamp, plus basic fields of the IP header: the source
IP address, the destination IP address, protocol name, and destination port number.
Does not display all fields of the IP header; it omits:
• IP version number bits
• Internet header length (ihl)
• type of service/differentiated services code point (tos)
• explicit congestion notification
• total packet or fragment length
• packet ID
• IP header checksum
• time to live (TTL)
• IP flag
• fragment offset
• options bits e.g.: interfaces=[port2] filters=[none]
0.655224 172.20.130.16.2264 -> 172.20.130.15.42574: udp 113
666 FortiWeb 5.2 Patch 2 Administration Guide
Fortinet
•
2
— All of the output from 1, plus the packet payload in both hexadecimal and ASCII. e.g.: interfaces=[port2] filters=[none]
0.915616 172.20.130.16.2264 -> 172.20.130.15.42574: udp 124
0x0000 4500 0098 d27d 4000 4011 0b8f ac14 8210 E....}@.@.......
0x0010 ac14 820f 08d8 a64e 0084 b75a 80e0 3dee .......N...Z..=.
0x0020 71b8 d617 38fa 3fd8 419b 5006 053c 99c1 q...8.?.A.P..<..
0x0030 e961 93bc 21c9 3197 a030 a709 76dc 0ed8 .a..!.1..0..v...
0x0040 98f8 ceef 6afb e7f2 7773 98e1 5ef7 bfbf ....j...ws..^...
0x0050 2f0d 726f 70cf 26cd d986 392f 4a0b f97b /.rop.&...9/J..{
0x0060 b84f 932d 3043 cbdd c2dc da77 0b73 70fc .O.-0C.....w.sp.
0x0070 158a 1868 eee0 793b c09e 7dc0 59f5 787c ...h..y;..}.Y.x|
0x0080 fc1a f25a dc18 735d f090 8e05 c3e8 c14f ...Z..s].......O
0x0090 3466 57c0 4688 58b8 4fW.F.X.
•
3
— All of the output from 2, plus the link layer (Ethernet) header. e.g.: interfaces=[port2] filters=[none]
0.317960 172.20.130.16.2264 -> 172.20.130.15.42574: udp 31
0x0000 50e5 49e8 dc3d 000f 7c08 2ff5 0800 4500 P.I..=..|./...E.
0x0010 003b 2cad 4000 4011 b1bc ac14 8210 ac14 .;,.@.@.........
0x0020 820f 08d8 a64e 0027 ea3c 80e0 981e 7474 .....N.'.<....tt
0x0030 6ddf 38fa 3fd8 419b 6e06 00f0 8dd5 e01d m.8.?.A.n.......
0x0040 810a e049 e5e9 380a f8 ...I..8..
•
<packets_int> is the number of packets the sniffer reads before stopping. Packet capture output is printed to your CLI display until you stop it by pressing Ctrl+C, or until it reaches the number of packets that you have specified to capture.
Packet capture can be very resource intensive. To minimize the performance impact on your
FortiWeb appliance, use packet capture only during periods of minimal traffic, with a local console CLI connection rather than a Telnet or SSH CLI connection, and be sure to stop the command when you are finished.
For example, you might capture all TCP port 443 (typically HTTPS) traffic occurring through port1, regardless of its source or destination IP address. The capture uses a high level of verbosity (indicated by 3).
A specific number of packets to capture is not specified. As a result, the packet capture continues until the administrator presses Ctrl+C. The sniffer then confirms that five packets were seen by that network interface.
667 FortiWeb 5.2 Patch 2 Administration Guide
Fortinet
(Verbose output can be very long. As a result, output shown below is truncated after only one packet.)
FortiWeb# diagnose network sniffer packet port1 'tcp port 443' 3 interfaces=[port1] filters=[tcp port 443]
10.651905 192.168.0.1.50242 -> 192.168.0.2.443: syn 761714898
0x0000 0009 0f09 0001 0009 0f89 2914 0800 4500
..........)...E.
0x0010 003c 73d1 4000 4006 3bc6 d157 fede ac16
.<s.@.@.;..W....
0x0020 0ed8 c442 01bb 2d66 d8d2 0000 0000 a002
...B..-f........
0x0030 16d0 4f72 0000 0204 05b4 0402 080a 03ab
..Or............
0x0040 86bb 0000 0000 0103 0303 ..........
Instead of reading packet capture output directly in your CLI display, you usually should save the output to a plain text file using your CLI client. Saving the output provides several advantages. Packets can arrive more rapidly than you may be able to read them in the buffer of your CLI display, and many protocols transfer data using encodings other than US-ASCII. It is often, but not always, preferable to analyze the output by loading it into in a network protocol analyzer application such as Wireshark ( http://www.wireshark.org/ ).
For example, you could use PuTTY or Microsoft HyperTerminal to save the sniffer output to a file. Methods may vary. See the documentation for your CLI client.
Requirements
• terminal emulation software such as PuTTY
• a plain text editor such as Notepad
• a Perl interpreter
• network protocol analyzer software such as Wireshark
To view packet capture output using PuTTY and Wireshark
1. On your management computer, start PuTTY.
2. Use PuTTY to connect to the FortiWeb appliance using either a local console, SSH, or Telnet connection. For details, see the FortiWeb
CLI Reference
.
3. Type the packet capture command, such as: diagnose network sniffer packet port1 'tcp port 443' 3 but do not press Enter yet.
668 FortiWeb 5.2 Patch 2 Administration Guide
4. In the upper left corner of the window, click the PuTTY icon to open its drop-down menu, then select Change Settings.
A dialog appears where you can configure PuTTY to save output to a plain text file.
5. In the Category tree on the left, go to Session > Logging.
6. In Session logging, select Printable output.
7. In Log file name, click the Browse button, then choose a directory path and file name such as C:\Users\MyAccount\packet_capture.txt to save the packet capture to a plain text file. (You do not need to save it with the .log file extension.)
8. Click Apply.
9. Press Enter to send the CLI command to the FortiWeb appliance, beginning packet capture.
10.If you have not specified a number of packets to capture, when you have captured all packets that you want to analyze, press Ctrl + C to stop the capture.
11.Close the PuTTY window.
12.Open the packet capture file using a plain text editor such as Notepad.
Fortinet
13.Delete the first and last lines, which look like this:
=~=~=~=~=~=~=~=~=~=~=~= PuTTY log 2014.07.25 11:34:40
=~=~=~=~=~=~=~=~=~=~=~=
FortiWeb-2000 #
These lines are a PuTTY timestamp and a command prompt, which are not part of the packet capture. If you do not delete them, they could interfere with the script in the next step.
669 FortiWeb 5.2 Patch 2 Administration Guide
14.Convert the plain text file to a format recognizable by your network protocol analyzer application.
You can convert the plain text file to a format (.pcap) recognizable by Wireshark (formerly called Ethereal) using the fgt2eth.pl Perl script. To download fgt2eth.pl, see the Fortinet
Knowledge Base article Using the FortiOS built-in packet sniffer .
The fgt2eth.pl script is provided as-is, without any implied warranty or technical support, and requires that you first install a Perl module compatible with your operating system.
To use fgt2eth.pl, open a command prompt, then enter a command such as the following:
Methods to open a command prompt vary by operating system.
On Windows XP, go to Start > Run and enter cmd.
On Windows 7, click the Start (Windows logo) menu to open it, then enter cmd.
fgt2eth.pl -in packet_capture.txt -out packet_capture.pcap
where:
• fgt2eth.pl
is the name of the conversion script; include the path relative to the current directory, which is indicated by the command prompt
• packet_capture.txt
is the name of the packet capture’s output file; include the directory path relative to your current directory
• packet_capture.pcap
is the name of the conversion script’s output file; include the directory path relative to your current directory where you want the converted output to be saved
Figure 92:Converting sniffer output to .pcap format
Fortinet
15.Open the converted file in your network protocol analyzer application. For further instructions, see the documentation for that application.
670 FortiWeb 5.2 Patch 2 Administration Guide
