topic Re: debug flow does not show NAT and threat related drop information in General Topics

debug flow does not show NAT and threat related drop information

ghostrider — Sun, 13 Nov 2016 12:45:34 GMT

Hello

One of our proxy server was not able to go to internet. The problem I later found that NAT was not configured for that proxy server.

To troubleshoot the issue, I just enabled debug flow for that proxy using filters but output of debug was not showing any information related to NAT? It was just showing route lookup and policy lookup is fine.

My question is how to get NAT related information OR threat related information (like traffic drop due to IPS signature match) in debug flow?

Re: debug flow does not show NAT and threat related drop information

reaper — Mon, 14 Nov 2016 09:39:49 GMT

here's a good starter : Getting Started: Flow Basic

if you set flow basic

> debug dataplane packet-diag set log feature flow basic

you will capture the basic flow, so outbound and inbound packets, including nat

you mentioned NAT was not configured, so that would also mean flow basic will not return NAT properties

for additional information regarding your flow, you will need to enable different log features

admin@myNGFW> debug dataplane packet-diag set log feature 
> all        all 
> appid      appid 
> cfg        cfg 
> ctd        ctd 
> flow       flow 
> misc       misc 
> module     module 
> pow        pow 
> proxy      proxy 
> ssl        ssl 
> tcp        tcp 
> tunnel     tunnel 
> url_trie   url_trie 
> zip        zip

so for threat information you would need to enable the 'ctd basic' feature and for appid the 'appid basic' etc.

beware that the more features you enable, the noisier the output log will be and the more resources will be required from the dataplane to capture all this information. you will want to set VERY strict filters and keep a close eye on the dataplane CPU usage

> show running resource-monitor second

Re: debug flow does not show NAT and threat related drop information

ghostrider — Mon, 14 Nov 2016 11:36:31 GMT

Thanks !

Re: debug flow does not show NAT and threat related drop information

Raido_Rattameister — Wed, 16 Nov 2016 17:50:19 GMT

Hey reaper do you know any document that explains those diferent flow options in more detail?

Re: debug flow does not show NAT and threat related drop information

reaper — Thu, 17 Nov 2016 15:34:27 GMT

nothing comprehensive... i'll add this to my todo list 😉