debug flow does not show NAT and threat related drop information

[ghostrider]

Hello

One of our proxy server was not able to go to internet. The problem I later found that NAT was not configured for that proxy server.

To troubleshoot the issue, I just enabled debug flow for that proxy using filters but output of debug was not showing any information related to NAT? It was just showing route lookup and policy lookup is fine.

My question is how to get NAT related information OR threat related information (like traffic drop due to IPS signature match) in debug flow?

[reaper · Accepted solution]

here's a good starter : Getting Started: Flow Basic

if you set flow basic

> debug dataplane packet-diag set log feature flow basic 

you will capture the basic flow, so outbound and inbound packets, including nat

you mentioned NAT was not configured, so that would also mean flow basic will not return NAT properties

for additional information regarding your flow, you will need to enable different log features

admin@myNGFW> debug dataplane packet-diag set log feature 
> all        all 
> appid      appid 
> cfg        cfg 
> ctd        ctd 
> flow       flow 
> misc       misc 
> module     module 
> pow        pow 
> proxy      proxy 
> ssl        ssl 
> tcp        tcp 
> tunnel     tunnel 
> url_trie   url_trie 
> zip        zip 

so for threat information you would need to enable the 'ctd basic' feature and for appid the 'appid basic' etc.

beware that the more features you enable, the noisier the output log will be and the more resources will be required from the dataplane to capture all this information. you will want to set VERY strict filters and keep a close eye on the dataplane CPU usage

> show running resource-monitor second

[ghostrider]

Thanks !

[Raido_Rattameister]

Hey reaper do you know any document that explains those diferent flow options in more detail?

[reaper]

nothing comprehensive... i'll add this to my todo list 😉