Solved

Fortigate Message

Posted on 2014-03-28
9
911 Views
Last Modified: 2014-04-11
Hi Experts,

I have set up a policy in my Forti firewall and blocking P2P applications.
I get messages that EDONKEY is running somewhere.
But when I check the computer, I cannot find anything.
Can you help me to understand the alert ?

See here:

Message meets Alert condition
date=2014-03-28 time=07:27:13 devname=myforti device_id=*** log_id=0022000003 type=traffic subtype=violation  pri=warning status=deny vd="root" src=192.168.212.48 srcname=192.168.212.48 src_port=58198 dst=81.19.104.27 dstname=81.19.104.27 dst_country="Spain" src_country="Reserved" dst_port=443 service=HTTPS proto=6 app_type=eDonkey duration=60 rule=66 policyid=66 identidx=0 sent=92 rcvd=52 shaper_drop_sent=0 shaper_drop_rcvd=0 perip_drop=0 shaper_sent_name="N/A" shaper_rcvd_name="N/A" perip_name="N/A" vpn="N/A" vpn_type=UNKNOWN(65535) vpn_tunnel="N/A" src_int="port14" dst_int="port16" SN=167064872 app="eDonkey" app_cat="P2P" user="N/A" group="N/A" msg="N/A" carrier_ep="N/A" profilegroup="N/A" subapp="eDonkey" subappcat="P2P"
0
Comment
Question by:Eprs_Admin
  • 5
  • 3
9 Comments
 
LVL 17

Expert Comment

by:TimotiSt
ID: 39962427
Looks like it's identifying some https traffic as edonkey:
dst_port=443 service=HTTPS

Are you running the latest firmware, to make sure UTM definitions are current?
0
 
LVL 8

Assisted Solution

by:myramu
myramu earned 167 total points
ID: 39965246
Hello,

Looks like its an IPS signature issue. It would be better to get in touch with Fortinet support team.

Good Luck!
0
 

Author Comment

by:Eprs_Admin
ID: 39965896
ok thanks.
I will check latest firmware version this week.
0
 

Author Comment

by:Eprs_Admin
ID: 39965916
we have this firmware running:
v4.0,build0665,130514 (MR3 Patch 14)
0
New! My Passport Wireless Pro Wi-Fi Mobile Storage

Portable wireless storage to offload, edit, and stream anywhere.

High-capacity, wireless mobile storage designed to accompany professional photographers and videographers in the field to easily offload, edit and stream captured photos and high-definition videos.

 
LVL 17

Assisted Solution

by:TimotiSt
TimotiSt earned 333 total points
ID: 39966158
4.0 Patch 14 is reasonably new. If it's just a bogus, you can disable that specific UTM rule, or get support from Fortigate.
0
 

Author Comment

by:Eprs_Admin
ID: 39966180
no I want this rule, because I will block all P2P applications.
0
 
LVL 17

Accepted Solution

by:
TimotiSt earned 333 total points
ID: 39966196
Then I'd say open a ticket with Fortinet support, get them to check it out for you.
0
 

Author Comment

by:Eprs_Admin
ID: 39966210
ok, can I just open a ticket with them when I have an active license ?
0
 

Author Comment

by:Eprs_Admin
ID: 39985278
since one week no answer from Fortinet.
0

Featured Post

PRTG Network Monitor: Intuitive Network Monitoring

Network Monitoring is essential to ensure that computer systems and network devices are running. Use PRTG to monitor LANs, servers, websites, applications and devices, bandwidth, virtual environments, remote systems, IoT, and many more. PRTG is easy to set up & use.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

How to set-up an On Demand, IPSec, Site to SIte, VPN from a Draytek Vigor Router to a Cyberoam UTM Appliance. A concise guide to the settings required on both devices
There are many Password Managers (PM) out there to choose from. PM's can help with your password habits and routines, but they should not be a crutch you rely on too heavily. I also have an article for company/enterprise PM's.
Sending a Secure fax is easy with eFax Corporate (http://www.enterprise.efax.com). First, just open a new email message. In the To field, type your recipient's fax number @efaxsend.com. You can even send a secure international fax — just include t…
A simple description of email encryption using a secure portal service. This is one of the choices offered by The Email Laundry for email encryption. The other choices are pdf encryption which creates an encrypted pdf of your email and any attachmen…

920 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

14 Experts available now in Live!

Get 1:1 Help Now