Configuring the FortiOS one-arm sniffer

Starting in FortiOS 7.4.1 with FortiSwitchOS 7.4.1, you can use the FortiOS one-arm sniffer to configure a VLAN interface on a managed FortiSwitch unit as an intrusion detection system (IDS). Traffic sent to the interface is examined for matches to the configured security profile. The matches are logged, and the unmatched sniffed traffic is not forwarded to the FortiGate device. Sniffing only reports on attacks; it does not deny or influence traffic.

Traffic scanned on the FortiOS one-arm sniffer interface is processed by the CPU. The FortiOS one-arm sniffer might cause higher CPU usage and perform at a lower level than traditional inline scanning.

The absence of high CPU usage does not indicate the absence of packet loss. Packet loss might occur due to the capacity of the TAP devices hitting maximum traffic volume during mirroring or, on the FortiGate device, when the kernel buffer size is exceeded and it is unable to handle bursts of traffic.

To configure the FortiOS one-arm sniffer in the CLI:

1. Specify the managed switch port to use to mirror traffic in RSPAN or ERSPAN mode.

2. Enable the FortiOS one-arm sniffer on the VLAN interface that will mirror traffic.

3. Configure the FortiOS one-arm sniffer in a firewall policy.

4. Generate traffic on the client.

5. Review the logs for the sniffer policy.

1. Specify the managed switch port to use to mirror traffic in RSPAN or ERSPAN mode

You can mirror traffic in RSPAN or ERSPAN mode on a layer-2 VLAN. Specify which ingress port you want to use for a mirroring source.

config switch-controller traffic-sniffer

set mode {rspan | erspan-auto}

config target-port

edit <FortiSwitch_serial_number>

set in-ports <port_name>

next

end

end

For example:

config switch-controller traffic-sniffer

set mode rspan

config target-port

edit S524DF4K15000024

set in-ports port6

next

end

end

2. Enable the FortiOS one-arm sniffer on the VLAN interface that will mirror traffic

After you enable ips-sniffer-mode, switch-controller-access-vlan and switch-controller-rspan-mode are enabled by default, and switch-controller-traffic-policy is set to sniffer by default.

config system interface

edit <interface_name>

set ips-sniffer-mode enable

set switch-controller-access-vlan enable

set switch-controller-traffic-policy sniffer

set switch-controller-rspan-mode enable

next

end

For example:

config system interface

edit rspan

set ips-sniffer-mode enable

set switch-controller-access-vlan enable

set switch-controller-traffic-policy sniffer

set switch-controller-rspan-mode enable

next

end

3. Configure the FortiOS one-arm sniffer in a firewall policy

Specify the same interface that you used in step 2. Enable the security profiles that you want to use and specify the sniffer-profile profile for each security profile. By default, all security profiles are disabled.

config firewall sniffer

edit <sniffer_ID>

set logtraffic {all | utm}

set interface <interface_name>

set av-profile-status {enable | disable}

set av-profile "sniffer-profile"

set webfilter-profile-status {enable | disable}

set webfilter-profile "sniffer-profile"

set application-list-status {enable | disable}

set application-list "sniffer-profile"

set ips-sensor-status {enable | disable}

set ips-sensor "sniffer-profile"

set file-filter-profile-status {enable | disable}

set file-filter-profile "sniffer-profile"

next

end

For example:

config firewall sniffer

edit 50

set logtraffic all

set interface rspan

set av-profile-status enable

set av-profile sniffer-profile

set webfilter-profile-status enable

set webfilter-profile sniffer-profile

set application-list-status enable

set application-list sniffer-profile

set ips-sensor-status enable

set ips-sensor sniffer-profile

set file-filter-profile-status enable

set file-filter-profile sniffer-profile

next

end

5. Review the logs for the sniffer policy

execute log display

Configuration example

The following example shows how a managed FortiSwitch unit mirrors traffic from a client and then sends the traffic to the FortiGate device for analysis. In this example, enable the FortiOS one-arm sniffer in the FortiOS CLI and then use the FortiOS GUI for the rest of the example.

1. Enable the FortiOS one-arm sniffer.

   config system interface

   edit "rspan.17"

   set ips-sniffer-mode enable

   set vdom root

   set interface port11

   set vlanid 4092

   next

   end

2. Go to Network > Interfaces.

3. Select rspan.17 (under port11) and click Edit.

4. Enable the security profiles that you want to use.

   

5. Click OK.

6. Generate traffic on the client.

7. Go to Log & Report > Sniffer Traffic.

   The logs generated from the mirrored traffic are listed.

   

   In the FortiOS CLI, use the execute log display command to view the logs:

   784 logs found.

   10 logs returned.

   1: date=2023-07-31 time=16:28:13 eventtime=1690846092971957519 tz="-0700" logid="0004000017" type="traffic" subtype="sniffer" level="notice" vd="vdom1" srcip=5.4.4.2 srcport=51293 srcintf="rspan.17" srcintfrole="undefined" dstip=96.45.45.45 dstport=53 dstintf="rspan.17" dstintfrole="undefined" srccountry="Germany" dstcountry="United States" sessionid=784 proto=17 action="accept" policyid=1 policytype="sniffer" service="DNS" trandisp="snat" transip=0.0.0.0 transport=0 duration=180 sentbyte=70 rcvdbyte=0 sentpkt=1 rcvdpkt=0 appid=16195 app="DNS" appcat="Network.Service" apprisk="elevated" utmaction="allow" countapp=1 sentdelta=70 rcvddelta=0 mastersrcmac="00:0c:29:38:2a:c6" srcmac="00:0c:29:38:2a:c6" srcserver=0 masterdstmac="04:d5:90:bf:f3:50" dstmac="04:d5:90:bf:f3:50" dstserver=0

   2: date=2023-07-31 time=16:27:39 eventtime=1690846059062169260 tz="-0700" logid="0004000017" type="traffic" subtype="sniffer" level="notice" vd="vdom1" srcip=5.4.4.2 srcport=37800 srcintf="rspan.17" srcintfrole="undefined" dstip=96.45.45.45 dstport=53 dstintf="rspan.17" dstintfrole="undefined" srccountry="Germany" dstcountry="United States" sessionid=782 proto=17 action="accept" policyid=1 policytype="sniffer" service="DNS" trandisp="snat" transip=0.0.0.0 transport=0 duration=180 sentbyte=70 rcvdbyte=0 sentpkt=1 rcvdpkt=0 appid=16195 app="DNS" appcat="Network.Service" apprisk="elevated" utmaction="allow" countapp=1 sentdelta=70 rcvddelta=0 mastersrcmac="00:0c:29:38:2a:c6" srcmac="00:0c:29:38:2a:c6" srcserver=0 masterdstmac="04:d5:90:bf:f3:50" dstmac="04:d5:90:bf:f3:50" dstserver=0 utmref=0-6524

   3: date=2023-07-31 time=16:27:39 eventtime=1690846059062027560 tz="-0700" logid="0004000017" type="traffic" subtype="sniffer" level="notice" vd="vdom1" srcip=5.4.4.2 srcport=52702 srcintf="rspan.17" srcintfrole="undefined" dstip=96.45.45.45 dstport=53 dstintf="rspan.17" dstintfrole="undefined" srccountry="Germany" dstcountry="United States" sessionid=780 proto=17 action="accept" policyid=1 policytype="sniffer" service="DNS" trandisp="snat" transip=0.0.0.0 transport=0 duration=180 sentbyte=61 rcvdbyte=0 sentpkt=1 rcvdpkt=0 appid=16195 app="DNS" appcat="Network.Service" apprisk="elevated" utmaction="allow" countapp=1 sentdelta=61 rcvddelta=0 mastersrcmac="00:0c:29:38:2a:c6" srcmac="00:0c:29:38:2a:c6" srcserver=0 masterdstmac="04:d5:90:bf:f3:50" dstmac="04:d5:90:bf:f3:50" dstserver=0 utmref=0-6510