web filter

[Hakan]

Merhaba,

eybis.kgk.gov.tr adresini UTM kısmından izin verilen yada güvenilir bir kategoride göstermemize rağmen site açılmıyor. ilgili kuraldan internete çıkışında web filterı tamamen kaldırıdığımızda siteye giriş yapılıyor. Bu konuda çözüm adına ne yapılabilir.

teşekürler

[tuncaybas]

Merhaba

eybis.kgk.gov.tr adresine ping attığımızda 10.60.0.31 geliyor. Bu lokal IP sanırım. Bu nedenle içerden eybis.kgk.gov.tr adresine giriş yaparken aslında fortigate uğramadan gelmesi lazım.

şöyle yapabilirsiniz.

dia debug flow filter addr 10.60.0.31
dia debug flow sh con en
dia debug flow trace start 100
dia debug en


bu komutları girdikten sonra siteye erişim denemesi yaparak yukardaki kodların çıktısını paylaşırmısınız.

[Hakan]

çok teşekkürler, buyrun....


id=20085 trace_id=61 func=print_pkt_detail line=4378 msg="vd-root received a packet(proto=6, 10.14.17.64:50981->10.60.0.31:443) from Idari. flag [F.], seq 851627738, ack 3248235757, win 256"
id=20085 trace_id=63 func=print_pkt_detail line=4378 msg="vd-root received a packet(proto=6, 10.14.17.64:50980->10.60.0.31:443) from Idari. flag [F.], seq 179744080, ack 3975992252, win 256"
id=20085 trace_id=62 func=print_pkt_detail line=4378 msg="vd-root received a packet(proto=6, 10.14.17.64:50979->10.60.0.31:443) from Idari. flag [F.], seq 3940714122, ack 2095453444, win 256"
id=20085 trace_id=61 func=resolve_ip_tuple_fast line=4437 msg="Find an existing session, id-5361d4d3, original direction"
id=20085 trace_id=63 func=resolve_ip_tuple_fast line=4437 msg="Find an existing session, id-5361d4d2, original direction"
id=20085 trace_id=62 func=resolve_ip_tuple_fast line=4437 msg="Find an existing session, id-5361d4d1, original direction"
id=20085 trace_id=61 func=ids_receive line=237 msg="send to ips"
id=20085 trace_id=63 func=ids_receive line=237 msg="send to ips"
id=20085 trace_id=62 func=ids_receive line=237 msg="send to ips"
id=20085 trace_id=61 func=av_receive line=254 msg="send to application layer"
id=20085 trace_id=64 func=print_pkt_detail line=4378 msg="vd-root received a packet(proto=6, 10.60.0.31:443->10.14.17.64:50981) from local. flag [.], seq 3248235757, ack 851627739, win 5840"
id=20085 trace_id=64 func=resolve_ip_tuple_fast line=4437 msg="Find an existing session, id-5361d4d3, reply direction"
id=20085 trace_id=64 func=ip_session_output line=449 msg="send to ips"
id=20085 trace_id=62 func=av_receive line=254 msg="send to application layer"
id=20085 trace_id=65 func=print_pkt_detail line=4378 msg="vd-root reid=20085 trace_id=81 func=print_pkt_detail line=4378 msg="vd-root received a packet(proto=6, 10.14.17.64:50986->10.60.0.31:443) from Idari. flag , seq 3872071067, ack 0, win 8192"
id=20085 trace_id=81 func=av_receive line=254 msg="send to application layer"
id=20085 trace_id=81 func=init_ip_session_common line=4527 msg="allocate a new session-53622102"
id=20085 trace_id=82 func=print_pkt_detail line=4378 msg="vd-root received a packet(proto=6, 10.60.0.31:443->10.14.17.64:50986) from local. flag [S.], seq 431974844, ack 3872071068, win 5840"
id=20085 trace_id=81 func=vf_ip4_route_input line=1596 msg="find a route: flags=00000000 gw-95.0.37.193 via port12"
id=20085 trace_id=82 func=resolve_ip_tuple_fast line=4437 msg="Find an existing session, id-53622102, reply direction"
id=20085 trace_id=81 func=fw_forward_handler line=670 msg="Allowed by Policy-207: AV SNAT"
id=20085 trace_id=82 func=ip_session_output line=449 msg="send to ips"
id=20085 trace_id=83 func=print_pkt_detail line=4378 msg="vd-root received a packet(proto=6, 10.14.17.64:50987->10.60.0.31:443) from Idari. flag , seq 1766419174, ack 0, win 8192"
id=20085 trace_id=81 func=ids_receive line=237 msg="send to ips"
id=20085 trace_id=83 func=init_ip_session_common line=4527 msg="allocate a new session-53622103"
id=20085 trace_id=83 func=vf_ip4_route_input line=1596 msg="find a route: flags=00000000 gw-95.0.37.193 via port12"
id=20085 trace_id=83 func=fw_forward_handler line=670 msg="Allowed by Policy-207: AV SNAT"
id=20085 trace_id=83 func=ids_receive line=237 msg="send to ips"
id=20085 trace_id=84 func=print_pkt_detail line=4378 msg="vd-root received a packet(proto=6, 10.14.17.64:50988->10.60.0.31:443) from Idari. flag , seq 4100941122, ack 0, win 8192"
id=20085 trace_id=84 func=init_ip_session_common line=4527 msg="allocate a new session-53622104"
id=20085 trace_id=84 func=ids_receive line=237 msg="send to ips"
id=20085 trace_id=84 func=vf_ip4_route_input line=1596 msg="find a route: flags=00000000 gw-95.0.37.193 via port12"
id=20085 trace_id=83 func=av_receive line=254 msg="send to application layer"
id=20085 trace_id=84 func=fw_forward_handler line=670 msg="Allowed by Policy-207: AV SNAT"
id=20085 trace_id=86 func=print_pkt_detail line=4378 msg="vd-root received a packet(proto=6, 10.60.0.31:443->10.14.17.64:50987) from local. flag [S.], seq 2951322617, ack 1766419175, win 5840"
id=20085 trace_id=84 func=av_receive line=254 msg="send to application layer"
id=20085 trace_id=86 func=resolve_ip_tuple_fast line=4437 msg="Find an existing session, id-53622103, reply direction"
id=20085 trace_id=85 func=print_pkt_detail line=4378 msg="vd-root received a packet(proto=6, 10.60.0.31:443->10.14.17.64:50988) from local. flag [S.], seq 2960354142, ack 4100941123, win 5840"
id=20085 trace_id=86 func=ip_session_output line=449 msg="send to ips"
id=20085 trace_id=85 func=resolve_ip_tuple_fast line=4437 msg="Find an existing session, id-53622104, reply direction"
id=20085 trace_id=85 func=ip_session_output line=449 msg="send to ips"
id=20085 trace_id=87 func=print_pkt_detail line=4378 msg="vd-root received a packet(proto=6, 10.14.17.64:50986->10.60.0.31:443) from Idari. flag [.], seq 3872071068, ack 431974845, win 64240"
id=20085 trace_id=87 func=resolve_ip_tuple_fast line=4437 msg="Find an existing session, id-53622102, original direction"
id=20085 trace_id=87 func=ids_receive line=237 msg="send to ips"
id=20085 trace_id=87 func=av_receive line=254 msg="send to application layer"
id=20085 trace_id=88 func=print_pkt_detail line=4378 msg="vd-root received a packet(proto=6, 10.14.17.64:50986->10.60.0.31:443) from local. flag , seq 108866684, ack 0, win 5840"
id=20085 trace_id=88 func=resolve_ip_tuple_fast line=4437 msg="Find an existing session, id-53622102, original direction"
id=20085 trace_id=88 func=__ip_session_run_tuple line=2523 msg="SNAT 10.14.17.64->95.0.37.248:50986"
id=20085 trace_id=89 func=print_pkt_detail line=4378 msg="vd-root received a packet(proto=6, 10.14.17.64:50989->10.60.0.31:443) from Idari. flag , seq 1885158889, ack 0, win 8192"
id=20085 trace_id=90 func=print_pkt_detail line=4378 msg="vd-root received a packet(proto=6, 10.14.17.64:50988->10.60.0.31:443) from Idari. flag [.], seq 4100941123, ack 2960354143, win 64240"
 

[tuncaybas]

207 nolu kural internete doğru olan kuralmıdır.

[Hakan]

evet.

az önce yaptıklarımızın internet çıkışlarımızı yavaşlatma gibi etkisi olabilir mi? yoksa sadece bir log görüntüsü mü aldık. Bir anda netimiz yavaşladı.

[tuncaybas]

sadece log aldık. şuan bendede internet yavaş. genel bir problem var sanırım.

[Hakan]

 
evet dediğiniz gibi sanırım genel bir problem.

loglardan herhangi bir çıkarım edindiniz mi?

[tuncaybas]

Routing Monitor ekranını gönderirmisiniz.

[Hakan]

port12 ttnet çıkış

port11 superonline çıkış
vlanlarin net çıkışına web filter uygulnanların hiçbiri https://eybis.kgk.gov.tr/ ' ye girememektedir.



Static      0.0.0.0/0   95.0.37.193   port12   
Static      10.0.0.0/24   0.0.0.0   ssl.root   
Connected      10.10.0.0/16   0.0.0.0   X86Servers   
Connected      10.11.16.0/20   0.0.0.0   WirelessMan   
Connected      10.11.32.0/20   0.0.0.0   Guest   
Connected      10.11.48.0/20   0.0.0.0   Voice   
Connected      10.11.64.0/20   0.0.0.0   Printer   
Connected      10.11.80.0/20   0.0.0.0   CAMERA   
Connected      10.11.96.0/20   0.0.0.0   Unauth   
Connected      10.11.112.0/20   0.0.0.0   WifiGecis   
Connected      10.12.16.0/20   0.0.0.0   Eng   
Connected      10.12.32.0/20   0.0.0.0   Eas   
Connected      10.12.48.0/20   0.0.0.0   Edu   
Connected      10.12.64.0/20   0.0.0.0   Law   
Connected      10.12.80.0/20   0.0.0.0   Arch   
Connected      10.12.96.0/20   0.0.0.0   Comm   
Connected      10.12.112.0/20   0.0.0.0   MYO   
Connected      10.12.128.0/20   0.0.0.0   Lab   
Connected      10.12.144.0/20   0.0.0.0   Other   
Connected      10.12.160.0/20   0.0.0.0   Tip   
Connected      10.13.16.0/20   0.0.0.0   Akademisyen   
Connected      10.14.16.0/20   0.0.0.0   Idari   
Connected      10.14.32.0/20   0.0.0.0   BIM   
Connected      10.14.48.0/20   0.0.0.0   Muhasebe   
Connected      10.14.64.0/20   0.0.0.0   Personel   
Connected      95.0.37.192/26   0.0.0.0   port12   
Static      95.9.114.175/32   95.0.37.193   port12   
Connected      172.16.27.0/24   0.0.0.0   MacServers   
Static      172.16.64.0/18   10.10.1.2   X86Servers   
Connected      192.168.21.0/24   0.0.0.0   PServe   
Static      192.168.201.0/24   0.0.0.0   ssl.root   
Static      192.168.202.0/24   0.0.0.0   ssl.root   
Static      192.168.203.0/24   0.0.0.0   ssl.root   
Static      192.168.204.0/24   0.0.0.0   ssl.root   
Connected      192.168.250.0/24   0.0.0.0   port13   
Connected      193.140.10.108/30   0.0.0.0   port14   
Connected      213.74.185.24/29   0.0.0.0   port11   

[tuncaybas]

eğer sizin içinde uygunsa özelden bana ammy admin erişimi gönderirseniz beraber bakalım.