Troubleshooting
Page 129
FortiRecorder 2.4.2 Administration Guide
Examining the ARP table
When connectivity cannot be established or is periodically interrupted, but hardware and link
status is not an issue, the first place to look is at a slightly higher layer in network connections:
the address resolution protocol (ARP) table. While most devices’ MAC address is bound to the
hardware at the manufacturer and not easily changed, some devices have configurable or
virtual MACs. In this case, you should make sure there is no conflict which could cause the IP to
resolve to a different network port whenever that other device is connected to your network.
Functioning ARP is especially important in high availability (HA) topologies. If changes in which
MAC address resolves to which IP address are not correctly propagated through your network,
failovers may not work.
To display the ARP table in the CLI, enter:
diagnose network arp list
Checking routing
If the MAC resolves correctly, but IP connectivity fails, try using ICMP (
ping
and
traceroute
)
to determine if the host is reachable, or to locate the point on your network at which
connectivity fails. You can do this from the FortiRecorder appliance using CLI commands.
IP layer connectivity fails when routes are incorrectly configured. Static routes direct traffic
exiting the FortiRecorder appliance — you can specify through which network interface a
packet will leave, and the IP address of a next-hop router that is reachable from that network
interface. Routers are aware of which IP addresses are reachable through various network
pathways, and can forward those packets along pathways capable of reaching the packets’
ultimate destinations. Your FortiRecorder itself does not need to know the full route, as long as
the routers can pass along the packet.
You must configure FortiRecorder with at least one static route that points to a router, often a
router that is the gateway to the Internet. You may need to configure multiple static routes if you
have multiple gateway routers (e.g. each of which should receive packets destined for a
different subset of IP addresses), redundant routers (e.g. redundant Internet/ISP links), or other
special routing cases.
However, often you will only need to configure one route: a default route.
For example, if a web server is directly attached to one physical port on the FortiRecorder, but
all other destinations, such as connecting clients, are located on distant networks, such as the
Internet, you might need to add only one route: a default route that indicates the gateway router
through which the FortiRecorder appliance can send traffic in the direction towards the Internet.
To determine which route a packet will be subject to, FortiRecorder examines each packet’s
destination IP address and compares it to those of the static routes. It will forward the packet
along to the route with the largest prefix match, automatically egressing from the network
interface on that network. (Egress port for a route cannot be manually configured.)
The
ping
command sends a small data packet to the destination and waits for a response. The
response has a timer that may expire, indicating that the destination is unreachable via ICMP.
ICMP is part of Layer 3 on the OSI Networking Model.
ping
sends Internet Control Message
Protocol (ICMP)
ECHO_REQUEST
packets to the destination, and listens for
ECHO_RESPONSE
packets in reply. Beyond basic existence of a possible route between the source and
If your management computer is
not
directly attached to one of the physical ports of the
FortiRecorder appliance, you may also require a static route so that your management
computer is able to connect with the web UI and CLI.
