Traffic Statistics for Tunnel Routing and IPSec
Statistics
l
user A (source IP) generates FTP traffic (source or destination port) in 60MB
l
user B (source IP) generates FTP traffic (source or destination port) in 40MB
l
user A (source IP) generates HTTP traffic (source or destination port) in 80MB
l
user B (source IP) generates HTTP traffic (source or destination port) in 20MB
From the BM logs, we have no idea which one is transferred through Tunnel Routing. The thing we know from the logs
is 100MB FTP traffic and 100MB HTTP traffic passed through FortiWAN, and they are 200MB in total.
In page Statistics > Tunnel Traffic, we see 60MB tunnel traffic (parts of the 200MB) belongs to the tunnel group.
However, it tells nothing about the statistics for the individual services (FTP and HTTP) in the tunnel traffic.
As for Reports > Service, statistics by service is displayed as follows:
l
FTP = 60MB
l
HTTP = 80MB
l
GRE = 60MB
l
Total = 200MB
All the tunnel traffic (FTP and HTTP generated by user B) is classified into GRE, and we have no idea about what the
original services are in it. What we can do is drilling it down by Internal IP to identify the generator user B, or drilling it
down by Inclass and Outclass to identify the individual service if the corresponding BM classes are well-defined.
Considering the IPSec transmission with the same example, user B generates the same traffic but transfer them
through IPSec. We will have BM logs the same as what we discussed above, and have no idea which service is
transferred through IPSec. In page Report > Service, the traffic is counted as follows:
l
FTP = 100MB
l
HTTP = 100MB
l
Total = 200MB
Drilling it down by Internal IP can identify the generators user A and user B, but it tells nothing about service ESP.
FortiWAN Handbook
Fortinet Technologies Inc.
255
