目前遇到更換Fortigate 60E在設置外對內開放2000 port時一直出錯(telnet 有通但沒回應訊息無法操作)，怎麼導就是不通，最後有查到2000 port已被voip給佔用，所以依官方的設定進行了修正動作
config system settings
set default-voip-alg-mode kernel-helper-based
end
單一外點測試正常，但某些外點反應連不上，測試了一下會變成有的IP可以正常登入內部伺服器2000 port(telnet會回應正常訊息)，有的就出現和沒改設定前一樣telnet有通但沒回應訊息無法操作，試過更換Port都正常，但外點早期就都是用2000port要改會很麻煩
外對內只有一條規則 Any to Server-2000 open Port-2000
目前除了更換PORT外不知還有什麼辨法可解?
fz500s wrote:
官方文件有寫 FortiGate...(恕刪)
config sys sett
set sccp-port <port_number>
end
你有試過這個指令改變FortiOS監控的port?
vxr wrote:
試著用這個命令.....(恕刪)
設備己重啟，這個清除指令也下完了，都沒用!!!
有將 session list 出來了
這個是可以通的記錄 ex IP:100.100.100.100
session info: proto=6 proto_state=06 duration=4 expire=0 timeout=3600 flags=00000000 sockflag=00000000 sockport=0 av_idx=0 use=4
origin-shaper=
reply-shaper=
per_ip_shaper=
ha_id=0 policy_dir=0 tunnel=/ vlan_cos=0/255
state=log may_dirty npu f00
statistic(bytes/packets/allow_err): org=132/3/1 reply=132/3/1 tuples=2
tx speed(Bps/kbps): 0/0 rx speed(Bps/kbps): 0/0
orgin->sink: org pre->post, reply pre->post dev=5->20/20->5 gwy=192.168.0.60/aaa.bbb.ccc.254
hook=pre dir=org act=dnat 100.100.100.100:46289->aaa.bbb.ccc.1:2000(192.168.0.60:2000)
hook=post dir=reply act=snat 192.168.0.60:2000->100.100.100.100:46289(aaa.bbb.ccc.1:2000)
pos/(before,after) 0/(0,0), 0/(0,0)
misc=0 policy_id=13 auth_info=0 chk_client_info=0 vd=0
serial=00001e73 tos=ff/ff app_list=0 app=0 url_cat=0
dd_type=0 dd_mode=0
npu_state=0x000c00
npu info: flag=0x81/0x81, offload=8/8, ips_offload=0/0, epid=76/64, ipid=64/76, vlan=0x0000/0x0000
vlifid=64/76, vtag_in=0x0000/0x0000 in_npu=1/1, out_npu=1/1, fwd_en=0/0, qid=1/2
這個是不行通的記錄 ex IP:123.123.123.186
session info: proto=6 proto_state=01 duration=22 expire=3577 timeout=3600 flags=00000000 sockflag=00000000 sockport=0 av_idx=0 use=4
origin-shaper=
reply-shaper=
per_ip_shaper=
ha_id=0 policy_dir=0 tunnel=/ vlan_cos=0/255
state=log may_dirty npu f00
statistic(bytes/packets/allow_err): org=88/2/1 reply=48/1/1 tuples=2
tx speed(Bps/kbps): 0/0 rx speed(Bps/kbps): 0/0
orgin->sink: org pre->post, reply pre->post dev=5->20/20->5 gwy=192.168.0.60/aaa.bbb.ccc.254
hook=pre dir=org act=dnat 123.123.123.186:1996->aaa.bbb.ccc.1:2000(192.168.0.60:2000)
hook=post dir=reply act=snat 192.168.0.60:2000->123.123.123.186:1996(aaa.bbb.ccc.1:2000)
pos/(before,after) 0/(0,0), 0/(0,0)
misc=0 policy_id=13 auth_info=0 chk_client_info=0 vd=0
serial=00001caf tos=ff/ff app_list=0 app=0 url_cat=0
dd_type=0 dd_mode=0
npu_state=0x000c00
npu info: flag=0x81/0x81, offload=8/8, ips_offload=0/0, epid=76/64, ipid=64/76, vlan=0x0000/0x0000
vlifid=64/76, vtag_in=0x0000/0x0000 in_npu=1/1, out_npu=1/1, fwd_en=0/0, qid=3/0
內文搜尋
從 APP 打開
X