Solved: How do I packet sniffer on Firewall NP7 hyperscale?

This article describes how to do a sniff on offloaded traffic in NP7.

Solution

FGT SITE A — overlay ip 10.166.242.2 (wan interface IP 10.47.0.157)– site to site vpn – (wan interface ip 10.47.1.134) 10.166.242.1 overlay ip – FGT Site B

Step 1: On this scenario the esp packets that is offloaded on NP7 will be captured.

# diagnose npu sniffer filter intf port1
# diagnose npu sniffer filter protocol 50
# diagnose npu sniffer filter dir 2
# diagnose npu sniffer start

• Port1 is the interface set where the sniff will listen to. Wherein port1 is where the VPN is configured.
• Protocol 50 is the esp protocol to capture.
• Dir has 3 options (0 – ingress, 1 – egress, 2- both) in case to capture both ingress and egress.

Step 2: Now this is the diag sniff command to run the sniff for np.

# diagnose sniffer packet npudbg ‘ ‘ 6 0 a

Sample output:
========================================

FG181F-2 # diagnose npu sniffer filter intf port1
FG181F-2 # diagnose npu sniffer filter protocol 50
FG181F-2 # diagnose npu sniffer filter dir 2
FG181F-2 # diagnose npu sniffer start
start sniffer with 1 filter(s)

FG181F-2 # diagnose sniffer packet npudbg  ' ' 6 0 a
interfaces=[npudbg]
filters=[ ]
pcap_lookupnet: npudbg: no IPv4 address assigned

2022-09-29 05:51:33.138406 npudbg -- 10.47.0.157 -> 10.47.1.134: ESP(spi=0xf36f5f69,seq=0x2)
0x0000   0049 7269 2b01 04d5 90d5 40d6 0800 4500        [email protected].
0x0010   0098 d802 0000 3f32 8cb1 0a2f 009d 0a2f        ......?2.../.../
0x0020   0186 f36f 5f69 0000 0002 7801 6734 cf67        ...o_i....x.g4.g
0x0030   4353 b2aa 8e40 1e91 886c abcf 9b02 05fe        [email protected]......
0x0040   5322 78a7 a57f 13a7 8ac1 5451 0757 0a2c        S"x.......TQ.W.,
0x0050   3dc6 1a7d 92f6 ff34 eabb ce79 059b 633d        =..}...4...y..c=
0x0060   e81a da1a 77c8 b2bb ce2f 7322 c090 4059        ....w..../s"..@Y
0x0070   4715 4d18 794e 1c69 2d2f 2896 d902 50d1        G.M.yN.i-/(...P.
0x0080   115e 5aa8 4ecc cba2 3e0e f698 b913 629e        .^Z.N...>.....b.
0x0090   eb63 85d1 3c50 e164 94a8 9522 a468 9864        .c..<p.d...".h.d 0x00a0="" c3dd="" d5f7="" 00d0="" ......="" 2022-09-29="" 05:51:33.139119="" npudbg="" --="" 10.47.1.134="" -=""> 10.47.0.157: ESP(spi=0xcb5ac2a8,seq=0x2)
0x0000   04d5 90d5 40d6 0049 7269 2b01 0800 4500        [email protected]+...E.
0x0010   0098 0100 0000 3f32 63b4 0a2f 0186 0a2f        ......?2c../.../
0x0020   009d cb5a c2a8 0000 0002 0c21 ba65 ae7f        ...Z.......!.e..
0x0030   c1d4 46e1 9cc5 81bb a128 8372 dd95 ad3b        ..F......(.r...;
0x0040   6c17 ffed 27d4 7be2 74c7 eac7 d89f a981        l...'.{.t.......
0x0050   ea63 4646 5561 7e94 4b6c 6e2b e65b 873d        .cFFUa~.Kln+.[.=
0x0060   6c7d 0209 b033 1323 3723 dd17 cb14 c603        l}...3.#7#......
0x0070   8054 d9ab 7ce2 6128 d8ff b2ab d063 f681        .T..|.a(.....c..
0x0080   fc5f c150 2066 2d2d 5ab3 cd96 96cd dfc9        ._.P.f--Z.......
0x0090   fe2c 5f18 4245 283f fdd1 489c 68b6 388b        .,_.BE(?..H.h.8.
0x00a0   2357 cdad bef6                                 #W....

2022-09-29 05:51:34.138387 npudbg -- 10.47.0.157 -> 10.47.1.134: ESP(spi=0xf36f5f69,seq=0x3)
0x0000   0049 7269 2b01 06d5 90d5 40d6 0800 4500        [email protected].
0x0010   0098 ac09 0000 ff32 f8a9 0a2f 009d 0a2f        .......2.../.../
0x0020   0186 f36f 5f69 0000 0003 7190 fdce e5ed        ...o_i....q.....
0x0030   3e6a 3f28 b2ae 2193 67b0 b367 ef5a e1df        >j?(..!.g..g.Z..
0x0040   eece 9cf7 42d3 c3c9 9f72 c564 ea9e 4f1b        ....B....r.d..O.
0x0050   8cbe 63dc 2447 4321 8ae4 cdb5 0380 b2fe        ..c.$GC!........
0x0060   d0e4 f18c 670f 21c2 ad8e 90a5 8055 01b6        ....g.!......U..
0x0070   e937 95b3 77c0 7c4d fa9c 5ded e25e 1cf8        .7..w.|M..]..^..
0x0080   044b 0bdb 7cdb 77cd 6a52 c6c0 a6c6 eb85        .K..|.w.jR......
0x0090   08ac 13b5 82ca 29cc ee5b 51c8 5b12 3dd2        ......)..[Q.[.=.
0x00a0   aa52 299c 8f4b                                 .R)..K

2022-09-29 05:51:34.138532 npudbg -- 10.47.1.134 -> 10.47.0.157: ESP(spi=0xcb5ac2a8,seq=0x3)
0x0000   04d5 90d5 40d6 0049 7269 2b01 0800 4500        [email protected]+...E.
0x0010   0098 0200 0000 3f32 62b4 0a2f 0186 0a2f        ......?2b../.../
0x0020   009d cb5a c2a8 0000 0003 c3fa addb c4fa        ...Z............
0x0030   97f4 069b 20bd 1348 a85d 4b95 f4ad d43d        .......H.]K....=
0x0040   2fb1 6107 4d7b 043c 02c5 af48 4e94 dffd        /.a.M{.<...HN...
0x0050   afdd 229e 9af6 5433 c576 ade2 1c2d 5804        .."...T3.v...-X.
0x0060   77fc d3e4 b024 9fd1 5e51 0a55 ed2e 57e7        w....$..^Q.U..W.
0x0070   793a a311 1414 0459 dfb2 5268 3ecb 5e5f        y:.....Y..Rh>.^_
0x0080   3a82 218a 8bcd 89c3 ce48 68c3 f0cb e601        :.!......Hh.....
0x0090   21d4 bac8 723f 78ce ce3e 3cc0 88b7 84cf        !...r?x..><.....
0x00a0   bcce 6cc7 7017                                 ..l.p.

2022-09-29 05:51:35.138400 npudbg -- 10.47.0.157 -> 10.47.1.134: ESP(spi=0xf36f5f69,seq=0x4)
0x0000   0049 7269 2b01 06d5 90d5 40d6 0800 4500        [email protected].
0x0010   0098 ac0a 0000 ff32 f8a8 0a2f 009d 0a2f        .......2.../.../
0x0020   0186 f36f 5f69 0000 0004 e592 c2e3 1e56        ...o_i.........V
0x0030   75a3 89d0 d5b9 5908 94d6 cfd4 583f cdf9        u.....Y.....X?..
0x0040   a869 c219 2335 2f50 8d6c b48a 044f c009        .i..#5/P.l...O..
0x0050   407f 6a2c 9569 82fd 57a7 cef4 9b9b 70b9        @.j,.i..W.....p.
0x0060   4a80 f389 2b79 4396 e13b bf8e 2f1a ba0c        J...+yC..;../...
0x0070   e6ab 511e 4176 96ea 62ea e9c8 01c0 09db        ..Q.Av..b.......
0x0080   fbea 756d eba5 8aa2 cf75 795e 2b63 8935        ..um.....uy^+c.5
0x0090   cc89 cae4 8436 c3ff 5115 6a9d 8ae7 311f        .....6..Q.j...1.
0x00a0   d571 98e9 725c                                 .q..r\

2022-09-29 05:51:35.138551 npudbg -- 10.47.1.134 -> 10.47.0.157: ESP(spi=0xcb5ac2a8,seq=0x4)
0x0000   04d5 90d5 40d6 0049 7269 2b01 0800 4500        [email protected]+...E.
0x0010   0098 0300 0000 3f32 61b4 0a2f 0186 0a2f        ......?2a../.../
0x0020   009d cb5a c2a8 0000 0004 62fb 6d11 aa41        ...Z......b.m..A
0x0030   5ac6 a475 2f98 3d01 7d12 7615 fc21 87e2        Z..u/.=.}.v..!..
0x0040   ded4 7ef4 8cfd 7462 faa9 be1e 0331 b862        ..~...tb.....1.b
0x0050   2329 a25c d356 ed88 d7f0 c140 a4d9 3892        #).\[email protected].
0x0060   7391 1735 cb54 3178 ae0f 5e39 2523 fa28        s..5.T1x..^9%#.(
0x0070   5d9d 5652 af87 d2ba f762 228f 6627 d6b7        ].VR.....b".f'..
0x0080   1270 3df7 b4d2 28a9 3771 8787 4d3b c8e9        .p=...(.7q..M;..
0x0090   1037 2570 005d 4e2f 86b0 645f ff87 db35        .7%p.]N/..d_...5
0x00a0   5ad6 c1fb fc10                                 Z.....

2022-09-29 05:51:36.138414 npudbg -- 10.47.0.157 -> 10.47.1.134: ESP(spi=0xf36f5f69,seq=0x5)
0x0000   0049 7269 2b01 06d5 90d5 40d6 0800 4500        [email protected].
0x0010   0098 ac0b 0000 ff32 f8a7 0a2f 009d 0a2f        .......2.../.../
0x0020   0186 f36f 5f69 0000 0005 faa6 c0c3 f43c        ...o_i.........<
0x0030   e7cd df8b 3503 8133 5584 8dcf b1b5 89e0        ....5..3U.......
0x0040   855c 5427 8fe5 ee27 c3b8 db2c 3fef 0ad4        .\T'...'...,?...
0x0050   76d1 ce8c 3b98 5c89 6e4e d773 150c 0a41        v...;.\.nN.s...A
0x0060   3c3b 59f4 ac09 c81d d7bb b44d 7ff5 46f5        <;Y........M..F.
0x0070   622a d768 cbbc f5f0 2ea6 437e bc9c 4d65        b*.h......C~..Me
0x0080   6855 ae93 73bc 452a 73f3 cfb8 a17e b5fd        hU..s.E*s....~..
0x0090   3d8d a211 360c fa3b 3447 96d6 8a39 52a3        =...6..;4G...9R.
0x00a0   9fe6 9569 9c9e                                 ...i..

2022-09-29 05:51:36.138576 npudbg -- 10.47.1.134 -> 10.47.0.157: ESP(spi=0xcb5ac2a8,seq=0x5)
0x0000   04d5 90d5 40d6 0049 7269 2b01 0800 4500        [email protected]+...E.
0x0010   0098 0400 0000 3f32 60b4 0a2f 0186 0a2f        ......?2`../.../
0x0020   009d cb5a c2a8 0000 0005 7c96 96e6 f053        ...Z......|....S
0x0030   a5d2 20e9 1f37 2427 dc1b 6d97 3930 b4aa        .....7

===================================================

Step 3: Then, it is possible to run now diag vpn tunnel list to see the details to use and decrypt this packet capture.