How To Troubleshoot Connection Failures Between Firewall And Log Collector

• Firewall
• Log collector

1. On the Firewall, check the Service Route to the Log Collector

2. If Service Route is set to "Use Management Interface for all" or "Use Default" then from the firewall CLI:
   1. Check IP connection between firewall and the log collector (LC).

ping host <IP address of LC>

2. Perform a traceroute check to the log collector:

   traceroute host <IP address of the LC>

   Similarly perform a traceroute check from the CLI of the log collector to the Management IP address of the firewall.
3. Check TCP connection between firewall and the log collector.

show netstat numeric-host yes numeric-port yes all yes | match 3978

Connection should show established if not then.

4. Check Permitted IP Address (Device > Setup> Interfaces > click Management > Permitted IP Addresses)

5. Perform a tcpdump on the firewall management interface.

tcpdump filter "port 3978" snaplen 0

6. Export the tcpdump packet capture to a scp or tftp server and analyze it to root cause the connection issue between firewall and log collector.

scp export mgmt-pcap from mgmt.pcap to username@host:path

3. If service route is dataplane interface then from the firewall CLI:
   1. Check IP connection between firewall dataplane interface and the log collector (LC).

      ping source <IP address of the dataplane interface> host <IP address of LC>

      If ping is successful then proceed to b otherwise check physical layer1 and data link layer2 on your network.
   2. Perform a traceroute check to the log collector:

      traceroute source <IP address of the dataplane interface> host <IP address of the LC>

      Similarly perform a traceroute check from the CLI of the log collector to the IP address of the dataplane of the firewall.
   3. Check TCP connection between firewall and the log collector by performing a packet capture on the dataplane using GUI.

4. Check the session details on the firewall CLI.

   show session all filter source <IP address of the dataplane interface> destination <IP address of the LC>

   Session should show active if discarded then check the firewall's related security policy, nat and routing.

4. If above checks are done then check if any firewall or device in your network is blocking this connection.