To resolve HTTP 414 'URI Too Long' errors on FortiGate, follow these steps:
Policy validation and identification.
Navigate to Policy & Objects -> Firewall Policy.
Identify the firewall policy processing the affected traffic and verify the configured inspection mode (proxy-based or flow-based), as well as the applied security profiles.
As another option to validate this information via CLI, you can use the following commands:
show firewall policy
show webfilter profile
FQDN object creation.
Create an FQDN object that matches the domain affected by the HTTP 414 error.
CLI example:
config firewall address
edit "FQDN_example"
set type fqdn
set fqdn "*.example.com"
next
end
Firewall policy creation using FQDN.
Create a new firewall policy using the FQDN object as the destination, applying flow-based inspection and the required security profiles.
CLI example:
config firewall policy
edit <policy_id>
set name "FLOW_HTTP414_FIX"
set srcintf "lan"
set dstintf "wan1"
set srcaddr "all"
set dstaddr "FQDN_example"
set action accept
set schedule "always"
set service "HTTP HTTPS"
set inspection-mode flow
set nat enable
next
end
Navigation testing.
Perform validation tests to confirm the behavior of the new policy:
Access affected URLs using a web browser. Validate that the full application loads without HTTP 414 errors. Verify navigation across application sections. Confirm no failed redirects or truncated URLs. Perform access validation from multiple affected endpoints if applicable.
Possible debug commands.
If additional analysis is required, use the following commands to inspect traffic behavior:
diagnose wad filter src <client-ip>
diagnose wad debug enable level verbose
diagnose wad debug enable category all
diagnose debug console timestamp enable
diagnose debug enable
Configure the Virtual IP to use HTTP/1.1 (if the issue persists)
If the issue persists after applying the flow-based firewall policy, configure the Virtual IP (VIP) to support only HTTP/1.1. This can help determine whether the behavior is related to HTTP/2 negotiation.
Note: The HTTP version settings for a Virtual IP are currently available through the CLI only.
For FortiOS v7.2.x and earlier:
config firewall vip
edit "<VIP_name>"
set http-supported-max-version http1
next
end
For FortiOS v7.4.1 and later:
config firewall vip
edit "<VIP_name>"
set h2-support disable
next
end
After applying the configuration, reproduce the issue and validate the previous step to verify HTTP traffic processing.
Disable debugging after capturing the required information:
Refer to the following articles for more information regarding firewall policy validation and troubleshooting in FortiGate:
| 
