Troubleshooting Tip: Happy Eyeballs fallback fails in proxy mode

In a proxy mode policy with the UTM features enabled, a Happy Eyeballs fallback may fail.

edit 1
    set uuid ffcfe5ce-eb11-51f0-64a5-3dbfa92ff5dd
    set srcintf "port1"
    set dstintf "port2"
    set action accept
    set srcaddr6 "Test_HappyEyeballs"
    set dstaddr6 "all"
    set schedule "always"
    set service "ALL"
    set utm-status enable
    set inspection-mode proxy
    set ssl-ssh-profile "certificate-inspection"
    set webfilter-profile "test_1"
    set logtraffic all
    set comments "Happy-Eyeballs Proxy Mode Test"
next

In Proxy Mode, FortiGate immediately responds with a SYN-ACK to the client, completing the client-side TCP handshake before attempting the server-side connection. If the upstream device silently drops the traffic, no RST is sent back to the client, which disrupts Happy Eyeballs fast fallback. As a result, dual-stack clients do not receive the quick failure signaling they expect to switch from IPv6 to IPv4.

To fix this, enable proxy-after-tcp-handshake so that the SYN is forwarded to the server before completing the client-side handshake. This ensures the client receives proper failure signaling, allowing Happy Eyeballs fallback to function correctly, even with UTM enabled in Proxy Mode.

For HTTPS (Port 443 – SSL/SSH Profile):

config firewall ssl-ssh-profile
    edit <profile-name>
        config https
            set proxy-after-tcp-handshake enable
        end
    next
end

For HTTP (Port 80 – Protocol Options Profile):

config firewall profile-protocol-options
    edit <profile-name>
        config http
            set proxy-after-tcp-handshake enable
        end
    next
end