Troubleshooting Tip: New Feature on v7.6.7 may break websites/applications using websockets

Description

This article describes what to do when some websites or applications that use WebSockets stop working after an upgrade to FortiOS v7.6.7.

Scope

• FortiGate.

• FortiOS v7.6.7.

• Proxy-based policies.

• Web-filter.

• Application control.

• Deep packet inspection.

 
Solution

A new feature in v7.6.7 introduces WebSocket traffic inspection, enabling the firewall to execute DLP, Antivirus, and other functions on WebSocket communications. This enhancement allows the detection and blocking of sensitive data transfers, malware and prohibited content. By default, this feature is disabled, and when it is, the WebSocket connection is blocked.

For more information, see feature 1199124 under New features or enhancements. 

config firewall profile-protocol-options
    edit "test1"
        config websocket  
            set status enable
            unset options
        end

Use 'test1' in the firewall policy:

config firewall policy
    edit 40
        set srcintf "port3"
        set dstintf "port7"
        set action accept
        set srcaddr "all"
        set dstaddr "all"
        set schedule "always"
        set service "ALL"
        set utm-status enable
        set inspection-mode proxy
        set profile-protocol-options "test1"  
        set ssl-ssh-profile "Full-Inspect-No-Exception"
        set webfilter-profile "monitor-all"
        set application-list "wifi-default"
        set logtraffic all
        set nat enable
        set port-preserve disable
        set comments " (Copy of PC2)"
    next
end