Skip to main content
S
senkhaii
Visitor II
August 4, 2026
Question

Apple Services & App Store Traffic Dropping (client-rst) Across Multi-WAN SD-WAN Setup via Fastly/Akamai CDNs

  • August 4, 2026
  • 2 replies
  • 51 views

Hi everyone,
We are experiencing persistent performance degradation and connection drops (client-rst) when downloading apps from the Apple App Store, updating iOS/macOS, or streaming Apple Music across our multi-WAN enterprise environment running FortiGate.
Network Architecture:

  • Firewall: FortiGate (Multi-WAN SD-WAN deployment)
  • WAN Links: 1 Gbps Fiber, Metro Ethernet, RadioLink
  • Clients: macOS and iOS devices across multiple enterprise LANs

The Issue:
During Apple-bound downloads, Apple devices initiate multi-stream parallel connections. While 17.0.0.0/8 traffic matches our designated Apple SD-WAN rules, traffic destined for local/global CDN nodes—specifically Fastly (151.101.x.x) and Akamai (185.158.x.x)—fails to match ISDB / FQDN objects.
As a result, these CDN flows hit our default multi-WAN load balancing rules, splitting packets across different WAN interfaces (port1, port3, port4). This IP switching mid-session breaks SSL/session persistence and triggers action="client-rst" on the FortiGate, resulting in stalled downloads.

2 replies

AEK
SuperUser
AEK
SuperUser
August 5, 2026

Hi Senkhaii

If you mean ISDB is not 100% correct for Fastly and Akamai and you are sure that it is up to date on your FGT then you can’t rely on it in SD-WAN rules. In that case you need to use another LB method that avoids this issue.

AEK
    S
    senkhaiiAuthor
    Visitor II
    August 5, 2026

    Hello AEK,

    I am currently using the Fortigate 120G model with version 7.2.11, and this is where things get interesting. This afternoon, I coincidentally downloaded an application from the App Store and it downloaded without any issues, as if there was no problem at all. However, I have not written any rules or made any changes since yesterday. When I checked the logs, they are showing the exact same entries as yesterday.

    This is actually the second time this has happened. Previously, the issue resolved itself, then reappeared on its own, and then resolved itself again. In your opinion, what do you think might be causing this?

    Terms & ConditionsAccessibility statement
    Thought Leadership Security Summit. Outpace New Threats with AI - enhanced defense. Tuesday, Septmeber 15, 8:30 AM - 2:30 PM PT. The Golf Club at Newcastle, WA.
    Fortinet Flag the Hack. Wednesday, August 26, 9:00 AM - 5:00 PM ET, COSM, Atlanta, GA.