Skip to main content
tongkai
New Member
September 13, 2018
Question

Forticlient log show CBBS Callhome failed, seems a TLS error

  • September 13, 2018
  • 2 replies
  • 12650 views

Because I saw some windows event error every 10 mins only on PC join forticlient EMS

schannel Event ID 36888, TLS protocol defined fatal error code is 70, The Windows SChannel error state is 105

 

I already configure Windows 7 to use TLS 1.1 & 1.2 which tell me at the release note at forticlient EMS 6.0.1

And confirm can deploy client ver 6.0.1 with EMS ver 6.0.1 and 6.0.2

--------------------------------------------------

When I try to export the log in Windows 7 client, it said:

13-Sep-18 06:38:54 AM Information FortiShield id=96851 user=DBLOG_SOURCE_SYSTEM msg="FortiShield is enabled" 13-Sep-18 06:39:21 AM Information Update id=96650 avsig=62.00159 avsiglastupdate="2018-09-13 06:39:19+08" ipssig=13.00448 irdbsig=4.00305 13-Sep-18 06:39:34 AM Warning AntiVirus CBBS Callhome failed 1 times and try again 5 seconds later! 13-Sep-18 06:39:40 AM Warning AntiVirus CBBS Callhome failed 2 times and try again 5 seconds later! 13-Sep-18 06:39:46 AM Warning AntiVirus CBBS Callhome failed 3 times and try again 5 seconds later! 13-Sep-18 06:39:53 AM Warning AntiVirus CBBS Callhome failed 4 times and try again 5 seconds later! 13-Sep-18 06:39:59 AM Warning AntiVirus CBBS Callhome failed 5 times and try again 5 seconds later! 13-Sep-18 06:40:05 AM Warning AntiVirus CBBS Callhome failed 6 times and try again 5 seconds later! 13-Sep-18 06:40:11 AM Warning AntiVirus CBBS Callhome failed 7 times and try again 5 seconds later! 13-Sep-18 06:40:17 AM Warning AntiVirus CBBS Callhome failed 8 times and try again 5 seconds later! 13-Sep-18 06:40:23 AM Warning AntiVirus CBBS Callhome failed 9 times and try again 5 seconds later! 13-Sep-18 06:40:29 AM Warning AntiVirus CBBS Callhome failed 10 times and try again 5 seconds later! 13-Sep-18 06:40:35 AM Warning AntiVirus CBBS Callhome failed 11 times and try again 5 seconds later! 13-Sep-18 06:40:41 AM Warning AntiVirus CBBS Callhome failed 12 times and try again 5 seconds later! 13-Sep-18 06:40:47 AM Warning AntiVirus CBBS Callhome failed 13 times and try again 10 minutest later!

------------------------------------------------------

My Windows 10 client did not have this error:

12-Sep-2018 11:20:29 PM Information FortiShield id=96851 user=DBLOG_SOURCE_SYSTEM msg="FortiShield is enabled" 12-Sep-2018 11:20:32 PM Information AntiVirus CBBS Callhome success and next callhome = 86400 seconds later 13-Sep-2018 12:30:46 AM Information FortiShield id=96851 user=DBLOG_SOURCE_SYSTEM msg="FortiShield is enabled" 13-Sep-2018 12:30:50 AM Information AntiVirus CBBS Callhome success and next callhome = 86400 seconds later 13-Sep-2018 12:31:15 AM Information Update id=96650 avsig=62.00153 avsiglastupdate="2018-09-13 00:31:13+08" 13-Sep-2018 01:56:29 AM Information Update id=96650 avsig=62.00154 avsiglastupdate="2018-09-13 01:56:28+08" irdbsig=4.00305 13-Sep-2018 02:56:33 AM Information Update id=96650 avsig=62.00155 avsiglastupdate="2018-09-13 02:56:31+08" ipssig=13.00448 13-Sep-2018 04:56:30 AM Information Update id=96650 avsig=62.00156 avsiglastupdate="2018-09-13 04:56:28+08" 13-Sep-2018 05:56:28 AM Information Update id=96650 avsig=62.00158 avsiglastupdate="2018-09-13 05:56:27+08" 13-Sep-2018 06:56:31 AM Information Update id=96650 avsig=62.00159 avsiglastupdate="2018-09-13 06:56:30+08" 13-Sep-2018 08:00:23 AM Information Update id=96650 avsig=62.00160 avsigetm=62.00159 avsiglastupdate="2018-09-13 08:00:21+08" 13-Sep-2018 08:01:24 AM Information Scheduler id=96800 msg="Forcefully kill a child process (fmon.exe) after grace period expires" 13-Sep-2018 08:44:32 AM Information Update id=96650 avsig=62.00161 avsiglastupdate="2018-09-13 08:44:31+08"

-----------------------------------------------------

So I want to know what is CBBS Callhome and why it fail to connect in Windows 7 client ?

Can update client configure and antivirce signature

    2 replies

    tongkai
    tongkaiAuthor
    New Member
    September 13, 2018

    so I found its mean Cloud Based Behavior Scan (CBBS)

    there is no error at EMS log, only in client log

    still finding solution

    tongkai
    tongkaiAuthor
    New Member
    September 30, 2018

    Have more test on the CBBC Callhome failed error

     

    It is because "Deploying FortiClient upgrade to Windows 7", "Enabling TLS 1.2 on Windows 7 using registry settings"

    When you add the registry, the error begin to happen. But you cannot disable the registry and "disable TLS 1.0 and 1.1 in EMS" to deploy

     

    Workaround, "Enabling TLS 1.0 and 1.1 in EMS" to deploy

    Thought Leadership. Security Summit. Thursday, November 12th, PGA National Resort, Palm Beach Gardens, FL.
    Thought Leadership. Security Summit. Thursday, October 8th. Disney's Grand Californian Hotel & SPA, Anaheim, CA.
    Security Operations Summit: Modernize SecOps. Operate AI-Native.AMER: November 4 | 9:00 AM PST. India and SAARC: November 5 | 10:00 AM IST. EMEA: November 5 | 10:30 AM CET. APAC: November 5 | 11:00 AM SGT