New Member

Question

Fortigate is bloking copilot.microsoft.com

Forum|Forum|2 months ago
May 25, 2026
21 replies
480 views

Hi,
we have such problem that fortigate fortios 7.4.11 is blocking copilot.microsoft.com the error we get in the browser is:

net::ERR_CERT_AUTHORITY_INVALID
Subject: Fortiguard SDNS Blocked Page
Issuer: Fortiguard SDNS Blocked Page

What we did:
1.in DNS profile --> static filter we created:
- wildcard name *.microsoft.com and allowed it
-allowed regex .*bing\.com
-allowed regex .*trafficmanager\.net

2.In the deep ssl inspection profile, we created the exempts:
-wildcard *.microsoft.com
-wildcard *.bing.com
-*.trafficmanager.net

But all the time, this site is blocked by SDNS, any help?

FortiGate

Lukino

Explorer

This means the blocking occurs at the DNS Filter / SDNS layer, before standard HTTPS inspection comes into play.
Therefore, the SSL inspection exemptions are likely not the main issue.

Additionally, copilot.microsoft.com relies on a broad and constantly changing set of Microsoft endpoints and CDN services, many of which are hosted outside the microsoft.com domain.

If possible, check release notes and consider testing on a newer mature build in the 7.4 train once available.

Yurisk

SuperUser

Most probably you are not catching all the domains/FQDNs needed for this to work at DNS level. DNS filtering has no “stateful/memory” inspection and esp in white/black listing, as in your case, if resolving copilot.ms.com redirects via CNAME to msgstete5te-whatever.aws.com - from Fortigate DNS filter standpoint, resolving this msgstete5te-whatever.aws.com is a new connection, which may be not covered by your DNS allowed/exempt entries.

Unfortunataley, unless Copilot publish all their domains to be allowed, the only way to learn all neede FQDNs is to take a specific PC/Host, close all other connections in it, and start working with Copilot while looking at DNS logs (which should be enabled in the DNS Filter profile) and so add to white list all that is being blocked.

yurisk.info - all things Fortinet blog, no ads

sjoshi

Staff

Hi @Tutek

Are you sure your https and dns traffic is matching same policy

Please confirm if the dns filter is same applied for dns traffic

Can you share dns query logs where it shows as block

Thanks, Salon

TutekAuthor

New Member

I have one ipv4 policy responsible for internet traffic, on this policy I have applied only one I have Dns-Profile, even if I disable Dns-Profile on the policy, then ipconfig /flushdns on client PC, the error is the same “net::ERR_CERT_AUTHORITY_INVALID”.

On the DNS Query logs for this source IP from client PC, after hitting many times in multiple browsers like Chrome, Edge, Firefox domain copilot.microsoft.com I don’t see any query associated with strict with that domain, only these:

20.165.94.63 (glb.sls.prod.dcat.dsp.trafficmanager.net) Accept (UTM Allowed)
104.18.22.222 (copilot.microsoft.com.cdn.cloudflare.net) Accept (UTM Allowed)
150.171.28.10 (bat.bing.net) Accept (UTM Allowed)
20.165.94.63 (glb.sls.prod.dcat.dsp.trafficmanager.net) Accept (UTM Allowed)
104.18.22.222 (copilot.microsoft.com.cdn.cloudflare.net) Accept (UTM Allowed)
48.209.138.168 (atm-settingsfe-prod-geo2.trafficmanager.net) Accept (UTM Allowed)
40.126.31.67 (login.windows.net) Accept (UTM Allowed)

sjoshi

Staff

Hi @Tutek

If you disable Dns-Profile are you still getting Fortiguard SDNS Blocked Page error?

Can you share snap.

Generally, a user would see this error when the site they intended to visit is blocked by the firewall. Usually, 'Web Filter', 'Application Filter', and 'DNS Filter' are the most likely to generate this page.

Check the the other security profile if it is being blocked?

From the dns query logs I can only see allow traffic

Maybe filter out foward traffic logs too if you see any block logs for the user source IP

Also refer below article:

Thanks, Salon

TutekAuthor

New Member

Today morning copilot.microsoft.com is working when I left dns-profile disabled over night - so yes this is rather DNS related problem.
I have added another static filter on dns-profile, type simple copilot.microsoft.com with action Allow, unfortunately with dns-profile enabled on ipv4 policy the problem comes back.

sjoshi

Staff

Hi @Tutek

I tested in my lab by blocking all the category under dns filter and only allow copilot as below

It worked for me.

C:\Users\fortinet.win11pro>nslookup
Default Server: dns.google
Address: 8.8.8.8

> fortinet.com
Server: dns.google
Address: 8.8.8.8

Non-authoritative answer:
Name: fortinet.com
Addresses: 2001:cdba::3257:9652
208.91.112.55 >» getting redirected to block portal for fortinet.com

> copilot.microsoft.com
Server: dns.google
Address: 8.8.8.8

Non-authoritative answer:
Name: copilot.microsoft.com.cdn.cloudflare.net
Addresses: 2606:4700::6812:17de
2606:4700::6812:16de
104.18.22.222
104.18.23.222
Aliases: copilot.microsoft.com
copilot-copilot-msft-com.trafficmanager.net

On dns query logs try to filter “domain was allowed because it is in the domain-filter list” by selecting message event.

It will show if it is being allowed by dns filter or not

Thanks, Salon

TutekAuthor

New Member

Here are my outputs for nslookup:

C:\Users\user239>nslookup
Default Server: ad01.ad.mydomain.pl
Address: 192.168.1.101

> fortinet.com
Server: ad01.ad.mydomain.pl
Address: 192.168.1.101

Non-authoritative answer:
Name: fortinet.com
Addresses: 54.151.118.105
54.177.212.176

> copilot.microsoft.com
Server: ad01.ad.mydomain.pl
Address: 192.168.1.101

Non-authoritative answer:
Name: copilot-copilot-msft-com.trafficmanager.net
Addresses: 2620:101:9000:53::55
208.91.112.55
Aliases: copilot.microsoft.com

>

I have created another static domain filter as yours *copilot.microsoft.com* type Wildcard, status Enable, for now copilot.microsoft.com is working also with dns-profile enabled on Chrome and on Edge but not on Firefox (still SDNS Blocked Page Error). This is ok for me as we are working mostly on Chrome browser, so fingers crossed maybe will be ok.

sjoshi

Staff

ideally if it is working with chrome and edge it should work with firefox, maybe try in incognito window

Further as mentioned in my previous comment, that the correct config for dns filter

Thanks, Salon

TutekAuthor

New Member

Unfortunately, after a while on the same client pc where copilot worked, the client make a phone call and tell that he has again certificate error:
NET::ERR_CERT_AUTHORITY_INVALID.
So the site is accessible only temporary.

sjoshi

Staff

Can you try running this command during maintaince window

diagnose ips share clear scert_cache <----- To clear the server entries.
diagnose ips share clear ccert_cache <----- To clear the client entries.

diagnose ips share clear cert_verify_cache

diagnose test app ipsmonitor 99 <----- To reset the IPS engine.

execute update-now

Further please check forward traffic logs and filter by the source IP and see if you see any block logs.

Share those logs incase if you see it

Check the SSL Event logs too

Thanks, Salon

TutekAuthor

New Member

I have issued these command on the console, but this didn’t help.

Copilot is working fine and after 10 or 15 minutes there is NET:ERR_CERT error.

On traffic log with source ip of this client everything I have is green (Allowed) and if I add filter with Result==deny, then I have only this:

142.250.147.188 (mtalk.google.com) Implicit Deny

sjoshi

Staff

can you change the dns for one pc to 8.8.8.8 instead of private dns and check the stability once

Thanks, Salon

TutekAuthor

New Member

if I set manually google dns on this pc, then copilot.microsoft.com and bing.com working all the time.

sjoshi

Staff

Hi @Tutek

You changed the dns to 8.8.8.8 and it worked which means issue is specific to the traffic flow and policy matched by the internal dns.

Based on the nslookup results using the internal DNS server, it is evident that the DNS query for the Copilot domain is being resolved to 208.91.112.55, which corresponds to the FortiGuard block page IP address.

Name: copilot-copilot-msft-com.trafficmanager.net
Addresses: 2620:101:9000:53::55
208.91.112.55
Aliases: copilot.microsoft.com

The same dns 8.8.8.8 traffic goes from the same policy and dns profile and there is no issue.

Check which are the policy your internal dns server matches to resolve the domain.

Also issue could be your internal dns server is caching the dns resolution and still resolving to 208.91.112.55

Thanks, Salon

TutekAuthor

New Member

DNS traffic works like this:

Clients PC --> AD DNS --> 8.8.8.8, 1.1.1.1

So one policy handles DNS requests to the domain server, and the other handles requests from the domain server to 8.8.8.8 and 1.1.1.1, both of them have the same DNS-Profile applied which is enabled on the policy responsible for internet traffic for the clients PC. So there is only one globally DNS-Profile applied on every ipv4 policy.

Show more replies

Sign up

Login with SSO

Login to the community

Login with SSO