Skip to main content
phermantovani
New Member
October 11, 2024
Question

Google Chrome Kyber Issues

  • October 11, 2024
  • 3 replies
  • 7509 views

Hello guys!

 

I am facing serious problems with Google Chrome Kyber. Specifically on 40F series. I have a couple of firewalls on 3 different versions (7.4.3, 7.4.4 and 7.4.5). Each of them has issues but with different behavior:

 

Google Kyber Issues

Slowness to open websites or pages that won´t load.

 

7.4.3 - Google Kyber problem
Which feature is impacting? Web Filter

Solutions:
1. Disable Web filter
2. disable Google Chrome Kyber
3. Adjust tcp-mss-sender and receiver to 1450 in the policy


7.4.4 - Google Kyber problem
Which feature is impacting? Application Control

Solution:
1. Disable Application Control
2. Disable Google Chrome Kyber
Adjusting tcp-mss-sender/receiver doesn´t work

 

7.4.5 - Google Kyber problem
Which feature is impacting? Application Control

Solution:
1. Disable Application Control
Disabling Google Chrome Kyber doesn´t work
Adjusting tcp-mss-sender/receiver doesn´t work

 

I am migrating a lot of customers from other vendor to Fortigate with Fortimanager and trying to follow a default firmware version to use to all my customers.

 

I´m start to think that 7.4 fortiOS isn´t a good idea and I´m a little bit worried about it.

 

Anyone has these kind of problems?

 

Maybe it´s worth downgrade to 7.2 version?

 

Thanks!

 

Mantovani

3 replies

Mrinmoy
Staff
Staff
October 11, 2024

I believe the problem may be related to the Kyber Support implemented in Chrome for TLS 1.3. Review the Chrome flags to verify the configuration. You can do this by navigating to "chrome://flags/#enable-tls13-kyber.".
Try disabling that option and see if the issue is resolved.

arahman
Staff
Staff
October 11, 2024

Hi please refer to this article below and also make sure your IPS version is updated

https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-Web-pages-not-loading-or-taking-too-long-to/ta-p/313958

phermantovani
New Member
October 11, 2024

Thank you for the replies. I know the problem is in the Kyber. I don´t wanna to setup a GPO to disable this feature.

 

As I told you, on version 7.4.3 I can solve this problem adjusting the tcp-mss-sender/receiver and works fine, but in version 7.4.4 and 7.4.5 it didn´t work.

 

 

Thought Leadership. Security Summit. Thursday, November 12th, PGA National Resort, Palm Beach Gardens, FL.
Thought Leadership. Security Summit. Thursday, October 8th. Disney's Grand Californian Hotel & SPA, Anaheim, CA.
Security Operations Summit: Modernize SecOps. Operate AI-Native.AMER: November 4 | 9:00 AM PST. India and SAARC: November 5 | 10:00 AM IST. EMEA: November 5 | 10:30 AM CET. APAC: November 5 | 11:00 AM SGT