Skip to main content
cmberry
cmberry
New Member
September 7, 2010
Question

Interface Setup

  • September 7, 2010
  • 12 replies
  • 12082 views
If my internal network uses only 1 port on the back of my 200B, is there any reason to use one of the switch ports vs a dedicated port? I am using MR2 Patch 2 on a 200B. I am having a few issues where a web page or download will lose its connection for about 1 second, and this happens all throughout the day and causes all sorts of issues. I do have a support ticket open on it, but I am looking to get opinions of whether my configuration could be causing some of the issues. Would there be an advantage to replace the internal network currently using the “switch” interface with for example “Port 14” with alias of “Internal”? The firewall comes with 192.168.1.99 preconfigured on the switch interface, so I kept it. What are your thoughts? My current setup looks like this: (Network>Interfaces)

    12 replies

    ede_pfau
    SuperUser
    ede_pfau
    SuperUser
    September 8, 2010
    The main difference is speed and dedicated network processors on the " single" ports. The 8 switch ports run at 10/100 only. As mentioned elsewhere on this Forum, the switch more closely behaves like a hub, i.e. all traffic is seen on all switch ports. Then there are 4 " regular" GbE ports which are nice to have if the connected equipment is Gigabit also. In addition, there is auto-MDI/MDIX on Gigabit ports. Then the rightmost 4 ports (block) are NP-accelerated GbE ports. You can offload IPSec encryption onto dedicated NPUs, as well as IPS and of course firewalling. Firewalling should reach wirespeed on these ports then. There are a couple of circumstances where even on these ports the NPU would not be used but the CPU. This is always the case for content-scanning (AV). There are articles on this in the KB. What I did on my last 200B was to delete the switch to obtain 8 single ports - much more flexible to use. You have to do that before ever touching the port(s) - no IPs, no rules, no VLAN interfaces etc. etc. So I did it in advance while I could. Then, I used the NPU ports for internal, wan1, wan2 and DMZ. You can get by with aliases although the port name will always shine through. If that bothers you, you could create zones with just 1 port in it - the zone name completely replaces the port name. Giving your internal LAN the default IP range of Fortinet devices is, eh, personal taste. I tend to keep away from " default LANs" because the moment I connect a new device I risk to insert it fully functional into my LAN. Imagine it runs a DHCP server on boot up, how that would interfere with your dedicated DHCP server... I think port 9 or 10 has a very special function if you ever wanted to install a firmware image using TFTP while in the boot monitor. Depending on the FG model, the boot loader will only listen on one specific port, and I think it' s port 9 on a FG200B. But this occasion is rare. HTH.
    cmberry
    cmberryAuthor
    New Member
    September 8, 2010
    The main difference is speed and dedicated network processors on the " single" ports. The 8 switch ports run at 10/100 only. As mentioned elsewhere on this Forum, the switch more closely behaves like a hub, i.e. all traffic is seen on all switch ports.
    Thank you for the detailed reply. That is exactly what I needed to know. I added a " internal2" using port 14, and set that all up using the same protection profiles as what I use for my " internal" interface, to test a theory of mine. What I hoped would happen once I get the internal network to use a dedicated port with a dedicated processor is that my problems with 4.0 MR2 would go away. This is not the case. I still have timeout issues with downloads/ failed downloads / and loss of internet for seconds at a time, etc. I have an open ticket but the techs do not seem to be making headway, or at least they are taking a long time to research it after the initial back and forth, so maybe that is a good sign... The issue is not related directly to processing power I guess. There is some issue with the UTM features, and I think it is within AV specifically, that causes 90% of my downloads from any/every site and FTP server to fail part way thru. I also see alot of " ie cannot display the webpage" . The thing is, I only lose connection for fractions of seconds, or a few seconds at most, and then everything is fine again. As you might imagine, this plays havok with downloads and critical internet access, like banking, etc. Anyway, thanks for the info, at least I can rule out the switch interface as the problem.
    ede_pfau
    SuperUser
    ede_pfau
    SuperUser
    September 8, 2010
    some wild guesses: What you see might be the latency caused by the AV proxies. For instance, the FG must assemble a complete email attachment before scanning it; fragmented viruses would not match signatures. This causes the mail to be sucked in immediately, then the scanning takes some time (seconds or fractions of) and then the mail is delivered in one move. This staccato can sometimes be observed well with web browsing. The screws for tuning this behaviour are the maximum scan size settings in the protection profiles. If you use v4, they still exist in a different menu. There you can specify the largest piece of data that will be AV scanned, for each service (http, imap, pop3, smtp, ftp) that is proxied. If the data chunk is bigger it get passed through unscanned. To experiment, see to it that you disable content scanning altogether. If that cures your outages, put it back in and fine tune it. You haven' t told us much about the network load your FG sees, or the amount of content scanning, CPU and memory load. But I guess performance is not the issue. Not with a FG200B.
    cmberry
    cmberryAuthor
    New Member
    September 8, 2010
    some wild guesses: What you see might be the latency caused by the AV proxies. For instance, the FG must assemble a complete email attachment before scanning it; fragmented viruses would not match signatures. This causes the mail to be sucked in immediately, then the scanning takes some time (seconds or fractions of) and then the mail is delivered in one move. This staccato can sometimes be observed well with web browsing. The screws for tuning this behaviour are the maximum scan size settings in the protection profiles. If you use v4, they still exist in a different menu. There you can specify the largest piece of data that will be AV scanned, for each service (http, imap, pop3, smtp, ftp) that is proxied. If the data chunk is bigger it get passed through unscanned. To experiment, see to it that you disable content scanning altogether. If that cures your outages, put it back in and fine tune it. You haven' t told us much about the network load your FG sees, or the amount of content scanning, CPU and memory load. But I guess performance is not the issue. Not with a FG200B.
    I was hoping tech support would figure it out before I posted here for ideas, but I guess it' s been long enough, so I will give the community a whack at my problem. Symptoms: Http Downloads from various sites not going to completion from at least 10 different sites and FTP servers. The amount that would download before failing varies each time. I tested using a 175mb file from trials2.adobe.com. Sometimes I would get only 100kb, sometimes 10MB, sometimes 50 mb, the download in IE would say complete, but I would be missing >50% of the download. I tried this literally hundreds of times over past 10 days, as have other users here. Never once finished a complete download on files bigger than a few MB. We do have internet access, the FTP server works, email works, antivirus/web/email filtering all work. It' s just that downloads fail and I see allot of " page not found" errors, which a simple refresh fixes, but it really is annoying. Network Layout: My network is very simple. I have attached a diagram. CPU load seems to be around 10% to 20% most all of the time. Mem usage is around 22% most of the time. I do UTM av scanning on most everything coming into/out of the network, web filtering, IPS filtering, email filtering, NO VOIP, NO VPN. Trouble shooting: I have tried using client comforting at various levels, including OFF. I have set the oversize file threshold to 10MB, then 5MB, then 3MB, with a PASS. 3MB was really as low as I wanted to go, but as of today, I have set each protocol it to 2MB to see what happens. I have done HUNDREDS of test/real downloads from many places, with different client PC' s, different browsers, different times of day, different OS' s, various file sizes, some HTTPS, some HTTP, etc, etc.... The simple fact is: when UTM is checked " on" for a given firewall policy, the files are corrupt and fail to download. As soon as this is turned " off" it works, every single time. Any expert help would be appreciated. I dont see why my 60B could do >3mb AV scanning, and my 200B cannot....
    rocampo
    rocampo
    New Member
    September 9, 2010
    Why don' t you try a different browser ( ex. Firefox ) to do test downloads.
    ede_pfau
    SuperUser
    ede_pfau
    SuperUser
    September 9, 2010
    Why don' t you try a different browser
    I have done HUNDREDS of test/real downloads from many places, with different client PC' s, different browsers
    it sure helps if you can read... back to the topic: I' ve seen this behaviour before, with HTTP traffic stalling for a couple of seconds. Meanwhile the browser times the session out. Until the Fortinet support comes back from vacation, - goole around to see if you can influence the browsers' timeout settings - prepare to change your FortiOS version (which is ...?) to see if it improves. Apparently not all users are experiencing this so there might be a chance that you find a working build. Mine is 4.1.5 and I cannot say that I have that many timeouts as you have but still some occur.
    cmberry
    cmberryAuthor
    New Member
    September 13, 2010
    I' ve seen this behaviour before, with HTTP traffic stalling for a couple of seconds. Meanwhile the browser times the session out. Until the Fortinet support comes back from vacation, - goole around to see if you can influence the browsers' timeout settings - prepare to change your FortiOS version (which is ...?) to see if it improves. Apparently not all users are experiencing this so there might be a chance that you find a working build. Mine is 4.1.5 and I cannot say that I have that many timeouts as you have but still some occur.
    I have v4.0,build0291,100824 (MR2 Patch 2). Which I think translates into 4.2.2. Tech support has no idea what is wrong with my unit and/or Patch 1 and 2. I guess I might have to downgrade to 4.1.7, which just came out I believe, but I would really rather get a workaround or hold out for Patch 3.
    rwpatterson
    rwpatterson
    New Member
    September 13, 2010
    Have you tried removing the protection profile altogether?
    cmberry
    cmberryAuthor
    New Member
    September 13, 2010
    yeah, the second I uncheck UTM on a given firewall policy, the problem disappears. The issue then is, what is the point of the firewall? :)
    rwpatterson
    rwpatterson
    New Member
    September 13, 2010
    I have taken my protection profiles apart piece by piece until I have found what the problem is. A pain, I agree, but at least I can get some of the benefits and just bypass the part that' s failing.
    cmberry
    cmberryAuthor
    New Member
    September 13, 2010
    I have taken my protection profiles apart piece by piece until I have found what the problem is. A pain, I agree, but at least I can get some of the benefits and just bypass the part that' s failing.
    Yup, I have attempted to do that, but I need to try again. Do you know if there is a delay between adding/removing a feature and when the firewall starts implementing the change? Meaning, do I need to wait Seconds or minutes between each change to test the results?
    ede_pfau
    SuperUser
    ede_pfau
    SuperUser
    September 13, 2010
    The effect is immediate. Some features are session based so if you don' t start a new session you won' t see any changes. HTTP is a nice protocol in that respect. Did you look into timeout settings of your browsers, Firefox and IE? There are some but it depends on the version, too.
    cmberry
    cmberryAuthor
    New Member
    September 13, 2010
    Is anyone using 4.2.2 who can confirm or deny they they seeing this problem often? Since there are no other threads on this yet, I feel a little crazy. But maybe it' s because most people here aren' t dumb enough roll out 4.2.2 in a production environment? Also, can anyone tell me if AV Engine 3.00013 (Updated 2009-08-13) is the latest? 8.13.2009 seems old, but everything else on my unit as very recent.
    abelio
    SuperUser
    abelio
    SuperUser
    September 14, 2010
    Hi,
    ORIGINAL: cmberry But maybe it' s because most people here aren' t dumb enough roll out 4.2.2 in a production environment?
    I' m running 4.2.2 in production environments, not 200B altoughm but a couple of 310B in a A-P HA and and 50/51B units How did you performed the 4.2.2 loading? Using an upgrade process? All my 4.2.2 issues went away after flash formatting and reload one ' fresh' 4.2.2 image. That' s my personal experience only, not a general advice obviously.
    Also, can anyone tell me if AV Engine 3.00013 (Updated 2009-08-13) is the latest? 8.13.2009 seems old, but everything else on my unit as very recent.
    Use CLI command: " get system fortiguard-service status" to get actual values about your installed engine versions and AV/attack definitions regards
    cmberry
    cmberryAuthor
    New Member
    September 14, 2010
    How did you performed the 4.2.2 loading? Using an upgrade process? All my 4.2.2 issues went away after flash formatting and reload one ' fresh' 4.2.2 image. That' s my personal experience only, not a general advice obviously.
    **** EDIT: I spoke too soon, my downloads are still broken. When my firewall gets the slightest bit busy, like CPU and RAM near 20%, the issue starts showing up.... ****** I did get to 4.2.2 from an upgrade path of 4.1.x and 4.0.x before that. I downloaded a fresh 4.2.2 firmware, checked the MD5 (it was correct), then downloaded and installed Tftpd32, so I could format and put on a clean 4.2.2 per your suggestion. But before I did that, I switched out the Time warner cable modem with a new (but same model), cable modem. Before I could test to see if that work, my firewall all did a push update to new AV def, 12.00351 (Updated 2010-09-14 via Push Update). Then about the same time Fortinet actually called me and we played around a bit. Long story short, my downloads *SEEM* to be working now. Don' t really know which thing I did fixed the issue, but whatever glitch I was having seem to have gone away. Wish I could pinpoint it for anyone else having the issues... Happy I dont have to format and flash via TFTP. :-) The biggest thing I did with tech support was disable " strict blocking" , then re-enabled it for both HTTP & HTTPS. Don' t know what for, but I' m working again for now. Thanks for all the suggestions and help in this matter.
    Show more replies
    Terms & ConditionsAccessibility statement