Skip to main content
menatwork
menatwork
Visitor III
November 24, 2022
Question

[SOLVED-BUG] FortiEMS/Forticlient - massive Webfilter issues for month (not yet solved by support)

  • November 24, 2022
  • 8 replies
  • 6569 views

Hi folks,

this is no criticism to Fortinetsupport, but I am very interested whether you guys @the forum are having the same issues with Forticlient EMS and the webfilter.

 

I have a open ticket running since June 2022 and did numerous tests, debuglogs, new installs, adapt the installation etc.

 

Situation:

  • Forticlient EMS at Server 2019
  • Sitting in the DMZ
  • Reachable via FQDN from the internet
  • Reachable from internal LAN via FQDN
  • The Forticlient correctly triggers Online-onfabric / Online-off-fabric rules (e.g. I can see that the webfilter is enabled when going off-fabric
  • and here comes the problem:
    • No matter what I do, the webfilter itself is not working properly
    • If I go from onfabric to off-fabric, the webfilter is enabled, BUT
    • it is not filtering anything
    • Sometimes - if I stay off-fabric with the device (e.g with smartphone-hotspot) the webfilter does its job in blocking XXX  sites for example
    • As soon as I start switching networks (off-fabric / on-fabric / off-fabric) the webfilter stops blocking (but being still correctly activated). Sometimes it starts to work after about 10 minutes
    • I tried  it with browser add-ons and without them (Forticlient-addon)

So you absolutly cannot rely on this part of Forticlient, which makes it some kind of insecure!

 

Does no one of you have this troubles? I cannot believe that I am the only one with this situation. Does you Forticlient-Webfilter work (does it block sites when going from on- to off-fabric?)

 

Some feedback woud be great!

Thanks a lot!

 

8 replies

Anthony_E
Staff
Anthony_E
Staff
November 28, 2022

Hello menatwork,

 

Thank you for using the Community Forum.

I will seek to get you an answer or help. We will reply to this thread with an update as soon as possible.


Regards,

Best Regards
    menatwork
    menatworkAuthor
    Visitor III
    November 29, 2022

    Hi,

    as no one replied it seems like no one have got this issues, or cannot replicate it? Really interesting....

    Anthony_E
    Staff
    Anthony_E
    Staff
    November 29, 2022

    Hello,

     

    I will try to find a FortiClient expert for you, like the other post.

     

    Regards,

    Best Regards
      btan
      Staff & Editor
      btan
      Staff & Editor
      November 29, 2022

      Hi @menatwork,

       

      In my personal experience, web filter works reliably (in lab environment). If you have a ticket opened, usually TAC support can assist to check how & why it is not working in your environment. 
      I see you have very detailed steps to reproduce, if somehow your case engineer already done checking all from FCT Diagnostic Result but no avail, may I suggest either below:

      1. Join one of our lab PC to your EMS to reproduce & investigate the issue
      2. Join one of your test machine to our lab EMS with your endpoint profile to reproduce & investigate the issue
      This may help narrow down the root cause.

        menatwork
        menatworkAuthor
        Visitor III
        November 29, 2022

        Hi and thanks for your answers!

         

        @btan 

         

        How can we realize  the point you mentioned -- Number 1: Join one of our lab PC to your EMS to reproduce & investigate the issue

        btan
        Staff & Editor
        btan
        Staff & Editor
        November 29, 2022

        You may open a ticket with us, and suggest this to your case engineer.

          menatwork
          menatworkAuthor
          Visitor III
          December 14, 2022

          So after about 6 month of investigation with TAC, it boiled down to a bug, which will be fixed in 7.2.0 version of Forticlient.

           

          I am really wondering that no one of you have got this issue....

          bwill
          bwill
          Visitor III
          May 1, 2024

          Hey Menatwork,

           

          Was your issue ever resolved? You are not alone; we have this problem as well. Our Forti ecosystem uses Client, EMS and Fortigates at the edge. When our users are behind the Fortigate which is connected to the DC with IPSEC, web filtering at the client does not work. When the client is on SSLVPN web filtering does not work. When the client is off network web filtering works. We are in the process of going to 7.2, hopefully it resolves these issues.

           

          HTH

          menatwork
          menatworkAuthor
          Visitor III
          May 14, 2024

          hi @bwill It was solved at the moment, when we upgraded to 7.2, but we have had numerous other troubles. Mainproblem is, that the Forticlient is not updating the av-defs as we expected. Some days it is unable to get the updates from the Fortinet-servers. The other day, there is a sandbox connection issue (Saas).

           

          I have had tickts open, which never solved it (the update-issue). A few days after we opened the ticket about this, the updates worked again (out of nowhere). I was able to reproduce the problem at my "home-office-workplace" with completly different internet-access and clients. so I am sure the update-problem is "triggered" by fortinetservers (we connect from EU).

           

          To be honest I will have to double check whether the webfilter of the Forticlient is still working reliable.

           

          I will come back to you as  soon as I have checked it.

            bwill
            bwill
            Visitor III
            May 14, 2024

            @menatwork Thanks for circling back and sharing the update. This is very helpful and should speed up our upgrade timeline.

            menatwork
            menatworkAuthor
            Visitor III
            May 29, 2024

            @bwill  sorry for checking back here that late... I have checked 5 mins ago, whether the webfilter of the forticlient is working for us, as soon as the device goes online/offnet.

             

            It is doing its job. (Blocking XXX sites for example)

             

            Forticlient 7.2.4 FortiEMS 7.2.4

              Terms & ConditionsAccessibility statement