Using webproxy-forward sometimes get errors "Site can't be reached. ERR_CONNECTION_CLOSED"

Forum|Forum|4 years ago
June 9, 2022
5 replies
4154 views

Hi,

I am using Transparent web proxy forwarding topology in dedicated VDOM like here https://community.fortinet.com/t5/FortiGate/Technical-Tip-Transparent-web-proxy-forwarding/ta-p/190343

I use just simple one policy with "webproxy-forward" to external proxy server.

config firewall policy
edit 1
set name "Access through EDU proxy"
set uuid fa0c4c6a-03b0-51ec-cbe7-600564e233d1
set srcintf "VicSmart1"
set dstintf "VicSmart20"
set action accept
set srcaddr "all"
set dstaddr "all"
set schedule "always"
set service "HTTPS" "HTTP" "Proxy_port_8080"
set inspection-mode proxy
set ssl-ssh-profile "certificate-inspection"
set webproxy-forward-server "EDU_Proxy"
set nat enable
next
end

Works fine but if I open many sites at the same time I get the errors "Site can't be reached" with ERR_CONNECTION_CLOSED sometimes. Just need to refresh and all good, site is open.

Maybe it is because traffic in my case comes in through VDOM interlink (root -> VDOM) and goes out through another VDOM interlink (VDOM -> root) and I have a vdom interlinks performance issue.

Any help would be appreciated.

FortiGate

bpozdena_FTNT

Staff

Hi @owlalex

It sounds more like the TCP connection was reset. You can start by checking your Fortigate forward event logs and see if there are any obvious deny events.

The next step should be performing packet captures on the LAN and WAN facing interfaces across all VDOMS and see if it is actually the Fortigate who resets the connection.

If the connection is indeed reset by the Fortigate and the logs do not indicate an obvious reason, the proxy daemon will likely need to be debugged. You should contact TAC if you are not familiar with the process.

HTH,

Boris

owlalexAuthor

Visitor III

Thank you, Boris.

You are right I see the action "TCP reset from server" in the log (Destination server: EDU_Proxy). Yes, now it's time for packet capture.

owlalexAuthor

Visitor III

I see sometimes an information like "625 5.962450 172.20.0.1 210.15.254.246 TCP 76 [TCP Retransmission] [TCP Port numbers reused] 4780 → 8080 [SYN] Seq=0 Win=65535 Len=0 MSS=1460 SACK_PERM=1 TSval=144583175 TSecr=0 WS=4096"

Not sure is it bad or normal.

bpozdena_FTNT

Staff

This packet itself is not a clear indication of an issue. It just shows the client is trying to open a new TCP session and that the packet capture already contains previous session with the same port numbers. It does not indicate why was the previous session closed.

The only wild guess I can take is that this could potentially be caused by session clashes, when for instance, you have multiple clients behind SNAT connecting to the same proxy.

You should also investigate on your EDU_Proxy server to see why exactly are the sessions being reset.

Since you have multi-vdom setup, transparent proxy and proxy forwarding in place, the debugging can get rather complex. You should really create a TAC support ticket with a detailed network diagram.

Questions should also be raised on whether such complex setup is actually needed ;-).

owlalexAuthor

Visitor III

You arer right, I am loking for a different solution https://community.fortinet.com/t5/Fortinet-Forum/How-to-set-external-web-proxy-as-part-of-SD-WAN/m-p/214300#M195122 as well :)

Sign up

Login with SSO

Login to the community

Login with SSO