New Member

Question

Web filtering problem on one VLAN only

Forum|Forum|2 years ago
July 9, 2024
11 replies
3274 views

Hi,

I have multiple VLANs that are working just fine. The last one I created cannot acces some Microsoft website and the username field on iCloud.com won't show up for example. I tried to redo the VLAN multiple times the see where I f*d-up. I cloned the rules from another VLAN that is working fine. I created a rule allowing Microsoft365 Internet services and portal.office.com finaly loads but there is other glitches and you can see a lag when the page load.

Any help will be appreciated.

Thank you

Edit: even with web filtering disabled, iCloud won't work

Edit2: FortiGate 601E v7.2.8

Edit3: The problem is with the interface, not the VLAN

abarushka

Staff

Hello,

You may consider to use browser developer tool. It will help to identify which URL fails (status column) or slow (time column):

Firefox: application menu > more tools > web developer tools > network
Chrome: customize and control google chrome > more tools > developer tools > network

In case there is UTM configured, you may consider to disable UTM for testing purposes.

CBInfoAuthor

New Member

Thank you for the quick response.

What should I do next? Even with web filter disabled or with URL filter exceptions it won't work.

What do you mean by "disable UTM"?

Quint021

Staff

Hello @CBInfo,

Concerning disabling UTM, navigate to the firewall policy that is handling the traffic and proceed to edit the policy. Identify the Security Profiles that are enabled and toggle them off 1 by 1 for testing to see at any point if the issue is resolved. Please make sure to back up the config before such changes as well.

Kind Regards,

CBInfoAuthor

New Member

Thank you Quint021. I already tried that. With the web filter turned off, portal.microsoft.com is accessible with a lag but icloud.com is still the same.

Quint021

Staff

Hello @CBInfo<,

For the particular VLAN in question, do you have any type of traffic shaping associated with that interface? In addition, what DNS servers are in use for the VLAN? If internal then you can try testing with public servers.

Kind Regards,

CBInfoAuthor

New Member

No shaping that I can see. The interface is setup like the other LAN interfaces. It is internal DNS like the other LAN interfaces. DNS and DHCP are on a Windows server.

abarushka

Staff

Hello,

I would recommend to check browser developer tool output (icloud.com) and sniff the traffic (icloud.com) and check for anomalies.

CBInfoAuthor

New Member

Hi and thank you to all of you who took the time to help me. I changed interface this morning and everything works fine. I still don't know why it's not working on the other interface...

Hong_FTNT

Staff & Editor

Hi @CBInfo,

On the problematic policy, you can try to reduce tcp-mss values by running the following commands and test:

config firewall policy
edit <policy id>
set tcp-mss-sender 1300
set tcp-mss-receiver 1300

end

Regards,

CBInfoAuthor

New Member

I did not change any policies, only the physical interface and it's now working. But of course I would like to know why the other interface is doing that.

CBInfoAuthor

New Member

In the CLI, I can see that there is a MTU override with a custom value on the problematic interface...

Sign up

Login with SSO

Login to the community

Login with SSO