Skip to main content
unknown1020
unknown1020
Explorer III
July 8, 2024
Question

website access problems

  • July 8, 2024
  • 5 replies
  • 3588 views

friends a question:

 

I have problems accessing a page, specifically a video that is within the page. Since it is displayed as not available.

Reviewing the logs, I do not observe any blockages from the firewall.

I performed the following validations:

 

*I generated a new policy, in which no security profile was enabled. Additionally, the no inspection profile was enabled.


*For the new policy, all ports were enabled. Furthermore, it is located above everyone.

 

However, when you directly access the internet router, you do have access to the page.

 

Do you know what could be happening?

5 replies

rvillaroman
Staff & Editor
rvillaroman
Staff & Editor
July 8, 2024

Hi @unknown1020,

 

To check if something is being blocked or denied, kindly try to run har file check.

https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-How-to-collect-HAR-file/ta-p/191358

 

There is a possibility that the video where you are being redirected is not loading due to an additional delay in the inspection. Also, kindly make sure that you are hitting the new firewall policy for this validation.

 

Furthermore, you may also play around with the TCP mss of your policy, as it might be caused by an MTU mismatch.

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Setting-TCP-MSS-value/ta-p/194518

 

Regards,

unknown1020
unknown1020Author
Explorer III
July 8, 2024

Hello, thanks for answering but I have some questions:

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Setting-TCP-MSS-value/ta-p/194518

 

In this case, there are several computers that cannot access the page. They are all Windows, so should I run the following command in Windows CMD?

For the MS Windows operating system client, enter:

ping -f -l 1472 <server ip>

Where "Server IP" is the IP of the user's computer, correct?

When running that command, what should I get? any value?

 

Regarding the HAR file, as I mentioned in the post, the policy does not have any security profiles enabled, all ports are open and it has no inspection. Could the firewall still be blocking some URL?
Or in the HAR file that should be obtained?

 

rvillaroman
Staff & Editor
rvillaroman
Staff & Editor
July 8, 2024

Hi @unknown1020,

 

Where "Server IP" is the IP of the user's computer, correct?

When running that command, what should I get? any value?

 

- Correct, IP of the server you are trying to reach.

- ping -f -l 1472  - you may start at 1472 and check if you can ping, if not try to adjust is by deducting 8 on the value.

 

Regarding on the harfile,Could the firewall still be blocking some URL?

- We still can check the possible cause, chances that it is unable to access due to added delay.

- You may compare the harfile on working(directly connected on the ISP router) and on the not working(connected on the firewall)

From there we may get the possible reason why it is not accessible.

 

Regards,

    unknown1020
    unknown1020Author
    Explorer III
    July 8, 2024

    thanks for answering.

     

    From the value that would be obtained, that value (mss value) would be added to the command: would it be the same for sender and receiver?

    configure firewall policy
    edit <policy ID>
    set tcp-mss-sender <mss value>
    set tcp-mss-receiver <mss value>

     

     

    Regarding the HAR file, I already performed the test by connecting a laptop directly to the ISP router and the page was accessed, which confirms that it is a fortigate problem

    rvillaroman
    Staff & Editor
    rvillaroman
    Staff & Editor
    July 8, 2024

    Hi @unknown1020,

     

    That is correct, you may initially try to set the value to 1400 and check if the issue persists.

     

    Regards,

      rvillaroman
      Staff & Editor
      rvillaroman
      Staff & Editor
      July 8, 2024

      Hi @unknown1020 ,

       

      If the video became accessible by setting the tcp mss value to 1400, you may add 40 for the TCP (20) and IP (20) header. On the guide it started on 1500 which you can deduct 48, TCP header (20) + IP header (20) + ICMP packet (8). 

        A
        Anonymous_User
        Contributor III
        July 12, 2024

        Hi @unknown1020 ,

        Good day to you.
        Here is the troubleshooting that may help:

        1. Create a new policy on top. No security profile. Source : All, Destination: All

        2. Connect PC direct to the Fortigate. No AP or switch in between.

        3. Disable endpoint control on the PC. Example: Sophos, Symantec, etc

        4. Disable VPN, Proxy on the PC.

        5. Try with another PC if the issue affecting specific PC or ALL PC.

         

        From the result, we can proceed further to check on the issue.

          lokelho2
          lokelho2
          New Member
          May 1, 2025

          Im wondering now if it isn't at the other end. I can see the sent traffic on our firewall but it doesn't get anything back. So it seems I can connect but not recieving any traffic from the site. I put a ticket in with our ISP. I wouldnt say Zayo knows their stuff pretty well though lol.

          Terms & ConditionsAccessibility statement
          Thought Leadership Security Summit. Outpace New Threats with AI - enhanced defense. Tuesday, Septmeber 15, 8:30 AM - 2:30 PM PT. The Golf Club at Newcastle, WA.