Troubleshooting Tip: How to diagnose the reason for the empty return code in the FortiWeb traffic logs

[jcastellanos]

Description	This article describes how to investigate if the reason for the empty return code could be related to a fail in the TLS negotiation.
Scope	FortiWeb v7.4.x.
Solution	The empty return code could be interpreted as no response from the server: In some scenarios the cause is related to TLS negotiation is not completing between FortiWeb and the real server because of a TLS version. A packet capture between Fortiweb and the real server could help to see this error: Confirm with the real server administrator what version the real server supports and enable the specific version of TLS in the server pool configuration. Go to Server Objects- > Server -> Server Pool -> SSL Connection Settings and adjust the TLS versions supported by the real server. In another scenario, the real server could answer an RST after the Client Hello sent by the FortiWeb The real server could host multiple domains; in such case, the Fortiweb should forward the Server Name to the real server to start the TLS negotiation. config server-policy server-pool     edit "<server-pool_name>"         config pserver-list             edit <entry_index>                 set server-side-sni enable             next         end    next end In packet capture, the Server Name is added to the Client Hello in TLS negotiation between FortiWeb and the Real Server.  For more information about 'server-side-sni' setting: Troubleshooting Tip: How to fix error 'ERR_EMPTY_RESPONSE'  In another scenario, the admin may see an empty return code in the traffic logs, where the method was 'others'. The site may load, but the security features are not applied to the traffic. Examine the Policy configuration and review the Services Configuration. The two may be reversed, as shown below: To resolve the issue, ensure the HTTPS service matches the HTTPS port and the HTTPS service matches the HTTPS port. Note: There is an empty return code because of the TLS negotiation failure. This could be one of several reasons why FortiWeb shows the status as empty code. Open a TAC ticket in case to further investigation in case the TLS negotiation is completed. For an explanation of the mechanism of FortiWeb traffic log, including the meaning of response code 0: Technical Tip: Response Code 0 found in Traffic Log.