I use just simple one policy with "webproxy-forward" to external proxy server.
config firewall policy edit 1 set name "Access through EDU proxy" set uuid fa0c4c6a-03b0-51ec-cbe7-600564e233d1 set srcintf "VicSmart1" set dstintf "VicSmart20" set action accept set srcaddr "all" set dstaddr "all" set schedule "always" set service "HTTPS" "HTTP" "Proxy_port_8080" set inspection-mode proxy set ssl-ssh-profile "certificate-inspection" set webproxy-forward-server "EDU_Proxy" set nat enable next end
Works fine but if I open many sites at the same time I get the errors "Site can't be reached" with ERR_CONNECTION_CLOSED sometimes. Just need to refresh and all good, site is open.
Maybe it is because traffic in my case comes in through VDOM interlink (root -> VDOM) and goes out through another VDOM interlink (VDOM -> root) and I have a vdom interlinks performance issue.
It sounds more like the TCP connection was reset. You can start by checking your Fortigate forward event logs and see if there are any obvious deny events.
The next step should be performing packet captures on the LAN and WAN facing interfaces across all VDOMS and see if it is actually the Fortigate who resets the connection.
If the connection is indeed reset by the Fortigate and the logs do not indicate an obvious reason, the proxy daemon will likely need to be debugged. You should contact TAC if you are not familiar with the process.
I see sometimes an information like "625 5.962450 172.20.0.1 220.127.116.11 TCP 76 [TCP Retransmission] [TCP Port numbers reused] 4780 → 8080 [SYN] Seq=0 Win=65535 Len=0 MSS=1460 SACK_PERM=1 TSval=144583175 TSecr=0 WS=4096"
This packet itself is not a clear indication of an issue. It just shows the client is trying to open a new TCP session and that the packet capture already contains previous session with the same port numbers. It does not indicate why was the previous session closed.
The only wild guess I can take is that this could potentially be caused by session clashes, when for instance, you have multiple clients behind SNAT connecting to the same proxy.
You should also investigate on your EDU_Proxy server to see why exactly are the sessions being reset.
Since you have multi-vdom setup, transparent proxy and proxy forwarding in place, the debugging can get rather complex. You should really create a TAC support ticket with a detailed network diagram.
Questions should also be raised on whether such complex setup is actually needed ;-).