Web Filtering HTTPS Option causing problems for mixed content website

[dvdsmith]

I have a website that my users visit that has problems when the HTTPS option is checked in the Profile for " Enable Fortiguard Web Filtering" . I' m not sure if I should blame Fortigaurd or the website. I' m using IE7.0 and the website refuses to work with Firefox or other browsers. I' ve tried one other mixed content website without a similar results. If anyone has another similar site to recommend for test purposes, please let me know. Also, could anyone let me know what the HTTPS option really does for me, since to my knowledge, URLs are always " in the clear" ? The manual doesn' t elaborate. Here is how it should behave. When they visit webcontrol.avv.com, they are directed to the HTTPS login page. Once they login, the address line loses HTTPS, now HTTP, but certain elements of the page have HTTPS content. FYI, all the content seem to be on avv.com, not from other URLs. With HTTPS option checked, the intial login comes up, but once they login, the browser returns an " Internet Explorer cannot display the webpage" error. Without closing the browser, if they reenter webcontrol.avv.com in the address line and click refresh, they get they page they should have gotten. However, while navigating in the website, any attempt to access information containing HTTPS content results in the affect frames displaying the same " cannot dislpay webpage" error. The only way to return to normal is to refresh the page. If I uncheck the HTTPS option, I am immediately able to navigate the site with no problems. Any suggestions? Thanks, Dave

[rwpatterson]

Sounds like you' re using a version of firmware that is dated. MR4 and newer should have taken care of this. MR4 is buggy, so I would say start with MR5. What model FGT, by the way...

[dvdsmith]

I' ve been using MR3 build 416 because its listed as " Most Stable Maintenance Release" . I' m using an FGT-100A, HA and VPN are not going to be used. Should I use MR5 Patch 3 or is there a reason I should go with one of the others? Thanks, Dave

[rwpatterson]

Like you, I was a cautious consumer. Upgrades in the past were buggy and untested endeavors adding ' features' that were problematic at best. I can assure you (and also by my signature) that since Fortinet' s strategy has been ' stability now, new features later' that the latest codes reflect bug fixes only. No new frills or ' bling' has been added to bugger up the code. MR3 was the first maintenance release that tried (emphasis on that word) to AV scan and rate HTTPS traffic. It didn' t work as designed. Recommendations at the time were to turn it off. MR4 was better, but MR5 is best. Much less memory intensive as well (at least better than MR4!). Good luck.

[dvdsmith]

Thanks for the advice. I' ve been burned too many times trying the latest/greatest new thing (anyone remember MSDOS 6.0?). I' m loading MR5 patch 4 onto the FGT-200 I just replaced so I can check it out, and when I get some downtime, I' ll load it on the FGT-100A. Thanks, Dave

[rwpatterson]

I remember MS DOS 4.0 (I started with 3.01). I also remember the first Active Desktop! Came with IE 4.0. What a load of crap..... One note: Your SSL-VPN tunnel policies will have to be sourced with ' any' instead of any other smaller subnets. One gotcha between MR3, and the latter.