AV scanning kills HTTP traffic

[#1]

I recently had an issue with port 8o traffic being stopped by a push update that also updated the AV engine. My experience is related here. According to Skyhigh, this was a known issue with the AV sigs and the AV engine that affected v2.5 MR9. His advice at that time was to upgrade to MR10. We did and the problem went away. Now, we are on v2.8 MR5 and having the same problem again - just started at ~0900 hrs EDT 10-18-2004. We can ping via DNS name and it will resolve and respond. However, that same site will not come up in Internet Explorer. To troubleshoot this, we have disabled AV scanning and intrusion detection on the outbound and found that when on, the issue is present; when AV is off, the issue goes away. Has anyone else seen this issue?

[#2]

Can' t sniff the v2.5 MR10 anymore as I have upgraded to v2.8 MR5.

[gbaharoff]

We have seen this on various models and FortiOS versions from 2.50 to 2.80 MR5. We noticed it with IPS and AV enabled in combination or not. Configuring an internal DNS server for your workstations to use seems to take care of the problem.

[#4]

Hello, I am seeing this problem as well. The HTTP traffic stops when virus scanning HTTP, as well as " file block" . It took me forever to find out what was going on. I finally disabled the virus checking and file block on the profile and the traffic came through again. We have our own DNS server and the workstations are pointed to it so that does not fix the problem per Pasdargent' s tip, if I read it correctly. OT: Not to rape this thread but can somebody give me a clue as to why the content filtering does the same thing as this virus issue, meaning, if I enable filtering, no traffic will come through to the machines, no loggin, nothing. If I enable " Web content block" it does the same thing. I am almost hairless on this one..

[#5]

Configuring an internal DNS server for your workstations to use seems to take care of the problem

Sorry about that mis-quote, Pasdargent. I was meaning to quote the Fortinet engineer, gbaharoff, in that the DNS issue is *not* the problem. It does seem to point to the anti-virus updates. I am on a 200 @ 2.8 rev5. There seems to be some really flakey stuff happening on this IOS. This is the first time I have used a Fortinet device and from what I have seen and read on these forums about this happening in the past, it is looking like this problem could hit at any time, which is not too pleasing. It really gives a false sense of security.

[#6]

We have internal DNS as well so we are very similar in our situations, indeed.

[#7]

I posted this earlier but I found the problem on my end. Here is what I had posted.. " I found the problem, at least on my end.. Hit me late last night. The problem is that I had WCCP redirecting from a Cisco router to a Cisco cache engine and when the content filtering, etc. was turned on within the Fortinet 200 device, it was getting redirected to the cache engine and stopping! Turn off WCCP on the redirecting router and all is good. Even the virus scanning works again. Hope this helps some of you guys.. One last thing, I am using the Frotinet in transparent mode."

[#8]

Chaps, I' ve just replaced an fg-1000 running 2.5 MR10 with an FG-3600 running 2.8MR5 ... and that' s when the problems started. All our users here have to go through our web caching service ( load balanced squid servers ) Basically for our web caches I' ve had to disable IDS (AV still running). This seems to cure 99.95 % of the problems we' ve been having. There are some sites that seem to have problems ( that don' t show up in the logs ) with Av enabled, so for them I' ve configured our client auto-proxy configuration file to point them to another web cache that has IDS on and AV off !!! and that works as well. Now we' ve just got some ftp funnies that seem to be AV related. Alex

[#9]

I had a case where an IPS configuration resulted in corupted files when downloading them through web. Fortigate IPS has some bad written signatures (in my case MS.GDIPlus.JPEG.BufferOverflow.a and b). Which is the well known signature for mulformed Jpegs executing code on some MS machines. By comparing it with Cisco IDS and by examining the sites that JPEGs where originating we concuded that it was a false positive (Cisco IDS and AV on PC did not think a JPEG fro a DELL' s site had JPEG buffer overflow). Unfortunately the client had configured the signature to drop session as an action. This led to corupted files (as the signature was drigered when downloading zip files). So think again before enabling drop session on signatures belonging to web-misc web-client etc groups as they could lead to bad HTTP trafic.

[#10]

Hi All, I faced the same issue whenever I try to enable Antivirus Port Scan on the Fortiget-50A unit, I couldn' t surf the internet. It block http request. I was running v2.5 firmware. After I upgrade the firmware to v280-build292, It solved the problem! :-P Hope it helps those who facing the same issue! Junhan

[#11]

There is nothing called " Antivirus Port Scan" . Probably you mean IPS (anomaly) port scanning. If you have a proxy it common (on most IDS) to missmuch the conections of your proxy as a portscan. As the proxy uses sequencial high ports (3506, 3507, 3508...) to connect to port 80 of other sites that can be triggered easily as port scan from other sites to your proxy. Normaly you create exeptions for some IP so the IDS ignores them for port scan (or other signatures). For now you cannot create exeptions on a fortigate