Accessing url blocked by fortigate action : server-rst

[esa12]

I have an issue when accessing url by ip address using https. Why does the firewall block web access and how do I solve it? all i can see in the log is:

[AEK]

Server Reset is an action performed from server side, not by firewall.

[ilias87]

Same issue here,  any idea how to solve it?

[AEK]

Server-rst event most probably means the issue is from server side.

Check the related logs on the server, typically the logs of the application that you trying to access.

[dingjerry_FTNT]

Hi @ilias87 ,

If you have any UTM services applied, please remove all of them first to see whether this issue is still there.

If yes, this issue should be caused by the server end.

If no, add the UTM services back one by one to see which will cause the issue.

[ilias87]

It is quite weird because it appeared after an upgrade to version 7.2.11.

Device tries to access its gateway ( Fortigate is in the middle with a virtual wire pair , in bridge mode) and this issue appeared. It tries to access it in https directly to an ip address as esa12 mentioned. I whitelisted ssl application with id 15895 but stil traffic is being blocked. Anything else (that passes through the same gateway) operates normally. 

[AEK]

Hi Ilias

Did you say "traffic is being blocked"? Or is it "server-rst"? If the traffic is being blocked then I guess the traffic is not matched by the expected rule, right?

[ilias87]

Hi AEK , I am using virtual wire pair policy for the whole local interface (Fortigate in transparent mode) and the local devices cannot access their gateway in https. (etc https://192.168.100.1). My ssl inspection policy was in "read-only ssl inspection" mode and when i change it temporary in "no inspection" , page is accessible again. Please note that this happened after an upgrade from 7.2.9 to 7.2.11 version. So clearly Fortigate doesn't like the cerficate of this local page , but i cannot add an exception for ip address  in "read-only ssl inspection " mode. The log message is correct "server-rst". Thanks for assistance!

[AEK]

Hi ilias

If the SSL inspection profile is blocking the traffic that means FGT doesn't like the certificate as you said.

In that case you should find in the FGT SSL logs why the certificate has been blocked, and then you can tune the SSL inspection profile accordingly.

[Dhruvin_patel]

Greetings!

The 'server-rst' action in a log indicates that the server has reset the connection; this does not mean that the FortiGate is blocking the connection.

There are a few possible reasons that you would get a "server-rst" action, e.g. the client did not send any info for a while for some reasons and the server decides to terminate the session, or if the client sends a FIN and the server may decide to send a RST instead of a FIN.

Regards!