Blocked HTTPS Traffic

[MIsmail]

Hii
Could someone help me please to identify the problem 
I don't know why this traffic is blocked and it affects our ADSync Server online syncronization 

[Markus_M · Accepted solution]

First remove the webfilter from the policy to see if it starts working in the first place. Based on the policy view there is no web filter applied at this time. Just to make sure.

If it fails working, there is no point troubleshooting anything on the webfilter since it has no direct affect. The traffic is blocked BEFORE the webfilter will be applied.

When the traffic is working fine, then apply webfilter etc. to the traffic. You will also need minimum certificate inspection, better a deep inspection as FortiGate can only block what it can read. Encrypted traffic cannot be read.

Next is that your initial screenshot show a different source interface (port1 vs port2). See if that is the pattern on the failure.

Check if the interface group/zone called "outside" contains both port1 and port2 - I would suspect that is not the case, based on the logs.

Best regards,

Markus

[Markus_M · Accepted solution]

First remove the webfilter from the policy to see if it starts working in the first place. Based on the policy view there is no web filter applied at this time. Just to make sure.

If it fails working, there is no point troubleshooting anything on the webfilter since it has no direct affect. The traffic is blocked BEFORE the webfilter will be applied.

When the traffic is working fine, then apply webfilter etc. to the traffic. You will also need minimum certificate inspection, better a deep inspection as FortiGate can only block what it can read. Encrypted traffic cannot be read.

Next is that your initial screenshot show a different source interface (port1 vs port2). See if that is the pattern on the failure.

Check if the interface group/zone called "outside" contains both port1 and port2 - I would suspect that is not the case, based on the logs.

Best regards,

Markus

[msanjaypadma]

Hi @MIsmail ,

Logs did not captured correctly.  try again.

[MIsmail]

Hi @msanjaypadma 
Thanks for caring, I tried to bybass the firewall and found that the traffic fail still exist
so the fortigate is not responsible for the failure.

thanks

[sw2090 · Accepted solution]

He is getting "implicit deny" as one of the first repliers already wrote.

This means that traffic did not hit ANY policy but policy #0 ("implicit deny") and thus got denied.

So it is of no use to try to disable Filters on policies because they are not hit.

I would suggest to check why this traffic doesn't hit any policy.