Forticlient log show CBBS Callhome failed, seems a TLS error

[tongkai]

Because I saw some windows event error every 10 mins only on PC join forticlient EMS

schannel Event ID 36888, TLS protocol defined fatal error code is 70, The Windows SChannel error state is 105

I already configure Windows 7 to use TLS 1.1 & 1.2 which tell me at the release note at forticlient EMS 6.0.1

And confirm can deploy client ver 6.0.1 with EMS ver 6.0.1 and 6.0.2

--------------------------------------------------

When I try to export the log in Windows 7 client, it said:

13-Sep-18 06:38:54 AM Information FortiShield id=96851 user=DBLOG_SOURCE_SYSTEM msg="FortiShield is enabled" 13-Sep-18 06:39:21 AM Information Update id=96650 avsig=62.00159 avsiglastupdate="2018-09-13 06:39:19+08" ipssig=13.00448 irdbsig=4.00305 13-Sep-18 06:39:34 AM Warning AntiVirus CBBS Callhome failed 1 times and try again 5 seconds later! 13-Sep-18 06:39:40 AM Warning AntiVirus CBBS Callhome failed 2 times and try again 5 seconds later! 13-Sep-18 06:39:46 AM Warning AntiVirus CBBS Callhome failed 3 times and try again 5 seconds later! 13-Sep-18 06:39:53 AM Warning AntiVirus CBBS Callhome failed 4 times and try again 5 seconds later! 13-Sep-18 06:39:59 AM Warning AntiVirus CBBS Callhome failed 5 times and try again 5 seconds later! 13-Sep-18 06:40:05 AM Warning AntiVirus CBBS Callhome failed 6 times and try again 5 seconds later! 13-Sep-18 06:40:11 AM Warning AntiVirus CBBS Callhome failed 7 times and try again 5 seconds later! 13-Sep-18 06:40:17 AM Warning AntiVirus CBBS Callhome failed 8 times and try again 5 seconds later! 13-Sep-18 06:40:23 AM Warning AntiVirus CBBS Callhome failed 9 times and try again 5 seconds later! 13-Sep-18 06:40:29 AM Warning AntiVirus CBBS Callhome failed 10 times and try again 5 seconds later! 13-Sep-18 06:40:35 AM Warning AntiVirus CBBS Callhome failed 11 times and try again 5 seconds later! 13-Sep-18 06:40:41 AM Warning AntiVirus CBBS Callhome failed 12 times and try again 5 seconds later! 13-Sep-18 06:40:47 AM Warning AntiVirus CBBS Callhome failed 13 times and try again 10 minutest later!

------------------------------------------------------

My Windows 10 client did not have this error:

12-Sep-2018 11:20:29 PM Information FortiShield id=96851 user=DBLOG_SOURCE_SYSTEM msg="FortiShield is enabled" 12-Sep-2018 11:20:32 PM Information AntiVirus CBBS Callhome success and next callhome = 86400 seconds later 13-Sep-2018 12:30:46 AM Information FortiShield id=96851 user=DBLOG_SOURCE_SYSTEM msg="FortiShield is enabled" 13-Sep-2018 12:30:50 AM Information AntiVirus CBBS Callhome success and next callhome = 86400 seconds later 13-Sep-2018 12:31:15 AM Information Update id=96650 avsig=62.00153 avsiglastupdate="2018-09-13 00:31:13+08" 13-Sep-2018 01:56:29 AM Information Update id=96650 avsig=62.00154 avsiglastupdate="2018-09-13 01:56:28+08" irdbsig=4.00305 13-Sep-2018 02:56:33 AM Information Update id=96650 avsig=62.00155 avsiglastupdate="2018-09-13 02:56:31+08" ipssig=13.00448 13-Sep-2018 04:56:30 AM Information Update id=96650 avsig=62.00156 avsiglastupdate="2018-09-13 04:56:28+08" 13-Sep-2018 05:56:28 AM Information Update id=96650 avsig=62.00158 avsiglastupdate="2018-09-13 05:56:27+08" 13-Sep-2018 06:56:31 AM Information Update id=96650 avsig=62.00159 avsiglastupdate="2018-09-13 06:56:30+08" 13-Sep-2018 08:00:23 AM Information Update id=96650 avsig=62.00160 avsigetm=62.00159 avsiglastupdate="2018-09-13 08:00:21+08" 13-Sep-2018 08:01:24 AM Information Scheduler id=96800 msg="Forcefully kill a child process (fmon.exe) after grace period expires" 13-Sep-2018 08:44:32 AM Information Update id=96650 avsig=62.00161 avsiglastupdate="2018-09-13 08:44:31+08"

-----------------------------------------------------

So I want to know what is CBBS Callhome and why it fail to connect in Windows 7 client ?

Can update client configure and antivirce signature

[tongkai]

so I found its mean Cloud Based Behavior Scan (CBBS)

there is no error at EMS log, only in client log

still finding solution

[tongkai]

Have more test on the CBBC Callhome failed error

It is because "Deploying FortiClient upgrade to Windows 7", "Enabling TLS 1.2 on Windows 7 using registry settings"

When you add the registry, the error begin to happen. But you cannot disable the registry and "disable TLS 1.0 and 1.1 in EMS" to deploy

Workaround, "Enabling TLS 1.0 and 1.1 in EMS" to deploy