Fortigate closes wetransfer connections

[czadbastian]

Hello,

Fortigate closes connections for reasons unknown to me. I have Fortigate 100F 7.2.3 build 1262. 

I applied https://community.fortinet.com/t5/Support-Forum/Large-transfer-fails-becuase-sessions-keep-getting-d... and conserve is off. All policies are proxy based.

Anyone know something?

Regards

[jhussain_FTNT]

Hi,

Do you have any UTMs configured in the policy?

Please test by setting the policy to be flow-based and see if you were successful in uploading the large file.

Regards

Jamal

[czadbastian]

Hi, unfortunately not

[pgautam]

Hi @czadbastian

Please check the session-ttl value in the established session list

dia sys session filter src <src machine ip>
dia sys session filter dst <destination_ip>
dia sys session list

You can adjust based on the session uptime requirement.

- globally in
config system session-ttl
and
- per policy in
config firewall policy
   set session-ttl

Regards

Priyanka

- Have you found a solution? Then give your helper a "Kudos" and mark the solution.

[czadbastian]

app control and web filter has blocking. In security events it was seen that the web filter was blocking sharepoint services which is strange. Surely fortigate has a problem with filtering traffic to and from sharepoint because in the app control I added everything related to microsoft 365 and there was still a problem. Web filter had defined what to cut but certainly not sharepoint. Just like wetransfer

[pgautam]

Hi @czadbastian,

In this case for the test machine can you make an open policy and test the behavior?

If for the test machine IP address we transfer the works file then from logs confirm what the depended services need to allow in the web filter and application control when you apply the security profile in the policy.

Regards

Priyanka 

- Have you found a solution? Then give your helper a "Kudos" and mark the solution.

[knagaraju]

Hi czadbastian,
As you have not enabled any security profiles on the fortigate, it will be acting as a normal L-3 device.

Could you please check the below things
1. Logs&Reports >>forward traffic >> Click on any one of the logs to see the action during the time of the issue.
2. Please check if you have applied any traffic shaping policies.

3.  If you have multiple ISPs connected to fortigate then 
Please route the traffic through other ISP just for testing and check the result.
5. If in case, you are using SDWAN then make sure you have a seperate rule configured to this specific traffic through only one ISP.

Regards
Nagaraju.

[czadbastian]

the person with the problem has the rule over the one who is blocking. I have one ISP. I turned off traffic shaping. will see what will happen

[czadbastian]

app control and web filter were blocking. In security events it was seen that the web filter was blocking sharepoint services which is strange. Surely fortigate has a problem with filtering traffic to and from sharepoint because in the app control I added everything related to microsoft 365 and there was still a problem. Web filter had defined what to cut but certainly not sharepoint. Just like wetransfer

[knagaraju]

Hello czadbastian,

You can try configuring a separate firewall policy using ISDB for wetransfer,just for testing.
Quick note: Please disable all security profiles while creating the ISDB policy.

Please refer the below link for example
https://docs.fortinet.com/document/fortigate/6.2.15/cookbook/179236/using-internet-service-in-policy

Regards
Nagaraju.