[HW: 100D | OS: 5.6.2] Heavy problems while SSL security scan the Fortigate 100D -> Outage

[Denny_Inatec]

Hello,

today we had more or less a complete outage for our incoming WAN traffic, because of a security (PCI DSS) scan, through an external company (https://www.usd.de/en/security-analysis-pentests/security-scan/)

We have two FG100D as HA-Cluster configured and using them also for WAF SSL/TLS termination. The scan has also SSL/TLS checks includes, to make sure, that we are not using old/deprecated/insecure ciphers. The problems started with:

SSL decryption failed

and we get them A LOT of them. Then the traffic quickly starts with "stuttering" and connection timeouts/packet lost.

After we identified that the Fortigate was the problem, we forced a manual failover to the slave and the traffic went back to normal. We didn't find anything in the logs, which we could identified as problem, but we are pretty sure, it must be something in the SSL/TLS engine from the FortiOS 5.6.2. Maybe a process hangs or the scan sent something, which wasn't good. We don't know. We do this scan every six month and we never had a problem like this. Is there a way to get more details, that we don't see in the normal logs ?