IPS killing downloads?

[Jeff_the_Network_Guy]

We have a 400A as our primary firewall that is currently running v4.0, build0632, 120705 (MR3 Patch 8). For months (and several FortiOS versions) we' ve have had problems with downloads and web browsing. It was very difficult to track due to a lack of consistency (" The Internet is slow....Waaahhhh!" ). Finally we figured out that exempting sites from IPS resulted in a marked improvement in reliability. It seems that if we have IPS turned on for the policy that governs our users' web browsing, we see a flurry of " deny status" with a message of " no session matched" . Downloads fail to complete, or report that they are complete but files are corrupt of only partially downloaded. We have tried to open a ticket with Fortinet on the issue but could never successfully navigate past level 1 support. If anyone has had a similar challenge I would love to hear how you resolved it.

[rwpatterson]

Just what (to me) appears to be a silly question. Why would you want to protect outbound traffic? Trying to keep the Internet clean?

[jtfinley]

Bob - Funny you say that, but I too have done this. Placing an IPS on an internal - > WAN connection only to see the internal users get blocked, etc. Live & learn.

[JaapHoetmer]

Hi Jeff. I have experienced a similar situation with a relatively new FG40C, loads and loads of errors logged showing ' no session matched' for a variety of outbound protocols, a very slow internet access, and difficulty accessing the Web GUI. I have tried a lot to analyse the issue, and finally found out that the physical LAN port #1 is probably faulty. After switching the cable that was plugged into port 1 over to port 5 on the FG40C, the errors disappeared and access returned to normal. It may not be the same issue you are experiencing, but it does point to issues in the physical world, maybe cabling? I am now in contact with the supplier, if I find out more I will let you know. Cheers, Jaap

[Jeff_the_Network_Guy]

Interesting. I' ll keep that in mind. I had a lot of problems with sites my Accounting group used to process payments. They' d get kicked out of sessions, or pages would not load. I ended up exempting the sites from IPS checking, and that kept them from having problems anymore. So far for me, this seems to be a challenges that results directly from the application of IPS to the rules. The results have been night and day when I enable/disable IPS.

[Coldfirex]

So do you ever have IPS on outbound policies? We have been doing this way (including for incoming traffic policies) with no major issues. My understanding was that this would help for example if a client connects to a remote server (web, email, etc) that itself might be infected or doing something malicious that IPS would prevent.

[Jeff_the_Network_Guy]

Maybe I' m reading things wrong but all of my " outbound" policies have IPS on them. Wouldn' t you want to check the stream of your user' s HTTP traffic for anomalies that might target them? I know the initial idea of network security is keeping hackers out, but considering how many exploits are payloaded into normal download traffic it seems to me that you had better be checking everything. The data brought in due to an HTTP get request from a user' s PC is not governed by an " inbound" firewall policy.

[SOLID_SYSTEMS]

Interesting, I' ll be going for my training next week and this will be my first exposure to fortinet. I come from a cisco heavy background and have been wondering if the transition to fortinet will be a bumpy ride.

[Secure_IT_BE_Nick]

So why 2 different targets then?? And a default IPS profile protect_clients? Ofcourse you use IPS for internal --> wan policies. For Jef' s problem changing the ips to flow instead of proxy could help with the performance or play with the protocol options.

[Jeff_the_Network_Guy]

I am not sure about the flow versus Proxy setting for IPS. Is that the same as " set algorithm low" under " config IPS global" ? My " General" IPS setting for most of the company is Windows, Client, High, Critical, IM, HTTP, FTP, RTSP, Oracle, IE, MediaPlayer, MSOffice, Adobe, Sun, IM. I' d like to think that is pretty well defined down, but it still gets me 1215 possibilities.