IPS killing downloads?

[Jeff_the_Network_Guy]

We have a 400A as our primary firewall that is currently running v4.0, build0632, 120705 (MR3 Patch 8). For months (and several FortiOS versions) we' ve have had problems with downloads and web browsing. It was very difficult to track due to a lack of consistency (" The Internet is slow....Waaahhhh!" ). Finally we figured out that exempting sites from IPS resulted in a marked improvement in reliability. It seems that if we have IPS turned on for the policy that governs our users' web browsing, we see a flurry of " deny status" with a message of " no session matched" . Downloads fail to complete, or report that they are complete but files are corrupt of only partially downloaded. We have tried to open a ticket with Fortinet on the issue but could never successfully navigate past level 1 support. If anyone has had a similar challenge I would love to hear how you resolved it.

[Jeff_the_Network_Guy]

Oh, and Fortinet already configured my protocol options to resolve an earlier challenge we were having with memory usage. I' d like to think that part is configured properly.

[ejhardin]

Jeff, I' m wondering what your IPS policy looks like for your outbound traffic? Also check out my post on Old IPS Signatures. http://support.fortinet.com/forum/tm.asp?m=88509&p=1&tmode=1&smode=1

[ejhardin]

Nick and Jeff, IPS doesn' t have a flow or proxy setting. IPS is flow. Jeff, The " set algorithm low setting" is a performance enhancement setting. Setting it to low will use less memory but will be less accurate.

[cmberry]

my downloads are being killed too. May or may not be related to the fact the youtube videos, quicktime videos, etc, all only partially download /stream. I had to download an update for adobe lightroom 8 times today to get 1 to go to completion. Also had several other web downloads start and not finish. I have IPS turned on, but have not tried yet to pinpoint if IPS causes my issues. I have seen this behaviour on my 200b, running both 4.3.9 and 4.3.10.

[Jeff_the_Network_Guy]

Hey cmberry, are you using traffic shaping? I am starting to wonder if this could be part of the equation. I have a client we have to download PDF files from that has been giving us problems for months. Recently I added the download server to our IPS exemption list, but the half downloads are still happening. I am starting to wonder if the traffic shape I have in place to keep using from using the pipe is resulting in the incomplete downloads instead of the IPS checks. Just a thought.

[cmberry]

Hey cmberry, are you using traffic shaping? I am starting to wonder if this could be part of the equation.

I dont use traffic shapping, but I do use ECMP routing. I have a call into the reseller to see if they can help me track this problem down. I' ll post any updates.

[TopJimmy]

I too use IPS on outbound policies. I don' t do it to " keep the internet clean" but I do it to protect outbound traffic from vulnerabilities. Example: The latest MS and JAVA vulnerabilities have an IPS signature in the " client" section of the IPS signatures. I apply those to outbound " client" sensors to block any malicious internet hosts from exploiting any potential vulnerable workstations/servers on my network. Maybe I' m missing the boat here but I think it was designed that way otherwise why else would they have a " client" target in the signatures.

[cmberry]

I use IPS on Internal > WAN connections too. Actually I use all UTM on outbound connections. I dont see how else you would stop a malicious site from causing havok without it. For instance, at 8am last Friday morning, I went to http://consumerist.com Guess what? They had been hacked and their site was pushing redirects to malicious sites attempting to install all sort of nastiness. Between Fortinet and Eset, nothing got past. Well, within an hour the site had gone down and remains down as of this hour, it was a serious hack. So, if I didnt have outbound UTM turned on, and I intentionlly went to a site I know and trust, how else would I have been protected in a situation like this? I dont understand people recommending only having inbound (e.g. FTP servers, webservers, etc) protected. Am I the dumb one?

[cmberry]

OK, I think I have a major update to the whole " Broken Download" problem. It appears to NOT be Fortinet' s problem! (Yes, I am shocked too) I stumbled upon this today, I recommend everyone reading it, even if you dont think you have download issues:

The recently released KB2735855 has been confirmed to cause data corruption

http://www.wilderssecurity.com/showthread.php?t=332920 http://answers.microsoft.com/en-us/windows/forum/windows_7-windows_update/kb2735855-causes-my-downloads-to-break/50beff42-60b1-44d3-9c6c-d46e91878bc0 I just uninstalled it, and will report back in 24 hours. I am resonably confident since my symptoms match almost exactly, and have been happening in the exact period since that patch was installed. Hope this helps!

[FG_User]

what' s the verdict? any luck?