Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
Jeff_the_Network_Guy
New Contributor III

IPS killing downloads?

We have a 400A as our primary firewall that is currently running v4.0, build0632, 120705 (MR3 Patch 8). For months (and several FortiOS versions) we' ve have had problems with downloads and web browsing. It was very difficult to track due to a lack of consistency (" The Internet is slow....Waaahhhh!" ). Finally we figured out that exempting sites from IPS resulted in a marked improvement in reliability. It seems that if we have IPS turned on for the policy that governs our users' web browsing, we see a flurry of " deny status" with a message of " no session matched" . Downloads fail to complete, or report that they are complete but files are corrupt of only partially downloaded. We have tried to open a ticket with Fortinet on the issue but could never successfully navigate past level 1 support. If anyone has had a similar challenge I would love to hear how you resolved it.
----------------(-- Jeff
----------------(-- Jeff
25 REPLIES 25
Jeff_the_Network_Guy

Oh, and Fortinet already configured my protocol options to resolve an earlier challenge we were having with memory usage. I' d like to think that part is configured properly.
----------------(-- Jeff
----------------(-- Jeff
ejhardin
Contributor

Jeff, I' m wondering what your IPS policy looks like for your outbound traffic? Also check out my post on Old IPS Signatures. http://support.fortinet.com/forum/tm.asp?m=88509&p=1&tmode=1&smode=1
ejhardin
Contributor

Nick and Jeff, IPS doesn' t have a flow or proxy setting. IPS is flow. Jeff, The " set algorithm low setting" is a performance enhancement setting. Setting it to low will use less memory but will be less accurate.
cmberry
New Contributor

my downloads are being killed too. May or may not be related to the fact the youtube videos, quicktime videos, etc, all only partially download /stream. I had to download an update for adobe lightroom 8 times today to get 1 to go to completion. Also had several other web downloads start and not finish. I have IPS turned on, but have not tried yet to pinpoint if IPS causes my issues. I have seen this behaviour on my 200b, running both 4.3.9 and 4.3.10.
Jeff_the_Network_Guy

Hey cmberry, are you using traffic shaping? I am starting to wonder if this could be part of the equation. I have a client we have to download PDF files from that has been giving us problems for months. Recently I added the download server to our IPS exemption list, but the half downloads are still happening. I am starting to wonder if the traffic shape I have in place to keep using from using the pipe is resulting in the incomplete downloads instead of the IPS checks. Just a thought.
----------------(-- Jeff
----------------(-- Jeff
cmberry
New Contributor

Hey cmberry, are you using traffic shaping? I am starting to wonder if this could be part of the equation.
I dont use traffic shapping, but I do use ECMP routing. I have a call into the reseller to see if they can help me track this problem down. I' ll post any updates.
TopJimmy
New Contributor

I too use IPS on outbound policies. I don' t do it to " keep the internet clean" but I do it to protect outbound traffic from vulnerabilities. Example: The latest MS and JAVA vulnerabilities have an IPS signature in the " client" section of the IPS signatures. I apply those to outbound " client" sensors to block any malicious internet hosts from exploiting any potential vulnerable workstations/servers on my network. Maybe I' m missing the boat here but I think it was designed that way otherwise why else would they have a " client" target in the signatures.
-TJ
-TJ
cmberry
New Contributor

I use IPS on Internal > WAN connections too. Actually I use all UTM on outbound connections. I dont see how else you would stop a malicious site from causing havok without it. For instance, at 8am last Friday morning, I went to http://consumerist.com Guess what? They had been hacked and their site was pushing redirects to malicious sites attempting to install all sort of nastiness. Between Fortinet and Eset, nothing got past. Well, within an hour the site had gone down and remains down as of this hour, it was a serious hack. So, if I didnt have outbound UTM turned on, and I intentionlly went to a site I know and trust, how else would I have been protected in a situation like this? I dont understand people recommending only having inbound (e.g. FTP servers, webservers, etc) protected. Am I the dumb one?
cmberry
New Contributor

OK, I think I have a major update to the whole " Broken Download" problem. It appears to NOT be Fortinet' s problem! (Yes, I am shocked too) I stumbled upon this today, I recommend everyone reading it, even if you dont think you have download issues:
The recently released KB2735855 has been confirmed to cause data corruption
http://www.wilderssecurity.com/showthread.php?t=332920 http://answers.microsoft.com/en-us/windows/forum/windows_7-windows_update/kb2735855-causes-my-downloads-to-break/50beff42-60b1-44d3-9c6c-d46e91878bc0 I just uninstalled it, and will report back in 24 hours. I am resonably confident since my symptoms match almost exactly, and have been happening in the exact period since that patch was installed. Hope this helps!
FG_User
New Contributor

what' s the verdict? any luck?
Announcements

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Labels
Top Kudoed Authors