Internet traffic blocked by policy violation

[yeowkm99]

Our internet users encounter issue whereby Internet services like office 365, access to google etc is blocked suddenly by policy violation.

the way to bypass it is to launch browser using administrator rights 

[network360_2021]

enable Implicit policy logging and check the reason , did you using ISDB based policy .

if you are using ISDB then some time office365 ip missing .

first you have to check your DNS server is resolving IP for the office365 and we have to check office365 ip address in ISDB for steps please check below kb

https://kb.fortinet.com/kb/documentLink.do?externalID=FD47288

[yeowkm99]

found this fortinet KB that is similar to what i am seeing

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Threat-131072-is-seen-in-logs-when-traffic...

[Debbie_FTNT]

Hey yeowkm99,

the page you linked is just an explanation that traffic logged as deny may show with the referenced threat ID.
This does NOT explain why traffic is blocked in the first place, which is what I think you're after?

Do you have any kind of authentication setup on your FortiGate?
Given that you mentioned running the browser as admin is a functioning workaround, that sounds to me a little like there might be something going on with authentication.
In particular, running the browser as admin could trigger a login event (that might be picked up through FSSO), or would cause NTLM/Kerberos to detect the admin user.

If the FortiGate for some reason lost the regular user authentication information (timeout maybe?) that could cause traffic to no  longer match (being denied for policy violation instead), and running the browser as admin, treated as a new login, could cause the traffic to match again.
I would suggest you have a look at traffic logs for the affected source IP before and after running the browser as admin, and check what differences there are - for the allowed traffic, does a username show in the logs, for example?
You might want to enable logging all sessions in the policy, to ensure that allowed traffic is captured properly.

Cheers!

[yeowkm99]

encountered the same issue after i come to office in the morning.

seems like there is a need for AD authentication. 

Cannot show the logs as i don't have permission to upload images.

[network360_2021]

please check the authentication of the computer - ip address .

goto FSSO collector --> Show logon Users ---> and search for the IP address before entering Admin user . here you  can see FSSO detail for this endpoint/laptop. same step repeat after enter Admin user name and password and check the FSSO detail .

here we can pinpoint issue is related SSO .

if you don't have access to collector agent server we can verify from the Fortigate

goto cli --> diagnose debug authd fsso filter source x.x.x.x (ip address)

diagnose debug authd fsso list

or you can check in the GUI for the users

[yeowkm99]

how do i check in the GUI for the users ?

[network360_2021]

if you are using FortiOS version 5

User&Device -->Monitor--->Firewall ---> select [Show all FSSO Logons]

version 6

Monitor ---> FireWall User Monitor -->Show all FSSO Logons

Version7

Status --> Add widget for the users

Thanks,

Network360

https://www.youtube.com/channel/UCSQUIhnEgz2-6JP_ykhIMUw

[Debbie_FTNT]

@network360_2021

In version 7, under Dashboard there are multiple options (Status, Security, Network etc.); one of them is called Users&Devices. This contains multiple user widgets in one location :).

[network360_2021]

Dashboard--->User&Device ---->Add Widget --> ADD Firewall Users-->select FSSO logon-->Add Widget

Thanks,

Network360

https://www.youtube.com/channel/UCSQUIhnEgz2-6JP_ykhIMUw