Issue with ASIC offloading and UTM on 100F Series?
After having done a load of testing I've come to the conlusion that there actually is an issue with ASIC offlading and UTM on the 100F Series.
This issue does not occur on 100E Series or a 300E or a 60F but it does on all of our 100F.
All FGT here are at 7.0.12.
When your internet policy is in flow mode (default) then per default ASIC offloading is on. If you then also applied some UTM Profiles or a security profile group to the policy you will notice that at least website that use http v2 protocol will no longer work. They will load endless or/and timout.
If you disable ASIC offloading the sites work immediately.
They also work if the policy is in proxy mode because in proxy mode the FGT does no ASIC offloading.
TAC are still investigating this with us. Up to now their suggested workaround is to disable ASIC offloading. However Fortinet themselves do not recommend that because this will generate a higher CPU load on the FGT.
Just wanted to post that in here for if anyone else runs into this.
"It is a mistake to think you can solve any major problems just with potatoes." - Douglas Adams
I don't have a reference at the moment, but we saw something matching this with traffic coming across an IPSec tunnel to a "core" firewall, then having flow mode UTM applied there before going out to the Internet. Issue was relatively inconsistent. IIRC, it was a bug in ipsengine that was being looked into.
Workaround was to set up MSS clamping to a reasonable value.
You wrote, the issue does not occur on a 60F. I made a different experience:
Since a few days, we test to deploy settings and automated software installations via Microsoft Autopilot and Intune. Our testclients are connected via WiFi, which is managed by a 60F. From 10 clients, a minimum of 8 faild at the software-installation-task during the Autopilot process. When we used a wired connection between the client and a Fortigate 300E cluster, all clients installed all packets without any issue.
After I saw a hint regarding to ASIC, we decided to deactivate ASIC on the 60F. This was the solution. After this change, 20 of 20 notebooks did a perfect installation so far...
My team has had similar issues on our 101Fs running 7.0.12. In some cases it was only specific traffic allowed in a rule and we were able to create a new rule isolating the affected traffic with asic disabled.
Packet captures show a normal TCP session and then a reply with an incorrect sequence number causing everything to restart.
Did TAC ever find a permanent resolution? We showed them the packet captures and it got to the point where TAC wanted to see captures not taken from the Fortigate thinking our routing equipment was introducing the error.
With and without IPSEC tunnels. We even create any any permit rules for testing but then one port/session/etc would stop working. If we isolate that session into its own rule, it would start working again.
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.