Not able to access HTTPS websites

[#1]

I am having problems accessing certain(not all) SSL websites behind a FortiGate 110c running 4.0 MR2. Sites I cannot access include gmail.com and a local banking website. It is quite odd because last week I was unable to access gmail.com and Firefox would give the error: " Connection Interrupted" . Today in the morning I was able to access the sites for a few hours, however, within an hour from the last successful access I could no longer access the sites and Firefox would give the error: " The connection was reset." During this time-frame no changes were made to the FortiGate - which is weird why all of the sudden the sites would go from not working, to working, then back to not working. Anyone have any idea what could be causing this or where to start troubleshooting?

[ejhardin]

Update: I contacted support regarding this issue and they advised me to disable HTTPS Deep Scanning. This solved the issue and now I am able to access all HTTPS websites.

Mike0 - I have a bug ticket in with a level 3 tech regarding this issue. The problem is with the deep ssl scanning. I hope to have more info soon.

[#3]

That' s good to know ejhardin, please keep us informed. I have not really experimented with SSL deep scanning since support told me to turn the feature off to resolve the issue. However, I have an upcoming deployment where SSL AV scanning / Deep scanning is important and I need this feature to work correctly.

[ibm_ioman]

I did exactly like in the post, I had already found the info on knowledge base. I modified tcp-mss to 1388 and also 1380, both on vpn interface and also wan1 (on which vpn interface is tight) and the same result -> no change, exactly the same message on sniffer. L.E.: I also modified it on port8, the same result: need to frag (mtu 1428)

[rwpatterson]

Did you just try to drop the MTU size to 1428? Rather than guessing try PINGing with different sizes from a command prompt until you get a size that works. This way at least you' ll have some point to start at:

c:\ping <host> -l <length of packet> -f

The ' -f' tells PING to not fragment the packet. This will either work or fail. Change the length until it hits the boundary size.

[ibm_ioman]

just to understand correctly, on what interface should I modify the tcp-mss?

[rwpatterson]

VPN interface.

[ibm_ioman]

I modified mtu to 1428 both on port8 and on vpn interface ... no change.

[ibm_ioman]

ping host -l 1400 -f ---> works ping host -l 1401 -f ---> doesn' t work modified mtu on vpn interface, still doesn' t work. I must specify, if I do a VIP to the call recorder (which works on ftp - port 21) and connect through Internet, not VPN, everything works.

[rwpatterson]

Change your MTU value to 1400, remove the tcp-mss value. Let us know how that goes.

[ibm_ioman]

changed mtu value to 1400 on vpn interface and unset tcp-mss - no result