Our sister company website is blocked

[Aymanellamony]

Hi team, 

We are new using fortinet firewall but our company website: Marj3y.com is being blocked without a clear reason. I can't find anything related in the logs?

Also how can I check it against viruses from the firewall console? 

[Markus_M · Accepted solution]

Hey Aymanellamony,

you will first have to find out which exact policy the traffic is going through. If there are no logs, you will have a hard time.

You can however, use the policy lookup feature on GUI (where the policy screen is on the top of it) or on CLI:

exec ping Marj3y.com (to get the FortiGate resolve the IP)

diag debug console timestamp enable

diag debug flow filter addr (IP the site will resolve to from FortiGate)

diag debug flow show iprope enable

diag debug enable

diag debug flow trace start 4 (count of packets)

Then access the site again. It will give you in the first lines a bunch of stuff with a "trace_id". The trace_id is a packet number and the first packet of the traffic will show where it goes by interfaces, routing decisions and the last lines will show which policy is matched. Crosscheck that policy.

For testing you can also disable any inspection on that policy and make it a no-inspection policy. This way you can see there could be an issue with the FortiGate not recognizing the website correctly and a webfilter may block the page.

Best regards,

Markus

[Aymanellamony]

Hi Markus,

Thanks for your help it seems that it is blocked by unexpected policy due to wrong object value which leds to a blocking first for this traffic.