Problem with SSl deep-Inspection and Websites

[Chris]

Hi, at first a happy new year to all. I have a Problem when i enable ssl deep-Inspection and surfing through the Web. I noticed that some sites loading only if i reload the site twice. Sometimes but not often I get a "ssl_error_bad_mac_read" error in Firefox. It also went gone when I reload the site. It is relative often reproducible when I am surfing through the fortinet forum. I am using the build in fortinet proxy certificate which CA is certainly imported in the browser under trusted ca authorities I have checked this with some other browsers and on other machines to rule out that it is a browser/machine problem only. The goal why i have enabled deep inspection is to use antivirus in https. Allow Invalid SSL Certificates and Log Invalid Certificates are both enabled but I get no errors. Like I said it is not on all sites but when I noticed that and loading process was too long then I reload the site and now it comes up. Then I figured out when deep-inspection is turned off then all runs well. How can I check what happens. Sniffing the traffic gave no usefull hints until now. I see sometimes only the req but no ack. Any hints for cli commands that can help to encircle the problem more precisely? My device is a FGT 60D with V5.2.5 Any help is appreciated.

[Willem_Bargeman · Accepted solution]

We have the same issue. Working with support on this case.

[Willem_Bargeman · Accepted solution]

Hi,

I've a update from Fortinet support.

Info from support:

There is an issue id 0372309 which have the same symptoms as you described. This has been already fixed in latest IPS engine version (v3.00284)

Apart from this, the workaround to the issue is to switch one of the UTM features to proxy mode (all UTM features on the policy will then internally use proxy daemons instead of ipsengine). 

So there are two options:

[ul]

update the IPS engine to version 3.00284 (request support for the package)

Change the UTM features to proxy mode[/ul]

I've installed the new IPS engine. Looks good so far. We will monitor the behavior the next few days.

[x_member]

Willem Bargeman wrote:

Hi,

I've a update from Fortinet support.

Info from support:

There is an issue id 0372309 which have the same symptoms as you described. This has been already fixed in latest IPS engine version (v3.00284)

Apart from this, the workaround to the issue is to switch one of the UTM features to proxy mode (all UTM features on the policy will then internally use proxy daemons instead of ipsengine). 

So there are two options:

[ul]

update the IPS engine to version 3.00284 (request support for the package)

Change the UTM features to proxy mode[/ul]

I've installed the new IPS engine. Looks good so far. We will monitor the behavior the next few days.

Thanks Willem.

We're on FortiOS 5.2.7 running ipsengine 03.167 (according to the crash log) so assuming the leading zeros are not shown in the crashlog I guess I need to phone support.