Some https website can' t be accessed...

[wcbenyip]

Hi, Since last day afternoon, it' s so strange that some staff cannot access to the https website like the e-banking, webmail via https...etc. This case is happened since last afternoon, the one would keep failed to access to the same https website if he found it' s failed since last afternoon, but some other https websites are working properly~ Even the same https website he can' t be accessed to, other staff may able to access.... so it' s not talking about the issues of the https website... I have no idea now... even both of the DNS server and FG are rebooted, the result is the same~ Anyone could help and give some direction? Thanks!!

[billp]

Perhaps a clue in this: http://support.fortinet.com/forum/tm.asp?m=56138&p=1&tmode=1&smode=1 Would be interesting if these are related. Bill

[#3]

My problem disappeared. What about yours?

[wcbenyip]

Well... it' s a different story~ Finally found that the e-banking https websites cannot be accessed due to the old IE version... it works now after upgrade the IE6 to IE7... (maybe the bank increased the security level or changed something in the same time?) However, some other https websites are still need to wait for a long long time... most of them are self-signed cert. (i.e. the yahoo mail https url is OK)... may still need some time to monitor the status~~~ On the other hand, I may need to upgrade the firmware version from v402 b099 to the lastest one... as the apps control for the IM is crashed.... no login could be found anymore and even no control...

[#5]

Nothing to do with the bank changing their settings.... We' ve started to use our 310b for web filtering including ssl inspection and have no end of issues. Sites that were previously accessible via our old proxy no longer work through the FGT using IE6. Go via proxy and all works. Go via FGT and it doesn' t. Like you say though, an upgrade to IE7 seems to fix most sites. What do we do with SSL sites still not working though? Allowing the sites using local ratings doesnt work, adding them as exempt in the URL filter doesnt work. Logs all say allowed/except but still just ' page cannot be displayed' . Nothing in the logs saying anything blocked either. The only workaround i' ve got is to use an fqdn alias for each site and a seperate policy allowing the traffic. Hardly ideal with loads of sites blocked and having to add a policy for every single host that we need to access (which can be many per domain in some cases)

[rwpatterson]

Under ' Advanced' in Internet Options, allow TLS 1.0. Works most of the time. Still a pain to visit every workstation.... Just got off the the phone with my SE. He had me turn of the proxy scanning in application control and that seemed to kick it. My Fortiguard is still active. I' ll have to see what other implications arise...

[wcbenyip]

Oh..... yes! Thanks for your input, rwpatterson ~ It' s really working now once change the setting of the " Proxy - All application" in the Application Control from BLOCK to ALLOW, any SSL urls are now resumed as normal~~~ But anyone knows why the proxy blocking is related to the SSL url ??? Some SSL url is using the http proxy?

[rwpatterson]

I went into the application control log, saw Ultrasurf and Freegate getting through. After I blocked Freegate, the problem came back. :( So it seems to be just Freegate that' s causing it. On the phone now with support. Will keep you updated...

[Daniel_Herbon]

Glad I came across this thead. Within the last 5 days two important banking sites that load via https stopped working for us in our main office where I have a 200A. However those same sites work in our office across the street where I have a 80C. Google works fine for me but oddly enough microsoft.com will not load. I' ve also rebooted everything that could possibly be the problem. I even changed out DNS servers to verify it wasn' t a DNS issue. Routers & Switches have also been rebooted. I' ve disabled the WEB protection profile which made no difference. I guess at this point Im going drop in an old ASA5505 in place of the 200A to verify its the 200A. 200A - v4.0,build0185,091020 (MR1 Patch 1) 80C - v4.0,build0178,090820 (MR1)

[rwpatterson]

OK, clarification... It seems that the IPS definition delivered on the 21st was the issue. I downgraded to 2.666 and the problem has now been gone for 30 minutes straight. Still monitoring, but if you put in a ticket on this, have them reference my ticket 356455.