Strange issue // Email services slow

[barakathalia]

Dear All,   I am writing this post from Saudi Arabia. I badly need all your help and advise on this issue which we are experiencing for a long time.   We are using Fortigate 200D Firewall in one of our office. Fortigate 200D Firewall is linked with our corporate Forti Manager device which is located in France. We have configured SITE to SITE VPN to access our corporate services like Intranet, OCS, HelpDesk, and etc.   We are facing slow email connectivity issue on every Sunday morning. Those who are connected through Fortigate  200D Firewall, they are not able to send and receive any emails on SUNDAY ONLY. Everything is normal on other week days. During the time of incident, Internet is working perfectly. I can access all other websites without any trouble. There is no schedule services running on that time.   Before we suspect that there might be an issue with VPN traffic to access the local file server. Last week, we have disabled the VPN rule to access the file and check. We faced the same problem again so now it is confirmed that there is no problem with VPN traffic. We have installed the latest firmware too. But, this issue keeps reoccuring again and again on every Sunday morning.   To be honest, I am almost helpless. My corporate team has tried their best to resolve this but no luck. I am here now to seek help from the experts.   Please help me on this and advice me the necessary workaround to identify this issue.   Thanks in advance   Best Regards, Barakath

[mahesh_secure]

Hi Where the mail server is Hosted.? Did you try ping mail server ip / host name on Sunday ? Any delay or latency? Issue on only morning session or full day? Regards Mahesh

[barakathalia]

Dear Mahesh,

It is hosted in France. Yes, I can ping the mail server IP and host name too. There is no delay.

It took minimum 3 hours to come back to normal stage. Sometimes it took a whole day.

During the time, there is no huge CPU and memory utilization in the Fortigate Firewall.

Regards,

Barakath

[mahesh_secure]

Hi Barakath Maybe some task running on mail server on particular time. Did you check with exchange admin? Any other branch having the same issue? What about the web mail access? Or only having issue in outlook / mail agent ? Regards Mahesh

[barakathalia]

Dear Mahesh,

Thanks again for your headsup

Oh Yes! My exchange admin also working on this issue. Like I said before, there is no scheduled tasks running on that time. We have more than 100 offices in all around the world. Out of everything, we are experiencing this stange issue in one particular office only. Webmail access is also down if we connected in the same network. But, If you connect to different network, everything will work perfectly.

I suspect there must be a glitch on the Firewall which is stopping the traffic on Sunday morning.

Regards,

Barakath

[mahesh_secure]

Hi Login with putty and collect the below output Diagnose debug disable Diagnose debug reset Diagnose debug flow filter clear Diagnose debug flow filter saddr ( mail accessing system ip address) Diagnose debug flow filter daddr (mail server ip address) Diagnose debug flow show function-name enable Diagnose debug flow show console enable Diagnose debug flow show timestamp enable Diagnose debug flow trace start 1000 Diagnos debug enable Collect the log when you experience the issue. Check any drop is there in log. Check the below link for more details http://kb.fortinet.com/kb....do?externalID=FD33882 Regards Mahesh

[barakathalia]

Sorry for the delayed response Mr. Mahesh   There is no drop in the results. Do you think there may be an issue with server which we have configured DHCP ?   I am planning to stop the connectivity between Firewall and server. Configure DHCP in the firewall itself and see the issue.   Regards, Barakath

[sw2090]

Barakath,

you could put yourself some traffic graph widgets for your vpn interface and wan interfac(s) onto the Dashboard of your FGT. This is the most easy way to quickly see what is up on the lines. Maybe there something running on sundays there which produces a load of internet traffic. When you wans are rather stuffed up this will also slow down the vpn conncetion (and vice versa)...

maybe you find it this way

[barakathalia]

There is one particular thing has been observed on this morning. This is all happening when someone sending an email with huge attachment(12MB) to all users in the same issue. The strange thing is that all our JV users are received this email but my company users didn't receive the same.

Our Outlook client says it is downloading but nothing happened. At the same time, we have received the same email on Webmail.

I need someone's advise on this matter. Its killing me everyday. Please, drop your contact number or email me at mail2barakath[at]gmail.com

Thanks a lot