Unable to download files over a certain size

[Eoin_Ryan]

I' m supporting a client to do some maintenance on a long-neglected network. The machines are unable to download Windows updates because of a file size download restriction that' s in place on the Fortigate 80C. Where in the policies/settings do I go to remove/edit this restriction please? I' ve not been able to find it yet. thanks

[Eoin_Ryan]

Ah - I think I' ve found a clue in a previous discussion. http://support.fortinet.com/forum/tm.asp?m=71476&appid=&p=&mpage=1&key=file%2Csize&language=single&tmode=&smode=&s=#71477 I hadn' t found it on my initial search because I didn' t notice the default search period was only the previous month! The person on that thread says You can use DLP, set to http-GET and set the file size to the limit you want. Set it to block. I think I found that setting and tweaked it, without good results. But - dammit, I can' t find how to get back into that setting. I can find http-post, but not get. Could anyone help me to navigate through DLP? It seems like DLP is a global setting that is applied separately and on top of any other policies, is that right? 2nd EDIT - I' ve also found a reference to the AV scanner blocking files above a certain size, 10MB. That is exactly the behaviour we' re seeing. It' s referenced on pg 260 of this - but this cookbook is for a much newer version of FortiOS than is installed on this firewall. http://docs.fortinet.com/cb/fortigate-cookbook.pdf That is for 4.3 and our device is using 4.0 An upgrade is out of the question at the moment, since I' m remotely connected. How can I tell if our file-size block is as a result of the DLP or AV policies?

[Dave_Hall]

Assuming this is strictly Microsoft updates and assuming you trust the security on your DNS servers, you maybe better off creating a firewall policy (and move it near the top of the firewall policy list) that bypasses any UTM features and allow clients to " talk" directly to the Microsoft servers. Under 4.0MR3 the code would like something like....

config firewall address
     edit " update.microsoft.com" 
         set associated-interface " wan1" 
         set type fqdn
         set fqdn " update.microsoft.com" 
     next
     edit " download.windowsupdate.com" 
         set associated-interface " wan1" 
         set type fqdn
         set fqdn " download.windowsupdate.com" 
     next
     edit " windowsupdate.microsoft.com" 
         set associated-interface " wan1" 
         set type fqdn
         set fqdn " windowsupdate.microsoft.com" 
     next
 end
 config firewall addrgrp
     edit " Windows-Updates" 
             set member " download.windowsupdate.com"  " update.microsoft.com"  " windowsupdate.microsoft.com"              
     next
 end
 config firewall policy
     edit 1001
         set srcintf " Internal" 
         set dstintf " wan1" 
         set srcaddr " all" 
         set dstaddr " Windows-Updates" 
         set action accept
         set schedule " always" 
         set service " ANY" 
         set nat enable
     next
 end

[Dave_Hall]

How can I tell if our file-size block is as a result of the DLP or AV policies?

DLP refers to scanning of information, usually from internal -> going out. AV polices is scanning in either direction. I am more incline to think your problem is the scan buffer size on incoming http (or HTTPS) traffic. Under 4.0MR3 (guessing it should be similar under 4.0), the fgt' s scan buffer size is configurable under the " config firewall profile-protocol-options" section. The default size is set at 10 mb, per protocol. Each protocol section has a set of options you can define, including blocking or allowing files that go over the size limit. (See the FortiOS CLI reference for your version.) Using the GUI is much prettier/easier tlo use than mucking around in the CLI...

[Dave_Hall]

Under 4.0MR3 (guessing it should be similar under 4.0), the fgt' s scan buffer size is configurable under the " config firewall profile-protocol-options" section. The default size is set at 10 mb, per protocol. Each protocol section has a set of options you can define, including blocking or allowing files that go over the size limit. (See the FortiOS CLI reference for your version.)

It should be noted that you can create/customized different Protocol Options and tailor them to specific traffic. If your company has a policy about blocking over sized files (that are not virus scanned) you can always create a new Protocol Options for Microsoft related traffic that allows over-sized files through, assuming the company would rather have UTM enabled on that traffic as well.

[Eoin_Ryan]

Thanks very much, that helped a lot. I was able to find the setting. If anyone else is looking (unlikely!) for the same setting in this old FortiOS, it is in Firewall | Protection Policies | Edit Policy and then expand AntiVirus. I' m not going to attempt the CLI in this case, just tweak the download size, since I' m less likely to break something! Similarily, the client is happy that the servers have the download size restriction removed and we don' t need to restrict it just to microsoft files. By the way, would we have to be in support (we' re out) to upgrade the firmware on the fgt or are they available to download? Any strong reasons to update, or not?

[Dave_Hall]

By the way, would we have to be in support (we' re out) to upgrade the firmware on the fgt or are they available to download? Any strong reasons to update, or not?

You need a valid Fortinet support login ID/password to access the firmware download section. Whether you need a valid product/subscription is a good question. Personally, I love working with and configuring firmware 4.0 MR3, followed closely by 4.0 MR2 and would personally recommend upgrading to either firmware paths (depending on what feature set you need). It' s important to note when upgrading the firmware on the Fortigate is to follow the upgrade path outlined in the firmware notes. If upgrading from 4.0 you will likely need to go through several firmware upgrades to get to the firmware/patch level you want (assuming you want to keep the current config/firewall rules). Personally, if I was dealing with more than 4 firmware upgrades, I might just consider blowing away (e.g. format the boot device) and tftp a new firmware image on it, then rebuild the config from scratch or use WinMerge.