Unable to stream video in proxy mode 51e

[James_G]

I have implemented a new Fortigate 51e in HA pair, OS 5.4.0, with Fortiguard AV / IPS / web content filter, most settings pretty much default. When set in proxy mode any videos from bbc.co.uk website fail to play, switching to flow mode resolves issue. Issue can be replicated after a factory reset and reconfigure. Any ideas?

[AndreaSoliva]

Hi

as long as it is unencrypted stream try to activate bypass streaming content in protocol-options:

            # config firewall profile-protocol-options             # edit [Name of the profile used]             # set streaming-content-bypass enable             # end

If you do not like to bypass any streaming content within protocol-options you can exclude the stuff based on mime which is implemented over the webfilter which means webfilter first and after all other UTM stuff. Mime based is configured in following way:

Use WireShark to analyse the mime header (Content-type) like below example:

       Hypertext Transfer Protocol        HTTP/1.0 200 OK\r\n        Request Version: HTTP/1.0        Response Code: 200        Server: DCLK-AdSvr\r\n        Content-Type: video/x-ms-asf\r\n        X-Google-Inred-Content-Type: video/x-ms-asf\r\n        Content-Length: 410\r\n        Content-Encoding: gzip\r\n               Hypertext Transfer Protocol        HTTP/1.1 200 OK\r\n        Request Version: HTTP/1.1        Response Code: 200        Last-Modified: Mon, 14 Sep 2009 00:40:51 GMT\r\n        Content-Type: video/x-flv\r\n        Content-Length: 200994\r\n        Connection: close\r\n        Content-Disposition: attachment; filename="video.flv"\r\n        Expires: Thu, 29 Oct 2009 09:06:24 GMT\r\n        Cache-Control: public,max-age=3600\r\n        Date: Thu, 29 Oct 2009 08:06:24 GMT\r\n        Server: gvs 1.0\r\n

This means relevant information is:

       Content-Type: video/x-ms-asf\r\n        Content-Type: video/x-flv\r\n

If you like to exclude every video or audio etc. you can define:

audio\\/.*

video\\/.*

this means the "/" has to be based on Regex to be excluded with "\\" this means nothing else as "attention the next sign is a special character which means "/". If you have your Content-Header you define a content-header config on FortiOS:

       # config webfilter content-header        # edit [Use a integer which is used afterwards within webfilter example "1"]        # set comment [Use a description "block video exempt audio"]        # config entries        # edit "video\\/.*"        # set action block        # next        # edit "audio\\/.*"        # set action exempt        # next        # end        # set name [set a name for the  "Content-Header" zB "block-video-exempt-audio"]        # next        # end

If you use exempt within action it will not scanned by antivirus! After defining the content-header you can include this config within a webfilter-profile:

       # config webfilter profile        # edit [Name of the WebFilter Profile]        # config web        # set content-header-list [Use the integer for the content-header config in our example "1"]        # end        # next        # end

Thats it meaning the profile must be match to the relevant Firewall Policy Rule which matchs to the specific traffic etc. The advantage of this config is: If you use the set streaming-content-bypass enable it is only for unencrypted traffic like http. If you use deep-inspection this mime stuff works also in deep-inspection.

hope this helps

have fun

Andrea

[Dianes]

Which proxy do you use ?