Using webproxy-forward sometimes get errors "Site can't be reached. ERR_CONNECTION_CLOSED"

[owlalex]

Hi, 

I am using Transparent web proxy forwarding topology in dedicated VDOM like here  https://community.fortinet.com/t5/FortiGate/Technical-Tip-Transparent-web-proxy-forwarding/ta-p/1903... 

I use just simple one policy with "webproxy-forward" to external proxy server.

config firewall policy
    edit 1
        set name "Access through  EDU proxy"
        set uuid fa0c4c6a-03b0-51ec-cbe7-600564e233d1
        set srcintf "VicSmart1"
        set dstintf "VicSmart20"
        set action accept
        set srcaddr "all"
        set dstaddr "all"
        set schedule "always"
        set service "HTTPS" "HTTP" "Proxy_port_8080"
        set inspection-mode proxy
        set ssl-ssh-profile "certificate-inspection"
        set webproxy-forward-server "EDU_Proxy"
        set nat enable
    next
end

Works fine but if I open many sites at the same time I get the errors "Site can't be reached" with ERR_CONNECTION_CLOSED sometimes. Just need to refresh and all good, site is open.

Maybe it is because traffic in my case comes in through VDOM interlink (root -> VDOM) and goes out through another VDOM interlink (VDOM -> root) and I have a vdom interlinks performance issue.

Any help would be appreciated.

[bpozdena_FTNT]

Hi owlalex,

It sounds more like the TCP connection was reset. You can start by checking your Fortigate forward event logs and see if there are any obvious deny events. 

The next step should be performing packet captures on the LAN and WAN facing interfaces across all VDOMS and see if it is actually the Fortigate who resets the connection. 

If the connection is indeed reset by the Fortigate and the logs do not indicate an obvious reason, the proxy daemon will likely need to be debugged. You should contact TAC if you are not familiar with the process.

HTH,

Boris

[owlalex]

Thank you, Boris.

You are right I see the action "TCP reset from server"  in the log (Destination server: EDU_Proxy).  Yes, now it's time for packet capture.

[owlalex]

I see sometimes an information  like "625 5.962450 172.20.0.1 210.15.254.246 TCP 76 [TCP Retransmission] [TCP Port numbers reused] 4780 → 8080 [SYN] Seq=0 Win=65535 Len=0 MSS=1460 SACK_PERM=1 TSval=144583175 TSecr=0 WS=4096"

Not sure is it bad or normal.

[bpozdena_FTNT]

This packet itself is not a clear indication of an issue. It just shows the client is trying to open a new TCP session and that the packet capture already contains previous session with the same port numbers. It does not indicate why was the previous session closed.  

The only wild guess I can take is that this could potentially be caused by session clashes, when for instance, you have multiple clients behind SNAT connecting to the same proxy. 

You should also investigate on your EDU_Proxy server to see why exactly are the sessions being reset. 

Since you have multi-vdom setup, transparent proxy and proxy forwarding in place, the debugging can get rather complex. You should really create a TAC support ticket with a detailed network diagram. 

Questions should also be raised on whether such complex setup is actually needed ;-). 

[owlalex]

You arer right, I am loking for a different solution https://community.fortinet.com/t5/Fortinet-Forum/How-to-set-external-web-proxy-as-part-of-SD-WAN/m-p...   as well :)