Hi,
I am using Transparent web proxy forwarding topology in dedicated VDOM like here https://community.fortinet.com/t5/FortiGate/Technical-Tip-Transparent-web-proxy-forwarding/ta-p/1903...
I use just simple one policy with "webproxy-forward" to external proxy server.
config firewall policy
edit 1
set name "Access through EDU proxy"
set uuid fa0c4c6a-03b0-51ec-cbe7-600564e233d1
set srcintf "VicSmart1"
set dstintf "VicSmart20"
set action accept
set srcaddr "all"
set dstaddr "all"
set schedule "always"
set service "HTTPS" "HTTP" "Proxy_port_8080"
set inspection-mode proxy
set ssl-ssh-profile "certificate-inspection"
set webproxy-forward-server "EDU_Proxy"
set nat enable
next
end
Works fine but if I open many sites at the same time I get the errors "Site can't be reached" with ERR_CONNECTION_CLOSED sometimes. Just need to refresh and all good, site is open.
Maybe it is because traffic in my case comes in through VDOM interlink (root -> VDOM) and goes out through another VDOM interlink (VDOM -> root) and I have a vdom interlinks performance issue.
Any help would be appreciated.
Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
Hi owlalex,
It sounds more like the TCP connection was reset. You can start by checking your Fortigate forward event logs and see if there are any obvious deny events.
The next step should be performing packet captures on the LAN and WAN facing interfaces across all VDOMS and see if it is actually the Fortigate who resets the connection.
If the connection is indeed reset by the Fortigate and the logs do not indicate an obvious reason, the proxy daemon will likely need to be debugged. You should contact TAC if you are not familiar with the process.
HTH,
Boris
Thank you, Boris.
You are right I see the action "TCP reset from server" in the log (Destination server: EDU_Proxy). Yes, now it's time for packet capture.
I see sometimes an information like "625 5.962450 172.20.0.1 210.15.254.246 TCP 76 [TCP Retransmission] [TCP Port numbers reused] 4780 → 8080 [SYN] Seq=0 Win=65535 Len=0 MSS=1460 SACK_PERM=1 TSval=144583175 TSecr=0 WS=4096"
Not sure is it bad or normal.
This packet itself is not a clear indication of an issue. It just shows the client is trying to open a new TCP session and that the packet capture already contains previous session with the same port numbers. It does not indicate why was the previous session closed.
The only wild guess I can take is that this could potentially be caused by session clashes, when for instance, you have multiple clients behind SNAT connecting to the same proxy.
You should also investigate on your EDU_Proxy server to see why exactly are the sessions being reset.
Since you have multi-vdom setup, transparent proxy and proxy forwarding in place, the debugging can get rather complex. You should really create a TAC support ticket with a detailed network diagram.
Questions should also be raised on whether such complex setup is actually needed ;-).
You arer right, I am loking for a different solution https://community.fortinet.com/t5/Fortinet-Forum/How-to-set-external-web-proxy-as-part-of-SD-WAN/m-p... as well :)
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
User | Count |
---|---|
1696 | |
1091 | |
752 | |
446 | |
228 |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.