Web Filtering Unreachable

[KC_Cheong]

On my Fortigate 50B, under status for Web Filtering it was showing Unreachable. For both IPS and AntiVirus it show the Licensed and Expires dates. Any causes for Web Filtering show as Unreachable? btw the 50B Operation Mode was set as Transparent.

[abelio]

Hello and welcome, many possible causes; first and more obvious: browse menu System->Maintenance->FortiGuard Center -> Web Filtering and AntiSpam Options Is WF enabled there?

[KC_Cheong]

alright found out that if set to use port 8888 it work. The Default port 53 will give Unreachable problem.

[KC_Cheong]

Today I got these Web Filtering & AntiSpam Unreachable again !!! When using the " Test Availability" on either port 8888 or 53, it always show " DNS Error. Please check the DNS setting of the Firewall. I am pretty sure the DNS settings are correct - How come so unstable? btw already using the latest firmware 3.00-b0733(MR7 Patch 2)...

[abelio]

. I am pretty sure the DNS settings are correct - How come so unstable? btw already using the latest firmware 3.00-b0733(MR7 Patch 2)...

Maybe the issue originates in another place. Check carfefully this articles in your network and against your Isp: http://kc.forticare.com/default.asp?id=1742 and http://kc.forticare.com/default.asp?id=1839 regards

[laf]

Post your dns settings: show system dns

[#7]

the solutions is to not use the option override internal DNS from the external interface (for example wan1).

[Austin_M]

Hi , There is an article in KB which suggests to use a higher range of ports to do the fortiguard updates as some ISPS block lower range source ports

[Phuoc_Ngo]

We experience this same issue and the root cause was that we have the IPSec policy with the destination set to ALL. This in turn route all Fortigate traffic to the IPSec tunnel.

[josh]

Phuoc Ngo wrote:
We experience this same issue and the root cause was that we have the IPSec policy with the destination set to ALL. This in turn route all Fortigate traffic to the IPSec tunnel.

I've been experiencing the same issue and can confirm this was the case. Source and destination on the VPN P2 config was set to 0.0.0.0/0. Regardless of setting source-IP on logging, etc. it would tunnel data over the IPSec interface "from the box". I find this odd, but I get it.

Resolution is to not use any source/destination in IPSec P2 config. I'm running FortiOS 5.6.2 on one end and 5.4.1 on the other.