- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Websites blocking on Android
Hello, I am having a problem with Fortigate.
It seems like some websites are being blocked only on Android, when I use a laptop or Ios everything is working fine. When I try to see the logs I can't see that a website is being blocked.
I would apprentice any help.
- Labels:
-
FortiGate
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Do you have AppControl active on your internet policies? Then the App Signatures may cause that...
--
"It is a mistake to think you can solve any major problems just with potatoes." - Douglas Adams
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thanks for the reply. Yes AppControl is active. By going on Chrome settings and changing the Use Secure DNS to Google (Public DNS) instead of current service DNS the websites that were being blocked are working.
Is it possible to fix this issue from Fortigate please? Instead of having to change the Secure DNS from Chrome. Thank you.
Created on 05-09-2023 05:44 AM Edited on 05-09-2023 05:44 AM
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
On Fortigate by switching off TLS and switching on DNS from DNS settings solved the issue. I am not sure if this will effect other things.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hello,
Can you please elaborate what you are referring to by switch off TLS on FortiGate side?
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hello, I used the setting below. Before only TLS was switched on.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi,
Please help us with DNS packet captures to see what is happening when you use TLS protocol for DNS service.
# diag sniffer packet any "(host <Android user IP address> or host <public IP address on the FGT) and port 853" 6 0 a ---------------ctrl+c to stop the pcap
Fortigate
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
As you informed after switching on DNS (UDP/53) from DNS settings you are able to access the website.
DNS primarily uses the UDP protocol on port 53 to serve the address resolve requests.
The FortiGate DNS Filter inspects the UDP protocol on port 53 traffic that traverse FortiGate, and based on the DNS Filter profile configuration, makes the Allow/Monitor/Block or Redirect decision for the inspected traffic.
DNS over TLS (DoT) is a security protocol for encrypting and encapsulating DNS queries and responses over the TLS protocol. DoT increases user privacy and security by preventing eavesdropping and manipulation of DNS data via man-in-the-middle attacks.
Before enabling DoT or DoH, ensure that they are supported by the DNS servers. The legacy FortiGuard DNS servers (208.91.112.53 and 208.91.112.52) do not support DoT or DoH queries, and will drop these packets. Disabling DoT and DoH is recommended when they are not supported by the DNS servers.
Please refer to the below documents for more understanding:
https://community.fortinet.com/t5/FortiGate/Technical-Tip-Changing-nbsp-the-nbsp-DNS-nbsp-protocol-n...
https://docs.fortinet.com/document/fortigate/7.4.0/administration-guide/42181/dns-over-tls-and-https....