Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
QQ311
New Contributor II

What might be the cause of the logs below?

After switching the web server of a web application, the device on which the web application runs does not start.

Modified hosts file on the device to test, and got the logs below on the firewall side.

I am a newbie on network and secutiry, could anyone please tell me what I should investigate on?

What might be the cause of this? We just switched the web server...
Can the cause be on the new web server side?

From my point of view, it seems like that the traffic did not even reach the new server?

So it is higtly likely that the cause is in the configuration on fortigate firewall side?

 

type="traffic" subtype="forward" level="notice" vd="root" srcip=internalIP_of_the_device srcport=xxxxx srcintf="Internal" srcintfrole="lan" dstip=externalIP_of_the_domain dstport=443 dstintf="port3" dstintfrole="dmz" proto=6 action="close" policytype="policy" service="HTTPS" trandisp="dnat" tranip=internalIP_of_the_externalIP tranport=443
type="traffic" subtype="forward" level="notice" vd="root" srcip=internalIP_of_the_device srcport=xxxxx srcintf="Internal" srcintfrole="lan" dstip=externalIP_of_the_domain dstport=443 dstintf="port3" dstintfrole="dmz" proto=6 action="close" policytype="policy" service="HTTPS" trandisp="dnat" tranip=internalIP_of_the_externalIP tranport=443 utmaction="block" countssl=1
type="traffic" subtype="forward" level="notice" vd="root" srcip=internalIP_of_the_device srcport=xxxxx srcintf="Internal" srcintfrole="lan" dstip=externalIP_of_the_domain dstport=443 dstintf="port3" dstintfrole="dmz" proto=6 action="close" policytype="policy" service="HTTPS" trandisp="dnat" tranip=internalIP_of_the_externalIP tranport=443
type="utm" subtype="ssl" eventtype="ssl-anomaly" level="warning" vd="root" action="blocked" policyid=113 policytype="policy" service="HTTPS" profile="aaaaa-certificate-inspection" srcip=internalIP_of_the_device srcport=xxxxx srccountry="Reserved" dstip=internalIP_of_the_externalIP dstport=443 srcintf="Internal" srcintfrole="lan" dstintf="port3" dstintfrole="dmz" proto=6 eventsubtype="certificate-probe-failed" hostname="aaaaa.bdcgeeer.go.jp"

4 REPLIES 4
ozkanaltas
Valued Contributor III

Hello @QQ311 ,

 

Yes, it seems this traffic is blocked by firewall policy 113 because of ssl-inspection. If you use self-sign or a not compatible certificate with the profile on a web server this action is normal. 

 

You can change the SSL inspection option aaa-Certificate-Inspection to No-Inspection on policy 113. Or you can change the certificate with a valid certificate on the aaa-certificate profile.

 

https://docs.fortinet.com/document/fortigate/6.2.16/cookbook/55107/protecting-an-ssl-server

If you have found a solution, please like and accept it to make it easily accessible to others.
NSE 4-5-6-7 OT Sec - ENT FW
If you have found a solution, please like and accept it to make it easily accessible to others.NSE 4-5-6-7 OT Sec - ENT FW
QQ311
New Contributor II

Hi @ozkanaltas ,

Thank you for your answer.

But the stange thing is that we use the same certificate on both the old and new server.

Since the device did not start, we have already switched back to the old server, and everything works well...

The device is kiosk device..

 

dbhavsar
Staff
Staff

Hi @QQ311 ,

 

- As per @ozkanaltas traffic is being blocked/dropped because of ssl cert-inspection and cert probe responses are failing that is causing the issue. You can check more on :https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-How-to-allow-HTTPS-port-443-traffic-... 

DNB
QQ311
New Contributor II

deleted

Announcements

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Labels
Top Kudoed Authors