What might be the cause of the logs below?

[QQ311]

After switching the web server of a web application, the device on which the web application runs does not start.

Modified hosts file on the device to test, and got the logs below on the firewall side.

I am a newbie on network and secutiry, could anyone please tell me what I should investigate on?

What might be the cause of this? We just switched the web server...
Can the cause be on the new web server side?

From my point of view, it seems like that the traffic did not even reach the new server?

So it is higtly likely that the cause is in the configuration on fortigate firewall side?

type="traffic" subtype="forward" level="notice" vd="root" srcip=internalIP_of_the_device srcport=xxxxx srcintf="Internal" srcintfrole="lan" dstip=externalIP_of_the_domain dstport=443 dstintf="port3" dstintfrole="dmz" proto=6 action="close" policytype="policy" service="HTTPS" trandisp="dnat" tranip=internalIP_of_the_externalIP tranport=443
type="traffic" subtype="forward" level="notice" vd="root" srcip=internalIP_of_the_device srcport=xxxxx srcintf="Internal" srcintfrole="lan" dstip=externalIP_of_the_domain dstport=443 dstintf="port3" dstintfrole="dmz" proto=6 action="close" policytype="policy" service="HTTPS" trandisp="dnat" tranip=internalIP_of_the_externalIP tranport=443 utmaction="block" countssl=1
type="traffic" subtype="forward" level="notice" vd="root" srcip=internalIP_of_the_device srcport=xxxxx srcintf="Internal" srcintfrole="lan" dstip=externalIP_of_the_domain dstport=443 dstintf="port3" dstintfrole="dmz" proto=6 action="close" policytype="policy" service="HTTPS" trandisp="dnat" tranip=internalIP_of_the_externalIP tranport=443
type="utm" subtype="ssl" eventtype="ssl-anomaly" level="warning" vd="root" action="blocked" policyid=113 policytype="policy" service="HTTPS" profile="aaaaa-certificate-inspection" srcip=internalIP_of_the_device srcport=xxxxx srccountry="Reserved" dstip=internalIP_of_the_externalIP dstport=443 srcintf="Internal" srcintfrole="lan" dstintf="port3" dstintfrole="dmz" proto=6 eventsubtype="certificate-probe-failed" hostname="aaaaa.bdcgeeer.go.jp"

[ozkanaltas]

Hello @QQ311 ,

Yes, it seems this traffic is blocked by firewall policy 113 because of ssl-inspection. If you use self-sign or a not compatible certificate with the profile on a web server this action is normal. 

You can change the SSL inspection option aaa-Certificate-Inspection to No-Inspection on policy 113. Or you can change the certificate with a valid certificate on the aaa-certificate profile.

https://docs.fortinet.com/document/fortigate/6.2.16/cookbook/55107/protecting-an-ssl-server

[QQ311]

Hi @ozkanaltas ,

Thank you for your answer.

But the stange thing is that we use the same certificate on both the old and new server.

Since the device did not start, we have already switched back to the old server, and everything works well...

The device is kiosk device..

[dbhavsar]

Hi @QQ311 ,

- As per @ozkanaltas traffic is being blocked/dropped because of ssl cert-inspection and cert probe responses are failing that is causing the issue. You can check more on :https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-How-to-allow-HTTPS-port-443-traffic-... 

[QQ311]

deleted