help - suddenly some clients can't access reguler website

[kssupport]

hi there,

I need help please.

I use FG60F with firmware 7.2.x

I've created firewall policy with webfilter and ssh inspection.

suddenly, some computers can't access certain https website, but the other PC still can access the web without issue.

if the -problem computers- use direct internet (not via fortinet), they can access the website.

where is the issue? anyone has same experience?

thank you

[AEK]

Hi

What the the x in 7.2.x?

Check the workaround mentioned in this fresh post, it is probably the same issue.

https://community.fortinet.com/t5/Support-Forum/Major-lags-with-enabled-web-filter-on-FortiGate-70G-...

[kssupport]

hi thanks for sharing the link. but seems differnt situation.

by the way, the firmware is 7.2.4

[AEK]

7.2.4 is not mature and many Web filter related issues have been fixed after.

Try update to 7.2.12 which is the most stable of the 7.2 version. 

[yderek]

@kssupport  Hi, Thanks for reaching forum 

As AEK mention above, the 7.2.4 isn't the mature version and it's not the lateset version , consider to upgrade to the latesd 7.2.x version after you review the release note of knonw issue 

For the issue you facing now 

-What logs do you see in the forward traffic for the blocked user ? 

-What error does user get from the website when they not able to access ? 

-What ssl inspection profile do you use in the firewall policy 

-Does user using the up to date browser ? 

[kssupport]

hi,

sorry late feedback.

- What logs do you see in the forward traffic for the blocked user ?

do you mean PC? however, there is no log under forward traffic, even though I already enabled log for all activity on related firewall policy

-What error does user get from the website when they not able to access ?

site cannot be reached....ERR Connection close

-What ssl inspection profile do you use in the firewall policy

ss inspection based on default, with modify method to full ssl inspection, and some parameter (as attached)

 

web fliter as captured, and I already added wild url to url filter list.

-Does user using the up to date browser ? yes

[Shyy]

I'd suggest to try and configure your policy and filter as proxy based if it is currently flow based.