linux servers and YUM update behind fg60

[#1]

we have many linux servers behind fortigates. none of them can get yum updates. we keep getting header incomplete errors as follows: (everything else on netowrks works g reat) [root@smeserver7 ~]# yum update ============================================================== WARNING: Additional commands may be required after running yum ============================================================== Loading " smeserver" plugin Loading " protect-packages" plugin Loading " installonlyn" plugin Loading " fastestmirror" plugin Setting up Update Process Setting up repositories smeextras 100% |=========================| 1.9 kB 00:00 updates 100% |=========================| 951 B 00:00 smeos 100% |=========================| 1.9 kB 00:00 smeupdates 100% |=========================| 1.9 kB 00:00 Loading mirror speeds from cached hostfile Reading repository metadata in from local files Excluding Packages from CentOS - updates Finished Resolving Dependencies --> Populating transaction set with selected packages. Please wait. ---> Downloading header for php-mysql to pack into transaction set. php-mysql-4.3.9-3.22.15.i 100% |=========================| 37 kB 00:00 http://sme-mirror.voxteneo.com/releases/7/smeupdates/i386/RPMS/php-mysql-4.3.9-3.22.15.i386.rpm: [Errno -1] Header is not complete. Trying other mirror. php-mysql-4.3.9-3.22.15.i 100% |=========================| 37 kB 00:00 http://distro.ibiblio.org/pub/linux/distributions/smeserver/releases/7/smeupdates/i386/RPMS/php-mysql-4.3.9-3.22.15.i386.rpm: [Errno -1] Header is not complete. Trying other mirror. php-mysql-4.3.9-3.22.15.i 100% |=========================| 37 kB 00:00 http://ftp.surfnet.nl/ftp/pub/os/Linux/distr/smeserver/releases/7/smeupdates/i386/RPMS/php-mysql-4.3.9-3.22.15.i386.rpm: [Errno -1] Header is not complete. Trying other mirror. php-mysql-4.3.9-3.22.15.i 100% |=========================| 37 kB 00:00 http://ftp.nluug.nl/os/Linux/distr/smeserver/releases/7/smeupdates/i386/RPMS/php-mysql-4.3.9-3.22.15.i386.rpm: [Errno -1] Header is not complete. Trying other mirror. php-mysql-4.3.9-3.22.15.i 100% |=========================| 37 kB 00:00 http://mirror.pacific.net.au/linux/smeserver/releases/7/smeupdates/i386/RPMS/php-mysql-4.3.9-3.22.15.i386.rpm: [Errno -1] Header is not complete. Trying other mirror. php-mysql-4.3.9-3.22.15.i 100% |=========================| 37 kB 00:00 http://smemirror.fullnet.co.uk/releases/7/smeupdates/i386/RPMS/php-mysql-4.3.9-3.22.15.i386.rpm: [Errno -1] Header is not complete. Trying other mirror. Error: failure: RPMS/php-mysql-4.3.9-3.22.15.i386.rpm from smeupdates: [Errno 256] No more mirrors to try.

[lmuir]

Logs on the FGT?

[#3]

what log, what am I looking for?

[#4]

log in to your fortigates web interface and go to -> Log & Report -> Log Access -> Memory. Or connect to the CLI and type: execute log filter <filter> execute log display Can you reach the update servers from your linux server(ping, trace)?

[abelio]

we have many linux servers behind fortigates. none of them can get yum updates.

There were some mention several months ago about this issue with CentOS linux (not all linuxes); you can do some googling and you' ll find that it' s not a fortinet only episode, it happened with some other vendor. I use fedora with yum updates, my box is behind fortigate running 4.0, with no issues. I' ve tested with and without AV for HTTP; You can test if the issue arises with centOS yum behind a FGT using AV HTTP in the protection profile for that traffic. Also test with this: (mirrors.kernel.org is a yum updates host) echo -e " TRACE / HTTP/1.1\nHost: mirrors.kernel.org\n\n" | nc mirrors.kernel.org 80 I' ll try with/without HTTP AV profile and if you cannot determine the cause, i' ll recommend updating linux servers with apt-get (this issue seems to be only yum related) good luck

[#6]

In our office we have a fg60, all servers we build here YUM works. Take to client location, behind fg60b, yum fails. At client location have disabled PP same result. when I run that command, no output: [root@aplussme ~]# echo -e " TRACE / HTTP/1.1\nHost: mirrors.kernel.org\n\n" | nc mirrors.kernel.org 80 [root@aplussme ~]#