no HTTPS site access

[ArcticWolf]

I have an FG300A and I have just configured our internal traffic to go to our head office through this firewall and the traffic goes through their internet gateway to the internet. beofre i configured the traffic through the FG300A https site access worked however now that i have it going through the FG300A i cannot access secure sites I have turned off web filtering to see if that would help and it still restricts access to these sites is there a default setting somewhere i am missing? the fortiOS is 2.8 mr11

[RickP]

The first thing that springs to my mind is the ' service' setting for the policy controlling this traffic. If it' s set to HTTP, the policy will allow *only* HTTP traffic and block all else. Change it to ' all' and see if it works. If it does, you can create a service group with only HTTP and HTTPS and use that if you want to restrict access to just those two...

[ArcticWolf]

Right now i have it set to all always any accept going from port1 to port5 and the same coming from port5 to port1

[ArcticWolf]

I have gotten it working, the problem was when we had a contractor install the firewall in the first place and implement it just for VPN he changed the MTU size on the internal facing port from the default of 1500 to 1440 for some reason. therefore all large packets were being dropped. We changed the MTU size back to the default of 1500 and the HTTPS as well as issues we had with logging into antoher domain through a citrix server, and FTP downloads due to exceeding size limit were fixed. the last two issues hadnt showed up until staff tried using them today. but all is working now.

[flynnp]

Hi Some additional info for you Problem: Certain web sites are not viewable. The Fortigate is configured to use PPPoE to connect to the ISP. Solution: Use the " tcp-mss" interface option. Topology: HTTP Client----(internal)FGT(pppoe)----dsl----ISP----Internet----Web Server ----Ethernet MTU 1500----PPPoE MTU 1492………..Ethernet MTU 1500 The reason for this is that a PPPoE frame takes an extra 8 bytes off the standard Ethernet MTU of 1500. When the server sends the large packet with DF bit set to 1, the ADSL provider' s router either does not send an ' ICMP fragmentation needed' packet or the packet gets dropped along the path to the web server. In either case, the web server never knows a fragmentation is required to reach the client. After you configure ' set tcp-mss' on the FortiGate unit' s internal interface, this command will change the incoming packets and send the packets with a new TCP MSS value out the downstream interface. By default the MSS is MTU minus 40 byes (TCP and IP headers). When the HTTP client initiates a TCP connection, the following example changes the MSS value from 1460 to 1452 when leaving the PPPoE interface and eventually reaches the web server. The web server will also choose the smaller MSS and therefore no fragmentation is needed. The client can now view web pageproperly. config system interface edit " internal" set ip 192.168.1.99 255.255.255.0 set tcp-mss 1492 next Regards Paul