website access problems

[unknown1020]

friends a question:

I have problems accessing a page, specifically a video that is within the page. Since it is displayed as not available.

Reviewing the logs, I do not observe any blockages from the firewall.

I performed the following validations:

*I generated a new policy, in which no security profile was enabled. Additionally, the no inspection profile was enabled.

*For the new policy, all ports were enabled. Furthermore, it is located above everyone.

However, when you directly access the internet router, you do have access to the page.

Do you know what could be happening?

[rvillaroman]

Hi @unknown1020,

To check if something is being blocked or denied, kindly try to run har file check.

https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-How-to-collect-HAR-file/ta-p/191358

There is a possibility that the video where you are being redirected is not loading due to an additional delay in the inspection. Also, kindly make sure that you are hitting the new firewall policy for this validation.

Furthermore, you may also play around with the TCP mss of your policy, as it might be caused by an MTU mismatch.

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Setting-TCP-MSS-value/ta-p/194518

Regards,

[unknown1020]

Hello, thanks for answering but I have some questions:

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Setting-TCP-MSS-value/ta-p/194518

In this case, there are several computers that cannot access the page. They are all Windows, so should I run the following command in Windows CMD?

For the MS Windows operating system client, enter:

ping -f -l 1472 <server ip>

Where "Server IP" is the IP of the user's computer, correct?

When running that command, what should I get? any value?

Regarding the HAR file, as I mentioned in the post, the policy does not have any security profiles enabled, all ports are open and it has no inspection. Could the firewall still be blocking some URL?
Or in the HAR file that should be obtained?

[rvillaroman]

Hi @unknown1020,

Where "Server IP" is the IP of the user's computer, correct?

When running that command, what should I get? any value?

- Correct, IP of the server you are trying to reach.

- ping -f -l 1472  - you may start at 1472 and check if you can ping, if not try to adjust is by deducting 8 on the value.

Regarding on the harfile,Could the firewall still be blocking some URL?

- We still can check the possible cause, chances that it is unable to access due to added delay.

- You may compare the harfile on working(directly connected on the ISP router) and on the not working(connected on the firewall)

From there we may get the possible reason why it is not accessible.

Regards,

[unknown1020]

thanks for answering.

From the value that would be obtained, that value (mss value) would be added to the command: would it be the same for sender and receiver?

configure firewall policy
edit <policy ID>
set tcp-mss-sender <mss value>
set tcp-mss-receiver <mss value>

Regarding the HAR file, I already performed the test by connecting a laptop directly to the ISP router and the page was accessed, which confirms that it is a fortigate problem

[rvillaroman]

Hi @unknown1020,

That is correct, you may initially try to set the value to 1400 and check if the issue persists.

Regards,

[unknown1020]

Thanks, a question, would you subtract 28 from that value of 1400? In which cases should I add + 28 or subtract - 40? since I am confused about the KB.

[rvillaroman]

Hi @unknown1020 ,

If the video became accessible by setting the tcp mss value to 1400, you may add 40 for the TCP (20) and IP (20) header. On the guide it started on 1500 which you can deduct 48, TCP header (20) + IP header (20) + ICMP packet (8). 

[Muhammad_Haiqal]

Hi @unknown1020 ,

Good day to you.
Here is the troubleshooting that may help:

1. Create a new policy on top. No security profile. Source : All, Destination: All

2. Connect PC direct to the Fortigate. No AP or switch in between.

3. Disable endpoint control on the PC. Example: Sophos, Symantec, etc

4. Disable VPN, Proxy on the PC.

5. Try with another PC if the issue affecting specific PC or ALL PC.

From the result, we can proceed further to check on the issue.