Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
yeowkm99
Contributor

Internet traffic blocked by policy violation

Our internet users encounter issue whereby Internet services like office 365, access to google etc is blocked suddenly by policy violation.

the way to bypass it is to launch browser using administrator rights 

10 REPLIES 10
network360_2021
New Contributor

enable Implicit policy logging and check the reason , did you using ISDB based policy .

if you are using ISDB then some time office365 ip missing .

first you have to check your DNS server is resolving IP for the office365 and we have to check office365 ip address in ISDB for steps please check below kb

https://kb.fortinet.com/kb/documentLink.do?externalID=FD47288

 

 

yeowkm99

Debbie_FTNT
Staff
Staff

Hey yeowkm99,

 

the page you linked is just an explanation that traffic logged as deny may show with the referenced threat ID.
This does NOT explain why traffic is blocked in the first place, which is what I think you're after?

Do you have any kind of authentication setup on your FortiGate?
Given that you mentioned running the browser as admin is a functioning workaround, that sounds to me a little like there might be something going on with authentication.
In particular, running the browser as admin could trigger a login event (that might be picked up through FSSO), or would cause NTLM/Kerberos to detect the admin user.

If the FortiGate for some reason lost the regular user authentication information (timeout maybe?) that could cause traffic to no  longer match (being denied for policy violation instead), and running the browser as admin, treated as a new login, could cause the traffic to match again.
I would suggest you have a look at traffic logs for the affected source IP before and after running the browser as admin, and check what differences there are - for the allowed traffic, does a username show in the logs, for example?
You might want to enable logging all sessions in the policy, to ensure that allowed traffic is captured properly.

Cheers!

+++ Divide by Cucumber Error. Please Reinstall Universe and Reboot +++
yeowkm99

encountered the same issue after i come to office in the morning.

seems like there is a need for AD authentication. 

Cannot show the logs as i don't have permission to upload images.

network360_2021

please check the authentication of the computer - ip address .

goto FSSO collector --> Show logon Users ---> and search for the IP address before entering Admin user . here you  can see FSSO detail for this endpoint/laptop. same step repeat after enter Admin user name and password and check the FSSO detail .

here we can pinpoint issue is related SSO .

if you don't have access to collector agent server we can verify from the Fortigate

goto cli --> diagnose debug authd fsso filter source x.x.x.x (ip address)

diagnose debug authd fsso list

or you can check in the GUI for the users

 

 

yeowkm99

how do i check in the GUI for the users ?

network360_2021

if you are using FortiOS version 5

User&Device -->Monitor--->Firewall ---> select [Show all FSSO Logons]

version 6

Monitor ---> FireWall User Monitor -->Show all FSSO Logons

 

Version7

Status --> Add widget for the users

 

Thanks,

Network360

https://www.youtube.com/channel/UCSQUIhnEgz2-6JP_ykhIMUw

 

 

 

Debbie_FTNT

@network360_2021

In version 7, under Dashboard there are multiple options (Status, Security, Network etc.); one of them is called Users&Devices. This contains multiple user widgets in one location :).

+++ Divide by Cucumber Error. Please Reinstall Universe and Reboot +++
network360_2021

Dashboard--->User&Device ---->Add Widget --> ADD Firewall Users-->select FSSO logon-->Add Widget

 

Thanks,

Network360

https://www.youtube.com/channel/UCSQUIhnEgz2-6JP_ykhIMUw

 

Labels
Top Kudoed Authors