Action Accept: session close | Security Action Blocked

[raminda]

Hi,

Recently we installed fortigate 200F with 7.0.11 OS. We are using one policy to allow Google Workspace access and randomly users need to refresh the browser to send emails. It says "Message could not be send check your network and try again". when incident happen log shows as below and once refresh the browser same user allow to send email without any issue. I'm using web filter & application control

Can anyone suggest a solution.

[distillednetwork]

What does the Result column of the log tell you?

[raminda]

It says : Deny: UTM Blocked

[distillednetwork]

If you have fortianalyzer take a look at the log in there, but my guess is it's a certificate inspection issue.  

If not, you can try to check the SSL logs by searching for the Source and Destination IP addresses in Log & Report > SSL 

[raminda]

Thanks for the reply, I'll check

[kgeorge]

Hello Raminda,

Can you let us know the configuration you have done to allow Google WorkSpace?

Have you tried with firewall Policy without any Security Profiles?

The Action with Accept:session close determines that, there is no seamless communication between Client and Server. Mainly, due to the session being idle and FortiGate will terminate TCP session and result is "session close"

This is mostly not be related to FortiGate issue however, any intermediatory or upstream devices.

It could be due to temporary outage with Google or Unstable internet connectivity.

If you are still facing the issue, just bypass FortiGate and check once from the same device.

Regards,

Klint George

[Christian_89]

The issue you're experiencing with FortiGate and Google Workspace access could be related to the web filter or application control settings. Here are a few troubleshooting steps you can try to resolve the problem:

1. Verify Web Filter Settings: Check your web filter settings to ensure that they are not blocking any necessary components or services used by Google Workspace. Make sure that the appropriate categories and domains are allowed for smooth access.

2. Adjust Application Control Settings: Review your application control settings and ensure that they are not interfering with the functionality of Google Workspace. If necessary, you can create specific application control policies to allow all the required Google Workspace applications and services.

3. Update FortiGate Firmware: Verify if there are any available firmware updates for your FortiGate device. Keeping your firmware up to date can often resolve compatibility issues and improve overall performance.

4. Check Security Profiles: Review your security profiles, such as antivirus and intrusion prevention, to ensure they are not blocking any necessary traffic related to Google Workspace. You may need to adjust the settings or create specific exceptions for Google Workspace-related traffic.

5. Monitor Logs: Continuously monitor the logs on your FortiGate device to identify any specific patterns or events that occur when users encounter the issue. This information can help pinpoint the cause of the problem and guide your troubleshooting efforts.