Solved

Fortigate's blocking iOS traffic

Posted on 2014-01-26
4
2,877 Views
Last Modified: 2014-02-14
Recently I have upgraded two clients to the newest firmware released for Fortigates, 5.0.5.  Both clients heavily utilize iOS in their environments and somewhere along the upgrade path to 5.0.5, iOS traffic seems be down right blocked or they start downloads but the downloads are never successful.  By blocked, the user will attempt to download iOS updates, iBooks, applications, etc and either the download never starts and eventually times out or the download does start but only gets a few Mb in before it stops.  One client has even reported this extends to Mac users attempting to use iTunes.

Besides the firmware upgrade to 5.0.5, nothing about these clients networks have changed.  Each are using different wireless setups, different switching, etc.  One client has a Fortigate 100D and the other 2x300C in an Active-Active HA cluster.

During testing with each client, I have disabled everything down to the web filter.  With the web filter active, the problems exists but with the web filter disabled, users can download successfully.  The traffic and web filter UTM logs show no traffic being blocked.  In testing, the web filter was set to allow all and web filter exceptions were placed for common URL's seen in traffic logs while users browsed to Apple/iOS related applications.

I have attempted to work with Fortinet support on the issue but their solution has been to factory reset each firewall, re-import the config, and follow the firmware upgrade matrix again in case there was corruption in the previous upgrade.  They have no been able to indicate that there actually are any signs of corruption and the 300C client firewalls came out of the box only one build behind the most recent release, so I highly doubt there was corruption upgrading one firmware release.

At this point I am contemplating downgrading the firmware on each firewall until I find the most recent release that this problem does not exist but the point of upgrading in the first place was to fix other bugs in the ipsengine and proxyworker processes that were causing issues.

Thanks for any help.
0
Comment
Question by:vthelp
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 2
  • 2
4 Comments
 
LVL 1

Expert Comment

by:Zabo1
ID: 39810576
do you have a rule that allows iOS devices access to time.apple.com over ntp?
0
 

Author Comment

by:vthelp
ID: 39811086
I can try this in testing tomorrow with one of the clients.  Is this something that is critical to iOS updates and applications in order for them to work?  If it is and the firewalls are blocking this, any clue as to why I might not be seeing that in any of the UTM logs?

I have worked with previous Fortigate firmware releases that caused similar issues like this, blocking certain traffic but showing nothing in the logs and it was a huge time sink tracking down the resolution, just like this one has been.

Thanks again.
0
 
LVL 1

Accepted Solution

by:
Zabo1 earned 500 total points
ID: 39817645
i know that it is critical to iOS to have access to time.apple.com, not sure why it's not showing in your Fortigate firewall logs.  some firewalls you have to specify a deny rule in order for blocked traffic to show in the log.
0
 

Author Closing Comment

by:vthelp
ID: 39859393
Fortigate ended up finding there was a bug in FortiOS 5 patch 5 and after upgrading to patch 6, the issue was resolved.
0

Featured Post

What is SQL Server and how does it work?

The purpose of this paper is to provide you background on SQL Server. It’s your self-study guide for learning fundamentals. It includes both the history of SQL and its technical basics. Concepts and definitions will form the solid foundation of your future DBA expertise.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

How to set-up an On Demand, IPSec, Site to SIte, VPN from a Draytek Vigor Router to a Cyberoam UTM Appliance. A concise guide to the settings required on both devices
When you try to share a printer , you may receive one of the following error messages. Error message when you use the Add Printer Wizard to share a printer: Windows could not share your printer. Operation could not be completed (Error 0x000006…
In this video we outline the Physical Segments view of NetCrunch network monitor. By following this brief how-to video, you will be able to learn how NetCrunch visualizes your network, how granular is the information collected, as well as where to f…
Michael from AdRem Software explains how to view the most utilized and worst performing nodes in your network, by accessing the Top Charts view in NetCrunch network monitor (https://www.adremsoft.com/). Top Charts is a view in which you can set seve…

717 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question