Helpful ReplyHot!Application control is blocking Whatsapp

Author
avarela
New Member
  • Total Posts : 1
  • Scores: 0
  • Reward points: 0
  • Joined: 2018/02/03 09:06:47
  • Status: offline
2018/02/03 09:32:34 (permalink)
0

Application control is blocking Whatsapp

I have problems with a policy where I include an application control where I block access to facebook, youtube and others, one of the applications that I allow within the control is whatsapp but it has presented problems since yesterday, the attached files are not They send and the messages are sent several minutes later, the same as when receiving.
I have been doing tests and by allowing the known applications the whatsapp starts working correctly, someone could help me know what the problem is if everything was working well until yesterday that I present this inconvenient.
 
My device is a Fortigate 90D
The only categories that I have blocked in the control of applications are: Botnet, Game, P2P, Social.Media, Update, Video/Audio and Unknown applications (now in monitor mode for whatsapp work)
The other categories are in monitor mode
#1
rajivk
New Member
  • Total Posts : 1
  • Scores: 0
  • Reward points: 0
  • Joined: 2018/02/04 07:44:31
  • Status: offline
Re: Application control is blocking Whatsapp 2018/02/04 07:59:44 (permalink)
0
i am having the same issue with a policy where I include an application control where one of the applications that I allow  is whatsapp but it has presented problems since yesterday, the attached files are not sent and the messages are sent several minutes later, the same as when receiving.
I have been doing tests and by allowing the unknown applications the whatsapp starts working correctly, someone could help me know what the problem is if everything was working well until yesterday.
 
My device is a Fortigate 400D
 
As of Now the Unknown applications is Monitor Mode for Whatsapp to work, which i believe is not the correct way to have in the system
#2
Discus
New Member
  • Total Posts : 6
  • Scores: 0
  • Reward points: 0
  • Joined: 2015/05/19 23:54:38
  • Status: offline
Re: Application control is bloking Whatsapp 2018/02/05 07:09:30 (permalink)
0
I'm seeing similar problems. 
 
WhatsApp traffic that is not correctly assigned to WhatsApp can be categorised as: 
  • unknown tcp/5222
  • unknown "Facebook-Web" - typically https traffic to IPs that have PTR records ending in ip4.static.sl-reverse.com, typically 169.x.x.x
  • Bittorrent. 
Obviously, allowing unknown things is a bad idea... 
 
Sadly, my 500E is also preventing me adding custom app signatures :/ 
 
This all manifests as WhatsApp being "broken" or "slow" depending on the user that's trying it. Mine is "slow" - crazily so. 
 
We're not doing full SSL inspection, only certificate inspection.
We're in proxy, not flow mode.
FortiOS 5.6.3
Maybe that's a factor?
 
It certainly *was* working before last weekend, so either WhatsApp changed something, or Fortigate did (or both!). 
post edited by Discus - 2018/02/08 01:14:08
#3
Shaun
New Member
  • Total Posts : 2
  • Scores: 0
  • Reward points: 0
  • Joined: 2017/11/13 02:32:01
  • Status: offline
Re: Application control is bloking Whatsapp 2018/02/08 00:17:50 (permalink)
0
Hi all,
 
Has anyone had any feedback from Fortinet regarding this issue?
 
I've logged a case with them to investigate as we picking up the same issue as Discuss stated above. Destination ranges from e6.whatsapp.net all the way up to e14.whatsapp.net, which is classified as a 'Facebook-Web' application within the 'Unknown' application category. 
#4
Discus
New Member
  • Total Posts : 6
  • Scores: 0
  • Reward points: 0
  • Joined: 2015/05/19 23:54:38
  • Status: offline
Re: Application control is bloking Whatsapp 2018/02/08 01:07:20 (permalink)
0
@Shaun - I also have an open case, and nothing yet beyond "we're looking into it"... :/ 

If *I* considered it enterprise traffic, I'd be fuming now, but it's something that people have adopted themselves (users may consider it critical...). Our official comms channels don't include it - but customers have become used to using it to contact our staff - and our staff have embraced it, despite all the goodies in GSuite etc. :/
 
However, it's been nearly a week now, so I expect some management push-back to come our way soon... :/ 
post edited by Discus - 2018/02/08 01:09:00
#5
Discus
New Member
  • Total Posts : 6
  • Scores: 0
  • Reward points: 0
  • Joined: 2015/05/19 23:54:38
  • Status: offline
Re: Application control is bloking Whatsapp 2018/02/09 01:21:44 (permalink)
0
I suspect some newer definitions have been pushed - it seems to be working a little better today. Will keep an eye on it. 
No feedback in my open ticket though. :/ 
#6
Shaun
New Member
  • Total Posts : 2
  • Scores: 0
  • Reward points: 0
  • Joined: 2017/11/13 02:32:01
  • Status: offline
Re: Application control is blocking Whatsapp 2018/02/09 01:33:24 (permalink) ☄ Helpfulby Discus 2018/02/09 02:51:37
0
Hi Discus,
 
I received the below feedback earlier today on my ticket I logged with Fortinet;
 
We have released improved WhatsApp signature in IPS definition version 12.315, please update the IPS definition to latest version and test again.
If the traffic about WhatsApp still detected as Facebook-Web in Forward Traffic log , please provide us a full packet capture which include the traffic, thanks.
 
I upgraded our IPS definition package to the latest version (12.315) and customer has confirmed it is working again with no issues. I've checked the logs, and the destinations where we were getting blocked (e6.whatsapp.net, e14.whatsapp.net, etc) which was classified as 'Facebook-Web' application traffic in the 'Unknown Applications' category, is now being seen as 'WhatsApp' application traffic within the 'Collaboration' category, which is correct.
 
Will continue to monitor and will revert if we pick up any issues.
 
#7
Discus
New Member
  • Total Posts : 6
  • Scores: 0
  • Reward points: 0
  • Joined: 2015/05/19 23:54:38
  • Status: offline
Re: Application control is blocking Whatsapp 2018/02/09 02:52:10 (permalink)
0
Thanks Shaun. :) 
#8
john.ngugi
New Member
  • Total Posts : 1
  • Scores: 0
  • Reward points: 0
  • Joined: 2019/09/12 06:59:22
  • Status: offline
Re: Application control is blocking Whatsapp 2019/09/12 07:02:29 (permalink)
0
Same problem.
#9
noize88
New Member
  • Total Posts : 7
  • Scores: 0
  • Reward points: 0
  • Joined: 2017/04/16 10:59:36
  • Status: offline
Re: Application control is blocking Whatsapp 2019/10/17 04:57:49 (permalink)
0
so is there any solution? 
i have followed this sol. but no luck. whatsapp not working.
https://kb.fortinet.com/kb/documentLink.do?externalID=FD37625
 
v6.2.1 build0932 (GA)
Application Control Signatures Version 14.00705 
Device & OS Identification Version 1.00084 Internet Service Database Definitions Version 7.00143AV Definitions Version 72.00388 AV Engine Version 6.00132 Mobile Malware Version 72.00388Security Rating Package Version 2.00027
#10
noize88
New Member
  • Total Posts : 7
  • Scores: 0
  • Reward points: 0
  • Joined: 2017/04/16 10:59:36
  • Status: offline
Re: Application control is blocking Whatsapp 2019/10/17 05:11:19 (permalink)
0
its seems from time to time it working.

but always laggy or message wont post.
 
#11
Jump to:
© 2019 APG vNext Commercial Version 5.5