Helpful ReplyHot!Webfiltering jumps into overdrive for no discernible reason

Author
ikmarwright
New Member
  • Total Posts : 11
  • Scores: 1
  • Reward points: 0
  • Joined: 2017/10/14 18:55:55
  • Status: offline
2020/03/08 06:53:54 (permalink)
0

Webfiltering jumps into overdrive for no discernible reason

The other day our LAN to WAN webfiltering started blocking about 80% of sites. The last change to the firewall had happened about 16 hours earlier, but nothing that should have blocked banking sites or duckduckgo.
 
I had to turn off webfiltering until I could reboot the firewall. Since I rebooted (with the same webfiltering active again), I've had no problems.
 
This is a 100D running 6.0.9 on voltage regulating UPSs.
 
Just curious if this had happened to anyone else. 
 
Dave
#1
TecnetRuss
Bronze Member
  • Total Posts : 22
  • Scores: 8
  • Reward points: 0
  • Joined: 2017/02/27 13:14:44
  • Status: offline
Re: Webfiltering jumps into overdrive for no discernible reason 2020/03/08 13:43:57 (permalink) ☄ Helpfulby ede_pfau 2020/03/09 04:09:22
5 (2)
We've recently seen a spike in "Web Page Blocked: an error occurred while trying to rate the website using the web filtering service" messages both internally and complaints about this from customers.  These show up in the Web Filter log as "Action: Blocked, Message: A rating error occurs".
 
I opened a support ticket and here's what we narrowed this down to:
  • FortiGates running FortiOS 6.0.8 and 6.0.9 (and probably 6.2.x too but not tested)
  • System / FortiGuard / Protocol = HTTPS (as per 6.0.8/6.0.9 release notes guidance)
  • Switching Update Server location from "US only" to "Lowest latency" or Port from 8888 to 53 or vice-versa sometimes temporarily resolved the problem but the "ratings error" returned.
 
If you run "diag debug rating" with the above settings you'll see that there are fewer FortiGuard servers available that respond over HTTPS compared to HTTP or UDP.  This seems to be a recent capacity issue but support hasn't confirmed this.  We had FortGuard over HTTPS enabled soon after FortiOS 6.0.8 came out and it ran for months without issues - until recently.
 
If you set System / FortiGuard / Protocol to UDP you should find that the ratings errors go away and normal, reliable web filtering resumes.  Our other option to avoid the block pages is to modify our Web Filtering profile to "Allow websites when a rating error occurs" (i.e. fail open), but I'd recommend against this as it potentially allows pass-through to malicious sites when rating fails.
 
If this is exactly what you're seeing I'd recommend you open a case with support.  Hopefully this gets resolved soon so we can switch back to the more secure FortiGuard over HTTPS.
 
Russ
NSE7
#2
ikmarwright
New Member
  • Total Posts : 11
  • Scores: 1
  • Reward points: 0
  • Joined: 2017/10/14 18:55:55
  • Status: offline
Re: Webfiltering jumps into overdrive for no discernible reason 2020/03/08 13:57:28 (permalink)
0
Thanks, Russ.
 
What's weird is it was the quietest office day we'd had in months. Only two users were in the office at the time and our website is offsite. And the websites blocks weren't logging either.
 
Regardless I'll double check my FortiGuard protocol tomorrow.
 
Dave
#3
TecnetRuss
Bronze Member
  • Total Posts : 22
  • Scores: 8
  • Reward points: 0
  • Joined: 2017/02/27 13:14:44
  • Status: offline
Re: Webfiltering jumps into overdrive for no discernible reason 2020/03/08 14:09:13 (permalink)
0
Yes, very similar to us - the very first time we noticed it was at 7:00 PM when there were only a few people in the office.  It is sporadic enough in our office that I've left our FortiGate in HTTPS mode for FortiGuard and our staff just know to hit refresh a few times and the ratings error goes away, but for bigger customers it is too disruptive and we had to ensure FortiGuard was using UDP to avoid the user complaints.

Russ
NSE7
#4
cashrewards
New Member
  • Total Posts : 1
  • Scores: 0
  • Reward points: 0
  • Joined: 2020/03/08 18:34:42
  • Status: offline
Re: Webfiltering jumps into overdrive for no discernible reason 2020/03/08 18:42:05 (permalink)
0
Same issues here, we are getting some of the Business websites is getting blocked like LinkedIn, WebFilter setting looks fine for me. Is there anything else I have to check in my settings? 
#5
ShawnZA
Silver Member
  • Total Posts : 90
  • Scores: 11
  • Reward points: 0
  • Joined: 2018/04/02 23:31:22
  • Location: Cape Town
  • Status: offline
Re: Webfiltering jumps into overdrive for no discernible reason 2020/03/09 03:05:41 (permalink)
0
On my home 60E on 6.2.3 I have this today...
When I go to Web Rating Overrides I am greeted by this message:
 
Cannot lookup rating as the Webfilter service is currently not running. Select a Webfilter profile in a firewall policy in order to start the service.
 
(Rebooted the 60E remotely now, never came back up, will check what happened when I get home)
 
 
 
And production 300D on 6.2.2:
When I go to Web Rating Overrides I am greeted by this message:
FortiGuard rating unavailable.
 
 
post edited by ShawnZA - 2020/03/09 03:33:07

Attached Image(s)

#6
ikmarwright
New Member
  • Total Posts : 11
  • Scores: 1
  • Reward points: 0
  • Joined: 2017/10/14 18:55:55
  • Status: offline
Re: Webfiltering jumps into overdrive for no discernible reason 2020/03/16 04:46:54 (permalink)
0
Just as a follow up. We were (and are) using UDP already when we had the problem. 
 
I've never seen the errors that ShawnZA received.
 
Update: Had the problem a second time. Set FortiGate to HTTPS, Applied then setup back to UDP. Good to go.
post edited by ikmarwright - 2020/03/19 11:47:21
#7
Jump to:
© 2020 APG vNext Commercial Version 5.5