FortiGate 7060E WebEx Issue Shenanigans

So, if you guys have a 7060E chassis and have a decent amount of traffic flowing through it I want to go ahead and warn you that WebEx may not function properly. If you are experiencing drops of video or audio and complaints of bandwidth issues chances are you are experiencing the same bug I am.

Basically, the UDP 9000 traffic that is on it’s way back to the clients is sometimes coming in on a different FPM than the one that originally processed the request. Well, apparently, the 7060E has bugs on how it shares these sessions / content tables because that causes a 10 second blip where audio, video, or both can disappear / freeze.

Very frustrating stuff that is not easily debugged.

Our work around for now until they fix the bug is a load balance flow rule that forces all UDP 9000 traffic to hit the same FPM (whichever one you choose).

Talk about pulling your hair out!

This entry was posted in FortiGate, Fortinet GURU, Tips and Tricks on by .

About Mike

Michael Pruett, CISSP has a wide range of cyber-security and network engineering expertise. The plethora of vendors that resell hardware but have zero engineering knowledge resulting in the wrong hardware or configuration being deployed is a major pet peeve of Michael's. This site was started in an effort to spread information while providing the option of quality consulting services at a much lower price than Fortinet Professional Services. Owns PacketLlama.Com (Fortinet Hardware Sales) and Office Of The CISO, LLC (Cybersecurity consulting firm).

2 thoughts on “FortiGate 7060E WebEx Issue Shenanigans

  1. Mike Butash

    That is really interesting, my customer with a 7060E uses a lot of youtube and google apps and I get a lot of complaints that things seem “slow”, but can’t really quantify what that means. That stuff is not easily flow-rule pinned to master, as it’s mostly all 443.

    Please let us know if you see any resolution, or run into other shenanigans, but thanks for posting this as warning for others supporting 7000’s!

    Reply
    1. Mike Post author

      When the issue first crept up it was specifically due to HTTPS. (killing office 365 and large downloads). The way to fix it on HTTPS was to disable tcp-options under config global.
      Give that a try and let me know if you see any benefits.

      If you REALLY wanted to, you could pin all HTTPS to the master….but that isn’t recommended in production (or else I would have pinned all UDP to the master or slave to solve my webex and skype issues!)

      Reply

Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.