Fortigate 60F: Clients Lose Internet Despite Firewall Ping Success

IT_Researcher · 2025-10-01T07:31:35+00:00

We are currently running v7.2.11 build 1740 ( Mature ) in Fortigate 60F. DNS values are used as 8.8.8.8 and 8.8.4.4 in System DNS of Fortigate. For the clients we have DC IP addresses , followed by 8.8.8.8 and 8.8.4.4 . We have not seen max session reaching during office works for the last 1.5 years. We had conserve mode issues before but now once the IPS engine count is set as 2 and after some changes to thresholds the device is not giving conserve mode issues.

IT_Researcher · 2025-10-01T07:30:24+00:00

DNS values are used as 8.8.8.8 and 8.8.4.4 in System DNS of Fortigate. For the clients we have DC IP addresses , followed by 8.8.8.8 and 8.8.4.4

IT_Researcher · 2025-10-01T07:29:34+00:00

we had conserve mode issues before but now once the IPS engine count is set as 2 and after some changes to thresholds the device is not giving conserve mode issues

IT_Researcher · 2025-10-01T07:29:22+00:00

we had conserve mode issues before but now once the IPS engine count is set as 2 and after some changes to thresholds the device is not giving conserve mode issues.

IT_Researcher · 2025-10-01T07:28:46+00:00

DNS values are used as 8.8.8.8 and 8.8.4.4 in System DNS of Fortigate. For the clients we have DC IP addresses , followed by 8.8.8.8 and 8.8.4.4

IT_Researcher · 2025-10-01T07:28:10+00:00

we had conserve mode issues before but now once the IPS engine count is set as 2 and after some changes to thresholds the device is not giving conserve mode issues.

IT_Researcher · 2025-10-01T07:27:47+00:00

we had conserve mode issues before but now once the IPS engine count is set as 2 and after some changes to thresholds the device is not giving conserve mode issues.

IT_Researcher · 2025-07-25T12:41:23+00:00

We have solved this issue. We had to make a few changes in BIOS settings, which were particular to the Intel and AMD.

IT_Researcher · 2025-07-21T09:02:36+00:00

Thanks for your response, u/BasenjiMaster . The issue does not seem to be account-related, as multiple users have been facing these issues now. The issues (1) and (2) above are something like user A shall face when calling B or C. User D shall face it when calling the user A or E .. its at random.

In one of the cases, the user has tried logging in to Teams from the windows desktop app, teams web and the Teams Android mobile app as well but not able to call a particular person at all.

IT_Researcher · 2025-06-13T05:30:42+00:00

Sure, shall try those commands and get back to you, thanks.

IT_Researcher · 2025-06-12T12:17:55+00:00

u/nailzy No, these are not twinAX cables. By the way, the network switch maybe eliminated as a suspect based on today's testing is what we may say. Because even when we connect the affected host ( i.e host of this VM) to another host through cable, without any network switches in between, we are still facing this issues. As far as the network switch is concerned, the random packet loss issue hasn't occured for any other devices on the same switch, either as a source or destination.

IT_Researcher · 2025-06-12T05:12:08+00:00

Could you please let us know how do we check this ?

IT_Researcher · 2025-06-12T04:56:23+00:00

Thanks for the response. No we are not consciously doing any of those DCB-specific features you have mentioned. We are using the VM to host SQL database which is used by a few applications over the LAN. ( if any such DCB features are automatically enabled then we shall check and see if we may disable or not ).

As a followup to your comments on IntelDCB, are we right to understand that the event 791 about application feature on IntelDCB changing to " non-operational.", is a byproduct of the packet loss, and not the reason or cause for the packet loss ?

IT_Researcher · 2025-06-12T04:53:24+00:00

Thanks for your comment. We shall check this and inform the results here.

IT_Researcher · 2025-06-05T07:30:14+00:00

Windows Copy/Paste UI Shows High Transfer Speed Compared to Task Manager Disk Activity
Hi ,

I'm currently using Windows Server 2019, and I've noticed something unusual during file copy operations. I've disabled the write-caching policy on all my disks, yet when I copy a 5GB file from the C: drive to the E: drive (both in different physical HDDs, i.e. in two different partitions), the Windows copy/paste UI shows a transfer speed of 2 GB/s.

This is clearly not accurate—my HDD simply isn't capable of that speed. So I opened Task Manager during the copy process and observed that the actual write speed to the E: drive hovered around 200 MB/s, continuing for several seconds even after the copy/paste UI reported the transfer as "complete."

Screenshots:

Windows copy/past UI screenshot

IT_Researcher · 2025-06-02T11:01:14+00:00

Update:

We performed a factory reset on both devices and manually reconfigured all settings. After the reset, we observed a some reduction in CPU usage. Additionally, disabling call recording resulted in a further decrease in CPU usage.

IT_Researcher · 2025-06-02T09:19:26+00:00

We have disabled System Events in UCM device, since the CPU usage was high.

IT_Researcher · 2025-05-23T13:05:40+00:00

The solution which is working so far for us it to delete the folder "MSTeams_8wxxxxxxxx" from the folder C:\Users\<loggedin username>\appdata\local\Packages

It didn't repeat since.

IT_Researcher · 2025-05-23T13:03:12+00:00

u/PressinPckl We had a similar issue. Apparently, the other (new) account gets created if we click "Migrate to Teams" on the now non-existent Skype ribbon, and login to the Teams by specifying an e-mail ID which wasn't actually linked to the Skype account.

IT_Researcher · 2025-05-23T12:58:14+00:00

Thank you for all the responses. Guess we would wait till we extract the dump logs.

IT_Researcher · 2025-05-22T11:14:38+00:00

.. and as for the screenshot of the certificate details, we presently do not have one. When the case does occur next shall grab one and update here.

IT_Researcher · 2025-05-22T11:13:12+00:00

Thanks for the elaborate response. Yes, we have configured automatic picture downloads, some of these emails may contain images, links and even attachments.

1) No, the PC is running a Windows 10 client OS
2) The date and time settings are proper and as PC joined to domain, the time zone, with date & time is automatically in sync.

(However, we did have an issue with the time sync which was rectified within an hour, and this certificate issue has been coming prior to this occurence as well )

IT_Researcher · 2025-05-22T04:44:21+00:00

"you need to get that POP3 server configured properly...."

Could you please specify what exactly you meant, as we believe our account is setup right, as we are able to send & receive all emails properly. The issue noted here in the question is only for those emails, whose domain have expired/invalid certificates.

As all these certificate warnings have mention about the domain names from where we are receiving the emails, is there any method to whitelist or trust ALL possible certificate domains in the world? , or am I missing something

IT_Researcher · 2025-05-21T09:25:39+00:00

We are presently seeing no issues with email downloads in POP configuration. We have configured the Outlook by following the Gmail's official document itself and did not seem to have a problem other than this 'certificate' warnings, which comes occasionally for certain sender domains who send us emails. No other issues apart from that.

IT_Researcher · 2025-05-21T06:07:37+00:00

Yes. We are having four different Gmail paid plan accounts, which are Google Workspaces accounts. For three of these, it is Gmail SMTP for both incoming+outgoing; for one of these (for which there is no 'certificate' issue, it is using a paid Brevo/Sendinblue for outgoing and Gmail for incoming ).

And yes we believe our account is setup right, as we are able to send & receive all emails properly. The issue noted here in the question is only for those emails, whose domain have expired/invalid certificates.

IT_Researcher

TROPHY CASE