FortiGate
FortiGate Next Generation Firewall utilizes purpose-built security processors and threat intelligence security services from FortiGuard labs to deliver top-rated protection and high performance, including encrypted traffic.
Not applicable
Article Id 191691
Article
Issue and Symptom FortiGate antivirus HTTP client comforting does not work as expected for clients using Internet Explorer. FortiGate antivirus HTTP Comfort Clients is enabled in the protection profile with the default settings of Interval set to 10 and Amount set to 1.
Components All FortiGate units. FortiOS v3.0
Description

ddouglas_11922_11922-diagram.JPG

  1. Edit the FortiGate firewall configuration and add a new protection profile called Test.
  2. In the protection profile under antivirus, enable Comfort Clients for HTTP. Leave Interval and Amount at the default settings.
  3. Create an internal to external firewall policy and select the Test protection profile.
  4. On the Client PC, open Internet Explorer and download a large file (for example, download an application from http://www.mozilla.org/download.html).

After you start the download, Internet Explorer does not prompt you to save the file and nothing seems to be happening. During this time the FortiGate unit is downloading and buffering the file. When the FortiGate unit has completed downloading and buffering the file, Internet Explorer prompts you to save the file. When you select Save, the download completes immediately. You do not experience any client comforting.

Why does this happen?

Investigation shows that client comforting does work.

The symptom is browser-dependent and only occurs with Internet Explorer.

Internet Explorer seems to buffer the client comforting packets, and will not prompt you to save the file until it has downloaded more than 400 bytes. Other browsers, for example Mozilla Firefox, do not buffer client comforting packets, but instead seem to start the download immediately.

With the default client comfort settings, if the file download is large enough, it takes more than 400 seconds, approximately seven minutes, for Internet Explorer to prompt you to save the downloaded file. In many cases seven minutes is long enough for the FortiGate unit to download and scan the entire file. So many users of Internet Explorer will never experience client comforting.

Solution

Either decrease the Comfort Clients Interval or increase the Amount.

In most cases, changing Interval to one second and the Amount to 600 bytes, results in Internet Explorer users experiencing client comforting as expected.