I have fortinet fortigate 40c. It is not a bundle product. We use it to unblock 300 of our websites and rest are all blocked by default. Now, we want to unblock skype. The problem is just specifying skype.com to unblok doesn't help it opening the application. So what options do i have. I have specified skype to open in application server as well but yet it doesn't work.
You need to create an application filter and apply it to your LAN->WAN IPv4 policy. This is different to a wildcard web filter that you have created.
Currently your default application filter (or your custom one) may be set to block Skype. You can also set up an application filter override, to allow Skype explicitly.
It might well be that it's not the AC blocking Skype but the WF.
1- Do you have a valid UTM licence? If not, WF will block.
2- Enable logging on that policy.
3- Make sure it's the first policy from top down so that it gets hit by traffic.
4- Disable WF. Disable AC. If Skype now is connecting, enable AC. If that is working, enable WF. If not, check the AC blocking rules, especially the 10 blocking entries.
I had the same problem on a Fortigate 90D: Skype chat works, but not calls. I investigated a bit and I found the culprit: webfilter... and firewall.
Explanation with an example:
I have 2 IPV4 policies for 2 types of users (let's call them LAN and GUEST). Both policies are using the SAME webfilter. The only difference is: LAN policy only has a few ports open, while GUEST policy has ALL ports open.
Logs are telling me that on BOTH policies, Skype is blocked by the webfilter. After reading Skype documentation, i know that if Skype is blocked on standard ports (80 or 443), it will use a random port to connect.
For the users under my LAN policy, Skype is blocked by the webfilter, then use another random port. And the random port not being allowed in my LAN policy --> Skype calls are not working.
For the users under the GUEST policy, Skype is also blocked by the webfilter, then use another random port. All ports being open in my GUEST policy: CALLS ARE WORKING !
My only option if I don't want to open all ports on my LAN policy in order for random Skype ports to work is to AUTHORIZE ALL WEBSITES IN THE WEBFILTER. Then apply, wait a few seconds, boom: Skype calls are working ! If I block pornography websites -> Skype is not working. If I block "Security Risk" category --> not working ! Even worse than that: putting the categories on "monitor" also seems to block skype calls ! You must select AUTHORIZE.
Conclusion: Skype calls are blocked by the webfilter. Only solution:
Allow skype to connect on standard ports by authorizing all websites in the webfilter, since it looks like skype is blocked in multiple web categories.
If you don't want to allow those categories in the webfilter, skype will be blocked on standard ports and will use a RANDOM port to connect, so you must open ALL ports in your policy (since it's impossible to guess which one will be used) in order for the Skype to work.
Third option, but it didn't work for me: you can specify a custom port in Skype connection options, then eventually authorize it in your policies. I tried it, but Skype was still using random ports.