0

enter image description hereI have fortinet fortigate 40c. It is not a bundle product. We use it to unblock 300 of our websites and rest are all blocked by default. Now, we want to unblock skype. The problem is just specifying skype.com to unblok doesn't help it opening the application. So what options do i have. I have specified skype to open in application server as well but yet it doesn't work.enter image description here

enter image description here

enter image description here

1

You need to create an application filter and apply it to your LAN->WAN IPv4 policy. This is different to a wildcard web filter that you have created.

Currently your default application filter (or your custom one) may be set to block Skype. You can also set up an application filter override, to allow Skype explicitly.

| improve this answer | |
  • I tried doing that too. It didn't work. When using skype application, it says check your internet connection. – de.walkar Jul 3 '16 at 6:51
  • There may be other application control entries that it relies on. I have just had a look in Fortiguards database and it appears that Skype also requires Skype_Communication so make sure that is whitelisted also. I would look back over your policies and ensure that users are hitting the correct web/application filters. fortiguard.com/appcontrol/app-12753 fortiguard.com/appcontrol/app-30197 – mgt Jul 3 '16 at 7:47
  • is it to be enabled in application sernsor ,skype_communication? – de.walkar Jul 3 '16 at 9:05
  • I could not get the skype_communication in the application sensor. All i can find is skype – de.walkar Jul 3 '16 at 9:15
1

It might well be that it's not the AC blocking Skype but the WF.
1- Do you have a valid UTM licence? If not, WF will block.
2- Enable logging on that policy.
3- Make sure it's the first policy from top down so that it gets hit by traffic.
4- Disable WF. Disable AC. If Skype now is connecting, enable AC. If that is working, enable WF. If not, check the AC blocking rules, especially the 10 blocking entries.

| improve this answer | |
  • No, we don't have the UTM licence. So we block all the websites except for what we need and we excempt and enable them. – de.walkar Jul 3 '16 at 13:13
1

I had the same problem on a Fortigate 90D: Skype chat works, but not calls. I investigated a bit and I found the culprit: webfilter... and firewall.

Explanation with an example:

I have 2 IPV4 policies for 2 types of users (let's call them LAN and GUEST). Both policies are using the SAME webfilter. The only difference is: LAN policy only has a few ports open, while GUEST policy has ALL ports open.

Logs are telling me that on BOTH policies, Skype is blocked by the webfilter. After reading Skype documentation, i know that if Skype is blocked on standard ports (80 or 443), it will use a random port to connect.

So:

  • For the users under my LAN policy, Skype is blocked by the webfilter, then use another random port. And the random port not being allowed in my LAN policy --> Skype calls are not working.

  • For the users under the GUEST policy, Skype is also blocked by the webfilter, then use another random port. All ports being open in my GUEST policy: CALLS ARE WORKING !

My only option if I don't want to open all ports on my LAN policy in order for random Skype ports to work is to AUTHORIZE ALL WEBSITES IN THE WEBFILTER. Then apply, wait a few seconds, boom: Skype calls are working ! If I block pornography websites -> Skype is not working. If I block "Security Risk" category --> not working ! Even worse than that: putting the categories on "monitor" also seems to block skype calls ! You must select AUTHORIZE.

Conclusion: Skype calls are blocked by the webfilter. Only solution:

  • Allow skype to connect on standard ports by authorizing all websites in the webfilter, since it looks like skype is blocked in multiple web categories.

  • If you don't want to allow those categories in the webfilter, skype will be blocked on standard ports and will use a RANDOM port to connect, so you must open ALL ports in your policy (since it's impossible to guess which one will be used) in order for the Skype to work.

  • Third option, but it didn't work for me: you can specify a custom port in Skype connection options, then eventually authorize it in your policies. I tried it, but Skype was still using random ports.

| improve this answer | |
  • I changed the Inspection method to proxy based in web filtering profiles and the skype started working. – de.walkar Oct 16 '16 at 7:37
0

I changed the Inspection method to proxy based in web filtering profiles and the skype started working. I hope this one helps for all.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.