Fortigate Firewalls and Desktop Share Failure

I recently ran into a problem with Desktop Sharing and Lync.  Typically, I start all of these troubleshooting sessions by looking at the common issues: certs, DNS, etc. but in this case I knew who to blame.  Me!

I recently installed a new firewall into the environment: A Fortigate 50b.  Before we get to the specific fix lets review what was and wasn’t working.

• Presence worked both ways
• IM’s worked both ways
• Audio/Video worked both ways
• Desktop Share would fail on setup

With this knowledge, I could start making some very good guesses of what might be happening.  Since Desktop Share utilizes TCP exclusively and Audio/Video uses UDP, I had a good guess that the problem lied somewhere in the TCP stack on the firewall.

So my next step was to review a client trace to see if there was anything in the client trace that would point me to any more specific information.  A review of the SDP showed this:

The workstation I am running the client on has two NIC’s (one wired and one wireless) so we see both of those IP’s listed but you will notice a lack of any relay/edge addresses.  So we can see that somewhere in the process of the TURN request, something was deleting, removing, preventing the TURN request.  Since this is a TCP request, we know the request is going out on 443.

So I decided to start poking around the Fortigate and see if there was any type of TCP/443 filtering that might be enabled and I found Unified Threat Management (UTM).  After I got over the shivers of the name I decided to disable UTM on my firewall policy.  My client network is VLAN4 on my Fortigate so I disabled UTM on VLAN 4 to WAN 1:

After the change, I immediately tested my desktop share and it was working.  At this point, I started disabling each option one at a time to discover the issue was related to the Protocol Options being enabled.  So I looked at the details this can be found in Firewall | Policy | Protocol Options:

My attention went immediately to the HTTPS section.  I found that if I disabled Monitor Content Information for Dashboard, Desktop Share starts to work immediately.

More Details

When I ran into this problem I knew this might be one of those issues that might make a great blog article.  So I did some quick searching and found this blog article:

http://silbers.net/blog/2013/02/04/application-layer-firewall-blocks-lync-application-sharing/

So although I started a blog post with some pretty WireShark images – I try to never double up another persons content.  As my old debate coach would say: “Stealing content just isn’t cool, dude!”  So if you want some more great content, go read Jeremy Silber’s blog on the topic.