FortiGate Application Control profile breaks AP Management connection

unknown

I have a remote office that is connected via a private 20Mbps x 20Mbps Metro Ethernet connection.

In our main office the connection terminates on a Layer 3 switch and inside this network is the Ruckus virtual SmartZone Essentials controller.

At the remote office the connection terminates on a FortiNet firewall (v6.0.3 firmware) and in this office is a single Ruckus R710 AP.

This has been configured this way for months, but last week I wanted more visibility of what traffic was traversing this connection, so I enabled the Application Control profile on the Policy of the FortiGate.

When I have the Application Control profile active, the AP losses its SSH management tunnel to the controller.  Remove it, and the tunnel comes back up.

On the FortiGate, the Application Control profile is only set to "monitor" the "Network Services" category which covers SSH.

To be more specific, the Application Control profile is not set to "Block" any category only monitor them.

Is there some other protocol at work here that, by possibly not being known or directly defined within Application Control profile could be being blocked?

For now, we have removed the Application Control from that Policy, but I would like to get this working.

pasquale_monard

If you run a debug flow packet capture before and after enabling App. Control what do you see?