Skip to main content
jiahoong112
Staff
jiahoong112
Staff
June 20, 2022

Technical Tip: Bypassing deep-inspection firewall policies using FQDN

  • June 20, 2022
  • 0 replies
  • 4887 views
Description

 

This article describes two methods that can be used when ssl-deep-inspection and proxy-based inspection is used on a very general firewall policy (source: Any destination: Any) and traffic to a specific website is blocked because of it.

 

Scope

 

Ensure FortiOS v6.2.2 and above is used. The goal is to allow access to specific websites whilst 'bypassing' the firewall policy which has ssl-deep-inspection and proxy-based inspection. 

Only traffic to the specified website in this firewall policy will be allowed. 

 

Solution

 

Method 1: (Exempt from SSL Inspection)

 

  1. Go to Policy & Objects -> Addresses -> Create New -> Address.

 

  1. Select Type FQDN. In the FQDN field, enter the FQDN to be allowed (wildcard FQDN is also possible). For example, if access to twitter.com is blocked due to ssl-deep-inspection, enter twitter.com in the FQDN field.

 

  1. Use this command in the CLI to see which IP address the newly created FQDN resolves to: 

 

diagnose firewall fqdn list | grep twitter 

 

For v7.0 and later:


diagnose firewall fqdn list-all | grep twitter

 

  1. It will usually be: 

 

diagnose firewall fqdn list | grep <configured_website_name>

 

For v7.0 and later:

 

diagnose firewall fqdn list-all | grep <configured_website_name>

 

  1. Go to Security Profiles -> SSL/SSH Inspection -> Edit SSL/SSH Inspection Profile that is being used, and add the FQDN object created earlier in the Addresses field under Exempt from SSL Inspection.

 

twitter.PNG

 

Method 2 (Create another policy without deep-inspection and proxy-based enabled to allow the traffic):

 

  1. Create an FQDN object by following steps 1 and 2 in method 1.

  2. After that, create a new firewall policy. Policy & Objects -> IPV4 Policy/Firewall Policy -> Create New.

  3. This new firewall policy is essentially a clone of the existing firewall policy with flow-based inspection, ssl-certificate-inspection used with Destination as the FQDN that was just created. Refer to the attached screenshot.

 

allow.PNG

 

Ensure the newly created FQDN firewall policy is placed on top of the existing firewall policy in the firewall policy sequence.

    Terms & ConditionsAccessibility statement