Staff

Technical Tip: How FortiGate does 'TLS Active Probe'

Forum|Forum|1 year ago
May 23, 2025
0 replies
2884 views

Description

This article describes how FortiGate does 'TLS Active Probe'.

Scope

FortiGate.

Solution

Diagram:

Client IP: PORT = 10.0.6.8:52934
FortiGate SNAT IP:PORT = 10.0.5.60:52934
FortiGate TLS Active Probe IP: PORT = 10.0.5.60:1298 <----- The IP and Interface for doing "TLS Active Probe" depend on the configuration under config ips global.
Website : 115.84.166.115:443(www.seoul.go.kr).

Sample configuration:

config ips global
config tls-active-probe
set interface-select-method specify
set interface "port4"
set vdom "root"
set source-ip 10.0.5.60
end
end

TCP Stream number:

Web traffic between Client and FortiGate ingress: 19, colored by red.
Web traffic between FortiGate egress and Website: 20, colored by blue.
TLS Active Probe between FortiGate egress and Website: 21, colored by yellow.

Here is a breakdown of the relevant parts:

A TCP 3-way handshake is established between a client and a website No. 208 ~ No. 214.
A Client initiates a TLS handshake by sending a Client Hello with SNI. No. 215.
At this point, a FortiGate locally generates a new TCP session to a website for the purpose of doing a 'TLS Active Probe'. No. 217 ~ No. 221.
A FortiGate sends a Client Hello to a website. No. 222.
A FortiGate performs a full TLS handshake with a website. No. 222 ~ No. 236.
If a FortiGate completes a 'TLS Active Probe', a FortiGate forwards a Client Hello from a client and performs further jobs. No. 246 ~.

Screenshot of each TCP stream. (A stream colored yellow is a 'TCP Active Probe'):

A 'TLS Active Probe' is also seen in the IPS debug log using the commands below:

diagnose debug console timestamp enable
diagnose ips filter set 'src 192.168.10.10 and dst 115.84.166.115'
diagnose ips debug enable ssl
diagnose ips debug enable urlfilter
diagnose debug enable