Technical Tip: Restricted SaaS Access (0365, G-Suite, Dropbox) or web-proxy profile not working as expected on FortiGate.

FortiGate has the feature of using a web-proxy profile for tenant restriction and other tasks as needed in an environment.

Refer to the following document for further information on the web-proxy profile configuration:

https://docs.fortinet.com/document/fortigate/6.2.0/new-features/480209/restricted-saas-access-0365-g-suite-dropbox

Sometimes, the web-proxy profile would not work even when configured on the firewall policy with the appropriate web-proxy profile.

The following configuration could be applied on the FortiGate to fix the issue:

# config firewall ssl-ssh-profile

    edit <Name of the Profile> <----- Replace it with the appropriate name.

# config ssl

set inspect-all disable

end

Also, appropriate websites should not be exempted from the SSL/SSH profile for Deep Packet Inspection.

When inspect-all is enabled, only configuration under 'config web-proxy global' will be looked at by the FortiGate, so settings under the option would only be considered.

Thus, disable inspect-all if FortiGate has to consider the settings under 'config web-proxy profile'.