Technical Tip: SSL exempt for Microsoft Windows Update
Description
This article explains how to use SSL exemption for Microsoft Windows Update sites.
Scope
FortiOS (supported versions).
Solution
Some Windows installations do require an additional SSL exemption for 'go.microsoft.com' in order for updates to succeed, see below.
SSL exemptions are configured as in the article Technical Tip: Exempting applications/domains/websites from Deep SSL Inspection.
If required to block or inspect Windows updates, the matching SSL exemptions must be removed. Once removed, the actions set up in the Application Control profile will be applied (Block, Reset, etc). If the SSL exemptions are not removed, the Application control will not take any action but will correctly detect the type of application.
A common problem that is seen and reported is that the Application Control with Block action correctly detects the application 'app="MS.Windows.Update"', yet the logs say 'action="pass"'.
Notes:
- This applies to all applications that are intended to be blocked through Application Control. Sites and domains that are exempt from SSL inspection (considered to be trusted), will bypass the Application Control profile configured with actions 'block' or 'reset'.
- In flow-based inspection mode, destinations that are 'Exempt from SSL Inspection' within the SSL Inspection profile are also exempt from subsequent UTM inspection (described in this KB article).
- In proxy-based inspection mode, destinations that are 'Exempt from SSL Inspection' within the SSL Inspection profile are exempt from SSL deep inspection, but subsequent UTM inspection applies.
