When configuring advanced traffic inspection on a FortiProxy device, the terminology around SSH can easily lead to misconfigurations. Specifically, distinguishing between an SSH Tunnel Policy and an SSH Proxy Policy is a common point of confusion.
While both involve inspecting SSH traffic (Port 22), they serve completely different architectural purposes.
SSH Tunnel Policy (Port Forwarding Inspection):
An SSH Tunnel Policy is used specifically to perform access control and deep inspection on TCP/IP port forwarding traffic that is being multiplexed inside an established SSH tunnel.
When a user creates an SSH tunnel, they encapsulate other protocols (like HTTP, RDP, or database traffic) inside the encrypted SSH session. To the FortiProxy, this normally looks like generic, encrypted SSH traffic, creating a blind spot.
Consider the following scenario, where a user establishes a local port forwarding tunnel:
ssh -L 20000:10.100.0.200:80 SSHuser@ssh_server
Once established, the user browses to 'http://localhost:20000'.
The actual HTTP traffic to '10.100.0.200:80' is securely tunneled over the SSH connection.
Configuration example:
config firewall ssl-ssh-profile
edit "SSH_TUNNEL_CHECK"
config ssh
set ports 22
set status deep-inspection
set ssh-tun-policy-check enable
end
next
end
This configuration is commonly used when the objective is to decrypt, monitor, or restrict the specific destination resources (e.g., preventing a user from tunneling unauthorized protocols over SSH).
SSH proxy policy (policy fine-tuning):
An SSH proxy policy does not look inside an encrypted port-forwarded tunnel in the same way. Instead, it acts as a secondary, fine-tuning mechanism for standard SSH traffic that has already been intercepted by a broader Explicit Web Proxy or Transparent Proxy policy.
How it works:
A client initiates a standard SSH connection that hits an Explicit or Transparent proxy firewall policy.
For the SSH Proxy policy to trigger, the parent proxy policy must have 'Enable SSH policy check' toggled on, and it must utilize a custom ssl-ssh-profile with deep inspection enabled for port 22.
If those conditions are met, FortiProxy hands the traffic off to the SSH Proxy Policy table to determine granular actions (such as blocking specific SSH commands, restricting file transfers via SFTP, or validating SSH host keys).
Important: The SSH Proxy policy cannot stand on its own. It acts as an extension of the primary web/transparent proxy policies to apply granular SSH protocol constraints.
Summary of differences:
Feature | SSH Tunnel Policy | SSH Proxy Policy | Primary focus | Inspects traffic nested inside an SSH port-forwarding tunnel (e.g., HTTP over SSH). | Applies granular security controls to standard SSH sessions. | Prerequisites | Requires an SSL/SSH profile with set ssh-tun-policy-check enable. | Requires a parent Explicit/Transparent proxy policy with 'Enable SSH policy check' active. | Use case | Preventing users from bypassing firewall restrictions via SSH tunneling. | Controlling what commands or actions users can perform during an allowed SSH/SFTP session. |
Related articles:
| 
