| With the introduction of the L7 policy matching mechanism, there is a possibility of issues in which policies match incorrectly, SSL inspection is bypassed, or the configured forward-server settings are not used. These issues occur because HTTPS traffic may partially match an L7 policy. When WAD evaluates the policy, it first performs a partial inspection and then a deeper scan of the traffic. If the connection is established based on a partial inspection, a more specific policy identified later may no longer apply. In other words, the initial decision remains in effect, which can unintentionally result in the wrong policy being matched.
Consider the example below in which traffic can be incorrectly deep inspected:
config firewall policy
edit 62
set type explicit-web
set name "Block Cat Gambling"
set dstaddr "URL_Cat_Gambling" <--- match host "all"
set comments "Block FortiGuard Category Gambling <Exception Page anpassen>"
set profile-protocol-options "BaFin-Monitor-SNI"
set ssl-ssh-profile "BaFin TLS Inspection"<--- deep-inspection
next
...
edit 271
set type explicit-web
set dstintf "any"
set srcaddr "172.17.35.35/32"
set dstaddr "wildcard.oceanblue.com"
set action accept
set schedule "always" set service "webproxy"
set explicit-web-proxy "web-proxy"
set logtraffic all
set log-http-transaction enable
set extended-log enable
next
end
In this example, even though the traffic (like *.oceanblue.com has a sub-category) is finally matched to policy 271, which has ssl-ssh- profile 'no-inspection', the traffic is deep-inspected by intermediate policy 62, which requires deep-inspection for matching proxy-address 'URL_Cat_Gambling'.
In scenarios like these, a new policy type can be used.
Transparent-web-connect (set type transparent-web-connect). Explicit-web-connect (set type explicit-web-connect). Once there is a connection policy, HTTPS requests will match the connection policy since it has a higher priority than a normal TP/explicit proxy policy. Plain-text HTTP or decrypted HTTPS traffic will only match a regular transparent/explicit proxy policy. Below is an example of explicit connect policy configuration. config firewall ssl-ssh-profile
edit "test-deep-inspection"
config https
set ports 443 # Traffic needs to be classified as HTTPS for a CONNECT request to match the connection policy.
set status deep-inspection
set quic inspect
set untrusted-server-cert ignore
end
... config firewall policy
edit 5
set type explicit-web-connect
set dstintf "port1"
set srcaddr "all"
set dstaddr "all"
set action accept
set schedule "always"
set service "webproxy"
set explicit-web-proxy "web-proxy"
set utm-status enable
set logtraffic all
set ssl-ssh-profile "test-deep-inspection"
next
end Below is an example of a transparent web connect policy configuration. config firewall policy edit 301
set type transparent-web-connect
set name "Transparent Connect Flow"
set srcintf "port3"
set dstintf "any"
set srcaddr "all"
set dstaddr "all"
set action accept
set schedule always
set ssl-ssh-profile certificate-inspection
set logtraffic all
next
end
Connection policies mainly support L4 addresses and do not support L7 addresses, such as URLs or HTTP headers, because they are designed specifically to match HTTPS CONNECT requests and SSL SNI. For proxy-address matching, host categories, excluding subcategories, and host-regex can be used in both explicit and transparent connection policies. User-agent matching is supported only in explicit connection policies.
| 
