Skip to main content
mseiler0815
mseiler0815
Visitor III
June 14, 2022
Question

Check if Traffis was decrypted

  • June 14, 2022
  • 5 replies
  • 8586 views

Hello community,

 

I'm just playing around with the TLS Decryption.

 

It's working for my client. But now I want to see in the Fortimanager if the Traffic was decrypted.

 

There are several apps shown in the logs.

 

-SSL

-HTTPS.Browser

-...TLS.V1.2

 

How do I know from the logs that the traffic was decrypted?

 

Is there a flag if I go into traffic details?

 

I know another firewall which has a flag "Decrypted" and a log which shows the shift from port 443 to 80 but still application TLS.

 

Thank you

 

Regards

 

Michael

5 replies

A
Anonymous_User
Contributor
June 16, 2022
Hello @mseiler0815 ,
 
Thank you for using the Community Forum. I will seek to get you an answer or help. We will reply to this thread with an update as soon as possible.
 
Thanks, 
akristof
Staff
akristof
Staff
June 17, 2022

Hello,

If you mean how you can check if FortiGate is doing Deep-inspection on traffic and able to inspect full traffic, then in logs, you will not see any explicit flag. You can check which firewall policy was matched and see if deep-inspection profile is used. Best way how to check if FortiGate is doing inspection is to open HTTPS website and check who signed the certificate. If you will see that the server certificate was signed by CA that is on FortiGate, then full inspection is happening.

    mseiler0815
    mseiler0815Author
    Visitor III
    June 17, 2022

    Hello,

     

    yes, thank you. 

    Sure, I can see it by checking the certificate.

    But I want to see why my IDE or Antivirus or other tools are not working anymore after enabling full inspection. There is no way to check this in the gui why my Bitwarden installation fails when do download start. There is just a general error msg.

    Or Iframes on a website which are not shown correctly.

    That's why I want to see which connection is decrypted to get an ideo which URL/IP addresses are to whitelist.

    Which flag in the logs are you referring to?

     

    Regards

     

    Michael

    akristof
    Staff
    akristof
    Staff
    June 17, 2022

    Hi,

    You can try to do this:

    https://community.fortinet.com/t5/FortiGate/Technical-Tip-Support-SSL-mirroring-in-proxy-mode/ta-p/193622

    This will show you all unencrypted communication.

    Some applications have problems with deep-inspection especially if you have self-signed CA on FortiGate and some FortiGates might have it's own cert store but you might want to double-check that your PC has this CA installed as trusted root CA.

    My suggestion would be if it is known application, you can use ISDB or fqdn to exempt traffic from inspection.

    A
    Anonymous_User
    Contributor
    June 17, 2022

    Hi Michael,
    If you apply deep inspection and hitting that policy, all HTTPS traffic will be decrypted.
    However, some webpage is being excluded by default. Example: Windows update, financial etc.

     

    Some website did not allow their traffic to be decrypted to maintain the integrity.
    If inspection is happening, the traffic will break and application will not working.


    Here is some good example:

    https://community.fortinet.com/t5/FortiGate/Technical-Tip-Basic-deep-SSL-inspection-configuration/ta-p/198305?cmd=displayKC&docType=kc&externalId=FD46282

    For the Fortimanager and Fortigate communication, you may consider to create dedicated policy for this and do not apply any security profiles since it is a trusted IP. You may set specific port number if required.

    mseiler0815
    mseiler0815Author
    Visitor III
    June 17, 2022

    Hello again,

     

    thanks for all the help. I really appreciate it.

    I'm familiar with the decryption in general and how to exclude pages with Cert Pinning/HSTS/Mutual Authentication and so on.

     

    My default policy is to decrypt as much as possible. Banking and Health excluded.

     

    All I need is something like this. (I hope it is ok to post something from another vendor).

     

    https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClboCAC

    I've been working with this for years and it is a timesafer if it comes to troubleshooting)

     

     

    Regards

     

    Michael 

      A
      Anonymous_User
      Contributor
      June 19, 2022

      Hi Michael,

      At the moment, Fortigate does not have that logs. However, this is a great feature to be included.

      Thank you for sharing with us.
      Let me know if you have any concern.

      AdamNib
      AdamNib
      New Member
      August 10, 2023

      So has this useful troubleshooring feature been added yet a year later?  Very handy on the Palo.

       

      For example, with deep decryption is switched on Android phones fail their connection check (and hence dont connect to the internet)...I have excluded certain googler FQDNs and apis but still cant see which is triggering the failure.

      Terms & ConditionsAccessibility statement