Deep inspection of incoming traffic from internet to VIP

Forum|Forum|12 years ago
July 30, 2014
7 replies
13107 views

Does anyone have any experience with deep inspection of incoming traffic such as SSH or SSL? Surely if the fortigate can ispect the traffics outgoing it must be able to do the same for incoming traffic? I' m looking to do this on 5.0.7 using a VIP that port forwards 443. How can the antivirus and other UTM work effectively without deep inspection of SSL sessions?

lightmoon1992

New Member

FortiGate has the ability to look into the incoming encrypted traffic, same concept of the outgoing, however you may chose to offload all the encryption also from your server to the FortiGate itself. For the AV scanning to be efficient, you need to understand what you are scanning before you do. in another word, in order to do efficient scanning, you need to decrypt the traffic so as of then you can apply scanning to it Mohammad

FortiAdamAuthor

New Member

OK so can you give me an idea of how I would accomplish this with 5.0.7? Wouldn' t the firewall need the certificate from the webserver? I don' t see how you could avoid browser certificate errors otherwise.

lightmoon1992

New Member

This is how you do it: 1- For the certificate, either you select to live with one of the existing FortiGate self signed certificates (which will display you the warning anyway), or you import your signed certificate ( via Symantec, Network Solutions, GoDay,etc) 2- Enable load balance functionality under system-config-feature 3- Create virtual server under firewall object-load balance - virtual server which represents the socket you are willing to advertise. you may select https under type drop down list, and then below you will have ssl offloading option enabled. here you select which certificate will be used and how the FortiGate will act on this socket. 4- Create real server under firewall object - load balance - virtual server 5- Finally, create external to internal firewall policy to include the virtual server created before Mohammad

FatalHalt

New Member

Hey guys, I was wondering if someone could help me with this? I followed the steps from the post above, and now have a virtual server on one of my unused public IPs at port 443, and it' s passing to a real server inside on port 443. Using the fortigate certificate.

config firewall vip   edit " vip.srv.ssloffload"           set type server-load-balance          set extip xxx.xxx.xxx.xxx          set extintf " wan2"           set server-type https          set extport 443              config realservers                  edit 1                      set ip xxx.xxx.xxx.xxx                      set port 443                  next              end          set ssl-mode full          set ssl-certificate " Fortinet_CA_SSLProxy"       next  end

For the policy, I included application control, as I would like to be able to tell if the traffic is OWA or Active Sync. But the logs just show HTTPS, with no application. Any ideas how I can get this to populate?

config firewall policy      edit 113          set srcintf " wan2"           set dstintf " port1"           set srcaddr " all"           set dstaddr " vip.srv.ssloffload"           set action accept          set schedule " always"           set service " HTTPS"           set utm-status enable          set logtraffic all          set ips-sensor " default"           set application-list " Monitor_All"           set profile-protocol-options " default"           set deep-inspection-options " default"       next  end

MichaelM

New Member

Hi,

I would like to bring this up as well. We had it all working like you needed to, a VirtualServer did the SSL offloading for a Microsoft Exchange Server serving OWA and ActiveSync via HTTPS.

Internet <-> FG <-> Exchange Server

With 5.2.2 we are having nothing but trouble, it was the admins fault not reading the release notes in detail (tiny details) but not having a backup made it even worse.

All we see for incoming traffic is Application SSL, which is kinda useless. We are checking for Applications like ActiveSync, Outlook Anywhere etc ... this all does not work any longer.

The support team challenged us to send tons of support output, even wanted us to manually decrypt the traffic from a packet trace via wireshark, which did not worked, no further steps taken on this path, waste of time. The last statement from the support team was:

-----------

I was discussing your issue with our engineering. Marking application as SSL is correct behavior. The reason is, that the Fortigate unit doesn't terminate the communication.

Communication is following: client ----SSL encrypted------FGT-------SSL encrypter-------Exchange. FGT unit is opening SSL connection to Exchange server on port 443. Communication between FGT and Exchange is encrypted and FGT can't see content of packets, so it's not able to mark application as ActiveSync/Outlook. To have this type of traffic correctly marked as ActiveSync/Outlook, you need to configure Exchange server to listen on HTTP not HTTPS.

-----------

What is going wrong here, the appliance is doing the offload, so it's there in cleartext.

Any help highly appreciated.

--Michael