Dns filter and redirect portal IP

Forum|Forum|7 years ago
April 4, 2019
9 replies
22353 views

In our DNS filter profile, we have checked the redirect checkbox and selected to fortiguard default for the ip.

So when a client asks for a blocked website, it'll get the IP of the fortiguard portal, like 208.91.112.55.

When the site is in SSL, then the browser will generate a warning that the name on the certificate don't match the one on the site and that's true.

For SSL inspection we already have a private root installed on all devices on our network. Would it be possible for the fortigate to generate a certificate on the fly for this site so the user facing the issue will know that it's blocked instead of calling support to know what to do with the warning ?

6.0

Markus

New Member

Yes, you have to generate (with your CA) and import a cert to your forti and create an ssl inspection profile with this cert.

nicolasrossAuthor

New Member

Not quite. Yes, we already have our own authority installed on the FG. But, as I have said, when it's the DNS filter that catches something, ti redirects to 208.91.112.55. It's the certificate from this IP (*.fortinet.com) that is prsented, and not one for the site the client was visisiting.

Markus

New Member

Sorry, I've misunderstood. That's another thing in this case, I apologize. I'm new with DNS Filter and don't know how to solve that. I made a policy for our AD Servers -> wan -> DNS and applied a DNS Filter. In the meaning that would deny any DNS request to the blocked categorys, but the user wouldn't see a block page. Maybe I'm completely wrong or misunderstood the DNS Filter thing. What if you setup (if you can) a small webserver with a response page and present a "real" cert? Then point to this URL instead of Fortiguard. Best

Sign up

Login with SSO

Login to the community

Login with SSO