FortiGate and Tor

Please check https://community.fortinet.com/t5/FortiGate/Technical-Tip-Blocking-and-monitoring-Tor-traffic/ta-p/196239

@hack3rcon 
When you enable tor sensors to monitor traffic, Tor connection will not work. It will be blocked by Fortigate because of Deep inspection.
Tor browser seem to not accept fortigate deep inspection certificate, thus not creating a connection to Tor network. But in this case you will be able to see which site or IP it tries to connect.

@hack3rcon 

You will see the IP that Tor browser will try to create first connection. 
When you open Tor browser, it tries to connect to Onion network, and starts to establish a connection.
Now Fortigate needs deep inspection enabled otherwise it wont recognize application used and sites visited.
Deep inspection requires usage of FortiGate certificate. Tor browser does not accept that, thus causing connection to not establish.

In Forward logs you will be able to see first IP that is supposed to give access to onion net. But since Tor is not able to connect to onion net, then no websites are browsed and nothing is shown in fortigate.

Hope this explanation is clear

@hack3rcon 

Let's put it this way.
1. You are using a normal browser to navigate to internet. Use a policy with deep inspection in Fortigate.
Fortigate will use it's certificate to decrypt all traffic, scan make decisions based on the findings, encrypt and send it to server side. For client to accept this connection and not think for a MIDM, it needs to have Fortigate certificate installed. This is because client will see fortigate as server side. 
Fortigate in this case will create 2 sessions, Client - Fortigate and Fortigate -Server.
On normal browser, you can install fortigate certificate as trusted root authority and creating ssl/tls sessions.
On tor browser, as far as i know, it is difficult to install certificates. This means that Fortigate will allow or deny traffic based on policy configuration, but Tor browser will not trust fortigate, resulting in session not being created.

2. You are right, this is the certificate used to be injected into network traffic

3. In deep inspection traffic is decrypted, so normally you can see usernames and passwords, but there is no way to extract that information, because decryption happens in hardware level and there is not possible for user to view traffic passing through, unless you configure some port mirroring for decrypted traffic as described in this link:
Technical Tip: Mirroring SSL inspected traffic - Fortinet Community

Regards,

@xshkurti 

@hack3rcon 
1. Certificate installation is done by admin on users pc. 
This means that different methods may be used: manually from client's desktop or via GPO if pc is member of a domain, or via powershell remote execution again if pc is member of a domain or if any other MDM solution is in place for Central PC management

2. Yes you are right, that is a way to know if there is any certificate installed on your PC.
Other ways would be to check through windows MMC snapins

If you have found this as a solution, please like and accept it to make it easily accessible for others.

Regards!

@xshkurti