Skip to main content
Netadmin-Japfa
New Member
May 16, 2023
Question

FORTIGATE-AWS GWLB having issue with https ssl blocking with probe cert failed

Dear All, 

 

We want to implement FORTIGATE-AWS GWLB.

This is our reference.

https://aws.amazon.com/blogs/apn/centralized-traffic-inspection-with-gateway-load-balancer-on-aws/

https://fortinetweb.s3.amazonaws.com/docs.fortinet.com/v2/attachments/e129c4eb-867b-11eb-9995-00505692583a/FortiOS_7.0_AWS_Administration_Guide.pdf

 

But we having issue with https ssl blocking with probe cert failed both IN dan OUT https traffic to/from Internet.

The issue will happen when:

1. if policy using flow based mode, utm av+ips+ssl-inpsection, the traffic not block by ssl

2. if policy using proxy based mode, utm with av+ips+ssl-inpsection, the traffic block by ssl

3. if policy using proxy based mode, utm with  ssl-inspection only (no av, no ips), tthe traffic block by ssl

 

Already using cert-probe-failed ALLOW

According to this reference

https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-allow-HTTPS-port-443-traffic-when/ta-p/200844

 

Now not blocking SSL, But..... the traffic IN and OUT , from / to INTERNET for https, is slow / not like normal behavior traffic if we test using curl from ec2 amazon Linux.

 

 

Did anyone having same issue?

How to resolve this?

 

 

 

 

 

2 replies

Netadmin-Japfa
New Member
May 16, 2023

This is what happen when using using 

policy using proxy based mode, utm with av+ips+ssl-inpsection, the traffic block by ssl

 

at VPC A, of EC2

ssm.jpg

Netadmin-Japfa
New Member
May 17, 2023

can anyone help? Please...

Thought Leadership. Security Summit. Thursday, November 12th, PGA National Resort, Palm Beach Gardens, FL.
Thought Leadership. Security Summit. Thursday, October 8th. Disney's Grand Californian Hotel & SPA, Anaheim, CA.
Security Operations Summit: Modernize SecOps. Operate AI-Native.AMER: November 4 | 9:00 AM PST. India and SAARC: November 5 | 10:00 AM IST. EMEA: November 5 | 10:30 AM CET. APAC: November 5 | 11:00 AM SGT