Skip to main content
BrianV
BrianV
New Member
July 16, 2017
Question

FortiOS 5.6 - SSL Inspection Settings Greyed Out

  • July 16, 2017
  • 2 replies
  • 25958 views

I've got a 60D running 5.6. I'm trying to enable some simple IPS rules like RDP brute force, FTP brute force, etc. Enabling the IPS on a policy requires adding SSL Inspection to the same policy. While I don't mind cert inspection, I don't want to do deep inspection. Granted, I'm not routing traffic through a MITM proxy on the Fortigate, all of the "deep-inspection" settings are on but entirely greyed out. I can't for the life of me figure out how do adjust any of these settings.

 

Any advice? Image attached.

    2 replies

    BrianV
    BrianVAuthor
    New Member
    July 16, 2017

    JFYI, I've somewhat circumvented this by enabling "Mutliple Security Policies" which now at least allows me to create separate SSL inspection policies and enable them on each policy accordingly.

    hmtay_FTNT
    Staff
    hmtay_FTNT
    Staff
    July 17, 2017

    Hello Brian,

     

    What you did was correct. You were trying to modify the default "deep-inspection" profile which is not allowed now in 5.6. To create a different one, you need to allow "Multiple security profiles" and create a new one.

     

    As for the question of the Fortigate forcing an SSL-Inspection profile on a policy, if you select certificate-inspection, the Fortigate is not doing a MiTM. It is only scanning the hostname.

     

    Homing

    isisjerry
    isisjerry
    New Member
    August 11, 2017

    I don't see how creating a second SSL-Inspection profile allows me to turn off that feature. It allows me to change some traits but I still can't disable it completely.

    In case you are wondering how to turn on "Multiple security profiles": 

    System > Feature Visibility > Multiple Security Profiles

    Jerry

    Terms & ConditionsAccessibility statement