How does SSL inspection factor in with IPsec VPNs?

Question

I have a successful SSL inspection policy enabled with AV scanning as well on my Fortigate 50E. I have the following policy configured on the LAN-Internet policy. SSL inspection is configured to inspect all ports:

edit 1
        set name "LAN-Internet"
        set uuid 3fb6d2ee-fc17-51e7-e50e-699ed85aaff6
        set srcintf "lan"
        set dstintf "wan1"
        set srcaddr "all"
        set dstaddr "all"
        set action accept
        set schedule "always"
        set service "ALL"
        set utm-status enable
        set av-profile "default"
        set profile-protocol-options "default"
        set ssl-ssh-profile "custom-deep-inspection"
        set nat enable
    next

If I next create a site-to-site IPsec VPN, does this mean that traffic going to/from the other side of the VPN tunnel is also being inspected? (This would be un-ideal since that traffic is generally trusted, and I'd rather conserve firewall resources by not scanning this traffic). Do I need to setup exclusions in the SSL inspection configuration for the remote subnets?

neonbit · Accepted Answer

No it won't. When you create the IPSEC VPN it will create a new interface (lets call it VPN1).

You will then need to create policies from lan > VPN1 and VPN1 > lan. Just disable AV and SSL inspection for those policies and the firewall wont scan the VPN traffic.

Sign up

Login with SSO

Login to the community

Login with SSO