Question about Deep Inpection and Certificate problem with WebEx

Forum|Forum|9 years ago
May 12, 2017
3 replies
12078 views

Hello,

We use FortiGate 3700D running FortiOS v5.2.3 build670 (GA), managed from FortiManager v5.2.2-build0706 150415.

We've deployed the builting Fortinet certificate "Fortinet_CA_SSLProxy.cer" on all workstations.

We've a policy with "SSL/SSH Inspection" and "Application Sensor" Profile to manage WebEx communications (allow audio/video and deny remote control or other features).

But we obtain a certificate error when we use WebEx (see attachment): "you cannot connect to audio or video because we cannot validate the security certificate to your WebEx site".

Do you know how to avoid this pop-up?

Regards, Chris

webex-popup.jpg

5.2

Best answer by hmtay_FTNT

Hi Chris,

>>In our case, we use deep-inspection specificly for WebEx to be able to filter the different Applications included in WebEx (Desktop.Sharing, Download, Upload, Sharing, Remote.Control, WhiteBoard...) and deny some of them. Thus we can't set an exemption for "*.webex.com" in the SSL profile, if not we'll lost the Application Filter?

Yes, if you are doing deep-inspection specifically for WebEx only, then exempting it in the SSL profile would defeat the purpose. Unfortunately, there is not much we could do here to make the native application accept any SSL Certificates but their own.

HoMing

hmtay_FTNT

Staff

Hello Chris,

SSL deep-inspection unfortunately only works for WebEx when accessed from the browser - harder to do certificate pinning on browsers than on native applications. On the native applications, they employ certificate pinning and hence you got the error when deep-inspection is enabled. They do not accept any certificates but their own. To get around this while maintaining deep-inspection, you can set an exemption in the SSL profile.

HoMing

chrbarAuthor

New Member

hmtay wrote:
To get around this while maintaining deep-inspection, you can set an exemption in the SSL profile.

Thanks HoMing for this good explaination.

In our case, we use deep-inspection specificly for WebEx to be able to filter the different Applications included in WebEx (Desktop.Sharing, Download, Upload, Sharing, Remote.Control, WhiteBoard...) and deny some of them.

Thus we can't set an exemption for "*.webex.com" in the SSL profile, if not we'll lost the Application Filter?

Regards,

Chris

hmtay_FTNTAnswer

Staff

Hi Chris,

>>In our case, we use deep-inspection specificly for WebEx to be able to filter the different Applications included in WebEx (Desktop.Sharing, Download, Upload, Sharing, Remote.Control, WhiteBoard...) and deny some of them. Thus we can't set an exemption for "*.webex.com" in the SSL profile, if not we'll lost the Application Filter?

Yes, if you are doing deep-inspection specifically for WebEx only, then exempting it in the SSL profile would defeat the purpose. Unfortunately, there is not much we could do here to make the native application accept any SSL Certificates but their own.

HoMing

Sign up

Login with SSO

Login to the community

Login with SSO