SSL Decryption Exclusion List

Forum|Forum|4 years ago
July 21, 2022
4 replies
3995 views

Hello community,

I'm looking for a list with SSL Decryption exlusions which are not in the default Deep Inspection Profile.

Things like skype, citrix and apple, which are already are excluded.

I'm facing issues with (for example) gotomeeting and other apps. Maybe someone can share a resource with this kind of information (ip and/or fqdn).

Sure, troubleshooting is possible. But if someone already solved this case, it would help the community. And this is just an example. A list to contribue would be great.

Thank you

/Michael

FortiGate

Anthony_E

Staff

Hello Michael,

Thank you for using the Community Forum.

I will seek to get you an answer or help. We will reply to this thread with an update as soon as possible.

Regards,

Best Regards

Anthony_E

Staff

Hello Michael,

I am still looking it is possible to get a list as requested.

Meanwhile, I am sharing this document:

https://docs.fortinet.com/document/fortigate/6.2.0/cookbook/122078/deep-inspection

Could you please tell me if it is helping?

Regards,

Best Regards

lummi

Visitor III

Hi Michael,

I would suggest you to use the "Internet Service Database" objects for this. These are dynamic objects maintained by Fortinet including IPs / Ports for specific services (contract required). So you would create two firewall policies - one for the default web traffic with deep inspection enabled and a second one above with Internet Service Object as destination and deep inspection disabled. Worked perfect for me in the past.