Webfilter & App Control DONT's WORK :'(

Forum|Forum|4 years ago
March 21, 2022
4 replies
4634 views

I have a problem with the webfilter and app control of my Fortigate60E

I am blocking EVERYTHING that is remote access and it is not working, which it is but if I go to Log&Report>FowardTraffic absolutely NOTHING is reflected in "Application Name", which makes me assume that my traffic passes without SSL inspection.

I'm using a basic Monitoring setup profiel on App Control and Webfilter, and it doesn't work either, I don't really see anything.

What's going on?

FortiGate

Best answer by wamendoza

yes, that's right, there was a crash related to ipsengine process so the restart of the ips engine was carried out using the CLI

" diagnose test application ipsengine 99".

Thanks for all your time Sir. :)

jhussain_FTNT

Staff

You need to configure the policy with deep inspection .When using SSL Certificate Inspection, the SSL Handshake is not interrupted, but the FortiGate reads the CN part of the certificate. This CN part, has the URL for the certificate was signed to. This way, the FortiGate has an URL to check into its categories database. But the TLS/SSL content is not read in any way.

When you use deep inspection, the FortiGate impersonates the recipient of the originating SSL session, then decrypts and inspects the content to find threats and block them. It then re-encrypts the content and sends it to the real recipient.

Kindly refer the below document

https://community.fortinet.com/t5/FortiGate/Technical-Note-Differences-between-SSL-Certificate-Inspection/ta-p/192301

https://docs.fortinet.com/document/fortigate/6.2.0/cookbook/122078/deep-inspection

wamendozaAuthor

Explorer II

Hi

After reviewing traffic flow diagram a bit and understanding that the IPS ENGINE encompasses all the traffic inspection(app control, webfilter, av, etc) , i realized that the ipsengine was not running in the "dig sys top",