Skip to main content
Guizado
Guizado
New Member
April 20, 2017
Solved

Weird Behaviour With SSL Inpection and Web Filtering?

  • April 20, 2017
  • 1 reply
  • 17880 views

Hello all,

I am having some issues with WEB Filtering and SSL Inspection / Deep Inspection.

So the first behaviour is, when using "Certificate Inspection" and "Inspect All Ports" IS NOT ticked, and I try to browse lets say a gambling site I get the "Web Page Blocked" splash screen by the Fortigate, so no problem, expected behaviour.

 

Now the same thing but with "Inspect All Ports" ticked and trying to browse the same website the Website is allowed.

 

 

Now lets try the same but with "Deep Inspection" instead of "Certificate Inspection"

Any options with "Inspect all Ports" enabled or disabled result on "This Page can't be displayed".

So Conclusion:

"Certificate Inspection":

Inspect All Ports Ticked = Gambling Page is not blocked, normal access to page. Inspect all Ports is not Ticket and HTTPS = 443 = Fortigate Splash Screen "Web Page is Blocked" as Expected.

 

Deep Inpection: "This Page can't be displayed".

Finnally any sites I visit that are HTTP and not HTTPS I do get the Fortigate blocking Splash Screen.

 

Am I missing something is the behaviour normal?

 

Many Thanks

    Best answer by hmtay_FTNT

    Hello Guizado,

     

    Let's go through your case one by one:

     

    >>Inspect All Ports Ticked = Gambling Page is not blocked, normal access to page.

    Can I know which FortiOS are you using, there was a bug with Inspect All Ports with Proxy use.

     

    >>Inspect all Ports is not Ticket and HTTPS = 443 = Fortigate Splash Screen "Web Page is Blocked" as Expected.

    If you are doing certificate-inspection and you get a replacement message on a HTTPS site, that means you did import the SSL Certificate onto your trusted Root CA list correctly, am i right? If the replacement message page loads automatically, that means you most likely imported the certificate. If you got an error message first and had to click "Advanced", you most likely did not import the certificate.

     

    >>Deep Inpection: "This Page can't be displayed".

    If you imported the correct SSL Certificate, this should not happen.

     

    Did you do something like this?

    http://cookbook.fortinet.com/preventing-certificate-warnings/

     

    HoMing

     

    1 reply

    hmtay_FTNT
    Staff
    hmtay_FTNTAnswer
    Staff
    April 21, 2017

    Hello Guizado,

     

    Let's go through your case one by one:

     

    >>Inspect All Ports Ticked = Gambling Page is not blocked, normal access to page.

    Can I know which FortiOS are you using, there was a bug with Inspect All Ports with Proxy use.

     

    >>Inspect all Ports is not Ticket and HTTPS = 443 = Fortigate Splash Screen "Web Page is Blocked" as Expected.

    If you are doing certificate-inspection and you get a replacement message on a HTTPS site, that means you did import the SSL Certificate onto your trusted Root CA list correctly, am i right? If the replacement message page loads automatically, that means you most likely imported the certificate. If you got an error message first and had to click "Advanced", you most likely did not import the certificate.

     

    >>Deep Inpection: "This Page can't be displayed".

    If you imported the correct SSL Certificate, this should not happen.

     

    Did you do something like this?

    http://cookbook.fortinet.com/preventing-certificate-warnings/

     

    HoMing

     

    Guizado
    GuizadoAuthor
    New Member
    April 21, 2017

    Hello thanks for your reply.

     

    The Certificate was created in the Fortinet, downloaded and signed by our Enterprise CA, and imported back, I am using this same certificate for "Certificate Inspection" and "Deep Inspection", the CA Server that signed the certificate is trusted on all our client Machines.

    I am not getting any Certificate warnings, its either the page gets blocked properly, or a page cannot be displayed error as if I had no Internet gets displayed with Deep Inspection.

    My version is 5.2.2 (642)

    hmtay_FTNT
    Staff
    hmtay_FTNT
    Staff
    April 21, 2017

    Hello Guizado,

     

    Can you upgrade your FortiOS 5.2 to the latest 5.2 available? 5.2.2 is a very old version and there has been bug fixes on many features including deep-inspection.

     

    https://info.fortinet.com/files/FortiOS/v5.00/images/build0670/fortios-v5.2.3-release-notes.pdf

     

    265375 - In deep-inspection mode, the server certificate chain validation may not be handled correctly.   Unlike going from 5.2 to 5.4 or 5.6, you are unlikely to go through major updates. Getting the most updated FortiOS is important if you are using deep-inspection in proxy-mode - more so if you use Chrome. Chrome very frequently comes up with new cipher-suites and we have to add support for those cipher-suites.    If you can give it a try and it still does not work, do let me know.    HoMing
    Terms & ConditionsAccessibility statement