FortiGate
FortiGate Next Generation Firewall utilizes purpose-built security processors and threat intelligence security services from FortiGuard labs to deliver top-rated protection and high performance, including encrypted traffic.
anil_nayak_FTNT
Description
This article explains how to block web-based chat on Gmail webmail using App Sensor + SSL Inspection.

Solution
1.) Configure Application Sensors Profile.

Go to Security Profile> Application Control> Application sensors.
Go to your application sensor profile ( or create a new profile).
In the application sensor create application sensor policy.
Click “+Create New” which is under “Enable Web Site Filter”.

aniln_FD35130_tn_FD35130-1.jpg

Set Action as 'BLOCK'.
Click “OK”.

aniln_FD35130_tn_FD35130-2.jpg

Click Apply.

2.) Create SSL Inspection Policy.

Go to Policy> Policy> SSL Inspection.
Make sure Protocol: HTTPS is checked.

aniln_FD35130_tn_FD35130-3.jpg

Click “Apply”.

 3.) Bind to Policy.

Go to Policy> Policy> Policy.
Select the correct policy.
Enable Application sensor and SSL inspection, and bind it to the correct profile.
Note that if you do not enable multiple security profiles, it would point to the default profile.

aniln_FD35130_tn_FD35130-4.jpg

Click “OK”

 4.) After this has been done, all https traffic which matches the policy will have a warning in certificate in the user’s web browser.

When ssl inspection is enabled, certificate warning would come up for other https sites which is an expected behaviour. To overcome this warning a Fortinet_CA-SSL proxy certificate has to be imported into the Trusted CA section on the browser as per below the related KB article 'Technical Note : Importing the FortiGate SSL Proxy certificate in Internet Explorer 8 (IE8) for decryption on SSL Inspection'.

aniln_FD35130_tn_FD35130-5.jpg

5.) Open gmail.com and verify that web-based chat feature in gmail is blocked.

A page similar to the one shown below should be seen.

aniln_FD35130_tn_FD35130-6.jpg

Related Articles

Technical Note : Importing the FortiGate SSL Proxy certificate in Internet Explorer 8 (IE8) for decr...

Contributors