|
After upgrading to v7.2.7, web filtering with deep packet inspection in explicit proxy policies fails to block access to HTTPS websites, while HTTP sites are restricted correctly. Instead of the certificates signed by the FortiGate Deep Inspection CA, the original server certificate is displayed in the browser.
This issue arises specifically when additional ports for HTTP, such as 443, are included under profile protocol options.
Sample configuration:
config firewall proxy-policy
edit 1
set proxy explicit-web
set dstintf "wan"
set srcaddr "all"
set dstaddr "all"
set service "webproxy"
set action accept
set schedule "always"
set logtraffic all
set utm-status enable
set logtraffic-start enable
set webfilter-profile "Proxy"
set profile-protocol-options "standard" <-----
set ssl-ssh-profile "custom-deep-inspection" <-----
config firewall profile-protocol-options
edit "standard"
config http
set ports 80 443 8443 8080 <-----
unset options
unset post-lang
next
next
end
This issue has been resolved in FortiOS v7.4.4, v7.6.0.
Workaround:
Remove additional ports for HTTP under profile-protocol-options.
config firewall profile-protocol-options
edit "standard"
config http
set ports 80
unset options
unset post-lang
next
next
end
|
