FortiGate Next Generation Firewall utilizes purpose-built security processors and threat intelligence security services from FortiGuard labs to deliver top-rated protection and high performance, including encrypted traffic.
This article describes how to optimize FortiGate SSL Inspection by balancing Security and Performance.
Scope
FortiGate.
Solution
Network security is not complete without SSL inspection, which enables businesses to look into encrypted communication for possible risks. However, if done improperly, adopting SSL inspection might have an adverse effect on performance. This knowledge base article offers little-known advice for FortiGate device optimization of SSL inspection, assuring both security and performance.
Custom Certificate Authorities: Use a bespoke Certificate Authority (CA) rather than FortiGate's pre-installed SSL inspection certificate. This reduces SSL inspection errors on client devices and boosts user trust.
Selective Inspection: SSL inspection is not required for all traffic. Use policies to selectively apply SSL inspection only to certain user groups or applications that pose higher security risks.
Whitelisting Trusted Sites: Add the crucial websites to the SSL inspection whitelist after identifying the ones that are used frequently. By doing this, the processing burden of verifying traffic to trustworthy destinations is reduced.
Exclusion of Encrypted Content: Configure the SSL inspection profile to exclude certain types of encrypted content, such as media files or archives, from inspection to save resources.
SSL Inspection Profile Customization: Customize SSL inspection profiles based on the organization's needs. Optimize compatibility and performance by changing parameters like cipher suites and SSL protocol versions.
Session Cache Tuning: Optimize SSL session caching settings to reduce the overhead of repeated handshakes during a browsing session.
Flow-based Inspection: In high-throughput scenarios, consider using flow-based SSL inspection to improve performance. Flow-based inspection is suited for large files and streaming content.
Hardware Offloading: Verify whether SSL offloading is supported by the FortiGate model. Performance can be greatly improved by offloading SSL processing to specialized hardware modules.
SNI-Based Inspection: Utilize Server Name Indication (SNI)-based inspection to efficiently inspect traffic for specific domains, saving resources by excluding others.
Performance Monitoring and Tuning: Continuously monitor performance metrics related to SSL inspection. Adjust settings based on usage patterns and performance benchmarks.
Conclusion:
A crucial part of defending networks from encrypted attacks is played by SSL inspection. Finding the ideal mix between performance and security is crucial, though. Administrators may optimize SSL inspection on their FortiGate devices by applying the less well-known advice presented in this article, ensuring that security is not jeopardized while retaining network performance.
