| Description | This article describes a possible troubleshooting step to allow websites blocked as a result of Cloudflare encrypted client hello (ECH) protocol. |
| Scope | FortiGate with DPI. |
| Solution |
If some websites are not accessible because of Cloudflare's ECH protocol during TLS handshake and firewall policy managing the source devices using DPI, exempting Cloudflare's ECH FQDN address in the relevant SSL-SSH profile will allow the traffic.
More information about Encrypted Packet Hello and how to block it in the following KB article: Technical Tip: How to block TLS 1.3 Encrypted Client Hello (ECH) in FortiGate firewalls |
