Check if Traffis was decrypted

[mseiler0815]

Hello community,

I'm just playing around with the TLS Decryption.

It's working for my client. But now I want to see in the Fortimanager if the Traffic was decrypted.

There are several apps shown in the logs.

-SSL

-HTTPS.Browser

-...TLS.V1.2

How do I know from the logs that the traffic was decrypted?

Is there a flag if I go into traffic details?

I know another firewall which has a flag "Decrypted" and a log which shows the shift from port 443 to 80 but still application TLS.

Thank you

Regards

Michael

[Anonymous]

Hello @mseiler0815 ,

Thank you for using the Community Forum. I will seek to get you an answer or help. We will reply to this thread with an update as soon as possible.

Thanks, 

[akristof]

Hello,

If you mean how you can check if FortiGate is doing Deep-inspection on traffic and able to inspect full traffic, then in logs, you will not see any explicit flag. You can check which firewall policy was matched and see if deep-inspection profile is used. Best way how to check if FortiGate is doing inspection is to open HTTPS website and check who signed the certificate. If you will see that the server certificate was signed by CA that is on FortiGate, then full inspection is happening.

[mseiler0815]

Hello,

yes, thank you. 

Sure, I can see it by checking the certificate.

But I want to see why my IDE or Antivirus or other tools are not working anymore after enabling full inspection. There is no way to check this in the gui why my Bitwarden installation fails when do download start. There is just a general error msg.

Or Iframes on a website which are not shown correctly.

That's why I want to see which connection is decrypted to get an ideo which URL/IP addresses are to whitelist.

Which flag in the logs are you referring to?

Regards

Michael

[akristof]

Hi,

You can try to do this:

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Support-SSL-mirroring-in-proxy-mode/ta-p/1...

This will show you all unencrypted communication.

Some applications have problems with deep-inspection especially if you have self-signed CA on FortiGate and some FortiGates might have it's own cert store but you might want to double-check that your PC has this CA installed as trusted root CA.

My suggestion would be if it is known application, you can use ISDB or fqdn to exempt traffic from inspection.

[mseiler0815]

Hi,

thank you. The root CA is installed and everythin is running pretty well.

All I need is a flag or an indicator if the traffic was decrypted. I was used to this with another vendor and it safed me plenty of time.

Something like "decryped:yes" in the traffic logs.

Regards

Michael 

[akristof]

Hi,

Unfortunately, FortiGate does not have this kind of flag. Each log will have policy_id that traffic matched and this can be used to check if deep-inspection is applied. But even this does not mean that deep-inspection is always performed, because maybe traffic is exempted or using non-standard port, etc.

[Muhammad_Haiqal]

Hi Michael,
If you apply deep inspection and hitting that policy, all HTTPS traffic will be decrypted.
However, some webpage is being excluded by default. Example: Windows update, financial etc.

Some website did not allow their traffic to be decrypted to maintain the integrity.
If inspection is happening, the traffic will break and application will not working.

Here is some good example:

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Basic-deep-SSL-inspection-configuration/ta...

For the Fortimanager and Fortigate communication, you may consider to create dedicated policy for this and do not apply any security profiles since it is a trusted IP. You may set specific port number if required.

[mseiler0815]

Hello again,

thanks for all the help. I really appreciate it.

I'm familiar with the decryption in general and how to exclude pages with Cert Pinning/HSTS/Mutual Authentication and so on.

My default policy is to decrypt as much as possible. Banking and Health excluded.

All I need is something like this. (I hope it is ok to post something from another vendor).

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClboCAC

I've been working with this for years and it is a timesafer if it comes to troubleshooting)

Regards

Michael 

[Muhammad_Haiqal]

Hi Michael,

At the moment, Fortigate does not have that logs. However, this is a great feature to be included.

Thank you for sharing with us.
Let me know if you have any concern.