Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
mseiler0815
New Contributor II

Check if Traffis was decrypted

Hello community,

 

I'm just playing around with the TLS Decryption.

 

It's working for my client. But now I want to see in the Fortimanager if the Traffic was decrypted.

 

There are several apps shown in the logs.

 

-SSL

-HTTPS.Browser

-...TLS.V1.2

 

How do I know from the logs that the traffic was decrypted?

 

Is there a flag if I go into traffic details?

 

I know another firewall which has a flag "Decrypted" and a log which shows the shift from port 443 to 80 but still application TLS.

 

Thank you

 

Regards

 

Michael

10 REPLIES 10
Anonymous
Not applicable

Hello @mseiler0815 ,
 
Thank you for using the Community Forum. I will seek to get you an answer or help. We will reply to this thread with an update as soon as possible.
 
Thanks, 
akristof
Staff
Staff

Hello,

If you mean how you can check if FortiGate is doing Deep-inspection on traffic and able to inspect full traffic, then in logs, you will not see any explicit flag. You can check which firewall policy was matched and see if deep-inspection profile is used. Best way how to check if FortiGate is doing inspection is to open HTTPS website and check who signed the certificate. If you will see that the server certificate was signed by CA that is on FortiGate, then full inspection is happening.

Adrian
mseiler0815

Hello,

 

yes, thank you. 

Sure, I can see it by checking the certificate.

But I want to see why my IDE or Antivirus or other tools are not working anymore after enabling full inspection. There is no way to check this in the gui why my Bitwarden installation fails when do download start. There is just a general error msg.

Or Iframes on a website which are not shown correctly.

That's why I want to see which connection is decrypted to get an ideo which URL/IP addresses are to whitelist.

Which flag in the logs are you referring to?

 

Regards

 

Michael

akristof

Hi,

You can try to do this:

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Support-SSL-mirroring-in-proxy-mode/ta-p/1...

This will show you all unencrypted communication.

Some applications have problems with deep-inspection especially if you have self-signed CA on FortiGate and some FortiGates might have it's own cert store but you might want to double-check that your PC has this CA installed as trusted root CA.

My suggestion would be if it is known application, you can use ISDB or fqdn to exempt traffic from inspection.

Adrian
mseiler0815

Hi,

 

thank you. The root CA is installed and everythin is running pretty well.

All I need is a flag or an indicator if the traffic was decrypted. I was used to this with another vendor and it safed me plenty of time.

Something like "decryped:yes" in the traffic logs.

 

Regards

 

Michael 

 

akristof

Hi,

Unfortunately, FortiGate does not have this kind of flag. Each log will have policy_id that traffic matched and this can be used to check if deep-inspection is applied. But even this does not mean that deep-inspection is always performed, because maybe traffic is exempted or using non-standard port, etc.

Adrian
Muhammad_Haiqal

Hi Michael,
If you apply deep inspection and hitting that policy, all HTTPS traffic will be decrypted.
However, some webpage is being excluded by default. Example: Windows update, financial etc.

 

Some website did not allow their traffic to be decrypted to maintain the integrity.
If inspection is happening, the traffic will break and application will not working.


Here is some good example:

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Basic-deep-SSL-inspection-configuration/ta...

For the Fortimanager and Fortigate communication, you may consider to create dedicated policy for this and do not apply any security profiles since it is a trusted IP. You may set specific port number if required.

haiqal
mseiler0815
New Contributor II

Hello again,

 

thanks for all the help. I really appreciate it.

I'm familiar with the decryption in general and how to exclude pages with Cert Pinning/HSTS/Mutual Authentication and so on.

 

My default policy is to decrypt as much as possible. Banking and Health excluded.

 

All I need is something like this. (I hope it is ok to post something from another vendor).

 

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClboCAC

I've been working with this for years and it is a timesafer if it comes to troubleshooting)

 

 

Regards

 

Michael 

Muhammad_Haiqal

Hi Michael,

At the moment, Fortigate does not have that logs. However, this is a great feature to be included.

Thank you for sharing with us.
Let me know if you have any concern.

haiqal
Top Kudoed Authors