Deep Packet Inspection pinning

[fran1942]

Hello, I am running SSL deep packet inspection (proxying users SSL queries) via my firewall.

I have noticed that some websites fail until I make an exception for them. I understand this is normally due to public key pinning (HPKP).

However I have run numerous tests on these websites and they do not seem to be using public key pinning.

What other reasons could there be for Deep Packet Inpsection failing on some HTTPS websites ?

Thank you.

[EMES]

What version of code are you running? You can run a few debug commands to see what is happening during the ssl session, from the ssl side of things.

[fran1942]

Hello I am running firmware version v5.4.1,build1064 (GA).

What commands can I run to debug what is blocking SSL deep packet inspection.

Thank you kindly.

[hmtay_FTNT]

Hello fran,

I posted the debug commands here:

https://forum.fortinet.com/tm.aspx?m=148759&tree=true >>What other reasons could there be for Deep Packet Inpsection failing on some HTTPS websites ?

If you are using proxy-mode:

If you are using an older OS, in your case 5.4.1, the latest 5.4 is 5.4.4, there might be known bugs that have been fixed in the new versions.

If you are using flow-mode:

You can ask support for the latest stable IPS Engine. Deep-inspection done in flow-mode uses a proprietary protocol that does not modify the SSL packets. This means that we update it very frequently as new ciphers are released. Google, as of late, has been trying out a lot of new ciphers on Chrome and even Firefox has followed. In this case, you would need the latest IPS Engine to decrypt those sessions. In proxy-mode, the FortiGate could strip away ciphers that it does not support. Therefore, it is not going to fail because of an unsupported cipher. In flow-mode, the IPS Engine does not strip away ciphers that it does not support. If it does not support a new cipher, the IPS Engine will not be able to decrypt the session.  In case you are wondering, the advantage of the design of the flow-mode decryption is the speed. The most likely sites to run into problems are Google sites. Since it takes modifications on both ends - client and server - other sites would need time to keep themselves up-to-date.

Hope this helps!

HoMing