Deep inspection of incoming traffic from internet to VIP

[FortiAdam]

Does anyone have any experience with deep inspection of incoming traffic such as SSH or SSL? Surely if the fortigate can ispect the traffics outgoing it must be able to do the same for incoming traffic? I' m looking to do this on 5.0.7 using a VIP that port forwards 443. How can the antivirus and other UTM work effectively without deep inspection of SSL sessions?

[lightmoon1992]

FortiGate has the ability to look into the incoming encrypted traffic, same concept of the outgoing, however you may chose to offload all the encryption also from your server to the FortiGate itself. For the AV scanning to be efficient, you need to understand what you are scanning before you do. in another word, in order to do efficient scanning, you need to decrypt the traffic so as of then you can apply scanning to it Mohammad

[FortiAdam]

OK so can you give me an idea of how I would accomplish this with 5.0.7? Wouldn' t the firewall need the certificate from the webserver? I don' t see how you could avoid browser certificate errors otherwise.

[lightmoon1992]

This is how you do it: 1- For the certificate, either you select to live with one of the existing FortiGate self signed certificates (which will display you the warning anyway), or you import your signed certificate ( via Symantec, Network Solutions, GoDay,etc) 2- Enable load balance functionality under system-config-feature 3- Create virtual server under firewall object-load balance - virtual server which represents the socket you are willing to advertise. you may select https under type drop down list, and then below you will have ssl offloading option enabled. here you select which certificate will be used and how the FortiGate will act on this socket. 4- Create real server under firewall object - load balance - virtual server 5- Finally, create external to internal firewall policy to include the virtual server created before Mohammad

[FatalHalt]

Hey guys, I was wondering if someone could help me with this? I followed the steps from the post above, and now have a virtual server on one of my unused public IPs at port 443, and it' s passing to a real server inside on port 443. Using the fortigate certificate.

config firewall vip
  edit " vip.srv.ssloffload" 
         set type server-load-balance
         set extip xxx.xxx.xxx.xxx
         set extintf " wan2" 
         set server-type https
         set extport 443
             config realservers
                 edit 1
                     set ip xxx.xxx.xxx.xxx
                     set port 443
                 next
             end
         set ssl-mode full
         set ssl-certificate " Fortinet_CA_SSLProxy" 
     next
 end

For the policy, I included application control, as I would like to be able to tell if the traffic is OWA or Active Sync. But the logs just show HTTPS, with no application. Any ideas how I can get this to populate?

config firewall policy
     edit 113
         set srcintf " wan2" 
         set dstintf " port1" 
         set srcaddr " all" 
         set dstaddr " vip.srv.ssloffload" 
         set action accept
         set schedule " always" 
         set service " HTTPS" 
         set utm-status enable
         set logtraffic all
         set ips-sensor " default" 
         set application-list " Monitor_All" 
         set profile-protocol-options " default" 
         set deep-inspection-options " default" 
     next
 end

[MichaelM]

Hi,

I would like to bring this up as well. We had it all working like you needed to, a VirtualServer did the SSL offloading for a Microsoft Exchange Server serving OWA and ActiveSync via HTTPS.

Internet <-> FG <-> Exchange Server

With 5.2.2 we are having nothing but trouble, it was the admins fault not reading the release notes in detail (tiny details) but not  having a backup made it even worse.

All we see for incoming traffic is Application SSL, which is kinda useless. We are checking for Applications like ActiveSync, Outlook Anywhere etc ... this all does not work any longer.

The support team challenged us to send tons of support output, even wanted us to manually decrypt the traffic from a packet trace via wireshark, which did not worked, no further steps taken on this path, waste of time. The last statement from the support team was:

-----------

 I was discussing your issue with our engineering. Marking application as SSL is correct behavior. The reason is, that the Fortigate unit doesn't terminate the communication. 

Communication is following: client ----SSL encrypted------FGT-------SSL encrypter-------Exchange. FGT unit is opening SSL connection to Exchange server on port 443. Communication  between FGT and Exchange is encrypted and FGT can't see content of packets, so it's not able to mark application as ActiveSync/Outlook.  To have this type of traffic correctly marked as ActiveSync/Outlook, you need to configure Exchange server to listen on HTTP not HTTPS. 

-----------

What is going wrong here, the appliance is doing the offload, so it's there in cleartext.

Any help highly appreciated.

--Michael

[seadave]

This type of setup needs to be added to the next Cookbook.  How to decrypt incoming SSL traffic and identify applications.

[mlohmiller]

I am having this exact issue. Please tell me there was another solution other than not to use HTTPS.