Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
bcote
New Contributor

Disable SSL/SSH Inspection in FortiOS 5.6

Hi all,

 

still in pre-production but I was wondering how I can turn off the now(since 5.6) forced SSL/SSH inspection. I know it is becoming more and more necessary, but for now, in our environment, it is causing us much more headaches than benefits. Eventually, we want to get there, but the time isn't now. I was told there is a way in the CLI to turn it off. I can't seem to find the right cookbook/Document explaining how. 

 

Anybody running 5.6 that might know where to look to get this turned off? All the info I can find dates back to 5.2 and the same commands don't apply to 5.6 anymore.

 

Any help will be greatly appreciated.

Ben

1 Solution
bstevens
New Contributor II

Upgraded from 5.4.x to 5.6.3 recently. Seemingly the forced SSL Inspection has wreaked havoc on web browsing.  Cert errors and web filter is now filtering out images that were not previously filtered.   If there is a way to turn off the forced ssl/ssh inspection I'd love to know as well.  At this point I'm not sure how to fix the issues short of turn off all Security profile options in the polices, which seems like a really bad fix.

View solution in original post

15 REPLIES 15
emnoc
Esteemed Contributor III

I agreed that SSL-SSH inspection is nothing to  worried about. Just build a dummy profile and use that with inspect disable and apply that to all policies that you don't need that level of inspection. It's really that simple.

Ken

 

PCNSE 

NSE 

StrongSwan  

PCNSE NSE StrongSwan
sebastan_bach

Hi, 

 

Thanks for your responses. Roman why would somebody ever enable Deep SSL Inspection for all the traffic on the firewall and kill it's performance. We want to enable deep-inspection for different saas applications for different users. This is really painful from a firewall perspective that does not provide that granularity which was possible in the profile mode where we could have different SSL inspection policies on a per rule basis. Which is clearly not possible in the policy based NGFW mode. 

 

not sure why you mentioned there are only few minor issues with 5.6 NGFW mode. 

 

This mode sets the device in flow mode and doesn't allow to set DLP either from GUI or even from CLI. DLP is neither visible in the feature visibility section under system. 

URL-Filtering would work but there are no logs for the same, how useful do you think that is to use.  

The application lookup goes all the way till the deny rule even though the application is matched in a another rule. This bug has been since 5.6 is all the way up to the new 6.0 release as well. 

 

With these limitations and bugs the policy based NGFW mode is clearly not usable at all. Hence I mentioned it's a release that one should stay away from. Unless I am wrong then please correct me. 

 

Sebastan

 

 

 

sebastan_bach

Hi ZeroInterrupt, 

 

Yes I have enabled in multiple security profile function under feature visibility in system settings. However, please note this functionality of using different SSL inspection profiles is only available when the device is operating in profile mode in flow or proxy mode. This flexibility goes for a toss when the device is operating in Policy based NGFW mode. 

 

Try it out yourself to see it. Stay away from policy based NGFW mode in 5.6.

 

Sebastan

 

romanr

Hi,

 

sebastan_bach wrote:

We want to enable deep-inspection for different saas applications for different users. This is really painful from a firewall perspective that does not provide that granularity which was possible in the profile mode where we could have different SSL inspection policies on a per rule basis. Which is clearly not possible in the policy based NGFW mode. 

 

Then you shouldn't use NGFW mode maybe?

The usecase for NGFW mode would most likely be an enterprise, which wants to deep inspect everything and only does exempts on what not to scan. In this way this is built and this can be done. You still can use the exempt function in your deep inspection profile to choose what to scan and what not....

 

sebastan_bach wrote:

not sure why you mentioned there are only few minor issues with 5.6 NGFW mode. 

 

 

I did mention, there are minor issues with 5.6.3 (meaning standard policy mode!!)... Look in my earlier postings, where I cleary state, that NGFW fireall mode in 5.6.3 is more like a tech-preview and in my opinion not built for production right now....

 

sebastan_bach wrote:

This mode sets the device in flow mode and doesn't allow to set DLP either from GUI or even from CLI. DLP is neither visible in the feature visibility section under system. 

URL-Filtering would work but there are no logs for the same, how useful do you think that is to use.  

The application lookup goes all the way till the deny rule even though the application is matched in a another rule. This bug has been since 5.6 is all the way up to the new 6.0 release as well. 

With these limitations and bugs the policy based NGFW mode is clearly not usable at all. Hence I mentioned it's a release that one should stay away from. Unless I am wrong then please correct me. 

I never said, that one should use NGFW firewall mode. And I don't understand why you do use it... I am sure no one from Fortinet told you to do so and an experienced system integrator would also try to put this not into prodution.... You are using an tech preview feature and therefore blaming the whole release not to be production ready - and here I totally disagree with you -> Because things work out in the traditional mode (be it proxy or flow) as they should (with minor issues to be fixed...)

 

Br,

Roman

cabhilai

I am also facing some issues with FortiOS 5.6. recently updated FortiOS from 5.4 to 5.6. Some windows PC get blue screen and restarted while using Firefox browser. 

Can any one suggest solution.

marco_d

I have also problems with the ssl inspection i think. At the moment i can not access google.com and news.google.com also when i set the webfilter to defaul with all allowed its not working. When i disable the webfilter and have no ssl inspection than it works. So i think the problem is with the ssl inspection cause before in the Version 5.4 all was working fine.

Top Kudoed Authors