Disable SSL/SSH Inspection in FortiOS 5.6

[bcote]

Hi all,

still in pre-production but I was wondering how I can turn off the now(since 5.6) forced SSL/SSH inspection. I know it is becoming more and more necessary, but for now, in our environment, it is causing us much more headaches than benefits. Eventually, we want to get there, but the time isn't now. I was told there is a way in the CLI to turn it off. I can't seem to find the right cookbook/Document explaining how. 

Anybody running 5.6 that might know where to look to get this turned off? All the info I can find dates back to 5.2 and the same commands don't apply to 5.6 anymore.

Any help will be greatly appreciated.

Ben

[emnoc]

I agreed that SSL-SSH inspection is nothing to  worried about. Just build a dummy profile and use that with inspect disable and apply that to all policies that you don't need that level of inspection. It's really that simple.

Ken

[sebastan_bach]

Hi, 

Thanks for your responses. Roman why would somebody ever enable Deep SSL Inspection for all the traffic on the firewall and kill it's performance. We want to enable deep-inspection for different saas applications for different users. This is really painful from a firewall perspective that does not provide that granularity which was possible in the profile mode where we could have different SSL inspection policies on a per rule basis. Which is clearly not possible in the policy based NGFW mode. 

not sure why you mentioned there are only few minor issues with 5.6 NGFW mode. 

This mode sets the device in flow mode and doesn't allow to set DLP either from GUI or even from CLI. DLP is neither visible in the feature visibility section under system. 

URL-Filtering would work but there are no logs for the same, how useful do you think that is to use.  

The application lookup goes all the way till the deny rule even though the application is matched in a another rule. This bug has been since 5.6 is all the way up to the new 6.0 release as well. 

With these limitations and bugs the policy based NGFW mode is clearly not usable at all. Hence I mentioned it's a release that one should stay away from. Unless I am wrong then please correct me. 

Sebastan

[sebastan_bach]

Hi ZeroInterrupt, 

Yes I have enabled in multiple security profile function under feature visibility in system settings. However, please note this functionality of using different SSL inspection profiles is only available when the device is operating in profile mode in flow or proxy mode. This flexibility goes for a toss when the device is operating in Policy based NGFW mode. 

Try it out yourself to see it. Stay away from policy based NGFW mode in 5.6.

Sebastan

[romanr]

Hi,

sebastan_bach wrote:

We want to enable deep-inspection for different saas applications for different users. This is really painful from a firewall perspective that does not provide that granularity which was possible in the profile mode where we could have different SSL inspection policies on a per rule basis. Which is clearly not possible in the policy based NGFW mode. 

Then you shouldn't use NGFW mode maybe?

The usecase for NGFW mode would most likely be an enterprise, which wants to deep inspect everything and only does exempts on what not to scan. In this way this is built and this can be done. You still can use the exempt function in your deep inspection profile to choose what to scan and what not....

sebastan_bach wrote:

not sure why you mentioned there are only few minor issues with 5.6 NGFW mode. 

I did mention, there are minor issues with 5.6.3 (meaning standard policy mode!!)... Look in my earlier postings, where I cleary state, that NGFW fireall mode in 5.6.3 is more like a tech-preview and in my opinion not built for production right now....

sebastan_bach wrote:

This mode sets the device in flow mode and doesn't allow to set DLP either from GUI or even from CLI. DLP is neither visible in the feature visibility section under system. 

URL-Filtering would work but there are no logs for the same, how useful do you think that is to use.  

The application lookup goes all the way till the deny rule even though the application is matched in a another rule. This bug has been since 5.6 is all the way up to the new 6.0 release as well. 

With these limitations and bugs the policy based NGFW mode is clearly not usable at all. Hence I mentioned it's a release that one should stay away from. Unless I am wrong then please correct me. 

I never said, that one should use NGFW firewall mode. And I don't understand why you do use it... I am sure no one from Fortinet told you to do so and an experienced system integrator would also try to put this not into prodution.... You are using an tech preview feature and therefore blaming the whole release not to be production ready - and here I totally disagree with you -> Because things work out in the traditional mode (be it proxy or flow) as they should (with minor issues to be fixed...)

Br,

Roman

[cabhilai]

I am also facing some issues with FortiOS 5.6. recently updated FortiOS from 5.4 to 5.6. Some windows PC get blue screen and restarted while using Firefox browser. 

Can any one suggest solution.

[marco_d]

I have also problems with the ssl inspection i think. At the moment i can not access google.com and news.google.com also when i set the webfilter to defaul with all allowed its not working. When i disable the webfilter and have no ssl inspection than it works. So i think the problem is with the ssl inspection cause before in the Version 5.4 all was working fine.