Doubts about benefits os proxy web witouth deep inspection.

[fortimaster]

Hello,

I have doubts about the benefits, regarding security, that a web connection can provide using the proxy without deep inspection. In some cases I connect to private networks that are not public, but I do not manage them, through the web proxy and I do not use deep inspection because there are some incompatibility problems. I wonder if the proxy brings any security benefits, by not analyzing all the traffic it receives (since I don't use deep inspection and they are https connections). Although they are private networks I do not trust them.

Thank you

[Anonymous]

Hello fortimaster, 

Thank you for using the Community Forum. I will seek to get you an answer or help. We will reply to this thread with an update as soon as possible. 

Thanks, 

 Fortinet Community Team 

[Atul_S]

Hello,

As a best practice to use Explicit proxy, one should set the explicit web proxy and explicit FTP proxy Default Firewall Policy Action to Deny. This means that a firewall policy is required to use these explicit proxies, allowing to control access and impose security features.

You can choose to enable the application profile for more granular control over explicit proxy including use of PAC files for access control under explicit proxy configuration.

If you do not want to use ssl inspection with your proxy connections then there is no way Fortigate can do TLS payload decrypt/encrypt and inspect. Please also be informed that if you choose to use UTM profiles including SSL deep inspection with explicit proxy, this is resource-intensive and may cause problems if your device already has high cpu/memory. Functionality is available within explicit proxy upto application layer protection but its worth checking with respect of your network design which option suits your network well.

Thanks

[fortimaster]

I know all that part, thank you very much. What I'm wondering is if there is any security benefit when using a web proxy, for example, for an https connection to a private network without using deep inspection. Obviously with deep inspection I know that I could analyze the traffic with UTM profiles. But does the proxy itself, by itself, provide any security benefit? 

[ktam88_FTNT]

Assuming this is a non-transparent web proxy then it would provide some anonymity protection where the traffic session would be sourced from the proxy itself.  e.g. the destination would only see the web proxy IP rather then your IP address. Although please note, 3rd party web proxy can be used with malicious intent - they can monitor/log all activities traversing through the proxy.