FGT protection and Outlook 2010 with Gmail in IMAP

[horinius]

My company' s FortiGate 80C is configured to protect connections to Internet (in Firewall > Policy). And this is causing problem when Outlook 2010 is used to open Gmail account using IMAP (in SSL). The send/receive error is as follows: Task ' Synchronizing subscribed folders for xxxxxxx@gmail.com.' reported error (0x800CCC0E) : ' Outlook cannot synchronize subscribed folders for xxxxxxx@gmail.com. Error: Cannot connect to the server. If you continue to receive this message, contact your server administrator or Internet service provider (ISP).' I' m 100% sure this problem is in part due to the firewall because as soon as I disable " Protection Profile" , this problem disappears. Of course, I don' t want to disable the protection in Fortigate. And of course, I don' t want to regress back to Outlook 2007 for my users even though Outlook 2007 doesn' t have this problem. Does anyone come across this problem and has solution or workaround? I know it' s more a problem with Microsoft than with Fortinet. I' ve already posted in Microsoft forum: http://social.technet.microsoft.com/Forums/en-US/outlook/thread/e37ecad7-e54d-418f-af02-6dc45099c952 (I think you need an account in order to view the forum content) but people there either misunderstood the problem or proposed wrong direction to " solve" the problem. I' m pretty sure the problem comes from the certificate issued by Fortigate but refused by Outlook 2010 (cf technical stuff below). So, maybe somebody knows how to make Outlook 2010 accept certificate or other trick? ----- Technical stuffs: In order to protect connection (ie to do inspection), Fortigate is using the man in the middle trick: it decrypts communicates with imap.gmail.com on one side, and encrypts communication using another certificate issued by itself and send the data to Outlook (or any IMAP client like Thunderbird) on the other side. So the certificate coming from imap.gmail.com and seen by Outlook is issued by Fortigate instead of by the original one (I suppose it' s Thwarte). If I use Thunderbird, it will ask me if I want to accept such certificate or not. Once the certificate is accepted, Thunderbird works without problem. But Outlook 2010 just silently rejects the certificate and thus connection. I think this problem could also be solved if Outlook accept firewall' s CA certificate (which is the issuer of the final certificate). I' ve done this test: I' ve exported the CA certificate and imported it into Thunderbird' s CA store and now TB doesn' t ask me to accept final certificate. Then I tried to import the CA certificate into my computer' s " Trusted Root Certification Authorities" certificate store but this doesn' t seem to work. Maybe Outlook is using its own CA certificate store?

[Carl_Wallmark]

Hi, i just had these problems with a customer of ours, only way i could make it work was to change port number to say 994 under Protocol Options -> IMAPS

[horinius]

Thanks for your reply. I do see the Predefined port number, but I don' t see where to change it. I' m using version 4.1.4. Is that the reason why I can' t change it? And can' t you ADD a port number to IMAPS instead of changing it? Because in this case, you would break other normal IMAPS using the default port, no?

[Carl_Wallmark]

ah, in 4.1.4 you will find the port numbers in the protection profile and then under Protocol Recognition, another solution to the problem, you can create a firewall policy and set the services to IMAPS, and not assign a protection profile to it, make sure the policy is above the other policy.

[horinius]

OK, thanks, I see the " Protocol Recognition" . But did you really mean port number 994, but not 993? In GMail' s help, it' s written 993 (http://mail.google.com/support/bin/answer.py?answer=77689) And OTOH, port 993 is by default there in the Fortigate. If I don' t want to drop protection, that means there' s no solution?

[horinius]

I forgot to say: I' ve added 994 in IMAPS but I still have the error.

[Carl_Wallmark]

ok. first of all, are you scanning IMAPS ? have you pushed out certificates to all your clients ?

[horinius]

I' m not sure how to answer your questions... > scanning IMAPS? I don' t think I' m doing so, but how to make sure? > have you pushed out certificates to all your clients ? I suppose you mean certificate of Fortigate CA, right? Well, that' s the problem as I stated in my original post -- I don' t see how to make Outlook accept it.

[horinius]

Ah! Right after I sent my previous message, I think I understood what you meant by " scanning IMAPS" . You mean " do I have it in Protocol Recognition?" Yes, of course. It' s there by default. Unless my vendor changed it, everything concerning protection should be by default.

[Carl_Wallmark]

sorry if i wasnt clear, the reason i asked was because if you dont plan to scan imaps for virus etc... you should either create a firewall policy with no protection profile or change the port for imaps to something other than the real imaps port (993), beause if you leave it with the default settings, the FG will try to do MITM (man-in-the-middle) attack, and if you havent pushed out certificates to your clients, they will receive an certificate error. so, the solution for this, and i assume you dont want to scan for viruses/spam, is to: 1. Create a firewall policy with service IMAPS, dont add a protection profile, move this policy above the other policy. 2. Change IMAPS port in the protection profile to somehing else than the real port, thats why i typed 994, in this way the FG wont look at 993 that is the real port. and if you plan to scan imaps traffic, you must install the FortiGate SSL Proxy certificate to all the clients that will use IMAPS, else they will receive an error.