FGT protection and Outlook 2010 with Gmail in IMAP

[horinius]

My company' s FortiGate 80C is configured to protect connections to Internet (in Firewall > Policy). And this is causing problem when Outlook 2010 is used to open Gmail account using IMAP (in SSL). The send/receive error is as follows: Task ' Synchronizing subscribed folders for xxxxxxx@gmail.com.' reported error (0x800CCC0E) : ' Outlook cannot synchronize subscribed folders for xxxxxxx@gmail.com. Error: Cannot connect to the server. If you continue to receive this message, contact your server administrator or Internet service provider (ISP).' I' m 100% sure this problem is in part due to the firewall because as soon as I disable " Protection Profile" , this problem disappears. Of course, I don' t want to disable the protection in Fortigate. And of course, I don' t want to regress back to Outlook 2007 for my users even though Outlook 2007 doesn' t have this problem. Does anyone come across this problem and has solution or workaround? I know it' s more a problem with Microsoft than with Fortinet. I' ve already posted in Microsoft forum: http://social.technet.microsoft.com/Forums/en-US/outlook/thread/e37ecad7-e54d-418f-af02-6dc45099c952 (I think you need an account in order to view the forum content) but people there either misunderstood the problem or proposed wrong direction to " solve" the problem. I' m pretty sure the problem comes from the certificate issued by Fortigate but refused by Outlook 2010 (cf technical stuff below). So, maybe somebody knows how to make Outlook 2010 accept certificate or other trick? ----- Technical stuffs: In order to protect connection (ie to do inspection), Fortigate is using the man in the middle trick: it decrypts communicates with imap.gmail.com on one side, and encrypts communication using another certificate issued by itself and send the data to Outlook (or any IMAP client like Thunderbird) on the other side. So the certificate coming from imap.gmail.com and seen by Outlook is issued by Fortigate instead of by the original one (I suppose it' s Thwarte). If I use Thunderbird, it will ask me if I want to accept such certificate or not. Once the certificate is accepted, Thunderbird works without problem. But Outlook 2010 just silently rejects the certificate and thus connection. I think this problem could also be solved if Outlook accept firewall' s CA certificate (which is the issuer of the final certificate). I' ve done this test: I' ve exported the CA certificate and imported it into Thunderbird' s CA store and now TB doesn' t ask me to accept final certificate. Then I tried to import the CA certificate into my computer' s " Trusted Root Certification Authorities" certificate store but this doesn' t seem to work. Maybe Outlook is using its own CA certificate store?

[horinius]

if you plan to scan imaps traffic, you must install the FortiGate SSL Proxy certificate to all the clients that will use IMAPS, else they will receive an error.

By " FortiGate SSL Proxy certificate" , do you mean the CA certificate which issues imap.gmail.com certificate? You see, the certification path is like this FortiGate CA (1) | +-- imap.gmail.com (2) Did you mean (1) or (2)? And where do you install it?

[Carl_Wallmark]

Download the FortiGate SSL Proxy certificate from the GUI of the fortigate, and then install it on the clients, in the " Trusted Root Certificate" . You can read about here: http://kb.fortinet.com/kb/microsites/search.do?cmd=displayKC&docType=kc&externalId=FD32404&sliceId=1&docTypeID=DT_KCARTICLE_1_1&dialogID=14939949&stateId=0 0 14941076

[horinius]

Thanks for the article. That' s what I have done as I' ve stated in my OP (not exactly the same steps, but the same effect). But to make sure that different steps don' t change the results, I had nevertheless followed the steps exactly. But still the problem isn' t solved. But on one hand, the procedure talks about IE8, not Outlook. And on the other hand, I' m wondering if using Windows 7 is the cause.

[horinius]

A little update for this issue. After quite an exhaustive test I' ve done on April, I' ve found that the problem comes from Win7 hotfixes: KB980436 and KB2207566. However, it' s quite possible that there are other hotfixes doing the same thing as the above updates and I don' t have the time to continue my test to find them all out. If you would like to try and if it is possible, uninstall KB980436 and KB2207566 and see if the problem goes away. However, these hotfixes are a part of SP1 and if you have SP1 applied, you need to remove it first... if you' re motivated enough :/ But if your Win7 has SP1 integrated, no need to try: you can' t remove SP1...

[horinius]

Another update to this issue, and maybe a good news Today, I' ve just noticed that this problem has gone away in my Outlook! I' ve redone all the tests in my virtual machines and indeed, the problem is no longer there. So this issue is basically solved without really knowing what fixed that. One thing is sure, it is NOT fixed by any Windows update (or Office update). So this left me two possibilities: 1. I' ve updated FGT 80C firmware recently (from 4.1.4 to 4.1.9) and the new version has sort of fixed this problem. 2. Google has changed something in its certificate for IMAPS. But I' m no expert in electronic certificate so I' m not sure if this is possible or not. PS: I didn' t add any port number to IMAPS or remove the protection profile from firewall policy. The problem just went away.

[rwpatterson]

If you have time to kill, back down to the prior version and see if the issue comes back....

[horinius]

Yeah, that' s a good idea. I suppose you mean that " Boot alternate firmware" button. I' ll try that and keep you informed.

[horinius]

OK, after the test, it' s definitely sure that firmware 4.1.9 has worked around this MSS (for Microsoft Super Stupidity!) You know what, a recent reply from a Microsoft support told me that " [blah blah blah].... they cannot modify the security update .... [blah blah blah] .... this is done by design ... [blah blah blah]..." And I spoke to myself " Oh yeah, by design... by their stupidly damned BAD design!" It' s really a good news that this problem has gone away. I don' t know how Fortinet engineers have done it but really, really a BIG thumb up!

[rwpatterson]

Good deal!