FGT200B State=SSL_EXEMPT_STATE

[Adrian_Oprea]

Hello Fortigate experts, I tested SSL decryption/inspection (SSL outbound from internal to internet and Reverse SSL) on Fortigate 200B fortios 4.0 MR3 Patch 15. Also tested SSL inspection on FGT 60C fortios 5.0 First, on fortios 4 MR3 Patch 15 I could not make the deep inspection work. After investigating I found out that the ssl sessions are stuck in SSL_EXEMPT_STATE although I don' t have any webfilter profile with set exempt-ssl applied to the policy. Command to verify #diagnose test application ssl 44. It showed the ssl session in State=SSL_EXEMPT_STATE. The session didn' t make it to SSL_PROXY like it should' ve done. I searched documents,forum various troubleshooting but didn' t resolved the issue. I made the config from cli ,also after reading documentation in GUI. Can you please point to a document or explain me the ssl states on fortios? Can you please share how to read the states in diagnose test application ssl 44? On FGT 60C with fortios 5 I got ssl inspection to work. diagnose test application sslworker 44 showed SSL_PROXY states. Also the Proxied counter increased. I noticed that SSL Proxy and Reverse SSL works the same. FGT proxies the connection and send his signed certs to the end points. For Reverse SSL I configured static nat with VIP and applied it to the policy from internet to internal. Also in deep-packet inspection I configured set certname using the server cert. Is this expected ? I expected that Reverse SSL/SSL bridging should not have a proxy behavior , only decrypting the traffic on the fly. Could you please tell how to configure Reverse SSL on Fortios 5? Thank you you very much. I really appreciate. Looking forward to seeing your replies. Regards, Adrian

[HA]

Hello, I have already configured SSL Inspection for 4.x and 5.x release on different platform. Both works in my case... For 4.x, if I' m remember correctly because all my devices are running 5.x code now, you must enabled ' Deep Inpsection' in the proxy option profile. As far as I known (maybe it will change with 5.2.x), Fortigate is not able to decrypt (using the private key) inbound SSL traffic. Palo Alto is able to do that... What you can do, is terminating the SSL session from the client (Front end session) and establish a NEW connection to the server (HTTP or HTTPS, backend session). Hope it can help you. Regards, HA

[Adrian_Oprea]

Hi HA, Thanks for the reply. Configuration is ok . I can see ssl traffic hitting FTG 200B when using diagnose test application ssl 4 command. But it isn' t Proxied. Proxied counter doesn' t increase. If I show details I can see the session stuck in SSL_EXEMPT_STATE. I don' t have any filter applied to the policy to exempt ssl. Software is fortios 4 MR3 Patch 15. The latest one. I read release notes for it but not known issues yet. Looks like a bug.Hmm. Thank you again. Fortigate experts please help me. Respect all.