Fortigate SSL handshake debug for HTTPS traffic and how to see which is the unsupported cipher?

[filiaks1]

Hello to Everyone,

I am playing with the trial VM and I am wondering except doing tcpdump packetsniffer what are the options to debug ssl hanshake issues like unsuppored ciphers ?

I am interested for proxy mode rules and flow mode rules and if there is an option when you enable debug flow simillar to fortiweb  (Diagnosing SSL/TLS handshake failures | FortiWeb 7.6.0 | Fortinet Document Library) to see such information?

Maybe also a "debug application" option as mentioned in Solved: debug SSL inspection for flow based vs proxy based... - Fortinet Community as for proxy mode "wad" process is used. I am wondering for the ips and wad what debug to enable to see the ssl handshake.

I enabled the options in Extended logging for SSL traffic - Fortinet Community and I see unsupported ciphers error for 7.2 that is the last trial VM version having flow and proxy mode and I see the issue with SSL failing for proxy mode. Maybe this is why it is stopped after 7.2 :)

[Yurisk]

Hi, to your original question - diagnose debug app sslvpn -1 followed by diagnose debug enable

will show you ciphers negotiated.

On another note - if you are using free evaluation license, only low/weak encryption is available and so any rule trying to use Deep SSL inspection will not work. 

[filiaks1]

Hey @Yurisk . Thanks for the fast reply. I did not see anything when I enabled diagnose debug app sslvpn -1  and connected to the web server that has https and fortigate emulates the certificate for the clients connecting through it. This seems like a debug command for SSL VPN and for https/ssl flow-based (not proxy based) emulation.

Also I started wondering when using "Protecting an SSL server" that is for inbound inspection what process is involved in that ssl encryption and decryption.

[Yurisk]

So you basically are trying to do SSL offloading from internal server by Fortigate for the external clients connecting to the Fortigate (it still won't work because of the weak ciphers but ..)?

Then you need other debug, which I am not aware of as didn't ever need to debug it. But may be start with show firewall vip <VIP_name> | grep ssl, diagnose firewall vip virtual-server stats

[filiaks1]

I tried  to debug the ipsengine (for flow based ssl inspection this should be the process not wad) and I found out that there is an ssl debug as well as the ipsengine generates too much logs and I did not see any SSL specific but maybe for non trial firewall that will be the way to go.

I even cleared the session and restarted the process with diag test application ipsmonitor 99 and diag sys kill 9 `pidof ipsengine` before the debug.

Just I see that never ipsengine should be debuged in working hours !

diagnose debug reset
diagnose debug disable
diagnose debug console timestamp enable
diagnose debug application ssl -1
diagnose debug application ipsengine -1
diagnose debug enable