Is this rule providing ANY value - SSL Inspection & Authentication rule

[JimBo]

Hi guys, 

As you can probably tell, I'm new here :)

We are running Fortigate firewall OS 6.4.10 - all is good!

Trying to get a handle on what this SSL policy rule is doing .... if anything at all, some basic understanding would be greatly appreciated.

Thank you

From the GUI under,

Policy & Objects,

SSL Inspection & Authentication

   Edit Policy

Incoming Interface: LAN users

Outgoing Interface: WAN

Source: LAN users

Destination: All

Security Profile:

SSL Inspection: no-inspection

Policy enabled

From the GUI under:

Security Profiles

SSL/SSH Inspection

    Edit SSL/SSH Inspection Profile

Name: no-inspection

SSL Inspection Options:

Enable SSL inspection of: Multiple Clients Connecting to Multiple Servers Protecting SSL Server

Inspection method: Full SSL Inspection

CA Certificate: Fortinet_CA_SSL

Blocked certificates: Block

Untrusted SSL certificates: Allow

Server certificate SNI check: Enable

Common Options

Invalid SSL certificates: Custom

Expired certificates: Block

Revoked certificates: Block

Validation timed-out certificates: Keep Untrusted & Allow

Validation failed certificates: Block

Log SSL anomalies: Enabled

Thank you and it there is additional details needed PLEASE ask.

[pavankr5 · Accepted solution]

The SSL policy rule you described is not providing any value for SSL inspection because the "SSL Inspection" option is set to "no-inspection" in the associated security profile. This means that SSL traffic matching this rule will not undergo SSL inspection.
Please check this article on why you should use SSL inspection
 https://docs.fortinet.com/document/fortigate/5.6.0/cookbook/605938/why-you-should-use-ssl-inspection

Thanks,

Pavan

[JimBo]

Hi Pavan,

Thank you for your assistance here, much appreciated. I setup a test-lab Fortigate 40F to replicate our prod environment and experiment with changes based on the URL you provided. In the initial run with deep inspection, Chrome and Bing both block this site (..... and others) as we are missing the Fortigate root certificate. You got me pointed in the right direction!! Thank you.

[JimBo]

Adding FortiGate 40F GUI screen shot to show the details.

We started with SSL no-inspection but now have switched to SSL certificate-inspection which appears to be a bit better than no-inspection.

When we tried to use the SSL deep-inspection but most web pages were blocked by Chrome and Bing due to Fortigate 'root' cert not installed in our Browers yet. 

Thanks again for your assistance!