One-Armed Sniffer and SSL Inspection

[rhap4boy]

What feature is supported for One-armed Sniffer?  Is SSL certificate inspection supported? Is SSL deep inspection supported?

[spoojary · Accepted solution]

A one-armed sniffer on a FortiGate is primarily used to passively monitor and capture traffic for diagnostic purposes. It's a passive monitoring tool that doesn't interact with the traffic it captures. When an interface is in sniffer mode, it won't participate in routing, switching, or any security processing.

Given that:

1. SSL Certificate Inspection: This is a type of SSL inspection where the FortiGate checks the certificate of the SSL/TLS traffic against its local certificate store to ensure its validity. This doesn't decrypt the actual payload/content of the SSL/TLS session.

2. SSL Deep Inspection: This is a more intrusive type of SSL inspection where the FortiGate acts as a man-in-the-middle, decrypting SSL/TLS traffic to inspect the content, then re-encrypting it to send to the final destination. This allows the FortiGate to check the content for any threats or compliance violations.

In the context of a one-armed sniffer:

• SSL Certificate Inspection: Not applicable, as the one-armed sniffer just captures traffic. It doesn't perform any kind of security inspection, including SSL certificate checks.

• SSL Deep Inspection: Again, not applicable for the same reasons. A one-armed sniffer doesn't decrypt or inspect traffic. It only captures it.

If you need to perform SSL Certificate or Deep Inspection, you'll need to set up the FortiGate in a mode where it can actively process and potentially modify the traffic (i.e., not in a one-armed sniffer setup). This usually involves placing the FortiGate inline, where it can intercept and inspect the traffic as it passes through.

[rhap4boy]

Thank you!