Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
Chris
Contributor

Problem with SSl deep-Inspection and Websites

Hi, at first a happy new year to all. I have a Problem when i enable ssl deep-Inspection and surfing through the Web. I noticed that some sites loading only if i reload the site twice. Sometimes but not often I get a "ssl_error_bad_mac_read" error in Firefox. It also went gone when I reload the site. It is relative often reproducible when I am surfing through the fortinet forum. I am using the build in fortinet proxy certificate which CA is certainly imported in the browser under trusted ca authorities I have checked this with some other browsers and on other machines to rule out that it is a browser/machine problem only. The goal why i have enabled deep inspection is to use antivirus in https. Allow Invalid SSL Certificates and Log Invalid Certificates are both enabled but I get no errors. Like I said it is not on all sites but when I noticed that and loading process was too long then I reload the site and now it comes up. Then I figured out when deep-inspection is turned off then all runs well. How can I check what happens. Sniffing the traffic gave no usefull hints until now. I see sometimes only the req but no ack. Any hints for cli commands that can help to encircle the problem more precisely? My device is a FGT 60D with V5.2.5 Any help is appreciated.

2 Solutions
Willem_Bargeman

We have the same issue. Working with support on this case.

View solution in original post

Willem_Bargeman

Hi,

I've a update from Fortinet support.

 

Info from support:

There is an issue id 0372309 which have the same symptoms as you described. This has been already fixed in latest IPS engine version (v3.00284)

Apart from this, the workaround to the issue is to switch one of the UTM features to proxy mode (all UTM features on the policy will then internally use proxy daemons instead of ipsengine). 

 

So there are two options:

[ul]
  • update the IPS engine to version 3.00284 (request support for the package)
  • Change the UTM features to proxy mode[/ul]

    I've installed the new IPS engine. Looks good so far. We will monitor the behavior the next few days.

  • View solution in original post

    11 REPLIES 11
    emnoc
    Esteemed Contributor III

    What I would do;

     

    1:Isolate a fw-policy with ssl deep-inspection for one site only

     

    2:Run the diag debug app ssl -1 command review the output

     

    3:test using various  browser

     

    I can't give you a exact reason for your problem but does it happen with fire-fox, ie and chrome? to the same site ? Chrome seems to exhibit issues that's not seen n IE or  Safari or FFOX. It also has better support and security and support SHA256 right out the box.

     

     

    PCNSE 

    NSE 

    StrongSwan  

    PCNSE NSE StrongSwan
    Chris

    Hi emnoc,

     

    thanks for the hints.

     

    I have enabled deep inspection an runs the debug but I see nothing.

    There is no application ssl but only sslvpn which is surely not what we need i think.

     

     

    emnoc
    Esteemed Contributor III

    Did you run diag debug flow and against the site(s)?

     I'm sure that will probably give you some more details.

     

     

    PCNSE 

    NSE 

    StrongSwan  

    PCNSE NSE StrongSwan
    Chris

    Yes i did. I tried it with debug level -1 and 7 (highest value) diag debug sslvpn -1

    diag debug flow tracert start

    diag debug flow show console enable

    diag debug enable

     

    Fortigate-60D # diag debug info debug output:           enable console timestamp:      disable console no user log message:    disable sslvpn debug level:     -1 (0xffffffff) CLI debug level:        3 Notice that there exists  only "sslvpn" not ssl. That seems why i see nothing. Surfing through many ssl sites also these which makes trouble but nothing is shown.

    I don't see also in the cli manual any references for ssl only sslvpn is described.

    The Wiki says something about this in conjunction with SSL/TLS offloading.

    Don't know if the 60D has this capability. It has an Asic (CP0) but maybe it is handled by software not Hardware.

     

    By the way i follow also the Thread NOW! Fortios 5.2.5 who it seems to be issues with deep inspection in the same way.

    Chris

    I see i have executed the debug flow trace command wrong. Have found an example for debug flow in another thread. Now i see the traffic. I will now analyse it and see if i can find something

    PrzTeam
    New Contributor

    hi i've same problem with deep inspection enabled firmware 5.2.6  the certificate used is a wildicard SHa2 globalsign with other six third-level domains.

    -----------------------------------------

    IT Security Manager

    2 Fortigate 400D (clustered)

    2 Fortigate 200D remote Portal

    -----------------------------------------

    ----------------------------------------- IT Security Manager 2 Fortigate 400D (clustered) 2 Fortigate 200D remote Portal -----------------------------------------
    x_member

    Was this ever resolved - sounds similar to some of the issues we are facing at the moment..

    Willem_Bargeman

    We have the same issue. Working with support on this case.

    x_member

    Willem Bargeman wrote:

    We have the same issue. Working with support on this case.

    Thanks for posting - it would be great if you could update with any progress.

    Labels
    Top Kudoed Authors