Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
mseiler0815
New Contributor II

SSL Decryption Exclusion List

Hello community,

 

I'm looking for a list with SSL Decryption exlusions which are not in the default Deep Inspection Profile.

 

Things like skype, citrix and apple, which are already are excluded.

 

I'm facing issues with (for example) gotomeeting and other apps. Maybe someone can share a resource with this kind of information (ip and/or fqdn).

 

Sure, troubleshooting is possible. But if someone already solved this case, it would help the community. And this is just an example. A list to contribue would be great.

 

Thank you

 

/Michael

4 REPLIES 4
Anthony_E
Community Manager
Community Manager

Hello Michael,

 

Thank you for using the Community Forum.

 

I will seek to get you an answer or help. We will reply to this thread with an update as soon as possible.

 

Regards,

Anthony-Fortinet Community Team.
Anthony_E
Community Manager
Community Manager

Hello Michael,

 

I am still looking it is possible to get a list as requested.

 

Meanwhile, I am sharing this document:

 

https://docs.fortinet.com/document/fortigate/6.2.0/cookbook/122078/deep-inspection

 

Could you please tell me if it is helping?

 

Regards,

Anthony-Fortinet Community Team.
lummi
New Contributor

Hi Michael,

 

I would suggest you to use the "Internet Service Database" objects for this. These are dynamic objects maintained by Fortinet including IPs / Ports for specific services (contract required). So you would create two firewall policies - one for the default web traffic with deep inspection enabled and a second one above with Internet Service Object as destination and deep inspection disabled. Worked perfect for me in the past.

 

2022-07-26.png

 

 

- Lummi

mseiler0815
New Contributor II

Hey Lummi,

 

very good idea. Thank you. This will help in this particular case.

 

But what about all repository servers from ubuntu/suse/debian and so on? This is just another example.

Not all distros are covered with isdb. 

It would be awesome if someone already figured out which ip/fqdns are required to get this running.

 

Regards

 

Michael 

Labels
Top Kudoed Authors