SSL Deep Inspection - Google Chrome

[PixoPuro]

Hi, is anyone else having a problem doing deep inspection using Google Chrome?

Google Chrome version:  119.0.6045.160 (Versão oficial) 64 bits

Fortigate 200F, 7.4.1.
config sys global
set admin-https-ssl-versions tlsv1-2 tlsv1-3

google same policy/ssl profile from prints below.

 same policy ID from above - EGDE

  same policy ID from abobe - firefox

 SSL Profile:

 

 

Do you guys have some advices?
TY

 

[Walkerthan]

I've configured the SSL/TLS settings to include versions tlsv1-2 and tlsv1-3. However, users on Google Chrome version 119.0.6045.160 (Official Build) 64-bit are reporting issues with deep inspection functionality. Despite updating the browser and ensuring compatibility with the specified TLS versions, some users are experiencing jet skiing intermittent disruptions in accessing secure websites.

[minheplus]

Hardware 401F (Firmware 7.4.3), If web filter is turn on, Chrome cannot access website. Disable TLS 1.3 hybridized Kyber, problem is resolved. When Fortinet fix this issue?

[tuan2tech]

I'm also having a hard time turning off Kyber for each computer. Our company has more than 100 pc

[juliaeldef548]

It seems like you're encountering issues with SSL Deep Inspection while using Google Chrome, specifically with Fortigate 200F version 7.4.1. Here are some suggestions and advice that might help:

1. Check Chrome Security Settings: Ensure that Google Chrome's security settings are configured to allow SSL Deep Inspection. Sometimes, browser settings can interfere with SSL inspection processes.

2. Verify SSL Profile Configuration: Double-check the SSL profile settings on your Fortigate device to ensure they are correctly configured for SSL Deep Inspection. Pay attention to any specific settings related to TLS versions and encryption algorithms.

3. Review Policy Configuration: Review the policy configuration on Fortigate for SSL Deep Inspection, especially for the domains experiencing issues (e.g., google.com). Make sure the policy is correctly applied and includes the necessary SSL inspection rules.

4. Check for Known Issues: Look for any known issues or compatibility issues between Fortigate, Google Chrome, and SSL Deep Inspection. Check vendor documentation, forums, or support channels for any reported issues and possible solutions.

5. Update Fortigate Firmware: Ensure that your Fortigate device is running the latest firmware version. Sometimes, firmware updates include bug fixes and improvements that can resolve compatibility issues with browsers like Google Chrome.

6. Test with Different Browsers: Try accessing the same websites using different web browsers like Mozilla Firefox or Microsoft Edge to see if the issue persists. This can help determine if the problem is specific to Google Chrome or if it's a broader issue with SSL Deep Inspection.

7. Contact Fortigate Support: If you're still experiencing issues after trying the above steps, consider reaching out to Fortigate support for further assistance. They may be able to provide specific troubleshooting steps or guidance based on your configuration and environment.

By following these steps and seeking assistance from support resources, you can hopefully resolve the issues you're encountering with SSL Deep Inspection in Google Chrome.

[PixoPuro]

stop using chatgpt

[gperezarsoft]

We're having the same issue.

Only solution was to disable TLS1.3 kyber support on chromium based browsers or disable ssl-inspection (Which would be stupid since that's one of the security measures of the product).

After inspecting the issue further we discovered that we were having fragmentation issues with this kind of tls handshake, check this out. https://community.fortinet.com/t5/Support-Forum/Fortigates-with-PPPoE-WAN-suddenly-need-TCP-MSS-1452...

Seems that the only way to keep SSL INSPECTION and TLS 1.3 kyber support in browsers is to set the tcp-mss value to the correct size. Since we're using PPPoE ours is 1452, yours might be different. Once the tcp-mss is set, everything works... or does it?

Which surprises me is that fortigate hasn't said anything about it...

[tuan2tech]

Why doesn't fortinet have an update to fix this problem? I also encountered an error of not being able to load SD-WAN rules with firmware 7.4.3