SSL_EXEMPT_STATE

[Adrian_Oprea]

Hello Fortigate experts, I tested SSL decryption/inspection (SSL outbound from internal to internet and Reverse SSL) on Fortigate 200B fortios 4.0 MR3 Patch 15. Also tested SSL inspection on FGT 60C fortios 5.0 First, on fortios 4 MR3 Patch 15 I could not make the deep inspection work. After investigating I found out that the ssl sessions are stuck in SSL_EXEMPT_STATE although I don' t have any webfilter profile with set exempt-ssl applied to the policy. Command to verify #diagnose test application ssl 44. It showed the ssl session in State=SSL_EXEMPT_STATE. The session didn' t make it to SSL_PROXY like it should' ve done. I searched documents,forum various troubleshooting but didn' t resolved the issue. I made the config from cli ,also after reading documentation in GUI. Can you please point to a document or explain me the ssl states on fortios? Can you please share how to read the states in diagnose test application ssl 44? On FGT 60C with fortios 5 I got ssl inspection to work. diagnose test application sslworker 44 showed SSL_PROXY states. Also the Proxied counter increased. I noticed that SSL Proxy and Reverse SSL works the same. FGT proxies the connection and send his signed certs to the end points. For Reverse SSL I configured static nat with VIP and applied it to the policy from internet to internal. Also in deep-packet inspection I configured set certname using the server cert. Is this expected ? I expected that Reverse SSL/SSL bridging should not have a proxy behavior , only decrypting the traffic on the fly. Could you please tell how to configure Reverse SSL on Fortios 5? Thank you you very much. I really appreciate. Looking forward to seeing your replies. Regards, Adrian