SSL Inspection - no windows updates possible

[Prami]

Hi! My Fortigate is a 100D with firmware 5.0.7 If I enable SSL Inspection in the policy, it is not possible to do the windows updates. I import the certificate in the internet explorer. I couldn' t find an understandable solution for this. Please help. Chris

[HA]

Hello, You must exclude microsoft domain from SSL Decrypt. See post https://forum.fortinet.com/FindPost/108307   Regards, HA

[AndreaSoliva]

Hi the post before is right! What you can also do is to exclude specifi sites from Scanning, Interceptiong anyway becaused it makes no sense (think about if it makes sense or not :) ). Keep in the rulebase in mind that always top down first match wins is the rule. If you install a rule on the top and in this rule you DO NOT USE ANY Profiles for Interception, Antivirus etc. you can add to this rules the object which are reflecting by FQDN the update server from microsoft etc. Example: Makes it really sense to scan Antivrus Updates coming from vendors delivered by https? I think you got it :-) What I configure for small customers (not enterprise) is following to exclude this thinks from scanning: ########################### # Firewall Settings Address ########################### config firewall address edit " host-albert.apple.com" set type fqdn set cache-ttl 1800 set color 7 set comment " ITunes Server" set fqdn " albert.apple.com" next edit " host-ax.itunes.apple.com" set type fqdn set cache-ttl 1800 set comment " ITunes Server / AppStore Server" set color 7 set fqdn " ax.itunes.apple.com" next edit " host-deimos3.apple.com" set type fqdn set cache-ttl 1800 set color 7 set comment " ITunes Server / AppStore Server" set fqdn " deimos3.apple.com" next edit " host-download.windowsupdate.com" set type fqdn set cache-ttl 1800 set color 7 set fqdn " download.windowsupdate.com" next edit " host-gs.apple.com" set type fqdn set cache-ttl 1800 set color 7 set comment " ITunes Server / AppStore Server" set fqdn " gs.apple.com" next edit " host-itunes.apple.com" set type fqdn set cache-ttl 1800 set color 7 set comment " ITunes Server / AppStore Server" set fqdn " itunes.apple.com" next edit " host-metrics.apple.com" set type fqdn set cache-ttl 1800 set color 7 set comment " ITunes Server / AppStore Server" set fqdn " metrics.apple.com" next edit " host-phobos.apple.com" set type fqdn set cache-ttl 1800 set color 7 set comment " ITunes Server / AppStore Server" set fqdn " phobos.apple.com" next edit " host-phobos.apple.com.edgesuite.net" set type fqdn set cache-ttl 1800 set color 7 set comment " ITunes Server / AppStore Server" set fqdn " phobos.apple.com.edgesuite.net" next edit " host-swcdn.apple.com" set type fqdn set cache-ttl 1800 set color 7 set comment " Mac OSx Update Server" set fqdn " swcdn.apple.com" next edit " host-swdownload.apple.com" set type fqdn set cache-ttl 1800 set color 7 set comment " Mac OSx Update Server" set fqdn " swdownload.apple.com" next edit " host-swquery.apple.com" set type fqdn set cache-ttl 1800 set color 7 set comment " Mac OSx Update Server" set fqdn " swquery.apple.com" next edit " host-swscan.apple.com" set type fqdn set cache-ttl 1800 set color 7 set comment " Mac OSx Update Server" set fqdn " swscan.apple.com" next edit " host-update.microsoft.com" set type fqdn set cache-ttl 1800 set color 7 set fqdn " update.microsoft.com" next edit " host-wildcard.apple.com" set type fqdn set cache-ttl 1800 set color 7 set fqdn " *.apple.com" next edit " host-wildcard.phobos.apple.com" set type fqdn set cache-ttl 1800 set color 7 set comment " ITunes Server / AppStore Server" set fqdn " *.phobos.apple.com" next edit " host-appldnld.apple.com" set type fqdn set cache-ttl 1800 set color 7 set comment " ITunes Server / AppStore Server" set fqdn " appldnld.apple.com" next edit " host-wildcard.download.windowsupdate.com" set type fqdn set cache-ttl 1800 set color 7 set fqdn " *.download.windowsupdate.com" next edit " host-wildcard.update.microsoft.com" set type fqdn set cache-ttl 1800 set color 7 set fqdn " *.update.microsoft.com" next edit " host-www.msftncsi.com" set type fqdn set cache-ttl 1800 set color 7 set fqdn " www.msftncsi.com" next edit " host-windowsupdate.microsoft.com" set type fqdn set cache-ttl 1800 set color 7 set fqdn " windowsupdate.microsoft.com" next edit " host-wildcard.windowsupdate.microsoft.com" set type fqdn set cache-ttl 1800 set color 7 set fqdn " *.windowsupdate.microsoft.com" next edit " host-wildcard.windowsupdate.com" set type fqdn set cache-ttl 1800 set color 7 set fqdn " *.windowsupdate.com" next edit " host-download.microsoft.com" set type fqdn set cache-ttl 1800 set color 7 set fqdn " download.microsoft.com" next edit " host-test.stats.update.microsoft.com" set type fqdn set cache-ttl 1800 set color 7 set fqdn " test.stats.update.microsoft.com" next edit " host-ntservicepack.microsoft.com" set type fqdn set cache-ttl 1800 set color 7 set fqdn " ntservicepack.microsoft.com" next edit " host-au.download.windowsupdate.com" set type fqdn set cache-ttl 1800 set color 7 set fqdn " au.download.windowsupdate.com" next edit " host-wildcard.activeupdate.trendmicro.com" set type fqdn set cache-ttl 1800 set color 7 set fqdn " *.activeupdate.trendmicro.com" next edit " host-wildcard.akamaitechnologies.com" set type fqdn set color 7 set fqdn " *.akamaitechnologies.com" next edit " host-wildcard.deploy.akamaitechnologies.com" set type fqdn set cache-ttl 1800 set color 7 set fqdn " *.deploy.akamaitechnologies.com" next end ########################### # Firewall Settings Group ########################### config firewall addrgrp edit " gr-apple-itunes-appstore-server" set member " host-albert.apple.com" " host-ax.itunes.apple.com" " host-gs.apple.com" " host-itunes.apple.com" " host-deimos3.apple.com" " host-metrics.apple.com" " host-phobos.apple.com.edgesuite.net" " host-phobos.apple.com" " host-wildcard.phobos.apple.com" " host-appldnld.apple.com" set comment " Group itunes appstoare update server also-solutions-sg0e0" set color 7 next edit " gr-mac-osx-update-server" set member " host-swscan.apple.com" " host-swquery.apple.com" " host-swdownload.apple.com" " host-swcdn.apple.com" set comment " Group mac os x update server also-solutions-sg0e0" set color 7 next edit " gr-windows-update-server" set member " host-download.windowsupdate.com" " host-wildcard.download.windowsupdate.com" " host-update.microsoft.com" " host-wildcard.update.microsoft.com" " host-www.msftncsi.com" " host-windowsupdate.microsoft.com" " host-wildcard.windowsupdate.microsoft.com" " host-wildcard.windowsupdate.com" " host-download.microsoft.com" " host-test.stats.update.microsoft.com" " host-ntservicepack.microsoft.com" " host-au.download.windowsupdate.com" set comment " Group windows update server also-solutions-sg0e0" set color 7 next edit " gr-akamaitechnologies-update-server" set member " host-wildcard.akamaitechnologies.com" " host-wildcard.deploy.akamaitechnologies.com" set comment " Group akamaitechnologies update server" set color 7 next end This is another way to go...not for every installation but a way for smaler customers! hope this helps have fun Andrea