SSL Inspection - policy needed for inbound AND outbound? (30E v5.6)

[train_wreck]

Hello. I have successfully enabled SSL inspection by creating a new deep inspection policy, then ticking the slider to enable it on the default LAN-WAN policy. Now, every HTTPS site is verified by the default Fortinet certificate.

Do I now need to create a "WAN-LAN" policy and enable SSL inspection there? Or will just having SSL inspection on the LAN-WAN policy be enough? One thing, the device datasheet lists SSL inspection throughput to be 130mbps, but with the above configuration I can still get ~940mbps of WAN-LAN throughput on out AT&T 1G/1G fiber connection....

[tanr · Accepted solution]

If you're not running your own servers you don't need a wan->lan policy, and probably don't want one as it would open up your network to access from the wan!

The security profiles you set on your lan->wan policies will work on inbound traffic as well, since that will be part of the sessions initiated from your lan.

[train_wreck]

Very good, thought this was the case. Thanks