SSL-Offloading

[szuko]

HI , I recently got into firewalls,  I have Fortigate 200F, I want to do SSL-offloading with  it if possible ?

my question is , is it possible to do it with Fortigate and if yes , then what makes it different from Fortiweb ? when i can offload traffic on my Fortigate and inspect it ? 

[AlexC-FTNT]

FortiWeb is doing application level inspection (a more focused aim than FortiGate). SSL offloading means removing the encryption from the traffic. You can do that with FortiGate through a VIP - Server Load balancing. Some info here:

http://docs.fortinet.com/document/fortigate/6.2.0/cookbook/713497/virtual-server

[szuko]

thanks for reply , if you put the SSL inspection on deep packet inspection isnt it same thing ? meaning doing Application level inspection ?

[AlexC-FTNT · Accepted solution]

There is a little difference regarding offloading. When you do that in FortiGate on a regular traffic policy, the traffic is decrypted in order to be scanned, and re-encrypted on the way to the local server. SSL offloading means that the last part of the communication (LAN segment) is not encrypted (so the servers don't require extra resources to decrypt the traffic). This is maybe better described here:
https://docs.fortinet.com/document/fortiweb/6.3.0/administration-guide/341240/offloading-vs-inspecti...