Virtual Server Report

[jokes54321]

Currently running FortiOS 7.2.11 and we're exposing a web server behind a Virtual Server configured for SSL offloading. Our security team is asking us to set the minimum protocol to TLS 1.2, but we've been asked to make sure no legacy clients are still using TLS 1.1.

I checked the forwarding logs and am not seeing protocol or ciphers, is there a way to see this in the logs or to pull this from FortiAnalyzer?  

Denny

[AEK]

In your SSL inspection profile, try enable some of the below:

ssl-anomaly-log       Enable/disable logging of SSL anomalies.
ssl-negotiation-log   Enable/disable logging SSL negotiation.
ssl-server-cert-log   Enable/disable logging of server certificate information.
ssl-handshake-log     Enable/disable logging of TLS handshakes.

You should then be able to see the related logs in FortiGate > Logs > SSL inspection logs, and in FAZ as well

[jokes54321]

I sure was hopeful this was going to work. I cloned the "certificate-inspection" policy and added the logging commands to the clone. I then applied the cloned policy to the firewall policy permitting traffic from the Internet to the Virtual Server that is configured for full ssl offloading. Unfortunately, nothing is showing in the logs. 

Armed with the new knowledge above, I asked ChatGPT to help, and it responded that with a VIP configuration, Deep Inspection would need to be setup to get the logging data I was after. Since this is traffic from the Internet, I don't think Deep Inspection will be an option here.

Perhaps I missed a setting to enable this? I will add this new cloned policy to an Outbound firewall policy to see if something logs when not using a Virtual Server.

[AEK]

If you are setting up a VIP to protect an server accessed from internet, in case you don't have a dedicated WAF then the recommended configuration is to enable deep inspection with SSL offloading on VS in order to scan the traffic after being decrypted.

Also use proxy based inspection in the firewall policy and add IPS and WAF profiles.

[jokes54321]

While this sounds like a solid security recommendation, would this solve my current need of identifying the negotiated TLS version in the logs?

[AEK]

Probably, since with certificate inspection the negotiation is with the back-end server, while in deep inspection the negotiation is with FortiGate.

[jokes54321]

Unfortunately, this logs nothing.  Here is the configuration, perhaps I missed something? I didn't enable WAF or IPS yet, but those don't seem relevant to the current issue at the moment.

VIP setup

config firewall vip
edit "mydomainname-vip"
set type server-load-balance
set extip x.x.x.35
set extintf "any"
set server-type https
set http-ip-header enable
set persistence http-cookie
set extport 443
config realservers
edit 1
set ip x.x.x.51
set port 443
next
end
set ssl-mode full
set ssl-certificate "mydomain_cert"
next
end

SSL Inspection Policy

config firewall ssl-ssh-profile
edit "deep-inspection-logging"
set comment "Deep inspection profile."
config https
set ports 443
set status deep-inspection
end
config ftps
set status disable
end
config imaps
set status disable
end
config pop3s
set status disable
end
config smtps
set status disable
end
config ssh
set ports 22
set status disable
end
config dot
set status disable
end
config ssl-exempt
edit 1
set type wildcard-fqdn
set wildcard-fqdn "adobe"
next
edit 2
set type wildcard-fqdn
set wildcard-fqdn "Adobe Login"
next
edit 3
set type wildcard-fqdn
set wildcard-fqdn "android"
next
edit 4
set type wildcard-fqdn
set wildcard-fqdn "apple"
next
edit 5
set type wildcard-fqdn
set wildcard-fqdn "appstore"
next
edit 6
set type wildcard-fqdn
set wildcard-fqdn "auth.gfx.ms"
next
edit 7
set type wildcard-fqdn
set wildcard-fqdn "autoupdate.opera.com"
next
edit 8
set type wildcard-fqdn
set wildcard-fqdn "citrix"
next
edit 9
set type wildcard-fqdn
set wildcard-fqdn "dropbox.com"
next
edit 10
set type wildcard-fqdn
set wildcard-fqdn "eease"
next
edit 11
set type wildcard-fqdn
set wildcard-fqdn "firefox update server"
next
edit 12
set type wildcard-fqdn
set wildcard-fqdn "fortinet"
next
edit 13
set type wildcard-fqdn
set wildcard-fqdn "google-drive"
next
edit 14
set type wildcard-fqdn
set wildcard-fqdn "google-play"
next
edit 15
set type wildcard-fqdn
set wildcard-fqdn "google-play2"
next
edit 16
set type wildcard-fqdn
set wildcard-fqdn "google-play3"
next
edit 17
set type wildcard-fqdn
set wildcard-fqdn "googleapis.com"
next
edit 18
set type wildcard-fqdn
set wildcard-fqdn "Gotomeeting"
next
edit 19
set type wildcard-fqdn
set wildcard-fqdn "icloud"
next
edit 20
set type wildcard-fqdn
set wildcard-fqdn "itunes"
next
edit 21
set type wildcard-fqdn
set wildcard-fqdn "live.com"
next
edit 22
set type wildcard-fqdn
set wildcard-fqdn "microsoft"
next
edit 23
set type wildcard-fqdn
set wildcard-fqdn "skype"
next
edit 24
set type wildcard-fqdn
set wildcard-fqdn "softwareupdate.vmware.com"
next
edit 25
set type wildcard-fqdn
set wildcard-fqdn "swscan.apple.com"
next
edit 26
set type wildcard-fqdn
set wildcard-fqdn "update.microsoft.com"
next
edit 27
set type wildcard-fqdn
set wildcard-fqdn "verisign"
next
edit 28
set type wildcard-fqdn
set wildcard-fqdn "Windows update 2"
next
end
set server-cert-mode replace
set server-cert "mydomain_cert"
set ssl-negotiation-log enable
set ssl-server-cert-log enable
set ssl-handshake-log enable
next
end

config firewall policy
edit 1234
set name "internet-to-webserver"
set srcintf "WAN"
set dstintf "DMZ"
set action accept
set srcaddr "all"
set dstaddr "mydomainname-vip"
set schedule "always"
set service "HTTPS"
set inspection-mode proxy
set ssl-ssh-profile "deep-inspection-logging"
set logtraffic all
next
end

[AEK]

In the SSL inspection profile, can you try with "Protecting SSL Server" instead of "Multiple Clients Connecting to Multiple Servers"?

[jokes54321]

It is currently setup this way now.  We went ahead and set the minimum TLS to 1.2 and are monitoring the application closely.