Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
wamendoza
New Contributor III

Webfilter & App Control DONT's WORK :'(

I have a problem with the webfilter and app control of my Fortigate60E

 

I am blocking EVERYTHING that is remote access and it is not working, which it is but if I go to Log&Report>FowardTraffic absolutely NOTHING is reflected in "Application Name", which makes me assume that my traffic passes without SSL inspection.

 

I'm using a basic Monitoring setup profiel on App Control and Webfilter, and it doesn't work either, I don't really see anything.

 

What's going on?

app.JPGwebfil.JPGav.JPGpolicy.JPG

fowartraffic.JPG

1 Solution
wamendoza

yes, that's right, there was a crash related to ipsengine process so the restart of the ips engine was carried out using the CLI

 

 " diagnose test application ipsengine 99".

 

Thanks for all your time Sir. :)

 

 

View solution in original post

4 REPLIES 4
jhussain_FTNT

You need to configure the policy with deep inspection .When using SSL Certificate Inspection, the SSL Handshake is not interrupted, but the FortiGate reads the CN part of the certificate. This CN part, has the URL for the certificate was signed to. This way, the FortiGate has an URL to check into its categories database. But the TLS/SSL content is not read in any way.

When you use deep inspection, the FortiGate impersonates the recipient of the originating SSL session, then decrypts and inspects the content to find threats and block them. It then re-encrypts the content and sends it to the real recipient.

 

Kindly refer the below document

https://community.fortinet.com/t5/FortiGate/Technical-Note-Differences-between-SSL-Certificate-Inspe...

 

https://docs.fortinet.com/document/fortigate/6.2.0/cookbook/122078/deep-inspection

wamendoza
New Contributor III

Hi

After reviewing traffic flow diagram a bit and understanding that the IPS ENGINE encompasses all the traffic inspection(app control, webfilter, av, etc) , i realized that the ipsengine was not running in the "dig sys top",

 

fortia.JPG

 

so the restart was carried out through the CLI of ips process via " diagnose test application ipsengine 99".

 

Now you can see the inspection of packets through FG.

ftlog.JPG

 

I was also able to notice that there was a crash:

273: 2022-01-24 10:51:29 ipsengine 07.000.044 crashed 3 times. The latest crash was at 2022-01-24

 

 

jhussain_FTNT

Hi,

The IPS crash log date was in month of Jan ( 2022-01-24  ). Are you noticing the same crashlog currently also.

wamendoza

yes, that's right, there was a crash related to ipsengine process so the restart of the ips engine was carried out using the CLI

 

 " diagnose test application ipsengine 99".

 

Thanks for all your time Sir. :)

 

 

Announcements

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Labels
Top Kudoed Authors