Webfilter and Full SSL Inspection

[vvserpent]

Dear Sir,

I planning to implement the Fortigate Webfitler .

What is the effect to the Fortigate Webfilter if Full SSL Inspection is not enabled?

Without Full SSL Inspection, the function of the Webfilter is limited, as it cannot decrypt and  analyse the whole URL inside the HTTPS connection, some harmful URL / Website cannot be blocked?

It is painful to install the Fortigate Certificate into huge amount of workstation manually. ..Is there alternative way to do the Webfilter task ?

[sw2090]

In fact without Deep Packet Inspection the URL filter cannot work. So the webfilter in this case can only check domain names against the FortiGuard cathegories since this information can be gathered out of the request without decrypting it. So this is the limit it then has.

Also all other UTM filters like IPS, AppControl or FileFilter etc will not work without DPI.

[vvserpent]

I did further research ,  the windows GPO can help to install SSL certificate into computers. It is time to study GPO .

[sw2090]

yes GPO or Intunes. That's the way we did it here.

[AEK]

Hello

Either you install FGT certificate on the client hosts with GPO, or you install your domain's sub CA certificate on the FortiGate.

Ref:   https://docs.fortinet.com/document/fortigate/6.2.15/cookbook/680736/microsoft-ca-deep-packet-inspect...