block vip admin page

[rezafathi]

hi

I have a server configured as a vip in my fortigate to be accesses from internet. I want to block it's admin page. (my.domain.com/admin) . I tried the policy with deep packet and ssl inspection along with creating a webfilter and blocked *\admin* but still admin page reachable from internet. how can i block admin page?

[rezafathi]

Hi

[dingjerry_FTNT · Accepted solution]

Hi @rezafathi ,

Please use the "Protecting SSL Server" option and install a valid server certificate on your FGT to decrypt and inspect traffic destined to the real server. 

https://docs.fortinet.com/document/fortigate/7.6.2/administration-guide/55107/protecting-an-ssl-serv...

[rezafathi]

hi

thanks. should i do that for all vip servers or not?

[dingjerry_FTNT]

I think that you can use one server certificate for multiple VIP servers.

[rezafathi]

what do you mean by server certificate? do you mean certificate for my domain?

[dingjerry_FTNT]

https://www.digicert.com/faq/public-trust-and-certificates/whats-the-difference-between-client-certi...

[rezafathi]

thanks. will i have same security features as full ssl inspection when i use protecting ssl server?

[dingjerry_FTNT]

Yes, technically, it is for inbound traffic from the Internet with "protecting ssl server".  And the other option is for outbound traffic to the Internet.

Both have the same features.