SSL Deep Inspection - Google Chrome

[PixoPuro]

Hi, is anyone else having a problem doing deep inspection using Google Chrome?

Google Chrome version:  119.0.6045.160 (Versão oficial) 64 bits

Fortigate 200F, 7.4.1.
config sys global
set admin-https-ssl-versions tlsv1-2 tlsv1-3

google same policy/ssl profile from prints below.

 same policy ID from above - EGDE

  same policy ID from abobe - firefox

 SSL Profile:

 

 

Do you guys have some advices?
TY

 

[minheplus]

Hardware 401F (Firmware 7.4.3), If web filter is turn on, Chrome cannot access website. Disable TLS 1.3 hybridized Kyber, problem is resolved. When Fortinet fix this issue?

[tuan2tech]

I'm also having a hard time turning off Kyber for each computer. Our company has more than 100 pc

[PixoPuro]

stop using chatgpt

[gperezarsoft]

We're having the same issue.

Only solution was to disable TLS1.3 kyber support on chromium based browsers or disable ssl-inspection (Which would be stupid since that's one of the security measures of the product).

After inspecting the issue further we discovered that we were having fragmentation issues with this kind of tls handshake, check this out. https://community.fortinet.com/t5/Support-Forum/Fortigates-with-PPPoE-WAN-suddenly-need-TCP-MSS-1452...

Seems that the only way to keep SSL INSPECTION and TLS 1.3 kyber support in browsers is to set the tcp-mss value to the correct size. Since we're using PPPoE ours is 1452, yours might be different. Once the tcp-mss is set, everything works... or does it?

Which surprises me is that fortigate hasn't said anything about it...

[tuan2tech]

Why doesn't fortinet have an update to fix this problem? I also encountered an error of not being able to load SD-WAN rules with firmware 7.4.3

[smaruvala]

Hi,

Regarding the Kyber issue there is a KB

https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-Web-pages-not-loading-or-taking-too-...

- This talks about the workarounds including the MSS settings.

Regards,

Shiva

[gperezarsoft]

Thank you smaruvala,

Might add that if you're following the "Disable kyber support" way you can use this registry keys in Edge, Chrome and Brave browsers which can be applied via GPO:

• HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Edge\PostQuantumKeyAgreementEnabled
• HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\PostQuantumKeyAgreementEnabled
• HKEY_LOCAL_MACHINE\Software\Policies\BraveSoftware\Brave\PostQuantumKeyAgreementEnabled

Setting the value to REG_DWORD 0.