AnsweredHot!Question about Deep Inpection and Certificate problem with WebEx

Author
chrbar
Bronze Member
  • Total Posts : 27
  • Scores: 0
  • Reward points: 0
  • Joined: 2014/11/03 13:37:50
  • Status: offline
2017/05/12 07:11:15 (permalink) 5.2
0

Question about Deep Inpection and Certificate problem with WebEx

Hello,

We use FortiGate 3700D running FortiOS v5.2.3 build670 (GA), managed from FortiManager v5.2.2-build0706 150415.
 
We've deployed the builting Fortinet certificate "Fortinet_CA_SSLProxy.cer" on all workstations.
We've a policy with "SSL/SSH Inspection" and "Application Sensor" Profile to manage WebEx communications (allow audio/video and deny remote control or other features).

But we obtain a certificate error when we use WebEx (see attachment): "you cannot connect to audio or video because we cannot validate the security certificate to your WebEx site".
 
Do  you know how to avoid this pop-up?

Regards,
Chris

Attached Image(s)

#1
hmtay_FTNT
Gold Member
  • Total Posts : 178
  • Scores: 22
  • Reward points: 0
  • Joined: 2017/02/22 11:02:10
  • Status: online
Re: Question about Deep Inpection and Certificate problem with WebEx 2017/05/12 08:41:41 (permalink)
0
Hello Chris,
 
SSL deep-inspection unfortunately only works for WebEx when accessed from the browser - harder to do certificate pinning on browsers than on native applications. On the native applications, they employ certificate pinning and hence you got the error when deep-inspection is enabled. They do not accept any certificates but their own. To get around this while maintaining deep-inspection, you can set an exemption in the SSL profile. 
 
HoMing
#2
chrbar
Bronze Member
  • Total Posts : 27
  • Scores: 0
  • Reward points: 0
  • Joined: 2014/11/03 13:37:50
  • Status: offline
Re: Question about Deep Inpection and Certificate problem with WebEx 2017/05/18 12:17:03 (permalink)
0
hmtay
To get around this while maintaining deep-inspection, you can set an exemption in the SSL profile.

 
Thanks HoMing for this good explaination.
 
In our case, we use deep-inspection specificly for WebEx to be able to filter the different Applications included in WebEx (Desktop.Sharing, Download, Upload, Sharing, Remote.Control, WhiteBoard...) and deny some of them.
 
Thus we can't set an exemption for "*.webex.com" in the SSL profile, if not we'll lost the Application Filter?
 
Regards,
Chris
 
#3
hmtay_FTNT
Gold Member
  • Total Posts : 178
  • Scores: 22
  • Reward points: 0
  • Joined: 2017/02/22 11:02:10
  • Status: online
Re: Question about Deep Inpection and Certificate problem with WebEx 2017/05/19 06:05:33 (permalink) ☼ Best Answerby chrbar 2017/05/23 13:52:33
5 (1)
Hi Chris,
 
>>In our case, we use deep-inspection specificly for WebEx to be able to filter the different Applications included in WebEx (Desktop.Sharing, Download, Upload, Sharing, Remote.Control, WhiteBoard...) and deny some of them.
 
Thus we can't set an exemption for "*.webex.com" in the SSL profile, if not we'll lost the Application Filter?
 
Yes, if you are doing deep-inspection specifically for WebEx only, then exempting it in the SSL profile would defeat the purpose. Unfortunately, there is not much we could do here to make the native application accept any SSL Certificates but their own.
 
HoMing
#4
Jump to:
© 2017 APG vNext Commercial Version 5.5