Helpful ReplyHot!Disable SSL/SSH Inspection in FortiOS 5.6

Author
bcote
Bronze Member
  • Total Posts : 29
  • Scores: 0
  • Reward points: 0
  • Joined: 2017/05/03 07:04:23
  • Status: offline
2017/05/12 12:58:47 (permalink)
0

Disable SSL/SSH Inspection in FortiOS 5.6

Hi all,
 
still in pre-production but I was wondering how I can turn off the now(since 5.6) forced SSL/SSH inspection. I know it is becoming more and more necessary, but for now, in our environment, it is causing us much more headaches than benefits. Eventually, we want to get there, but the time isn't now. I was told there is a way in the CLI to turn it off. I can't seem to find the right cookbook/Document explaining how. 
 
Anybody running 5.6 that might know where to look to get this turned off? All the info I can find dates back to 5.2 and the same commands don't apply to 5.6 anymore.
 
Any help will be greatly appreciated.

Ben
#1
MikePruett
Platinum Member
  • Total Posts : 676
  • Scores: 15
  • Reward points: 0
  • Joined: 2014/01/08 19:39:40
  • Location: Montgomery, Al
  • Status: offline
Re: Disable SSL/SSH Inspection in FortiOS 5.6 2017/05/13 12:18:59 (permalink)
0
ssl cert inspection is hurting you? I'm running 5.6 and it isn't forcing deep inspection.

Mike Pruett
Fortinet GURU
#2
hmtay_FTNT
Gold Member
  • Total Posts : 221
  • Scores: 35
  • Reward points: 0
  • Joined: 2017/02/22 11:02:10
  • Status: offline
Re: Disable SSL/SSH Inspection in FortiOS 5.6 2017/05/15 08:43:02 (permalink)
0
Hi Ben,
 
There was another thread with the same question:
 
https://forum.fortinet.com/tm.aspx?tree=true&m=148779&mpage=1
 
In short: The basic certificate-inspection is not doing a MiTM. It only scans the SNI of the Client Hello and SSL Certificate. Thus, you will not run into any SSL errors or problems with decrypting the sessions. In the past, with the older FortiOS, when users can choose to disable it, it would cause signatures to not work on HTTPS sessions if disabled. 
 
Let's say we add a rule "www.facebook.com". Without enabling at least certificate-inspection, the rule will not work on https://www.facebook.com.
 
HoMing
#3
bcote
Bronze Member
  • Total Posts : 29
  • Scores: 0
  • Reward points: 0
  • Joined: 2017/05/03 07:04:23
  • Status: offline
Re: Disable SSL/SSH Inspection in FortiOS 5.6 2017/05/25 05:37:58 (permalink)
0
Hey guys,
 
thanks for confirming this. I am planning a deployment for next weekend and it was one of the differences between my current installation and my new 1500D. I didn't want SSL Inspection to complicate the move to production. Ultimately, the goal will be to do Deep inspection at some point, simply not now.
 
Thanks again,
 
Ben
#4
gsarica
Bronze Member
  • Total Posts : 60
  • Scores: 0
  • Reward points: 0
  • Joined: 2016/07/28 13:23:52
  • Status: offline
Re: Disable SSL/SSH Inspection in FortiOS 5.6 2017/05/25 06:17:26 (permalink)
0
5.6.0 completely broke deep inspection for us, it was working seamlessly on 5.4.3. I currently have a ticket open.
#5
bstevens
New Member
  • Total Posts : 2
  • Scores: 2
  • Reward points: 0
  • Joined: 2018/01/12 09:16:38
  • Status: offline
Re: Disable SSL/SSH Inspection in FortiOS 5.6 2018/01/12 09:28:53 (permalink) ☄ Helpfulby cblanco 2018/03/23 10:20:10
5 (1)
Upgraded from 5.4.x to 5.6.3 recently. Seemingly the forced SSL Inspection has wreaked havoc on web browsing.  Cert errors and web filter is now filtering out images that were not previously filtered.   If there is a way to turn off the forced ssl/ssh inspection I'd love to know as well.  At this point I'm not sure how to fix the issues short of turn off all Security profile options in the polices, which seems like a really bad fix.
#6
cblanco
New Member
  • Total Posts : 1
  • Scores: 0
  • Reward points: 0
  • Joined: 2018/03/23 10:19:21
  • Status: offline
Re: Disable SSL/SSH Inspection in FortiOS 5.6 2018/03/23 10:21:07 (permalink)
0
Currently experiencing the same issue. Everything was working fine.
#7
sebastan_bach
Silver Member
  • Total Posts : 90
  • Scores: 1
  • Reward points: 0
  • Joined: 2008/04/03 11:04:47
  • Status: offline
Re: Disable SSL/SSH Inspection in FortiOS 5.6 2018/04/28 21:09:47 (permalink)
0
Don't use 5.6 at all. its a pathetic release with poor QA job. If you are in NGFW mode in 5.6 then you are more affected as there can be only a single SSL inspection profile and that will be applied to all the firewall rules, so how great is that. 
 
Regards
 
Sebastan
#8
romanr
Platinum Member
  • Total Posts : 903
  • Scores: 26
  • Reward points: 0
  • Joined: 2004/06/08 08:29:56
  • Location: Vienna/Austria
  • Status: offline
Re: Disable SSL/SSH Inspection in FortiOS 5.6 2018/04/30 05:52:47 (permalink)
0
sebastan_bach
Don't use 5.6 at all. its a pathetic release with poor QA job. If you are in NGFW mode in 5.6 then you are more affected as there can be only a single SSL inspection profile and that will be applied to all the firewall rules, so how great is that. 



Hi,
 
actually I don't know what you guys have configured... 5.6.3 has some minor troubles here and there, but ssl inspection are doing their job (knowing that from quite some amount of boxes for a lot of customers...)
 
For NGFW firewall mode:
- Before using that, please get into the concepts first. NGFW mode is intended to MAINLY USE DEEP INSPECTION!
- If you complain, there is only one profile to select - think about why! The firewall needs to re-evaluate sessions after an application detection has happened. therefore it just cannot switch ssl profiles all the time, while processing traffic.
- If you are not fine with that - then NGFW mode might not fit your requirements - or your concept of using seems to go wrong.
 
And somehow offtopic - Providing some details on the running configuration and the troubles you run into, will help you to receive some support from others here.
 
Br,Roman
#9
ZeroInterrupt
Bronze Member
  • Total Posts : 54
  • Scores: 0
  • Reward points: 0
  • Joined: 2007/05/23 12:35:30
  • Status: offline
Re: Disable SSL/SSH Inspection in FortiOS 5.6 2018/05/03 05:31:05 (permalink)
0
sebastan_bach
Don't use 5.6 at all. its a pathetic release with poor QA job. If you are in NGFW mode in 5.6 then you are more affected as there can be only a single SSL inspection profile and that will be applied to all the firewall rules, so how great is that. 
 
Regards
 
Sebastan




Do you have 'multiple security profiles' turned on under 'system->feature visibility->advanced features'?  I have and create multiple ssl inspection profiles. 
#10
emnoc
Expert Member
  • Total Posts : 4836
  • Scores: 294
  • Reward points: 0
  • Joined: 2008/03/20 13:30:33
  • Location: AUSTIN TX AREA
  • Status: offline
Re: Disable SSL/SSH Inspection in FortiOS 5.6 2018/05/03 06:03:14 (permalink)
0
I agreed that SSL-SSH inspection is nothing to  worried about. Just build a dummy profile and use that with inspect disable and apply that to all policies that you don't need that level of inspection. It's really that simple.
Ken
 

PCNSE6,PCNSE7, ACE, CCNP,FCNSP,FCESP,Linux+,CEH,ECSA,SCSA,SCNA,CISCA email/web
#11
sebastan_bach
Silver Member
  • Total Posts : 90
  • Scores: 1
  • Reward points: 0
  • Joined: 2008/04/03 11:04:47
  • Status: offline
Re: Disable SSL/SSH Inspection in FortiOS 5.6 2018/05/10 21:26:32 (permalink)
0
Hi, 
 
Thanks for your responses. Roman why would somebody ever enable Deep SSL Inspection for all the traffic on the firewall and kill it's performance. We want to enable deep-inspection for different saas applications for different users. This is really painful from a firewall perspective that does not provide that granularity which was possible in the profile mode where we could have different SSL inspection policies on a per rule basis. Which is clearly not possible in the policy based NGFW mode. 
 
not sure why you mentioned there are only few minor issues with 5.6 NGFW mode. 
 
This mode sets the device in flow mode and doesn't allow to set DLP either from GUI or even from CLI. DLP is neither visible in the feature visibility section under system. 
URL-Filtering would work but there are no logs for the same, how useful do you think that is to use.  
The application lookup goes all the way till the deny rule even though the application is matched in a another rule. This bug has been since 5.6 is all the way up to the new 6.0 release as well. 
 
With these limitations and bugs the policy based NGFW mode is clearly not usable at all. Hence I mentioned it's a release that one should stay away from. Unless I am wrong then please correct me. 
 
Sebastan
 
 
 
#12
sebastan_bach
Silver Member
  • Total Posts : 90
  • Scores: 1
  • Reward points: 0
  • Joined: 2008/04/03 11:04:47
  • Status: offline
Re: Disable SSL/SSH Inspection in FortiOS 5.6 2018/05/10 21:29:47 (permalink)
0
Hi ZeroInterrupt, 
 
Yes I have enabled in multiple security profile function under feature visibility in system settings. However, please note this functionality of using different SSL inspection profiles is only available when the device is operating in profile mode in flow or proxy mode. This flexibility goes for a toss when the device is operating in Policy based NGFW mode. 
 
Try it out yourself to see it. Stay away from policy based NGFW mode in 5.6.
 
Sebastan
 
#13
romanr
Platinum Member
  • Total Posts : 903
  • Scores: 26
  • Reward points: 0
  • Joined: 2004/06/08 08:29:56
  • Location: Vienna/Austria
  • Status: offline
Re: Disable SSL/SSH Inspection in FortiOS 5.6 2018/05/15 08:15:43 (permalink)
0
Hi,
 
sebastan_bach
We want to enable deep-inspection for different saas applications for different users. This is really painful from a firewall perspective that does not provide that granularity which was possible in the profile mode where we could have different SSL inspection policies on a per rule basis. Which is clearly not possible in the policy based NGFW mode. 

 
Then you shouldn't use NGFW mode maybe?
The usecase for NGFW mode would most likely be an enterprise, which wants to deep inspect everything and only does exempts on what not to scan. In this way this is built and this can be done. You still can use the exempt function in your deep inspection profile to choose what to scan and what not....
 
sebastan_bach
not sure why you mentioned there are only few minor issues with 5.6 NGFW mode. 
 

 
I did mention, there are minor issues with 5.6.3 (meaning standard policy mode!!)... Look in my earlier postings, where I cleary state, that NGFW fireall mode in 5.6.3 is more like a tech-preview and in my opinion not built for production right now....
 
sebastan_bach
This mode sets the device in flow mode and doesn't allow to set DLP either from GUI or even from CLI. DLP is neither visible in the feature visibility section under system. 
URL-Filtering would work but there are no logs for the same, how useful do you think that is to use.  
The application lookup goes all the way till the deny rule even though the application is matched in a another rule. This bug has been since 5.6 is all the way up to the new 6.0 release as well. 
With these limitations and bugs the policy based NGFW mode is clearly not usable at all. Hence I mentioned it's a release that one should stay away from. Unless I am wrong then please correct me. 



I never said, that one should use NGFW firewall mode. And I don't understand why you do use it... I am sure no one from Fortinet told you to do so and an experienced system integrator would also try to put this not into prodution.... You are using an tech preview feature and therefore blaming the whole release not to be production ready - and here I totally disagree with you -> Because things work out in the traditional mode (be it proxy or flow) as they should (with minor issues to be fixed...)
 
Br,
Roman
#14
Jump to:
© 2018 APG vNext Commercial Version 5.5