SSL content scanning and inspection
Firewall Protection Profile
FortiGate Version 4.0 Administration Guide
400
01-400-89802-20090424
Figure 248: FortiGate SSL content scanning and inspection packet flow
Supported FortiGate models
FortiGate models that support SSL acceleration also support SSL content scanning and
inspection. The following FortiGate models support SSL content scanning and inspection:
•
110C
•
111C
•
310B
•
602B
•
3016B
•
3600A
•
3810A
•
5005FA2
•
5001A.
Setting up certificates to avoid client warnings
FortiGate SSL content scanning and inspection intercepts the SSL keys that are passed
between clients and servers during SSL session handshakes and substitutes spoofed
keys. Two encrypted SSL sessions are set up, one between the client and the FortiGate
unit, and a second one between the FortiGate unit and the server. Inside the FortiGate unit
the packets are decrypted.
HTTPS, IMAPS,
POP3S, or
SMTPS Server
Client Starts
HTTPS, IMAPS,
POP3S or
SMTPS session
HTTPS, IMAPS, POP3S or
SMTPS encrypted packets
accepted by firewall policy
1
Protection profile includes
SSL content scanning and
inspection
2
SSL decrypt/encrypt process
decrypts SSL sessions
using session certificate
and key
Protection Profile content
scanning and inspection
applied (antivirus, web filtering,
spam filtering, DLP,
content archiving)
3
Session encrypted
using SSL session
certificate and key
Encrypted packets
forwarded to destination
4
5
6
Protection
profile
Firewall
SSL Decrypt/
Encrypt Process
Content scanning
and inspection
3
1
2
Encrypted
packets
3
1
2
Encrypted
packets
3
1
2
Decrypted
packets
Summary of Contents for Gate 60D
Page 705: ...www fortinet com...
Page 706: ...www fortinet com...