SSL/TLS Profile
Use the SSL/TLS Profile for any SPP where TCP connections can be made to TCP 433 or other TCP ports defined for SSL/TLS. SSL/TLS Pprofile parameters can be used with symmetric or asymmetric traffic.
As detailed below, some settings are recommended for expert use only. The same SSL/TLS profile can be used by multiple SPPs but any SPP can only use one SSL/TLS profile at a time. You can create a maximum of 64 SSL/TLS Profiles.
| Field/Selection | Description | Recommendations | ||
|---|---|---|---|---|
|
Web servers (recommended) |
Firewalls (No) |
DNS servers (Only if 443 is open) |
||
| Name | 1-35 characters (a-Z, 0-9, "-", "_" only) | |||
| Protocol Anomaly (Content Type Anomaly) |
Enable/Disable TLS Protocol Anomaly (Content Type) check. Normal Content Types include: changecipherspec (20), alert (21), handshake (22), application_data (23), and heartbeat (24). With Protocol Anomaly enabled, any packet where the Content Type is not 20-24 will be dropped. |
|||
| Version Anomaly | Drops packets where version is not SSL 3.0 or TLS 1.0, 1.1 or 1.2 | |||
| Cipher Anomaly | Drops packets that don't conform to existing Cipher suites (~400 valid). | |||
|
Block Incomplete Request |
Enable/Disable Block Incomplete TLS Request Slow-connection. When the actual data length of TLS record is less than its length field value or the data length of handshake protocol is less than its length field value, the request is considered as Incomplete Request which will be dropped and logged. |
|
||
|
Aggressive Aging Incomplete Request |
If an incomplete request is detected, sends a RST to the server to remove the session from the server connection table. |
|||
|
Block Source With Incomplete Request |
Blocks Source IP that sent the incomplete request |
|||
|
Renegotiation Check |
Establishes a threshold of number of SSL renegotiations allowed (default 5) over a time period (default 1s). Most ADCs and WAFs do not allow any renegotiations. This should be used only if a WAF or ADC are not between FortiDDoS and Servers. |
Expert use. SSL renegotiations are monitored in both directions and thus not recommended for SPPs containing outbound services like Firewalls, Proxies or WiFi gateways. |
||
|
Default 1s. Range 1-65535 |
|||
|
Default 5 renegotiations. Range 1-65535 |
|||