SSL/TLS Profile

SSL/TLS Profile

Use the SSL/TLS Profile for any SPP where TCP connections can be made to TCP 433 or other TCP ports defined for SSL/TLS. SSL/TLS Pprofile parameters can be used with symmetric or asymmetric traffic.

As detailed below, some settings are recommended for expert use only. The same SSL/TLS profile can be used by multiple SPPs but any SPP can only use one SSL/TLS profile at a time. You can create a maximum of 64 SSL/TLS Profiles.

Field/Selection	Description	Recommendations
Field/Selection	Description	Web servers (recommended)	Firewalls (No)	DNS servers (Only if 443 is open)
Name	1-35 characters (a-Z, 0-9, "-", "_" only)
Protocol Anomaly (Content Type Anomaly)	Enable/Disable TLS Protocol Anomaly (Content Type) check. Normal Content Types include: changecipherspec (20), alert (21), handshake (22), application_data (23), and heartbeat (24). With Protocol Anomaly enabled, any packet where the Content Type is not 20-24 will be dropped.
Version Anomaly	Drops packets where version is not SSL 3.0 or TLS 1.0, 1.1 or 1.2
Cipher Anomaly	Drops packets that don't conform to existing Cipher suites (~400 valid).
Block Incomplete Request	Enable/Disable Block Incomplete TLS Request Slow-connection. When the actual data length of TLS record is less than its length field value or the data length of handshake protocol is less than its length field value, the request is considered as Incomplete Request which will be dropped and logged.
Aggressive Aging Incomplete Request	If an incomplete request is detected, sends a RST to the server to remove the session from the server connection table.
Block Source With Incomplete Request	Blocks Source IP that sent the incomplete request
Renegotiation Check	Establishes a threshold of number of SSL renegotiations allowed (default 5) over a time period (default 1s). Most ADCs and WAFs do not allow any renegotiations. This should be used only if a WAF or ADC are not between FortiDDoS and Servers.	Expert use. SSL renegotiations are monitored in both directions and thus not recommended for SPPs containing outbound services like Firewalls, Proxies or WiFi gateways.
Renegotiation Aging Time	Default 1s. Range 1-65535
Renegotiation Threshold	Default 5 renegotiations. Range 1-65535

Field/Selection	Description	Recommendations
Name	1-35 characters (a-Z, 0-9, "-", "_" only)
Protocol Anomaly (Content Type Anomaly)	Enable/Disable TLS Protocol Anomaly (Content Type) check. Normal Content Types include: changecipherspec (20), alert (21), handshake (22), application_data (23), and heartbeat (24). With Protocol Anomaly enabled, any packet where the Content Type is not 20-24 will be dropped.
Version Anomaly	Drops packets where version is not SSL 3.0 or TLS 1.0, 1.1 or 1.2
Cipher Anomaly	Drops packets that don't conform to existing Cipher suites (~400 valid).
Block Incomplete Request	Enable/Disable Block Incomplete TLS Request Slow-connection. When the actual data length of TLS record is less than its length field value or the data length of handshake protocol is less than its length field value, the request is considered as Incomplete Request which will be dropped and logged.
Aggressive Aging Incomplete Request	If an incomplete request is detected, sends a RST to the server to remove the session from the server connection table.
Block Source With Incomplete Request	Blocks Source IP that sent the incomplete request
Renegotiation Check	Establishes a threshold of number of SSL renegotiations allowed (default 5) over a time period (default 1s). Most ADCs and WAFs do not allow any renegotiations. This should be used only if a WAF or ADC are not between FortiDDoS and Servers.	Expert use. SSL renegotiations are monitored in both directions and thus not recommended for SPPs containing outbound services like Firewalls, Proxies or WiFi gateways.
Renegotiation Aging Time	Default 1s. Range 1-65535
Renegotiation Threshold	Default 5 renegotiations. Range 1-65535

Field/Selection

Description

Recommendations

Web servers

(recommended)

Firewalls

(No)

DNS servers

(Only if 443 is open)

Name

1-35 characters (a-Z, 0-9, "-", "_" only)

Protocol Anomaly (Content Type Anomaly)

Enable/Disable TLS Protocol Anomaly (Content Type) check. Normal Content Types include: changecipherspec (20), alert (21), handshake (22), application_data (23), and heartbeat (24).

With Protocol Anomaly enabled, any packet where the Content Type is not 20-24 will be dropped.

Version Anomaly

Drops packets where version is not SSL 3.0 or TLS 1.0, 1.1 or 1.2

Cipher Anomaly

Drops packets that don't conform to existing Cipher suites (~400 valid).

Block Incomplete Request

Enable/Disable Block Incomplete TLS Request Slow-connection. When the actual data length of TLS record is less than its length field value or the data length of handshake protocol is less than its length field value, the request is considered as Incomplete Request which will be dropped and logged.

Aggressive Aging Incomplete Request

If an incomplete request is detected, sends a RST to the server to remove the session from the server connection table.

Block Source With Incomplete Request

Blocks Source IP that sent the incomplete request

Renegotiation Check

Establishes a threshold of number of SSL renegotiations allowed (default 5) over a time period (default 1s).

Most ADCs and WAFs do not allow any renegotiations. This should be used only if a WAF or ADC are not between FortiDDoS and Servers.

Expert use. SSL renegotiations are monitored in both directions and thus not recommended for SPPs containing outbound services like Firewalls, Proxies or WiFi gateways.

Renegotiation Aging Time

Default 1s. Range 1-65535

Renegotiation Threshold

Default 5 renegotiations. Range 1-65535

Handbook

SSL/TLS Profile

SSL/TLS Profile