SSL/TLS Profile

Use the SSL/TLS Profile for any SPP where TCP connections can be made to TCP 433 or other TCP ports defined for SSL/TLS. SSL/TLS Profile parameters can be used with symmetric or asymmetric traffic.

As detailed below, some settings are recommended for expert use only. The same SSL/TLS profile can be used by multiple SPPs but any SPP can only use one SSL/TLS profile at a time. You can create a maximum of 64 SSL/TLS Profiles.

Note: You cannot delete any SSL/TLS Profile if it has SSL Inspection addresses/groups. Remove those from the SSL/TLS Profile first. Those addresses/groups may be in use by other SPPs or Profiles.

Field/Selection	Description	Recommendations
		Web servers (recommended)	Firewalls (No)	DNS servers (Only if 443 is open)
Name	1-35 characters (a-Z, 0-9, "-", "_" only)
Protocol Anomaly (Content Type Anomaly)	Enable/Disable TLS Protocol Anomaly (Content Type) check. Normal Content Types include: changecipherspec (20), alert (21), handshake (22), application_data (23), and heartbeat (24). With Protocol Anomaly enabled, any packet where the Content Type is not 20-24 will be dropped.
Version Anomaly	Drops packets where version is not SSL 3.0 or TLS 1.0, 1.1 or 1.2
Cipher Anomaly	Drops packets that don't conform to existing Cipher suites (~400 valid).
Block Incomplete Request	Enable/Disable Block Incomplete TLS Request Slow-connection. When the actual data length of TLS record is less than its length field value or the data length of handshake protocol is less than its length field value, the request is considered as Incomplete Request which will be dropped and logged.
Aggressive Aging Incomplete Request	If an incomplete request is detected, sends a RST to the server to remove the session from the server connection table.
Block Source With Incomplete Request	Blocks Source IP that sent the incomplete request
Renegotiation Check	Establishes a threshold of number of SSL renegotiations allowed (default 5) over a time period (default 1s). Most ADCs and WAFs do not allow any renegotiations. This should be used only if a WAF or ADC are not between FortiDDoS and Servers.	Expert use. SSL renegotiations are monitored in both directions and thus not recommended for SPPs containing outbound services like Firewalls, Proxies or WiFi gateways.
Renegotiation Aging Time	Default 1s. Range 1-65535
Renegotiation Threshold	Default 5 renegotiations. Range 1-65535
Inspection Mode	Enable Inspection Mode to inspect the HTTP anomalies and rate parameters inside the SSL/TLS. Note: You must save the SSL/TLS Profile and then edit the Profile to get access to the remaining SSL/TLS inspection options. WARNING: SSL Inspection is experimental in 6.3.0 and performance is limited. It should not be used on VMs or FDD-200F and used with FDD-1500F or 2000F only when less than 7000 HTTPS transactions per second is required in the SPP. If unsure, do not use and contact Fortinet.

To configure using the CLI:

config ddos spp ssl-tls profile

edit <name>

set protocol-anomaly {enable|disable}

set version-anomaly {enable|disable}

set cipher-anomaly {enable|disable}

set block-inncomplete-request {enable|disable}

set aggressive-aging-incomplete-request {enable|disable}

set renegotiation {enable|disable}

set ssl-inspection-mode {enable|disable}

next

end

SSL Inspection

SSL Inspection is experimental in 6.3.0 and performance is limited. It should not be used on VMs or FDD-200F and used with FDD-1500F or 2000F only when less than 7000 HTTPS transactions per second is required in the SPP. If unsure, do not use and contact Fortinet.

SSL Inspection creates sub-profiles that will be inspected.

Edit an existing SSL/TLS Profile to access the SSL/TLS Inspection options.

Create a new Inspection Profile and configure the following settings:

Parameter	Description
Name	Name for the profile. Maximum 35 characters (a-Z, 0-9, _ - only).
Status	Enable/disable this SSL Inspection Profile.
Destination Type	ADDR4 ADDR4 Group Note: Only IPv4 addresses (subnets/ranges) or groups are supported. See System > Address and Service.
Destination	Any ADDR4 ADDR4 Group from System > Address and Service objects. Must be pre-defined prior to use here.
Certificate	SSL Certificate from System > Certificate. Must be pre-defined prior to use here.
Service Ports	TCP Ports monitored at the defined IPv4 addresses above. Maximum 10 individual ports, space-separated (no ranges).

To configure using the CLI:

config ddos spp ssl-tls profile

edit <name>

...

config ssl-inspection

edit <name>

set status {enable|disable}

set server-ip-type {addr4|addr4-grp}

set {server-addr4|server addr4-grp} {Any|<name of {addr4|addr4-grp} object from System, Address and Service>

(Note: set {server-addr4|server addr4-grp} ? will respond with a list of available objects.)

set server-certificate <name of SSL Certificate from System, Certificate>

(Note: set {server-addr4|server addr4-grp} ? will respond with a list of available objects.)

set server-port <up to 10 port numbers separated by spaces>

next

end

next

end