SSL/TLS Profile
Use the SSL/TLS Profile for any SPP where TCP connections can be made to TCP 443 or other TCP ports defined for SSL/TLS. SSL/TLS Profile parameters can be used with symmetric or asymmetric traffic.
As detailed below, some settings are recommended for expert use only. The same SSL/TLS profile can be used by multiple SPPs but any SPP can only use one SSL/TLS profile at a time. You can create a maximum of 64 SSL/TLS Profiles.
Note: You cannot delete any SSL/TLS Profile if it has SSL Inspection addresses/groups. Remove those from the SSL/TLS Profile first. Those addresses/groups may be in use by other SPPs or Profiles.
| Field/Selection | Description |
|---|---|
| Name | 1-35 characters (a-Z, 0-9, "-", "_" only) |
| Protocol Anomaly (Content Type Anomaly) |
Enable/Disable TLS Protocol Anomaly (Content Type) check. Normal Content Types include: changecipherspec (20), alert (21), handshake (22), application_data (23), and heartbeat (24). With Protocol Anomaly enabled, any packet where the Content Type is not 20-24 will be dropped. Note: Enable this in Learning/Detection Mode for each SPP. After a few days, use the Dashboard > Top Attacks page and set to OUTBOUND. Look for Protocol Anomalies. If you see outbound drops, that means your protected devices are using or allowing these anomalies. You may see this particularly where local clients are allowed to BYOD phones, tablets, or laptops. If seen DISABLE this option. Be sure to check all SPPs. This Protocol, Version and Cipher anomalies are DDoS vectors. Disabling them has no impact on DDoS protection. They are provided as a “clean-pipe” option when they can be used. |
| Version Anomaly |
By default all are allowed. Select the specific SSL/TLS versions you want to block. If unsure, enable all anomalies during Learning/Detection Mode. As above, after a few days go to Dashboard > Top Attacks and look for OUTBOUND drops from any of these anomalies and DISABLE (clear the checkbox) those anomalies seen. Be sure to check all SPPs. |
| Cipher Anomaly |
Drops packets that don't conform to existing Cipher suites (~400 valid). As above, enable this in Learning/Detection Mode for each SPP. After a few days go to Dashboard > Top Attacks and look for OUTBOUND drops showing this Anomaly. DISABLE if seen. Be sure to check all SPPs. |
|
Block Incomplete Request |
Expert use only. This anomaly may drop segmented packets which are out of the control of the local servers. This feature is not a DDoS vector. Use your WAF to manage this issue. Enable/Disable Block Incomplete TLS Request Slow-connection. When the actual data length of TLS record is less than its length field value or the data length of handshake protocol is less than its length field value, the request is considered as Incomplete Request which will be dropped and logged. |
|
Aggressive Aging Incomplete Request |
Expert use only. See Block Incomplete Request above. If an incomplete request is detected, sends a RST to the server to remove the session from the server connection table. |
|
Block Source With Incomplete Request |
Expert use only. See Block Incomplete Request above. Blocks Source IP that sent the incomplete request |
|
Renegotiation Check |
Expert use. SSL renegotiations are monitored in both directions and thus not recommended for SPPs containing outbound services like Firewalls, Proxies or WiFi gateways. Establishes a threshold of number of SSL renegotiations allowed (default 5) over a time period (default 1s). Most ADCs and WAFs do not allow any renegotiations. This should be used only if a WAF or ADC are not between FortiDDoS and Servers. |
|
Default 1s. Range 1-65535 |
|
Default 5 renegotiations. Range 1-65535 |
|
Inspection Mode |
Enable Inspection Mode to inspect the HTTP anomalies and rate parameters inside the SSL/TLS. Note: You must save the SSL/TLS Profile and then edit the Profile to get access to the remaining SSL/TLS inspection options. WARNING: SSL Inspection is experimental in 6.3.0 and performance is limited. It should not be used on VMs or FDD-200F and used with FDD-1500F or 2000F only when less than 7000 HTTPS transactions per second is required in the SPP. If unsure, do not use and contact Fortinet. |
To configure using the CLI:
config ddos spp ssl-tls profile
edit <name>
set protocol-anomaly {enable|disable}
set version-anomaly {enable|disable}
set cipher-anomaly {enable|disable}
set block-inncomplete-request {enable|disable}
set aggressive-aging-incomplete-request {enable|disable}
set renegotiation {enable|disable}
set ssl-inspection-mode {enable|disable}
next
end
SSL Inspection
|
SSL Inspection is experimental in 6.3.0 and performance is limited. It should not be used on VMs or FDD-200F and used with FDD-1500F or 2000F only when less than 7000 HTTPS transactions per second is required in the SPP. If unsure, do not use and contact Fortinet. |
SSL Inspection creates sub-profiles that will be inspected.
Edit an existing SSL/TLS Profile to access the SSL/TLS Inspection options.
Create a new Inspection Profile and configure the following settings:
|
Parameter |
Description |
|---|---|
| Name | Name for the profile. Maximum 35 characters (a-Z, 0-9, _ - only). |
| Status | Enable/disable this SSL Inspection Profile. |
| Destination Type |
Note: Only IPv4 addresses (subnets/ranges) or groups are supported. See System > Address and Service. |
| Destination |
|
| Certificate | SSL Certificate from System > Certificate. Must be pre-defined prior to use here. |
| Service Ports | TCP Ports monitored at the defined IPv4 addresses above. Maximum 10 individual ports, space-separated (no ranges). |
To configure using the CLI:
config ddos spp ssl-tls profile
edit <name>
...
config ssl-inspection
edit <name>
set status {enable|disable}
set server-ip-type {addr4|addr4-grp}
set {server-addr4|server addr4-grp} {Any|<name of {addr4|addr4-grp} object from System, Address and Service>
(Note: set {server-addr4|server addr4-grp} ? will respond with a list of available objects.)
set server-certificate <name of SSL Certificate from System, Certificate>
(Note: set {server-addr4|server addr4-grp} ? will respond with a list of available objects.)
set server-port <up to 10 port numbers separated by spaces>
next
end
next
end