config firewall ssl-ssh-profile

Configure SSL/SSH protocol options.

config firewall ssl-ssh-profile

Description: Configure SSL/SSH protocol options.

edit <name>

set comment {var-string}

config ssl

Description: Configure SSL options.

set inspect-all [disable|certificate-inspection|...]

set client-cert-request [bypass|inspect|...]

set unsupported-ssl [bypass|inspect|...]

set invalid-server-cert [allow|block]

set untrusted-server-cert [allow|block|...]

set sni-server-cert-check [enable|strict|...]

end

config https

Description: Configure HTTPS options.

set ports {integer}

set status [disable|certificate-inspection|...]

set client-cert-request [bypass|inspect|...]

set unsupported-ssl [bypass|inspect|...]

set invalid-server-cert [allow|block]

set untrusted-server-cert [allow|block|...]

set sni-server-cert-check [enable|strict|...]

end

config ftps

Description: Configure FTPS options.

set ports {integer}

set status [disable|deep-inspection]

set client-cert-request [bypass|inspect|...]

set unsupported-ssl [bypass|inspect|...]

set invalid-server-cert [allow|block]

set untrusted-server-cert [allow|block|...]

set sni-server-cert-check [enable|strict|...]

end

config imaps

Description: Configure IMAPS options.

set ports {integer}

set status [disable|deep-inspection]

set client-cert-request [bypass|inspect|...]

set unsupported-ssl [bypass|inspect|...]

set invalid-server-cert [allow|block]

set untrusted-server-cert [allow|block|...]

set sni-server-cert-check [enable|strict|...]

end

config pop3s

Description: Configure POP3S options.

set ports {integer}

set status [disable|deep-inspection]

set client-cert-request [bypass|inspect|...]

set unsupported-ssl [bypass|inspect|...]

set invalid-server-cert [allow|block]

set untrusted-server-cert [allow|block|...]

set sni-server-cert-check [enable|strict|...]

end

config smtps

Description: Configure SMTPS options.

set ports {integer}

set status [disable|deep-inspection]

set client-cert-request [bypass|inspect|...]

set unsupported-ssl [bypass|inspect|...]

set invalid-server-cert [allow|block]

set untrusted-server-cert [allow|block|...]

set sni-server-cert-check [enable|strict|...]

end

config ssh

Description: Configure SSH options.

set ports {integer}

set status [disable|deep-inspection]

set inspect-all [disable|deep-inspection]

set unsupported-version [bypass|block]

set ssh-tun-policy-check [disable|enable]

set ssh-algorithm [compatible|high-encryption]

end

set whitelist [enable|disable]

set block-blacklisted-certificates [disable|enable]

config ssl-exempt

Description: Servers to exempt from SSL inspection.

edit <id>

set type [fortiguard-category|address|...]

set fortiguard-category {integer}

set address {string}

set address6 {string}

set wildcard-fqdn {string}

set regex {string}

next

end

set server-cert-mode [re-sign|replace]

set use-ssl-server [disable|enable]

set caname {string}

set untrusted-caname {string}

set server-cert {string}

config ssl-server

Description: SSL servers.

edit <id>

set ip {ipv4-address-any}

set https-client-cert-request [bypass|inspect|...]

set smtps-client-cert-request [bypass|inspect|...]

set pop3s-client-cert-request [bypass|inspect|...]

set imaps-client-cert-request [bypass|inspect|...]

set ftps-client-cert-request [bypass|inspect|...]

set ssl-other-client-cert-request [bypass|inspect|...]

next

end

set ssl-anomalies-log [disable|enable]

set ssl-exemptions-log [disable|enable]

set rpc-over-https [enable|disable]

set mapi-over-https [enable|disable]

next

end

config firewall ssl-ssh-profile

Parameter

Description

Type

Size

comment

Optional comments.

var-string

Not Specified

whitelist

Enable/disable exempting servers by FortiGuard whitelist.

option

-

 

Option

Description

enable

Enable setting.

disable

Disable setting.

block-blacklisted-certificates

Enable/disable blocking SSL-based botnet communication by FortiGuard certificate blacklist.

option

-

 

Option

Description

disable

Disable FortiGuard certificate blacklist.

enable

Enable FortiGuard certificate blacklist.

server-cert-mode

Re-sign or replace the server's certificate.

option

-

 

Option

Description

re-sign

Multiple clients connecting to multiple servers.

replace

Protect an SSL server.

use-ssl-server

Enable/disable the use of SSL server table for SSL offloading.

option

-

 

Option

Description

disable

Don't use SSL server configuration.

enable

Use SSL server configuration.

caname

CA certificate used by SSL Inspection.

string

Not Specified

untrusted-caname

Untrusted CA certificate used by SSL Inspection.

string

Not Specified

server-cert

Certificate used by SSL Inspection to replace server certificate.

string

Not Specified

ssl-anomalies-log

Enable/disable logging SSL anomalies.

option

-

 

Option

Description

disable

Disable logging SSL anomalies.

enable

Enable logging SSL anomalies.

ssl-exemptions-log

Enable/disable logging SSL exemptions.

option

-

 

Option

Description

disable

Disable logging SSL exemptions.

enable

Enable logging SSL exemptions.

rpc-over-https

Enable/disable inspection of RPC over HTTPS.

option

-

 

Option

Description

enable

Enable inspection of RPC over HTTPS.

disable

Disable inspection of RPC over HTTPS.

mapi-over-https

Enable/disable inspection of MAPI over HTTPS.

option

-

 

Option

Description

enable

Enable inspection of MAPI over HTTPS.

disable

Disable inspection of MAPI over HTTPS.

config ssl

Parameter

Description

Type

Size

inspect-all

Level of SSL inspection.

option

-

 

Option

Description

disable

Disable.

certificate-inspection

Inspect SSL handshake only.

deep-inspection

Full SSL inspection.

client-cert-request

Action based on client certificate request.

option

-

 

Option

Description

bypass

Bypass the session.

inspect

Inspect the session.

block

Block the session.

unsupported-ssl

Action based on the SSL encryption used being unsupported.

option

-

 

Option

Description

bypass

Bypass the session.

inspect

Inspect the session.

block

Block the session.

invalid-server-cert

Allow or block the invalid SSL session server certificate.

option

-

 

Option

Description

allow

Allow the invalid server certificate.

block

Block the connection when an invalid server certificate is detected.

untrusted-server-cert

Allow, ignore, or block the untrusted SSL session server certificate.

option

-

 

Option

Description

allow

Allow the untrusted server certificate.

block

Block the connection when an untrusted server certificate is detected.

ignore

Always take the server certificate as trusted.

sni-server-cert-check

Check the SNI in the client hello message with the CN or SAN fields in the returned server certificate.

option

-

 

Option

Description

enable

Check the SNI in the client hello message with the CN or SAN fields in the returned server certificate. If mismatched, use the CN in the server certificate to do URL filtering.

strict

Check the SNI in the client hello message with the CN or SAN fields in the returned server certificate. If mismatched, close the connection.

disable

Do not check the SNI in the client hello message with the CN or SAN fields in the returned server certificate.

config https

Parameter

Description

Type

Size

ports

Ports to use for scanning .

integer

Minimum value: 1 Maximum value: 65535

status

Configure protocol inspection status.

option

-

 

Option

Description

disable

Disable.

certificate-inspection

Inspect SSL handshake only.

deep-inspection

Full SSL inspection.

client-cert-request

Action based on client certificate request.

option

-

 

Option

Description

bypass

Bypass the session.

inspect

Inspect the session.

block

Block the session.

unsupported-ssl

Action based on the SSL encryption used being unsupported.

option

-

 

Option

Description

bypass

Bypass the session.

inspect

Inspect the session.

block

Block the session.

invalid-server-cert

Allow or block the invalid SSL session server certificate.

option

-

 

Option

Description

allow

Allow the invalid server certificate.

block

Block the connection when an invalid server certificate is detected.

untrusted-server-cert

Allow, ignore, or block the untrusted SSL session server certificate.

option

-

 

Option

Description

allow

Allow the untrusted server certificate.

block

Block the connection when an untrusted server certificate is detected.

ignore

Always take the server certificate as trusted.

sni-server-cert-check

Check the SNI in the client hello message with the CN or SAN fields in the returned server certificate.

option

-

 

Option

Description

enable

Check the SNI in the client hello message with the CN or SAN fields in the returned server certificate. If mismatched, use the CN in the server certificate to do URL filtering.

strict

Check the SNI in the client hello message with the CN or SAN fields in the returned server certificate. If mismatched, close the connection.

disable

Do not check the SNI in the client hello message with the CN or SAN fields in the returned server certificate.

config ftps

Parameter

Description

Type

Size

ports

Ports to use for scanning .

integer

Minimum value: 1 Maximum value: 65535

status

Configure protocol inspection status.

option

-

 

Option

Description

disable

Disable.

deep-inspection

Full SSL inspection.

client-cert-request

Action based on client certificate request.

option

-

 

Option

Description

bypass

Bypass the session.

inspect

Inspect the session.

block

Block the session.

unsupported-ssl

Action based on the SSL encryption used being unsupported.

option

-

 

Option

Description

bypass

Bypass the session.

inspect

Inspect the session.

block

Block the session.

invalid-server-cert

Allow or block the invalid SSL session server certificate.

option

-

 

Option

Description

allow

Allow the invalid server certificate.

block

Block the connection when an invalid server certificate is detected.

untrusted-server-cert

Allow, ignore, or block the untrusted SSL session server certificate.

option

-

 

Option

Description

allow

Allow the untrusted server certificate.

block

Block the connection when an untrusted server certificate is detected.

ignore

Always take the server certificate as trusted.

sni-server-cert-check

Check the SNI in the client hello message with the CN or SAN fields in the returned server certificate.

option

-

 

Option

Description

enable

Check the SNI in the client hello message with the CN or SAN fields in the returned server certificate. If mismatched, use the CN in the server certificate to do URL filtering.

strict

Check the SNI in the client hello message with the CN or SAN fields in the returned server certificate. If mismatched, close the connection.

disable

Do not check the SNI in the client hello message with the CN or SAN fields in the returned server certificate.

config imaps

Parameter

Description

Type

Size

ports

Ports to use for scanning .

integer

Minimum value: 1 Maximum value: 65535

status

Configure protocol inspection status.

option

-

 

Option

Description

disable

Disable.

deep-inspection

Full SSL inspection.

client-cert-request

Action based on client certificate request.

option

-

 

Option

Description

bypass

Bypass the session.

inspect

Inspect the session.

block

Block the session.

unsupported-ssl

Action based on the SSL encryption used being unsupported.

option

-

 

Option

Description

bypass

Bypass the session.

inspect

Inspect the session.

block

Block the session.

invalid-server-cert

Allow or block the invalid SSL session server certificate.

option

-

 

Option

Description

allow

Allow the invalid server certificate.

block

Block the connection when an invalid server certificate is detected.

untrusted-server-cert

Allow, ignore, or block the untrusted SSL session server certificate.

option

-

 

Option

Description

allow

Allow the untrusted server certificate.

block

Block the connection when an untrusted server certificate is detected.

ignore

Always take the server certificate as trusted.

sni-server-cert-check

Check the SNI in the client hello message with the CN or SAN fields in the returned server certificate.

option

-

 

Option

Description

enable

Check the SNI in the client hello message with the CN or SAN fields in the returned server certificate. If mismatched, use the CN in the server certificate to do URL filtering.

strict

Check the SNI in the client hello message with the CN or SAN fields in the returned server certificate. If mismatched, close the connection.

disable

Do not check the SNI in the client hello message with the CN or SAN fields in the returned server certificate.

config pop3s

Parameter

Description

Type

Size

ports

Ports to use for scanning .

integer

Minimum value: 1 Maximum value: 65535

status

Configure protocol inspection status.

option

-

 

Option

Description

disable

Disable.

deep-inspection

Full SSL inspection.

client-cert-request

Action based on client certificate request.

option

-

 

Option

Description

bypass

Bypass the session.

inspect

Inspect the session.

block

Block the session.

unsupported-ssl

Action based on the SSL encryption used being unsupported.

option

-

 

Option

Description

bypass

Bypass the session.

inspect

Inspect the session.

block

Block the session.

invalid-server-cert

Allow or block the invalid SSL session server certificate.

option

-

 

Option

Description

allow

Allow the invalid server certificate.

block

Block the connection when an invalid server certificate is detected.

untrusted-server-cert

Allow, ignore, or block the untrusted SSL session server certificate.

option

-

 

Option

Description

allow

Allow the untrusted server certificate.

block

Block the connection when an untrusted server certificate is detected.

ignore

Always take the server certificate as trusted.

sni-server-cert-check

Check the SNI in the client hello message with the CN or SAN fields in the returned server certificate.

option

-

 

Option

Description

enable

Check the SNI in the client hello message with the CN or SAN fields in the returned server certificate. If mismatched, use the CN in the server certificate to do URL filtering.

strict

Check the SNI in the client hello message with the CN or SAN fields in the returned server certificate. If mismatched, close the connection.

disable

Do not check the SNI in the client hello message with the CN or SAN fields in the returned server certificate.

config smtps

Parameter

Description

Type

Size

ports

Ports to use for scanning .

integer

Minimum value: 1 Maximum value: 65535

status

Configure protocol inspection status.

option

-

 

Option

Description

disable

Disable.

deep-inspection

Full SSL inspection.

client-cert-request

Action based on client certificate request.

option

-

 

Option

Description

bypass

Bypass the session.

inspect

Inspect the session.

block

Block the session.

unsupported-ssl

Action based on the SSL encryption used being unsupported.

option

-

 

Option

Description

bypass

Bypass the session.

inspect

Inspect the session.

block

Block the session.

invalid-server-cert

Allow or block the invalid SSL session server certificate.

option

-

 

Option

Description

allow

Allow the invalid server certificate.

block

Block the connection when an invalid server certificate is detected.

untrusted-server-cert

Allow, ignore, or block the untrusted SSL session server certificate.

option

-

 

Option

Description

allow

Allow the untrusted server certificate.

block

Block the connection when an untrusted server certificate is detected.

ignore

Always take the server certificate as trusted.

sni-server-cert-check

Check the SNI in the client hello message with the CN or SAN fields in the returned server certificate.

option

-

 

Option

Description

enable

Check the SNI in the client hello message with the CN or SAN fields in the returned server certificate. If mismatched, use the CN in the server certificate to do URL filtering.

strict

Check the SNI in the client hello message with the CN or SAN fields in the returned server certificate. If mismatched, close the connection.

disable

Do not check the SNI in the client hello message with the CN or SAN fields in the returned server certificate.

config ssh

Parameter

Description