config firewall ssl-ssh-profile
Configure SSL/SSH protocol options.
config firewall ssl-ssh-profile
Description: Configure SSL/SSH protocol options.
edit <name>
set comment {var-string}
config ssl
Description: Configure SSL options.
set inspect-all [disable|certificate-inspection|...]
set client-cert-request [bypass|inspect|...]
set unsupported-ssl [bypass|inspect|...]
set invalid-server-cert [allow|block]
set untrusted-server-cert [allow|block|...]
set sni-server-cert-check [enable|strict|...]
end
config https
Description: Configure HTTPS options.
set ports {integer}
set status [disable|certificate-inspection|...]
set client-cert-request [bypass|inspect|...]
set unsupported-ssl [bypass|inspect|...]
set invalid-server-cert [allow|block]
set untrusted-server-cert [allow|block|...]
set sni-server-cert-check [enable|strict|...]
end
config ftps
Description: Configure FTPS options.
set ports {integer}
set status [disable|deep-inspection]
set client-cert-request [bypass|inspect|...]
set unsupported-ssl [bypass|inspect|...]
set invalid-server-cert [allow|block]
set untrusted-server-cert [allow|block|...]
set sni-server-cert-check [enable|strict|...]
end
config imaps
Description: Configure IMAPS options.
set ports {integer}
set status [disable|deep-inspection]
set client-cert-request [bypass|inspect|...]
set unsupported-ssl [bypass|inspect|...]
set invalid-server-cert [allow|block]
set untrusted-server-cert [allow|block|...]
set sni-server-cert-check [enable|strict|...]
end
config pop3s
Description: Configure POP3S options.
set ports {integer}
set status [disable|deep-inspection]
set client-cert-request [bypass|inspect|...]
set unsupported-ssl [bypass|inspect|...]
set invalid-server-cert [allow|block]
set untrusted-server-cert [allow|block|...]
set sni-server-cert-check [enable|strict|...]
end
config smtps
Description: Configure SMTPS options.
set ports {integer}
set status [disable|deep-inspection]
set client-cert-request [bypass|inspect|...]
set unsupported-ssl [bypass|inspect|...]
set invalid-server-cert [allow|block]
set untrusted-server-cert [allow|block|...]
set sni-server-cert-check [enable|strict|...]
end
config ssh
Description: Configure SSH options.
set ports {integer}
set status [disable|deep-inspection]
set inspect-all [disable|deep-inspection]
set unsupported-version [bypass|block]
set ssh-tun-policy-check [disable|enable]
set ssh-algorithm [compatible|high-encryption]
end
set whitelist [enable|disable]
set block-blacklisted-certificates [disable|enable]
config ssl-exempt
Description: Servers to exempt from SSL inspection.
edit <id>
set type [fortiguard-category|address|...]
set fortiguard-category {integer}
set address {string}
set address6 {string}
set wildcard-fqdn {string}
set regex {string}
next
end
set server-cert-mode [re-sign|replace]
set use-ssl-server [disable|enable]
set caname {string}
set untrusted-caname {string}
set server-cert {string}
config ssl-server
Description: SSL servers.
edit <id>
set ip {ipv4-address-any}
set https-client-cert-request [bypass|inspect|...]
set smtps-client-cert-request [bypass|inspect|...]
set pop3s-client-cert-request [bypass|inspect|...]
set imaps-client-cert-request [bypass|inspect|...]
set ftps-client-cert-request [bypass|inspect|...]
set ssl-other-client-cert-request [bypass|inspect|...]
next
end
set ssl-anomalies-log [disable|enable]
set ssl-exemptions-log [disable|enable]
set rpc-over-https [enable|disable]
set mapi-over-https [enable|disable]
next
end
config firewall ssl-ssh-profile
Parameter name |
Description |
Type |
Size |
||||||
---|---|---|---|---|---|---|---|---|---|
comment |
Optional comments. |
var-string |
Maximum length: 255 |
||||||
whitelist |
Enable/disable exempting servers by FortiGuard whitelist. |
option |
- |
||||||
|
|
||||||||
block-blacklisted-certificates |
Enable/disable blocking SSL-based botnet communication by FortiGuard certificate blacklist. |
option |
- |
||||||
|
|
||||||||
server-cert-mode |
Re-sign or replace the server's certificate. |
option |
- |
||||||
|
|
||||||||
use-ssl-server |
Enable/disable the use of SSL server table for SSL offloading. |
option |
- |
||||||
|
|
||||||||
caname |
CA certificate used by SSL Inspection. |
string |
Maximum length: 35 |
||||||
untrusted-caname |
Untrusted CA certificate used by SSL Inspection. |
string |
Maximum length: 35 |
||||||
server-cert |
Certificate used by SSL Inspection to replace server certificate. |
string |
Maximum length: 35 |
||||||
ssl-anomalies-log |
Enable/disable logging SSL anomalies. |
option |
- |
||||||
|
|
||||||||
ssl-exemptions-log |
Enable/disable logging SSL exemptions. |
option |
- |
||||||
|
|
||||||||
rpc-over-https |
Enable/disable inspection of RPC over HTTPS. |
option |
- |
||||||
|
|
||||||||
mapi-over-https |
Enable/disable inspection of MAPI over HTTPS. |
option |
- |
||||||
|
|
config ssl
Parameter name |
Description |
Type |
Size |
||||||||
---|---|---|---|---|---|---|---|---|---|---|---|
inspect-all |
Level of SSL inspection. |
option |
- |
||||||||
|
|
||||||||||
client-cert-request |
Action based on client certificate request. |
option |
- |
||||||||
|
|
||||||||||
unsupported-ssl |
Action based on the SSL encryption used being unsupported. |
option |
- |
||||||||
|
|
||||||||||
invalid-server-cert |
Allow or block the invalid SSL session server certificate. |
option |
- |
||||||||
|
|
||||||||||
untrusted-server-cert |
Allow, ignore, or block the untrusted SSL session server certificate. |
option |
- |
||||||||
|
|
||||||||||
sni-server-cert-check |
Check the SNI in the client hello message with the CN or SAN fields in the returned server certificate. |
option |
- |
||||||||
|
|
config https
Parameter name |
Description |
Type |
Size |
||||||||
---|---|---|---|---|---|---|---|---|---|---|---|
ports |
Ports to use for scanning (1 - 65535, default = 443). |
integer |
Minimum value: 1 Maximum value: 65535 |
||||||||
status |
Configure protocol inspection status. |
option |
- |
||||||||
|
|
||||||||||
client-cert-request |
Action based on client certificate request. |
option |
- |
||||||||
|
|
||||||||||
unsupported-ssl |
Action based on the SSL encryption used being unsupported. |
option |
- |
||||||||
|
|
||||||||||
invalid-server-cert |
Allow or block the invalid SSL session server certificate. |
option |
- |
||||||||
|
|
||||||||||
untrusted-server-cert |
Allow, ignore, or block the untrusted SSL session server certificate. |
option |
- |
||||||||
|
|
||||||||||
sni-server-cert-check |
Check the SNI in the client hello message with the CN or SAN fields in the returned server certificate. |
option |
- |
||||||||
|
|
config ftps
Parameter name |
Description |
Type |
Size |
||||||||
---|---|---|---|---|---|---|---|---|---|---|---|
ports |
Ports to use for scanning (1 - 65535, default = 443). |
integer |
Minimum value: 1 Maximum value: 65535 |
||||||||
status |
Configure protocol inspection status. |
option |
- |
||||||||
|
|
||||||||||
client-cert-request |
Action based on client certificate request. |
option |
- |
||||||||
|
|
||||||||||
unsupported-ssl |
Action based on the SSL encryption used being unsupported. |
option |
- |
||||||||
|
|
||||||||||
invalid-server-cert |
Allow or block the invalid SSL session server certificate. |
option |
- |
||||||||
|
|
||||||||||
untrusted-server-cert |
Allow, ignore, or block the untrusted SSL session server certificate. |
option |
- |
||||||||
|
|
||||||||||
sni-server-cert-check |
Check the SNI in the client hello message with the CN or SAN fields in the returned server certificate. |
option |
- |
||||||||
|
|
config imaps
Parameter name |
Description |
Type |
Size |
||||||||
---|---|---|---|---|---|---|---|---|---|---|---|
ports |
Ports to use for scanning (1 - 65535, default = 443). |
integer |
Minimum value: 1 Maximum value: 65535 |
||||||||
status |
Configure protocol inspection status. |
option |
- |
||||||||
|
|
||||||||||
client-cert-request |
Action based on client certificate request. |
option |
- |
||||||||
|
|
||||||||||
unsupported-ssl |
Action based on the SSL encryption used being unsupported. |
option |
- |
||||||||
|
|
||||||||||
invalid-server-cert |
Allow or block the invalid SSL session server certificate. |
option |
- |
||||||||
|
|
||||||||||
untrusted-server-cert |
Allow, ignore, or block the untrusted SSL session server certificate. |
option |
- |
||||||||
|
|
||||||||||
sni-server-cert-check |
Check the SNI in the client hello message with the CN or SAN fields in the returned server certificate. |
option |
- |
||||||||
|
|
config pop3s
Parameter name |
Description |
Type |
Size |
||||||||
---|---|---|---|---|---|---|---|---|---|---|---|
ports |
Ports to use for scanning (1 - 65535, default = 443). |
integer |
Minimum value: 1 Maximum value: 65535 |
||||||||
status |
Configure protocol inspection status. |
option |
- |
||||||||
|
|
||||||||||
client-cert-request |
Action based on client certificate request. |
option |
- |
||||||||
|
|
||||||||||
unsupported-ssl |
Action based on the SSL encryption used being unsupported. |
option |
- |
||||||||
|
|
||||||||||
invalid-server-cert |
Allow or block the invalid SSL session server certificate. |
option |
- |
||||||||
|
|
||||||||||
untrusted-server-cert |
Allow, ignore, or block the untrusted SSL session server certificate. |
option |
- |
||||||||
|
|
||||||||||
sni-server-cert-check |
Check the SNI in the client hello message with the CN or SAN fields in the returned server certificate. |
option |
- |
||||||||
|
|
config smtps
Parameter name |
Description |
Type |
Size |
||||||||
---|---|---|---|---|---|---|---|---|---|---|---|
ports |
Ports to use for scanning (1 - 65535, default = 443). |
integer |
Minimum value: 1 Maximum value: 65535 |
||||||||
status |
Configure protocol inspection status. |
option |
- |
||||||||
|
|
||||||||||
client-cert-request |
Action based on client certificate request. |
option |
- |
||||||||
|
|
||||||||||
unsupported-ssl |
Action based on the SSL encryption used being unsupported. |
option |
- |
||||||||
|
|
||||||||||
invalid-server-cert |
Allow or block the invalid SSL session server certificate. |
option |
- |
||||||||
|
|
||||||||||
untrusted-server-cert |
Allow, ignore, or block the untrusted SSL session server certificate. |
option |
- |
||||||||
|
|
||||||||||
sni-server-cert-check |
Check the SNI in the client hello message with the CN or SAN fields in the returned server certificate. |
option |
- |
||||||||
|
|
config ssh
Parameter name |
Description |
Type |
Size |
||||||
---|---|---|---|---|---|---|---|---|---|
ports |
Ports to use for scanning (1 - 65535, default = 443). |
integer |
Minimum value: 1 Maximum value: 65535 |
||||||
status |
Configure protocol inspection status. |
option |
- |
||||||
|
|
||||||||
inspect-all |
Level of SSL inspection. |
option |
- |
||||||
|
|
||||||||
unsupported-version |
Action based on SSH version being unsupported. |
option |
- |
||||||
|
|
||||||||
ssh-tun-policy-check |
Enable/disable SSH tunnel policy check. |
option |
- |
||||||
|
|
||||||||
ssh-algorithm |
Relative strength of encryption algorithms accepted during negotiation. |
option |
- |
||||||
|
|
config ssl-exempt
Parameter name |
Description |
Type |
Size |
||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
type |
Type of address object (IPv4 or IPv6) or FortiGuard category. |
option |
- |
||||||||||||
|
|
||||||||||||||
fortiguard-category |
FortiGuard category ID. |
integer |
Minimum value: 0 Maximum value: 255 |
||||||||||||
address |
IPv4 address object. |
string |
Maximum length: 79 |
||||||||||||
address6 |
IPv6 address object. |
string |
Maximum length: 79 |
||||||||||||
wildcard-fqdn |
Exempt servers by wildcard FQDN. |
string |
Maximum length: 79 |
||||||||||||
regex |
Exempt servers by regular expression. |
string |
Maximum length: 255 |
config ssl-server
Parameter name |
Description |
Type |
Size |
||||||||
---|---|---|---|---|---|---|---|---|---|---|---|
ip |
IPv4 address of the SSL server. |
ipv4-address-any |
Not Specified |
||||||||
https-client-cert-request |
Action based on client certificate request during the HTTPS handshake. |
option |
- |
||||||||
|
|
||||||||||
smtps-client-cert-request |
Action based on client certificate request during the SMTPS handshake. |
option |
- |
||||||||
|
|
||||||||||
pop3s-client-cert-request |
Action based on client certificate request during the POP3S handshake. |
option |
- |
||||||||
|
|
||||||||||
imaps-client-cert-request |
Action based on client certificate request during the IMAPS handshake. |
option |
- |
||||||||
|
|
||||||||||
ftps-client-cert-request |
Action based on client certificate request during the FTPS handshake. |
option |
- |
||||||||
|
|
||||||||||
ssl-other-client-cert-request |
Action based on client certificate request during an SSL protocol handshake. |
option |
- |
||||||||
|
|