DescriptionThis article describes the additional steps prior configuring one-arm urlfilter for HTTPS. SolutionThere is a procedure called "one-arm urlfilter" which is explained for the case of HTTP:
1. Independent from webfilter licence
2. Require of "one-arm ips" activation
3. Require static-to-BGP redistribution to populate "ips-dns" discovered routes
4. Blocking based on static urlfilter list
When the inspection requires HTTPs traffic being block additional steps are required prior configuring the urlfilter:
1. nslookup in order to confirm all possible IP addresses are being populated through static-to-BGP redistribution.
2. Capture packets and confirm the "Server Name" on the "Client Hello" SSL packet and this IURL is the one it is needed to be added in the urlfilter list.
Refer to the related article to perform one-arm urlfilter with HTTP web traffic.
Related Articles
Technical Note: How to configure FortiGate to perform routing based on specific URLs
