Technical Tip: How to enable Deep Content Inspection
FortiGate v4.0 MR3
FortiOS versions 4.0 MR3 and 5.0.x include a deep scanning option, that includes support for scanning encrypted protocols when used with Anti Virus and Webfilter Profiles. To run this security information, server and client certificates must be obtained. This article describes the basic steps needed to enable this feature.
FortiOS firmware version 4.00 MR3
FortiOS firmware version 5.0.x
FortiGate models with ASIC version CP6 or higher have the option to do inspection of encrypted Web and email traffic (HTTPS,SMTPS,POPS,IMAPS). This will allow the FortiGate unit to perform virus and content inspection for those encrypted protocols.
To determine if a FortiGate unit supports the deep scanning, run the below command and verify ASIC version:
FGT # get hardware status [...] ASIC version: CP6 [...]
To enable deep scanning, follow the below steps:
FortiOS firmware version 4.0 MR3: Go to Policy > Protocol Options > HTTPS > Deep Scan > Enable and select apply to save the changes.
FortiOS firmware version 5.0.0: Go to Policy > SSL inspection > HTTPS port 443> Enable and select apply to save the changes.
FortiOS firmware version 5.0.1 and higher: Go to Policy > UTM Proxy Options >SSL inspection > HTTPS port 443> Enable and select apply to save the changes.
To avoid the warning message that pops up in the browser when using a custom certificate, a key and a password will need to be loaded onto the FortiGate, and a certificate will have to be loaded into the PCs web browser.