Technical Tip: How to enable Deep Content Inspection
Products
FortiGate v4.0 MR3
FortiGate v5.0
Description
FortiOS versions 4.0 MR3 and 5.0.x include a deep scanning option, that includes support for scanning encrypted protocols when used with Anti Virus and Webfilter Profiles. To run this security information, server and client certificates must be obtained. This article describes the basic steps needed to enable this feature.
Scope
FortiOS firmware version 4.00 MR3
FortiOS firmware version 5.0.x
Solution
FortiGate models with ASIC version CP6 or higher have the option to do inspection of encrypted Web and email traffic (HTTPS,SMTPS,POPS,IMAPS). This will allow the FortiGate unit to perform virus and content inspection for those encrypted protocols.

To determine if a FortiGate unit supports the deep scanning, run the below command and verify ASIC version:

FGT # get hardware status
[...]
ASIC version: CP6
[...]

 
To enable deep scanning, follow the below steps:

FortiOS firmware version 4.0 MR3:
Go to Policy > Protocol Options > HTTPS > Deep Scan > Enable  and select apply to save the changes.
 
FortiOS firmware version 5.0.0:
Go to Policy > SSL inspection > HTTPS  port 443> Enable  and select apply to save the changes.
 
FortiOS firmware version 5.0.1 and higher:
Go to Policy > UTM Proxy Options >SSL inspection > HTTPS  port 443> Enable  and select apply to save the changes. 

To avoid the warning message that pops up in the browser when using a custom certificate, a key and a password will need to be loaded onto the FortiGate, and a certificate will have to be loaded into the PCs web browser.

To create a signed certificate and a key, an OpenSSL software may be used: http://www.slproweb.com/products/Win32OpenSSL.html
 
Use the three commands listed on this website to create a certificate request, key file and sign it. http://webdesign.about.com/od/ssl/ht/new_selfsigned.htm
 
Once these three commands are completed:
  1. Go to the System > Certificates > Local, and select Import.
  2. Set the Type to Certificate.
  3. Select the CRT and KEY files that were created and enter the passcode to upload the cert.
 
To have the FortiGate USE this certificate go to the CLI and use the following syntax:
 
config firewall ssl setting
set caname (certificate filename)
end
 
Ensure to load the CRT file into the browser as trusted.
 
 
Related Articles
Technical Note : FortiGate HTTPS Web URL Filtering and HTTPS Fortiguard Web Filtering
Technical Tip : SSL Inspection fails when FortiGate verifies the server certificate by its CA certificate
Troubleshooting Tip : Verifying server certificate on SSL Inspection
Last Modified Date: 08-20-2013 Document ID: FD30586