Verificador de cobertura de perfis de segurança do FortiGate

Responde por que meu perfil não está funcionando antes de o chamado ser aberto. Percorre a cadeia de dependências e nomeia qual elo falhou.

Segurança e WAF

Roda inteiramente no seu navegador. Nada é enviado.

A cadeia de dependências

  • A security profile only acts when every precondition above it holds: the policy must permit the traffic, SSL inspection must decrypt it, the inspection mode must support the feature, and only then does the profile act.
  • Most reports that a profile is not working resolve at the second step. The traffic is HTTPS, the policy carries certificate inspection rather than deep inspection, and there is nothing to read.
  • Certificate inspection validates the certificate and reads the handshake. It does NOT decrypt the payload, so AntiVirus, IPS, DLP and file filter have nothing to examine.
  • Application control and web filter degrade rather than go blind: SNI still identifies some hosts, but not URL paths or page content.
  • Describe a policy:
  • traffic: https
  • ssl: certificate
  • mode: flow
  • profiles: antivirus, ips, application-control, web-filter
Endpoint da APIGEThttps://ronutz.com/api/v1/fortigate-security-profile-coverage-checkerDocumentado, não servido. Abre a especificação.

Referências