Subjected: Attempted Exemption from Fortigate SSL Certificate Inspection for Synology NAS Outgoing Connection to Microsoft OneDrive But Did Not Work

Author: Mr. Turritopsis Dohrnii Teo En Ming (TARGETED INDIVIDUAL)
Country: Singapore
Date: 30 Jan 2022 Sunday Singapore Time

Type of Publication: Plain Text
Document Version: 20220130.01

Problem Description: Client Reports Her Synology NAS Cannot Connect to Microsoft OneDrive After Deployment of Fortigate 80F Firewall

Forum Discussion #1: HELP Needed please >>> Users suddenly cannot connect to Microsoft OneDrive and Sharepoint
Link: https://community.fortinet.com/t5/Fortinet-Forum/HELP-Needed-please-gt-gt-gt-Users-suddenly-cannot-connect-to/td-p/56216?m=183046

Forum Discussion #2: OneDrive synchronization error
Link: https://community.fortinet.com/t5/Fortinet-Forum/OneDrive-synchronization-error/m-p/167611?m=152352

DETAILED STEPS

Login to Fortigate 80F firewall.

Go to Policy & Objects > Addresses

Create 56 Address Objects using FQDN for the hosts mentioned in the following article.

Article: Required URLs and ports for OneDrive
Link: https://docs.microsoft.com/en-us/onedrive/required-urls-and-ports?redirectSourcePath=%252fen-us%252farticle%252fRequired-URLs-and-ports-for-OneDrive-ce15d2cc-52ef-42cd-b738-d9c6f9b03f3a

Go to Security Profile > SSL/SSH Inspection

Create a CLONE of deep-inspection profile

Rename this cloned profile to "Allow OneDrive".

Edit "Allow OneDrive" SSL Inspection profile.

Under "Exempt from SSL Inspection", add the 56 address objects which you have created for OneDrive previously.

Reference Guide 1: SSL/SSH inspection
Link: https://docs.fortinet.com/document/fortigate/6.0.0/handbook/24449/ssl-ssh-inspection

Reference Guide 2: Creating an SSL/SSH profile that exempts Google
Link: https://docs.fortinet.com/document/fortigate/5.6.0/cookbook/655529/creating-an-ssl-ssh-profile-that-exempts-google

Click OK.

Go to Policy & Objects > Firewall Policy.

Edit the firewall policy/rule for internal network to wan1 (outgoing internet access).

Change SSL Inspection profile to "Allow OneDrive".

Click OK.

Above Steps Did Not Work

Unfortunately, the above steps did not work. I had to create a new firewall policy on top of the outgoing internet access policy specifically dedicated to the Synology NAS with all Security Profiles turned off. This method works.

Mr. Turritopsis Dohrnii Teo En Ming, 43 years old as of 30 Jan 2022, is a TARGETED INDIVIDUAL living in Singapore. He is an IT Consultant with a Systems Integrator (SI)/computer firm in Singapore. He is an IT enthusiast.

REFERENCES

[1] https://pastebin.com/raw/5MHNAqYE

[2] https://controlc.com/5d1fd012

Edit
Pub: 30 Jan 2022 09:38 UTC
Views: 92