Fortinet FortiGate: CLI (FortiOS CLI)¶

Apply the FortiGate changes from the FortiOS CLI (over SSH or the console): an FQDN address object, an SSL inspection exemption, and an Application Control allowance.

Note

For background on why an ordinary "allow outbound 443" rule is not enough, see the FortiGate overview. The same changes are available as click-through steps on the GUI (FortiOS web UI) page.

1. Create an FQDN address object¶

Create a reusable address object for the RTA endpoint so you can reference it consistently in inspection profiles and policies. (The endpoint also has two static IPs, 3.33.194.251 and 15.197.255.2, if you prefer an IP-based rule.)

config firewall address
    edit "rta-connect-endpoint"
        set type fqdn
        set fqdn "connect.remotetesting.secureworks.com"
        set comment "RTA OpenVPN endpoint"
    next
end

2. Exempt from SSL inspection¶

SSL/SSH deep inspection will intercept the OpenVPN handshake and terminate the tunnel. You have two options; choose one.

Option A: Add an exemption to the SSL/SSH inspection profile¶

This keeps deep inspection active for other traffic while excluding the RTA destination. Replace deep-inspection with your actual profile name:

config firewall ssl-ssh-profile
    edit "deep-inspection"
        config ssl-exempt
            edit 0
                set type address
                set address "rta-connect-endpoint"
            next
        end
    next
end

Option B: Use certificate-inspection on the firewall policy¶

Point the firewall policy for the RTA destination at the built-in certificate-inspection profile instead of deep-inspection. Certificate inspection validates the server certificate without re-terminating TLS, so OpenVPN passes through unmodified.

Apply it to the policy covering outbound traffic from the RTA segment (or to a narrower policy scoped to rta-connect-endpoint); replace <POLICY_ID> with the policy's ID:

config firewall policy
    edit <POLICY_ID>
        set ssl-ssh-profile "certificate-inspection"
    next
end

Tip

Option B is the simpler path on appliances where editing the global deep-inspection profile is not permitted. Scoping it to a dedicated policy also avoids unintended side-effects on other traffic.

3. Allow the OpenVPN application¶

FortiGuard Application Control includes a signature named OpenVPN (category: Network Services or VPN, depending on the FortiGuard database version installed). If an Application Control profile applied to outbound traffic is set to block or monitor-and-drop this signature, the RTA tunnel will not establish.

Replace default with your actual app-control profile name:

config application list
    edit "default"
        config entries
            edit 0
                set application 17244
                set action pass
            next
        end
    next
end

Note

17244 is the FortiGuard application ID for the OpenVPN signature. Before applying the CLI block above, confirm it matches on your appliance with diagnose application list | grep -i openvpn (FortiGuard database updates can renumber signatures), or search by name in the GUI instead.

If your outbound policy for this destination does not reference any Application Control profile, no action is needed here.

4. Apply and verify¶

FortiGate profile and policy changes take effect on save; there is no separate commit or deploy step.

Verify connectivity¶

From a host on the same network segment as the RTA, confirm TCP/443 reaches the endpoint:

nc -vz connect.remotetesting.secureworks.com 443

A successful result looks like:

Connection to connect.remotetesting.secureworks.com port 443 [tcp/https] succeeded!

Then confirm the RTA tunnel itself comes up and stays up (no repeated reconnects in the RTA management console).

Check the logs¶

Filter the forward traffic log (category 0) to the endpoint's static IPs and display it; confirm the session to connect.remotetesting.secureworks.com:443 shows action accept and is not immediately closed:

execute log filter reset
execute log filter category 0
execute log filter field dstip 3.33.194.251 15.197.255.2
execute log display

Then check the Application Control log (category 10) and confirm no block events for the OpenVPN application from the RTA source address:

execute log filter reset
execute log filter category 10
execute log display

The same logs are available in the web UI under Log & Report > Forward Traffic and Log & Report > Application Control; see the GUI guide.

If the connection is accepted but resets after a few seconds, SSL inspection is still intercepting the session. Revisit Step 2.