Fortinet FortiGate: GUI (FortiOS web UI)¶
Apply the FortiGate changes entirely through the FortiOS web console: an FQDN address object, an SSL inspection exemption, and an Application Control allowance.
Note
For background on why an ordinary "allow outbound 443" rule is not enough, see the FortiGate overview. The same changes are available as copyable commands on the CLI (FortiOS CLI) page.
1. Create an FQDN address object¶
Create a reusable address object for the RTA endpoint so you can reference it
consistently in inspection profiles and policies. (The endpoint also has two
static IPs, 3.33.194.251 and 15.197.255.2, if you prefer an IP-based rule.)
Go to Policy & Objects > Addresses > Create New > Address and fill in:
| Field | Value |
|---|---|
| Name | rta-connect-endpoint |
| Type | FQDN |
| FQDN | connect.remotetesting.secureworks.com |
| Interface | Any |
2. Exempt from SSL inspection¶
SSL/SSH deep inspection will intercept the OpenVPN handshake and terminate the tunnel. You have two options; choose one.
Option A: Add an exemption to the SSL/SSH inspection profile¶
This keeps deep inspection active for other traffic while excluding the RTA destination.
Go to Security Profiles > SSL/SSH Inspection > open the profile applied to outbound traffic > Exemptions tab > Create New, and fill in:
| Field | Value |
|---|---|
| Address | rta-connect-endpoint (select the object created above) |
| Ports | 443 |
Option B: Use certificate-inspection on the firewall policy¶
Create a dedicated firewall policy for the RTA destination and apply the built-in
certificate-inspection profile instead of deep-inspection. Certificate
inspection validates the server certificate without re-terminating TLS, so OpenVPN
passes through unmodified.
Go to Policy & Objects > Firewall Policy > the policy covering outbound traffic
from the RTA segment > set SSL Inspection to certificate-inspection (or
create a narrower policy scoped to rta-connect-endpoint that references
certificate-inspection).
Tip
Option B is the simpler path on appliances where editing the global deep-inspection profile is not permitted. Scoping it to a dedicated policy also avoids unintended side-effects on other traffic.
3. Allow the OpenVPN application¶
FortiGuard Application Control includes a signature named OpenVPN (category: Network Services or VPN, depending on the FortiGuard database version installed). If an Application Control profile applied to outbound traffic is set to block or monitor-and-drop this signature, the RTA tunnel will not establish.
Go to Security Profiles > Application Control > open the profile applied to outbound traffic > locate OpenVPN (use the search box) > set Action to Allow.
Alternatively, add an application override:
Application Control profile > Application Overrides tab > Add Signatures >
search for OpenVPN > set Action to Allow.
If your outbound policy for this destination does not reference any Application Control profile, no action is needed here.
4. Apply and verify¶
FortiGate profile and policy changes take effect on save; there is no separate commit or deploy step.
Verify connectivity¶
From a host on the same network segment as the RTA, confirm TCP/443 reaches the endpoint:
nc -vz connect.remotetesting.secureworks.com 443
A successful result looks like:
Connection to connect.remotetesting.secureworks.com port 443 [tcp/https] succeeded!
Then confirm the RTA tunnel itself comes up and stays up (no repeated reconnects in the RTA management console).
Check the logs¶
On the FortiGate, check:
- Log & Report > Forward Traffic, confirm the session for
connect.remotetesting.secureworks.com:443shows action accept and is not immediately closed. - Log & Report > Application Control, confirm no block events for the OpenVPN application from the RTA source address.
If the connection is accepted but resets after a few seconds, SSL inspection is still intercepting the session. Revisit Step 2.