Fortinet FortiGate: AI assistant (LLM)

Paste this into your AI assistant to have it help configure FortiGate to allow the RTA's outbound connection. It still pauses for your confirmation and for anything your version does differently.

Configuration prompt

You are helping me configure my Fortinet FortiGate (FortiOS) so the Sophos Remote
Testing Appliance (RTA) can reach its endpoint. Work through the steps in order and
show me the pending change before I apply anything.

CONTEXT:
- The RTA needs exactly ONE outbound connection: an OpenVPN tunnel on TCP/443 to
  connect.remotetesting.secureworks.com. That FQDN resolves to two static IPs,
  3.33.194.251 and 15.197.255.2, which do not change.
- An ordinary "allow outbound 443" rule is often not enough. SSL/SSH deep
  inspection intercepts the OpenVPN handshake and terminates the tunnel, and
  FortiGuard Application Control can drop the OpenVPN signature. Both must be
  addressed for this one destination.
- Some appliances also register over standard HTTPS on TCP/443 to
  get.remotetesting.secureworks.com. If I tell you the appliance uses that
  endpoint, allow it and exempt it from SSL/SSH inspection too, but by FQDN only:
  its IP addresses are not static.

STEPS:
1. Create an FQDN address object so the later steps can reference the endpoint
   consistently.
   GUI: Policy & Objects > Addresses > Create New > Address. Set Name
   rta-connect-endpoint, Type FQDN, FQDN connect.remotetesting.secureworks.com,
   Interface Any.
   CLI:
   config firewall address
       edit "rta-connect-endpoint"
           set type fqdn
           set fqdn "connect.remotetesting.secureworks.com"
           set comment "RTA OpenVPN endpoint"
       next
   end
   The endpoint also has the two static IPs above if I prefer an IP-based rule.

2. Exempt the endpoint from SSL/SSH deep inspection so the OpenVPN handshake is
   not intercepted. Do ONE of these; ask me which inspection profile or policy
   applies to my outbound traffic before you change anything.
   Option A: add an exemption to the SSL/SSH inspection profile applied to
   outbound traffic.
   GUI: Security Profiles > SSL/SSH Inspection > open <SSL_SSH_PROFILE> >
   Exemptions tab > Create New. Set Address to rta-connect-endpoint and Ports
   to 443.
   CLI (replace <SSL_SSH_PROFILE> with my actual profile name, for example deep-inspection):
   config firewall ssl-ssh-profile
       edit "<SSL_SSH_PROFILE>"
           config ssl-exempt
               edit 0
                   set type address
                   set address "rta-connect-endpoint"
               next
           end
       next
   end
   Option B: create a dedicated firewall policy scoped to rta-connect-endpoint and
   set its SSL Inspection to the built-in certificate-inspection profile instead of
   deep-inspection. Certificate inspection validates the server certificate without
   re-terminating TLS, so OpenVPN passes through unmodified.

3. Allow the OpenVPN application, but only if an Application Control profile is
   applied to the outbound policy for this destination. If that policy references
   no Application Control profile, skip this step and tell me.
   GUI: Security Profiles > Application Control > open <APP_CONTROL_PROFILE> >
   find the OpenVPN signature (use the search box) > set Action to Allow. You can
   instead add it under the Application Overrides tab with Action Allow.
   CLI (replace <APP_CONTROL_PROFILE> with my actual app-control profile name, for example default):
   config application list
       edit "<APP_CONTROL_PROFILE>"
           config entries
               edit 0
                   set application 17244
                   set action pass
               next
           end
       next
   end
   17244 is the FortiGuard application ID for the OpenVPN signature, but FortiGuard
   database updates can renumber signatures. Before you apply the CLI, confirm the
   ID on my appliance with "diagnose application list | grep -i openvpn", or match
   the signature by name in the GUI. If it does not match, stop and show me what
   you see.

VERIFY:
- FortiGate profile and policy changes take effect on save; there is no separate
  commit or deploy step.
- From a host on the same network segment as the RTA, confirm TCP/443 reaches the
  endpoint:
  nc -vz connect.remotetesting.secureworks.com 443
  A success looks like: Connection to connect.remotetesting.secureworks.com port
  443 [tcp/https] succeeded!
- In Log & Report > Forward Traffic, confirm the session for
  connect.remotetesting.secureworks.com:443 shows action accept and is not
  immediately closed.
- In Log & Report > Application Control, confirm no block events for the OpenVPN
  application from the RTA source address.
- Then confirm the RTA tunnel itself comes up and stays up (no repeated
  reconnects) in the RTA management console. If the session is accepted but resets
  after a few seconds, SSL inspection is still intercepting it: revisit step 2.

RULES YOU MUST FOLLOW:
- These steps are authoritative. If a menu, command, or option does not match what
  is written here (versions differ), STOP and show me what you actually see. Do not
  guess at equivalent settings or invent CLI syntax.
- Make the narrowest change that allows this one destination. Do not broaden an
  existing rule to "any", and do not disable, bypass, or pause the firewall, TLS/SSL
  decryption, or threat inspection globally to make it work.
- Allowlist connect.remotetesting.secureworks.com. Its two IPs (3.33.194.251 and
  15.197.255.2) are static, but get.remotetesting.secureworks.com (used on some
  platforms) is not, so allow that one BY FQDN, never by a hardcoded IP.
- Do not apply, commit, or deploy the change until I confirm. Show me the pending
  configuration first.
- Change only what these steps describe. Do not alter unrelated rules, objects, or
  policy, and do not touch anything outside allowing this destination.