Attempted Exemption from Fortigate SSL Certificate Inspection for Synology NAS Outgoing Connection to Microsoft OneDrive But Did Not Work

January 30, 2022

Subject: Attempted Exemption from Fortigate SSL Certificate Inspection for Synology NAS Outgoing Connection to Microsoft OneDrive But Did Not Work

Author: Mr. Turritopsis Dohrnii Teo En Ming (TARGETED INDIVIDUAL)

Country: Singapore

Date: 30 Jan 2022 Sunday Singapore Time

Type of Publication: Plain Text

Document Version: 20220130.01

Problem Description: Client Reports Her Synology NAS Cannot Connect to Microsoft OneDrive After Deployment of Fortigate 80F Firewall

Forum Discussion #1: HELP Needed please >>> Users suddenly cannot connect to Microsoft OneDrive and Sharepoint

Link: https://community.fortinet.com/t5/Fortinet-Forum/HELP-Needed-please-gt-gt-gt-Users-suddenly-cannot-connect-to/td-p/56216?m=183046

Forum Discussion #2: OneDrive synchronization error

Link: https://community.fortinet.com/t5/Fortinet-Forum/OneDrive-synchronization-error/m-p/167611?m=152352

DETAILED STEPS

===============

Go to Policy & Objects > Addresses

Create 56 Address Objects using FQDN for the hosts mentioned in the following article.

Article: Required URLs and ports for OneDrive

Link: https://docs.microsoft.com/en-us/onedrive/required-urls-and-ports?redirectSourcePath=%252fen-us%252farticle%252fRequired-URLs-and-ports-for-OneDrive-ce15d2cc-52ef-42cd-b738-d9c6f9b03f3a

Go to Security Profile > SSL/SSH Inspection

Create a CLONE of deep-inspection profile

Rename this cloned profile to "Allow OneDrive".

Edit "Allow OneDrive" SSL Inspection profile.

Under "Exempt from SSL Inspection", add the 56 address objects which you have created for OneDrive previously.

Reference Guide 1: SSL/SSH inspection

Link: https://docs.fortinet.com/document/fortigate/6.0.0/handbook/24449/ssl-ssh-inspection

Reference Guide 2: Creating an SSL/SSH profile that exempts Google

Link: https://docs.fortinet.com/document/fortigate/5.6.0/cookbook/655529/creating-an-ssl-ssh-profile-that-exempts-google

Click OK.

Go to Policy & Objects > Firewall Policy.

Edit the firewall policy/rule for internal network to wan1 (outgoing internet access).

Change SSL Inspection profile to "Allow OneDrive".

Click OK.

Above Steps Did Not Work

===========================

Unfortunately, the above steps did not work. I had to create a new firewall policy on top of the outgoing internet access policy specifically dedicated to the Synology NAS with all Security Profiles turned off. This method works.

Mr. Turritopsis Dohrnii Teo En Ming, 43 years old as of 30 Jan 2022, is a TARGETED INDIVIDUAL living in Singapore. He is an IT Consultant with a Systems Integrator (SI)/computer firm in Singapore. He is an IT enthusiast.

REFERENCES

==========

[1] https://pastebin.com/raw/5MHNAqYE

[2] https://controlc.com/5d1fd012

[3] https://rentry.co/h5bs8

[4] https://zerobin.net/?f86d9cb8b639cf13#DKwWRTlEoFRvJni4UiJ7tEKYMUkY1Hj3Zs5IDcJ6LM8=