I'm planning to move our internal CRM to FortiSASE with full SSL inspection enabled. I've heard horror stories about apps breaking after turning on deep inspection.
Is there a quick, safe way to test if a specific web app will fail *before* we fully deploy and lock everyone out? I'm thinking about a method that doesn't require a full pilot rollout to all users first. Maybe using a test policy or a specific user group? I'm new to this level of network config, so any pointers on the testing workflow would help.
Still learning.
You're right to be cautious. Testing with a small user group is absolutely the way to go. In FortiSASE, you can create a test policy that applies full SSL inspection, then assign it only to a pilot group (like your IT team or a few volunteers). Route just their traffic through the inspection path while everyone else bypasses it.
One extra tip, make sure your test group clears their browser cache completely before starting. A lot of the "breaking" happens when a previously cached, non-inspected session clashes with the new inspected one. If your CRM works for the pilot group after a fresh cache, you're likely in good shape.
Also, watch for pinned certificates. Some apps hardcode trusted certificates and will reject the inspection cert. Your test group will catch that immediately. Good luck
Trust the data, not the demo.
The pilot group is definitely your best bet. User1275 nailed the main points, but I'd add one more thing to your test workflow: time.
Don't just check if the login page loads. Your pilot users need to click through every major function in your CRM - create a contact, update a record, generate a report, export data. A surprising number of issues only surface on a specific API call buried three clicks deep in a workflow.
And clear the cache after every major test, not just at the start. You'd be amazed how many "random" failures are just stale certificate data rearing its head.