Technical Tip: Validating FortiEDR collector host firewall enforcement and logging

Host firewall is a feature introduced in Collector 6.1+ that allows FortiEDR to enforce network traffic control at the endpoint level. FortiEDR does not implement its own firewall engine. It leverages the native Windows Filtering Platform (WFP) to instruct Windows to allow or block specific network connections. FortiEDR manages the policy, and Windows performs the actual enforcement at the kernel level.

Windows Filtering Platform (WFP) is the built-in Windows kernel framework responsible for network traffic filtering and firewall enforcement. WFP has been available since Windows Server 2008, so Host Firewall does not work on older Windows versions.

How to validate that a host firewall is working.

Before testing host firewall functionality, verify that:

• A host firewall policy has been created.
• The collector's collector group is assigned to that host firewall policy.

The following example is set up using a public IP address (for example, a reachable Google IP 142.250.73.110).
The examples demonstrate simple outbound TCP tests. Any traffic matching a defined Host Firewall policy (based on IP, port, or protocol) can be used for validation.

Test network connectivity (using PowerShell):

Test-NetConnection 142.250.73.110 -Port 80

If the block rule is enforced successfully, the output will show TCP connection failed.

Test using curl:

curl http://142.250.73.110

Logging and visibility:

When the host firewall blocks traffic, logs can be observed in two locations.

1. FortiEDR console threat hunting. Navigate to threat hunting: blocked events are categorized with the 'firewall block' type.

    

Example of a blocked event:

2. Windows event viewer.

Because enforcement is performed by Windows Filtering Platform (WFP), Windows can also log the block event once Filtering Platform auditing is enabled. Once auditing is enabled, block events will appear in the security log in the Windows event viewer.

The following common Event IDs can be used for filtering:

• 5152 - WFP blocked a packet
• 5157 - WFP blocked a connection
  
  

Example of a blocked event in Windows Event Viewer: