Skip to main content
bmiranda
Staff
bmiranda
Staff
February 22, 2023

Technical Tip: Block domain access while allowing sub-directories access

  • February 22, 2023
  • 0 replies
  • 3014 views
Description This article describes how to allow access to sub-directories while blocking access to the parent domain.
Scope All versions.
Solution

In order to make this solution work, it is needed to enable Deep Packet Inspection, otherwise, the FortiGate will not be able to look beyond the certificate of the domain being used and will block access. This should not be confused with sub-domain filtering which is different and does not need DPI.

 

For this example, the domain 'www.fortinet.com' and the sub-directory 'http://www.fortinet.com/products/next-generation-firewall' will be used.

 

Step 1:
Configure the Web Filter Profile's Static URL Filters:

 

WebFilterProfile.png

 

Step 2:
Configure the SSL/SSH Inspection Profile as 'Full SSL Inspection':

 

SSLProfile1.png

 

Note: be sure that the domain is not exempting (by default Fortinet domain is exempted so it is necessary to remove it in this example):

 

SSLProfile2.png

 

Step 3:
Create the Firewall Policy using both profiles created in the previous steps:

 

FWPolicy.png

 

Step 4:

Download and install the CA certificate to allow the FortiGate to be able to perform Deep Inspection:

 

 

1)Certificate1.png

 

 

2)Certificate2.png

 

3)

Certificate3.png

 

 

4)

Certificate4.png

 

5)

Certificate5.png 

Confirm that the newly installed certificate is visible in the Computer Certificates and in the correct folder:

 

Certificate6.png

 

Step 5:

Test the access to 'www.fortinet.com' - This should fail: 

 

fortinetfail.png

 

Test the access to 'www.fortinet.com/products/next-generation-firewall' - This should work:

 

fortinetsuccess.png
      Terms & ConditionsAccessibility statement