Application Control - cloudflare Warp getting through Firewall

2 replies
4037 views

I have a question regarding blocking the Cloud flare warp app on our application control in the firewall settings.

I have blocked all proxys and VPN's in the generic filters and the app is inside those blocks. However the app still seems to run and bypass all filtering on the firewall. When I run a scan I can see that the app is working and bypasses the application control settings.

Anyone know what this problem?
Is it a tunnelling problem or a port?
I can see it uses the MASQUE protocol.

Anthony_E

Staff

Hello,

Thank you for using the Community Forum. I will seek to get you an answer or help. We will reply to this thread with an update as soon as possible.

Thanks,

Best Regards

Yurisk

SuperUser

Reading the Fortinet docs about this - they recommend to block Cloud Warp access by IP address blocks, I can deduct that Fortinet yet to come up with an effective AppControl signature to block it.

https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-Block-Cloudflare-WARP/ta-p/213214

CloudFlare Warp ranges from Cloudflare docs: https://developers.cloudflare.com/cloudflare-one/connections/connect-devices/warp/deployment/firewall/

Also, I'd think if you had white-listed ports only allowed, like 80/443/etc and block every other port, enforcing protocol adherence in profile, it would potentially block it as it is some MASQUE protocol tunneled inside HTTPS and FGT usually has no problem with detecting such, provided you have Deep SSL Inspection.

yurisk.info - all things Fortinet blog, no ads

Sign up

Login with SSO

Login to the community

Login with SSO