Azure Front Door on-premis Fortigate

Hi,

Thank you for reaching out. I am not sure if this is possible on a FortiGate as there is no option to integrate Azure front door specifically to the fortigate. I only found document under FortiSOAR:

https://docs.fortinet.com/document/fortisoar/1.0.0/azure-front-door-waf/679/azure-front-door-waf-v1-0-0

Based on the article you provided on the ticket I assume that the FortiGate would have to be the edge device to Azure Front Door and you are just looking for an application signature for the Azure application. If this is the case then I recommend creating a support ticket and request the customer application signature. We do have a dedicated application and IPS signature team that can respond to such requests if applicable.

Thank you,

saleha

that's why i ask here because in to this article is a line: "Note that the Fortinet Technical Support department does not offer technical assistance in customizing application control signatures."

Yes as far as TAC support customer signatures are not offered however we can submit it internally to the IPS signature team to check if they can offer such signature. The reason support is not offered because of the variable elements that goes into creating such signature. I still recommend submitting the support ticket at least to check if this can be accomodated.

Thank you,

saleha

So you're trying to match traffic that has the X-Azure-FDID header with a specific value?

If so, then I suppose the signature could be as simple as this:

F-SBID( --name "my-custom-signature"; --service HTTP; --flow from_client; --pattern [!]"X-Azure-FDID: YOURIDHERE"; --context HEADER; --app_cat <ID>; )

Explanation:

• Searches/matches only HTTP (including HTTPS if decrypted) traffic
• Searches for the pattern X-Azure-FDID: YOURIDHERE"
• Match is valid if the pattern is NOT present ("[!]")
• Does the search only in the HTTP header
• Checks only packets sent from client (~ HTTP requests)
• Puts the signature into the <ID> application category (pick a category you like)

This assumes that the header is present in every single HTTP request sent from clients.

If you set this signature to block-action, any HTTP request that does not contain this header should then in theory be blocked by AppControl.

Signature syntax doc: https://docs.fortinet.com/document/ipsengine/7.4.0/custom-ips-and-application-control-signature-syntax-guide/274110/creating-ips-and-application-control-signatures

Use with care.

No guarantees.

No refunds. :)