Block a protocol in a deny rule

Question

Hi,I need to set a rule to deny any one RDP to a server, not just TCP 3389 but on any port.I know this can be done using IPS security profiles but there is a problem: When I set the rule to deny, no IPS profile may be selected and in the rule I can only choose RDP service which is TCP 3389. IPS profiles and exceptions within can only be selected when the rule is an Allow type. So? In short, I need a rule to deny RDP protocol with any port (default or non-default) to be blocked toward a specific destination. Regards,

pminarik · Accepted Answer

FortiGates have two main modes of operation when it comes to firewall policies and UTM: System Settings > NGFW mode: Profile-Based & Policy-Based

Profile-based (default)

In this mode, you cannot do what you are asking for. The initial firewall policy match is done only up to layer4 (TCP/UDP ports).

Only after this policy match is decided, the UTM profiles from that policy are applied. UTM then either drops or allow the traffic.

There is no fallback to re-evaluate the traffic against other firewall policies below the matched one, so if you wanted to include additional blocks or permissions for a given source&destination, you would need to implement that together with the RDP block within one policy.

Policy-Based

In this mode you first configure "basic firewall policies" that handle the initial layers & central SNAT & which SSL inspection to apply. In a separate table you can configure "Security Policies", where you can directly target specific application signatures, URL categories, etc.

Here's a link to the documentation about the Profile vs Policy mode differences

Based on your description, policy-based mode would be the best fit to implement a policy that matches your description the closest. However, keep in mind that this is not the default mode of operation and is not used as much. If you already have everything configured in profile-based mode, you would need to set things from scratch if switching to policy-based mode (the switch wipes all firewall policies), so this may or may not be worth the effort...

pminarik · Answer

Action=deny is a block performed at "layer 4" - based on IP addresses, IP protocols, and ports - hence why you cannot select any UTM profile when action=deny.

If you would like to permit general traffic towards the server and specifically deny only RDP using IPS, what you should do instead is set the policy to action=allow, and then add an IPS profile that contains your desired RDP signature(s) set to action=block.

Sign up

Login with SSO

Login to the community

Login with SSO