Block application based on Hostname that has spaces

Question

I'm looking for a way to block applications based on the "Hostname", but the "Hostname" has a space in it. For example, there is a Just Proxy VPN that is getting through our firewall. If I filter the Application Control log, the Application is SSL_TLSv1.2, and in the details, the Hostname is "Just Proxy VPN" and the URL is "/", and the Category is Network.Service. It uses different IP addresses and ports, so I can't block using those.

I can't block all of SSL_TLSv1.2, but I want to block any application using hostname= "Just Proxy VPN". I can filter for it in the logs, but I can't seem to setup a block for it. Is there a way to create an Application using this information to then block it?

Here is a detail log for one instance:

itime=2017-04-10 20:44:54 vd=root app=SSL_TLSv1.2 date=2017-04-10 dstip=139.59.64.226 apprisk=medium group=FSSO_NoNetscape service=tcp/7624 proto=6 eventtype=app-ctrl-all devid=FG1K5D3I15800570 dstintf=port25 applist=BlockYouTube msg=Network.Service: SSL_TLSv1.2, dstport=51229 type=utm dtime=2017-04-10 20:44:54 devname=HA-Group dstname=139.59.64.226 appid=41540 sessionid=847504567 profiletype=applist user=NWEA-DT srcintf=port28 srcip=10.4.48.48 level=information url=/ appcat=Network.Service srcport=49567 logid=1059028704 subtype=app-ctrl time=20:44:54 action=pass itime_t=1491875094 hostname=Just Proxy VPN policyid=83

Thanks,

Michelle

hmtay_FTNT · Accepted Answer

Hello Michelle,

The --pattern syntax parses space, " ", like any other char. A custom Application Control signature for your case is:

F-SBID( --name "JustProxy.VPN.Custom"; --protocol tcp; --app_cat 6; --weight 10; --service SSL; --pattern "Just Proxy VPN"; --context host; --no_case; )

This is one way to block VPNs that use SSLVPN with their self-signed certificates. We try to cover as completely as we can the VPNs that can be downloaded and used to bypass our signatures. One case that is not as easy to cover is VPNs that use self-signed certificates. The reason is there are infinite possibilities when it comes to a self-signed certificate - certificate generators can create a certificate with completely random values within the constraints of the framework of a SSL Certificate.

The best solution (might not be plausible in your environment) is to block Untrusted SSL Certificates. Just want to let you know of the possible solutions for your case. Thanks!

HoMing

hmtay_FTNT · Answer

Hi Michelle,

>>This worked for a while...but then it seemed to break my HA so I removed them. I switched from Active-Active to Active-Passive until I can get upgraded to 5.6 to see if that helps my HA (waiting on Fortianalyzer 5.6 firmware).

Did you check with support to see if they could diagnose the problem?

>>Your custom pattern for YogaVPN doesn't appear to list the hostname anywhere. How does that custom signature know to block the YogaVPN instead of another hostname?

YogaVPN uses a different protocol. It uses a HTTPS connection to get some servers and it has a list of hardcoded servers in the binaries. Therefore, the custom signature I provided you do not have the hostname. We have pushed new signatures for YogaVPN into the official database. It is going through the beta stage and should be released this week.

>>In the meantime, I took out my custom VPN signatures, but I have to add them again. There are just too many proxy VPN sites that our students are finding that I need to block, which aren't known by Fortinet yet.

Do you have the names of the VPNs? In my previous reply, I told you about blocking Untrusted SSL Certificates. Is that solution possible for the policies for the students?

HoMing

Sign up

Login with SSO

Login to the community

Login with SSO