Skip to main content
sebag
sebag
New Member
October 20, 2016
Question

Can't add a new application control security to explicit proxy policy? fortiOS 5.4.1

  • October 20, 2016
  • 3 replies
  • 11448 views

Hi, I’m new on Fortigate.

 

I create a new Application Control security profile to block multimedia (video, youtube, Netflix, Spotify, etc.) and I want to apply It to one of my Explicit Proxy Policy. I want to block that’s programs if some of that client were installed on my user’s desktop.

When I edit Explicit Proxy Policy and choose my new application control I get a an error in GUI, but if I choose the default application control it’s apply ok and save ok.

 

Any idea, why?

 

Thanks.

3 replies

sebag
sebagAuthor
New Member
November 4, 2016

Hello, Thanks to Fortinet Supports!!! Here is the solution:

 

> Session log: 1) Problem: Customer can not use an specific Profile of Application Control in Explicit proxy "Some changes failed to save" 2) I applied it via CLI and detected the following message Cannot block Proxy.HTTP application in explicit proxy policy. object check operator error, -651, discard the setting Command fail. Return code 1 3) We allowed "Proxy" in the profile and we succeed.

 

thanks!!!

hmtay_FTNT
Staff
hmtay_FTNT
Staff
February 24, 2017

Hello sebag,

 

Did you set the category "Proxy" or the signature "Proxy.HTTP" to Block? If you are using an Explicit Proxy Policy and tries to block the "Proxy.HTTP" signature, it will give you an error. That is because the "Proxy.HTTP" signature blocks the exact traffic that Explicit Proxy Policy sends.

 

HoMing

dboreham_FTNT
Staff
dboreham_FTNT
Staff
May 17, 2017

To add to the above response from HoMing, if your Application Control profile blocks the "Proxy" category, then you cannot apply it to the Explicit Proxy policy, as it includes the "Proxy.HTTP" application.  One solution would be to block the "Proxy" as a category while adding "Proxy.HTTP" as an Application Override.  This approach will allow for the Explicit Proxy application, but will block other types of proxies.  

jayden67
jayden67
New Member
October 31, 2024

"Hey! It sounds like FortiOS 5.4.1 might have compatibility issues with custom profiles in the Explicit Proxy settings. A quick fix could be to start with the default profile, then add custom controls one at a time to pinpoint the issue check out. Also, ensure all app signatures are up-to-date—older signatures can sometimes cause these errors. Hope this helps, and good luck!"

Terms & ConditionsAccessibility statement