Skip to main content
albaker1
albaker1
New Member
May 9, 2023
Question

Create a rule using URLs for web traffic (and NOT FQDNs)

  • May 9, 2023
  • 3 replies
  • 5846 views

Is it possible to configure a firewall rule using URLs and not FQDNs? I know how to configure FQDN, but the problem is that the wildcard FQDNs for Microsoft and Windows updates don't resolve all the proper IP addresses and traffic gets blocked from our WSUS server to the actual update site. FTG is running 7.2.4.

 

Thanks

3 replies

abarushka
Staff
abarushka
Staff
May 10, 2023

Hello,

 

It is not supported for the moment. Can you please elaborate whether wildcard FQDNs generally don't work or only in this particular case?

albaker1
albaker1Author
New Member
May 15, 2023

I've not had any wildcard FQDNs work at all. I know there is an Internet Service for Microsoft or Windows updates, but if I ccrated a wildcard FQDN for *.microsoft.com, I can pretty much bet you that windowsupdate.microsoft.com and *.windowsupdate.microsoft.com will not match these. We have some vendors that I can't find Internet Services for, and wildcard FQDNs don't resolve most of the IPs. 

Christian_89
Christian_89
Contributor III
May 15, 2023

To configure a firewall rule using URLs in FortiGate running firmware version 7.2.4, you can follow these steps:

  1. Create a Custom Web Filter URL Category:

    • Go to Security Profiles > Web Filter > URL Filter.
    • Click on "Create New".
    • Enter a name for the URL category (e.g., "Custom_Updates").
    • In the "URL Pattern" field, enter the specific URLs you want to allow or block (e.g., "http://.microsoft.com/").
    • Configure any other settings as per your requirements.
    • Save the URL category.

  2. Create a Firewall Policy:

    • Go to Policy & Objects > IPv4 Policy (or IPv6 Policy for IPv6 traffic).
    • Click on "Create New".
    • Configure the source, destination, and service settings as needed.
    • In the "Web Filter" section, select the previously created URL category (e.g., "Custom_Updates").
    • Set the desired action (allow or block) for the URL category.
    • Configure any other settings required for the firewall policy.
    • Save the policy.

By creating a custom URL category and using it in a firewall policy, you can define specific URLs to allow or block traffic. This approach allows you to bypass the limitations of wildcard FQDNs and ensure that the traffic from your WSUS server to the actual update sites is not blocked.

pavankr5
Staff
pavankr5
Staff
May 12, 2023

Hello 

To can create a firewall rule that uses URLs instead of FQDNs.

+ Go to Security Profiles > Web Filter.
+ Create a new profile or edit an existing one.
+ Under "URL Filter", select "Enable URL Filter" and click "Create New".
+ In the "Pattern" field, enter the URL or URL pattern that you want to allow or block. You can use regular expressions to specify complex patterns.
+ Choose whether you want to allow or block traffic to the specified URLs, and click "OK".
+ Save the web filter profile.

 

+ Go to Firewall > Policy and create a new policy or edit an existing one.
+ In the "Security Profiles" section, select the web filter profile that you just created.
+Specify the source and destination addresses, ports, and protocols for the firewall rule.
+ Save the firewall policy.

 

Note: This method may be less efficient than using FQDNs, as the firewall will need to perform a DNS lookup for each URL.

 

Thanks

albaker1
albaker1Author
New Member
May 15, 2023

pavankr5, I'm not sure I follow the logic. If I create a url filter for "https://*.vendor.com", I do this because I don't know all the subdomains associated with that wildcard FQDN. In the bottom section, I'm supposed to create a  policy with destination addresses. That was the purpose for my question. I have no idea what addresses to put in, and I'm tired of manually entering them. I seem to be missing something in your response, but I'd sure like to understand this better. Thank you for your time.

Yurisk
SuperUser
Yurisk
SuperUser
May 15, 2023

Hi,

trying to catch all IPs/domains/subdomains of the Microsoft the giant is an exercise in frustration, may I add. Have you tried using ISDB addresses instead? That is how I usually open access to all kinds of cloud services (Gmail/Whatsapp/Facebook/Windows Updates) and it works fine.

Regards

yurisk.info - all things Fortinet blog, no ads
albaker1
albaker1Author
New Member
May 15, 2023

"Internet Services" was referenced on the 9:58 post (CST) earlier, so we're already using ISDB for Microsoft. We have some vendors that I can't find a matching ISDB service for, which is the reason for the initial question. We are adding child domains and specific IPs as we find them out, but I was hoping to automate this. 

Terms & ConditionsAccessibility statement