DLP with Web Filter

Question

Hi,

We have made some IPV4 policies over FortiGate 51E running fortiOS v5.4.2,build1100 (GA) version. We are using FSSO to authenticate users that have specific web filter categories and we are trying to deploy DLP with some user exceptions but without success. Our main goal is to block executables files for users that does not belong to AD group called “GRP-ALLOW-EXECS”. At the same time, we have 3 other groups for web filtering: GRP-RESTRICTED-WEB, GRP-MODERATE-WEB and GRP-PRIVILEGED-WEB (for different web filter policies respectively). For all 3 web filter policy we have set DLP to block executable downloads and that’s OK but if we create a new policy rule above to allow exec downloads for the AD group, the webfilter policies (below) are bypassed.

Is there a way to combine WebFilter and DLP profiles together?

Johan_de_Koning · Answer

Sorry to say but what you are saying doesnt make sense since this is expected behaviour, ofcourse is the rule which is on top of the chain will prevail the others being under it. Classis Firewall behaviour.

So to think in the perspective in which you will succeed is, place group GRP-ALLOW-EXECS with its DLP filter for blocking execs on top of the 3 groups GRP-RESTRICTED-WEB, GRP-MODERATE-WEB and GRP-PRIVILEGED-WEB. The 3 groups will then still be blocked with execs according to your policy.

Sign up

Login with SSO

Login to the community

Login with SSO