New Member

Question

DNS web filtering instead of SSL inspection?

11 replies
19803 views

Hi, I want to set up some basic web category filtering for our school. A common problem is that we can block " http://facebook.com" but we can' t block " https://facebook.com" . Is there an easy way to do this without setting up SSL Inspection? I have seen articles about DNS Inspection mode for the web filtering but no doc on how to set it up. Do the clients need to use the Fortigate as their DNS server? Currently we use internal MS dns with forwarding to external (ISP) dns. How would this need to change to use DNS mode? TIA

Bromont_FTNT

Staff

What firmware are you running? You can block sites without deep SSL inspection by using the certificate CN and/or SNI

LanceMcAuthor

New Member

Hi, thanks for your reply. Firmware is v5.0,build3608 (GA Patch 7). Can you send be a link to doc or basic instructions for setting up this blocking filter?

Dipen

New Member

FortiOS 5.0.x has issues with blocking HTTPS sites but FortiOS 5.2 is out, it has got better HTTPS blocking capabilities. In any case you always use Application Control instead of Web Filters to achieve your results.

pcraponi

New Member

you can follow this doc to block HTTPS without deep scan: http://docs.fortinet.com/d/fortigate-configuring-fortios-v5.0-webfiltering-for-https-scanning-without-ssl-deep-scanning Not work for all websites (youtube, for example) but for facebook works fine. This method block using cert CN... regards, paulo raponi

Dipen

New Member

All because of certificates. Mismatch in URL & CN in certificates causes this always . Youtube is a pain because the certificate of YouTube is *.google.com Application Control I s more helpful to block HTTPS.

LanceMcAuthor

New Member

Many thanks for the replies. I have arranged for the OS to be upgraded to 5.2 then we will try the solutions suggested.

pcraponi

New Member

5.2 are a very new OS. It have some bugs yet... The best way are you trying with 5.0.7 and if you have NO SUCCESS, you can upgrade to 5.2... I can confirm that 5.0.7 works fine with HTTPS block..

Bromont_FTNT

Staff

Just to be clear... before v5 non deep SSL inspection used only certificate CN thus Google sites could not be differentiated. in v5 inspection via SNI was also added so Youtube etc can be blocked without SSL deep inspection.

Prab

New Member

Hi all,

In firmware version 5.6.3, build1547, I tested the Certificate based inspection & I was able to block youtube.com and allow google.com using Web filter only.

The following screenshot shows it:

I did not get any certificate warnings. The client browser will just see default Error_CONNECTION_CLOSED or The site can't be reached message. It's worth noting that, I did configure my filter to not to display a block page/replacement message.

Hope it helps!

Thanks & regards,

Prab :)

2018-07-11_12h45_38.jpg

emnoc

New Member

Just to be clear... before v5 non deep SSL inspection used only certificate CN thus Google sites could not be differentiated.

BTW the certificate "CN" is ignore in ALL major web-browsers when a AltName is present.

Back to te OP, you could also use a Explicit proxy and block the website without setting up SSLinspection.

Ken

norascott

New Member

I was creative my first website by download WordPress free themes from sktthemes.net. the website run smoothly but applying SSL to the domain it occurs DNS server error. What is the solution of this error? please help me.

Sign up

Login with SSO

Login to the community

Login with SSO