Firewall decisions based on SNI field?

Forum|Forum|6 years ago
December 19, 2019
14 replies
34574 views

Hi all,

Does anybody know if FortiGate can be configured to do this?

[ul]

When a client opens a TCP connection to predefined port (typically, HTTPS), respond to the TCP handshake on behalf of a server.

Accept the "Client Hello" TLS message from the client,

Read the server's hostname specified in the SNI field of the "Client Hello".

Check the hostname against "destination" of the firewall policies - maybe by performing its own DNS resolution to see if the IP falls into allowed ranges, or maybe by textual comparison if the destination is set as some regexp object?

Make a Allow/Block decision based on the result?[/ul]

Today, when virtually any TLS client supports the SNI field, this would be very useful feature.

Thanks,

Vladimir.

Policy

Best answer by boneyard

FortiGate should look at the SNI by default for webfiltering according to this article:

https://kb.fortinet.com/k....do?externalID=FD34661

your feature to use it in the ipv4 policy is sort of using a webfilter profile with fixed entries in my opinion. but to have it happen automatically is not something how the fortigate operates on layer 4.

the question to keep in mind is how long this be useful, SNI is close to getting encrypted, once that happens the feature becomes useless.

Vladimir_OstrovskyAuthor

New Member

This should be essentially the same as the use of "[link=https://developer.mozilla.org/en-US/docs/Web/HTTP/Methods/CONNECT]CONNECT hostname:443 HTTP/1.1[/link]" header by Explicit Proxy for HTTPS connections. The Proxy also responds to TCP handshake, then reads this header and makes decisions based on this hostname.

I'm just looking for a way to implement the same thing without using the Explicit Proxy.

emnoc

New Member

A LB will do this with ease and is how multiple websites are hosted on a SLB with numerous pool members. Have you looked at the fortiweb product line? I'm sure it has that ability and probably GEOIP support for the sources. We use to do that with in F5-LTM and iRules to restrict certain websites based on src-address or geo information.

Since the fortigate has a basic SLB, I would explore the fortiweb features.

Ken Felix

Vladimir_OstrovskyAuthor

New Member

Probably my question wasn't clear enough - it's about filtering outgoing HTTPS traffic, so LB is not really applicable here.

I just found this CheckPoint paper, "URL Filtering using SNI for HTTPS websites" - it demonstrates how to achieve this, but I'd glad to do it with FortiGate.

Sign up

Login with SSO

Login to the community

Login with SSO