FortiSASE Security Policy

Hello ,

Thank you for using the Community Forum. I will seek to get you an answer or help. We will reply to this thread with an update as soon as possible.

Thanks,

Hello,

We are still looking for someone to help you.

We will come back to you ASAP.

Regards,

Hello,

I may found an answer to your question:"

how Forti (in Proxy mode) handles URL based filtering and Application control.":

To understand how FortiProxy handles URL-based filtering and application control, we need to look at the security profiles it offers:

1. URL Filtering: FortiProxy uses FortiGuard Web Filtering, a subscription service that rates over 60 million websites and two billion web pages into 77 categories. - You can allow or block access to specific categories of websites based on your organization's policies. - URL filtering allows you to restrict access to URLs that you specify, providing granular control over web access.
2. Application Control:  FortiProxy's Application Control feature can detect the network traffic of more than 1,000 applications, even those not using standard ports for communication.

It allows you to identify and control applications on networks and endpoints regardless of the port, protocol, or IP address used. - You can write custom signatures to tailor application control to your network's specific needs, enhancing your control over application communication.

By utilizing these features, FortiProxy effectively manages URL-based filtering and application control to enhance security and control over web traffic within your network.

Hi Anthony, thanks for the Info. This is really helpful.

What i am trying to understand is how can one structure the policy that only allows you to lets say "google drive" and then move to the next policy to get allowed for lets say facebook.

The use case is what if a user is part of two different AD groups and needs to have access to different Apps/URL which is allowed by different policy.

Now that we have the whole Security profile tied to a rule, this gets really tricky to allow/block.

Can't you match on users/groups and give them different profiles? Also see the app control as you can be more open in the URL filtering and then go dipper with App Control and then CASB. You will need to plan your rules and profiles carefully.