Help with custom application signature

Counterintuitively, you may be able to add a Web Filter and add a 'static URL filter' entry to exempt that URL from all UTM. This will stop it from even being scanned by the Application Control.
See: https://community.fortinet.com/t5/FortiGate/Technical-Tip-The-difference-between-allow-and-exempt-in-the-web/ta-p/261349

If you need to do this within Application Control, it seems like the signature is correct. I would check and see if the request from the client is HTTPS, and if it is, you may need to enable Deep Inspection so Application Control can see inside that encrypted stream. 

---

@dsan wrote:

Hello,

 

I'm blocking app control Proxy category but I need to whitelist access to proxy-safebrowsing.googleapis.com. It falls under Proxy.HTTP application and gets blocked. I would like to do it via custom signature. But I can't seem to match the traffic using my custom signature.  I've read the signature creating guide and followed it but no luck. It still recognized as Proxy.HTTP.  

 

config application custom
 edit "Google.Safebrowsing.Proxy"
 set signature "F-SBID( --attack_id 9876; --name \"Google.Safebrowsing.Proxy\"; --service HTTP; --protocol tcp; --  app_cat 6; --pattern \"safebrowsing.googleapis.com\"; --weight 40;)"
 set category 6
next

end

 

config application list
 edit "AppControl"
 set extended-log enable
 set other-application-log enable
 set unknown-application-log enable
 set deep-app-inspection disable
 unset options
 config entries
 edit 4
     set application 9876
     set action pass
 next
 edit 5
     set category 2 6 7 8
 next
end
next
end

 

Sample log of traffic:

 

date=2024-10-01 time=17:26:51 id=7420921850693158485 itime=2024-10-01 17:26:51 euid=3 epid=326934 dsteuid=3 dstepid=101 type=utm subtype=app-ctrl level=warning action=block sessionid=186458912 policyid=89 srcip=10.123.111.111 dstip=123.123.123.123 srcport=54654 dstport=80 proto=6 logid=1059028705 service=HTTP eventtime=1727818011353619038 incidentserialno=82324068 crscore=10 craction=1048576 crlevel=medium direction=outgoing apprisk=critical appid=107347980 srcintfrole=lan dstintfrole=undefined applist=AppControl appcat=Proxy app=Proxy.HTTP hostname=proxy-safebrowsing.googleapis.com url=/ eventtype=signature srcintf=WIFI dstintf=port16 rawdata=Response-Content-Type=text/html rawdataid=1/1 msg=Proxy: Proxy.HTTP tz=-0400 policytype=policy srccountry=Reserved dstcountry=United States poluuid=39cfc8a0-241e-51ef-27e1-221716410659 httpmethod=CONNECT devid=FG4H111111111111 vd=root dtime=2024-10-01 17:26:51 itime_t=1727818011

 

Anyone has any idea how to match it ? Maybe "hostname" is not something that is searched for the "pattern".

In today’s digital landscape, having a robust mobile app is no longer a luxury but a necessity for businesses across industries. Mobile apps provide a direct, convenient way to engage with customers, streamline operations, and boost brand loyalty. From e-commerce to fintech, companies are leveraging mobile solutions to stay competitive and meet evolving consumer demands. Developing a high-quality app requires a clear understanding of user needs, seamless UI/UX design, and reliable backend infrastructure. This process can be complex, especially when considering cross-platform compatibility, security, and performance optimization. For businesses looking to build or improve their mobile applications, partnering with experienced developers can make a significant difference. DashDevs https://dashdevs.com/mobile-app-development/ offers tailored mobile app development services that help companies create scalable, user-friendly apps designed to drive growth and enhance customer experience. As mobile usage continues to rise globally, businesses that invest in well-designed apps position themselves for long-term success. The key lies in creating solutions that are not just functional but also intuitive, secure, and aligned with business goals.

---

If you're encountering a challenge with creating a custom signature to whitelist proxy-safebrowsing.googleapis.com, as it's still being blocked under the Proxy.HTTP category. One important thing to consider is that the hostname field in the log may not be the right match point for your signature. When crafting custom signatures, the pattern typically matches the data in the payload, and hostname might not be directly searchable in the signature definition.