How to block specific application

This will be highly dependent on what exact application you have in mind. Here are a couple options, in no particular order:

1, Deny policy targetting ISDB destinations
A well-known app with known IP:port lists can be blocked by an explicity DENY policy with the destination set to the ISDB entry relevant to the application. E.g. TeamViewer-TeamViewer.

2, Application Control signature blocking

Well-known applications may also have pre-made signatures. Those can be set to block in an Application Control UTM profile, which you can then apply to your internet-access firewall policies.

3, If the app is HTTPS/DNS dependent (must resolve some FQDN to function, or uses standard HTTPS for communication), you may be able to get away with simply blocking the relevant FQDNs with DNS filter or webfilter. (e.g. add static URL filter entries with block action)

4, For custom/less known apps: If you're crafty enough and have some knowledge of the application's protocol(s), you may be able to create your own custom IPS signature to block the application with Application Control. Documentation here

5, Alternatively, if the signature doesn't exist yet and you think other users would benefit from it being made, you can submit a request for a new AppControl signature here.

Note: With signature-based blocking, you may or may not need to utilise deep packet inspection (HTTPS/TLS decryption).

Hi, I need block  all protocolls except mqtt of una VIP that are published to internet. The requeriment is block all protocol in the direccion from WAN (internet) -> to LAN, I wonder if is posible use the aplication control in this direction, I saw tha the aplication control has the signature to mqtt protocol and, I tried to appy the aplication control in the firewall rules with all signatures applied and on exception on the mqtt protocoll, but  that didn't work. Any ideas??

Thanks and happy new year.

@mbenitez 

Just to add one clarification, Fortigate will block traffic originating from outside (WAN) to LAN unless you specifically create a Firewall Policy to allow it.

However if the traffic is initiated from LAN-> WAN, the reply to the traffic from WAN to LAN will be allowed.

So in your requirement, it all depends on who is initiating the traffic. 

You can also create a local in policy to block traffic coming from WAN to LAN. Here is more information about the same:
https://docs.fortinet.com/document/fortigate/7.4.1/administration-guide/363127/local-in-policy

Regards,

Varun

You should use Application Control and Web Filter in your security profiles. First, enable Application Control and create a policy that blocks remote access tools such as TeamViewer. Then, apply this policy to the relevant interfaces or user groups. To stop users from running installer files, use the Web Filter to block downloading of executable files (.exe, .msi) and enable SSL inspection for full visibility. Even if users have admin rights, this setup can help enforce restrictions at the network level.