How to deal with Adobe Creative Cloud?

Question

I am looking for advice on how to deal with Adobe Creative Cloud.

Fortinet provided information (Internet Services, etc.) unfortunately seem not complete.

I need to close down all unnecessary traffic from inside to the internet.

One of the policies should deal with Adobe Creative Cloud, but I can't make it work reliably.

I tried a combination of Adobe Internet Services and Security Profiles:

Policy with all Adobe Internet Services and no Security Profile
- Adobe Cloud is unreliable and does not connect, lots of timeouts. With some troubleshooting I have found additional IP Addresses that are not in any of the Fortinet provided Internet Services. Examples are *.adobess.com, *,typekit.com, *.astockcdn.net, *.adobejanus.com
Thus I created an additional policy with the aboce FQDN, all using HTTPS
- Better, but i probably missed yet another set of IP addresses.
Enhanced the policy with a Security Profile with all categories blocked, adding all I could find on Adobe manually in a Filter Override.
- Tested this also with no Adobe Internet Services, but All/All
- That prooved not so efficient as expected
Changed the Application Control to let through everything in Monitor mode
- This is the current status, but I still have a ALL/ALL rule at the end where apparent Adobe traffic is leaking into.
- As I closed down all other traffic, I recognized additional blocks in Policy 0.

Interestingly, those blocked connections were labeled as Adobe...

Examples are

13.224.92.48 (static.adobelogin.com) -> Amazon-AWS (but not any Adobe Internet Service...)

2.21.22.155 (helpx.adobe.com) -> Akamai-CDN (but not any Adobe...)

40.126.31.136 (www.tm.a.prd.aadg.akadns.net) -> Suspect Adobe usage, but I'm not sure

162.247.242.19 (bam.nr-data.net) -> New Relic (but not any Adobe...)

there are more..

For some of those I checked Adobe Acrobat DC with procmon looking at the IP connections opened directly on one of the PC's. Obviously I cannot directly link back to the above FQDN's as I only see PTR records in procmon.

Fact is that I, despite using the Fortinet provided Internet Services and the Application Profile, I can't make Adobe Cloud working correctly. But I do not want to keep everything open.

So, what might be your advise on how I can approach this?

Thanks

Dan

AlexC-FTNT · Answer

Hi Dan,

The most important two features implied are 'detection' and 'blocking', and we need to find out where it fails.

To correctly detect the HTTPS traffic, you need proxy-mode policy, Application control profile, "deep-inspection" SSL-SSH profile, and possibly Webfilter profile as well.

In some of your tests it seems that you managed to get the detection working, but blocking is effective on other profiles - need to see what security feature is blocking these sites (in logs). Some of the domains may not be allowed by allowing only Adobe (AWS/Akamai..) - these may be used by other sites as well, therefore may fall in the blocking category for those.

This being said, a better approach is to block unwanted specific elements/domains/categories rather than allow only specific domains.

Sign up

Login with SSO

Login to the community

Login with SSO