Skip to main content
tanr
tanr
New Member
January 25, 2018
Question

Security policy to allow some services only for servers behind multiple wildcard urls?

  • January 25, 2018
  • 2 replies
  • 9473 views

Hi All,

 

I just worked around the fact that FortiOS (5.4.7 anyway) doesn't let you specify wildcard URLs for security policies.  I get the issue of the possible performance hit, but wanted to check to see if people can suggest a better way to do this than what I've done.

 

Situation is a small subset of users, on their own vlan, that I need to allow to connect out to some specific external game servers.  The two problems are:

1. There are a lot of game servers which are under multiple wildcard urls in multiple countries.

2. The connections need to allow a wide swath of tcp and udp ports, which I can't allow the use of to most external IPs.

 

So, I have a separate rule for these users, with a destination specified as the CIDR ranges owned by the company running the game servers, which allows both their normal service and all the tcp/udp ports needed for the game servers.

 

This works, but will break if the company buys a new set of IPs or outsources their servers.

 

Is there a cleaner way to do this with App Control or Web Filters?  Note that the apps connecting to the game servers are not currently listed under App Control, and that I don't want to allow those ports to be used *anywhere* except to those game servers.

 

Thanks.

2 replies

jsaab05
jsaab05
New Member
January 25, 2018

Hello.

You can use FQDN Object in the destination field on Firewall policy to allow access the user_gamers to games servers.

tanr
tanrAuthor
New Member
January 26, 2018

Can't do it with wildcards, I'm afraid.  Something like *.company.com isn't allowed.  And as the company keeps generating new servers, and has hundreds already active, even if I wanted to enter all the FQDNs (like us-gameserver-0161.company.com) that rule would still break down when they add more servers to the list.

dmcquade
dmcquade
New Member
January 29, 2018

Use a webfilter. Block the categories you don't want your users to visit and make exceptions via the URL Filter within the profile. For example you can create a wildcard entry "*somewebsite.com" and set to exempt or allow.

 

HTH

d

tanr
tanrAuthor
New Member
January 29, 2018

My understanding is that Web Filtering is primarily looking at the destination for HTTP/HTTPS requests, and isn't designed to be applied for specific services beyond that.

 

Also, Web Filter specifies what is not allowed, instead of what is.  For this case, I need to specify that these particular services are only allowed if going from certain users out to specific servers. Those services are not allowed for any other users or to any other servers.

romanr
romanr
New Member
January 29, 2018

Hi,

 

using Wildcards on Server Names can only work in eg http(s) or on protocol level running it in a proxy.

 

As the Fortigate just cannot dump a DNS Zone it is not possible to look up all the entries in there - as long as your DNS security works properly ;)

 

If this game service is a well known public provider, you can try to convince Fortinet to take their IP and Service definitions into the internet service database. With FortiOS 5.6 you can easily use the isdb feature in a policy.

 

Besides that you will need to work with ipv4 adressing and create either a custom internet service or standard address groups...

 

Br,

Roman

Terms & ConditionsAccessibility statement