Webfilter blocking URI (Page) after allowing the Host Address (Domain)

Forum|Forum|4 years ago
January 4, 2022
9 replies
8447 views

Hi All, We have a Fortigate 30E and I have a requirement to block certain page in a particular domain.

Ex.) There is a domain https://xyz.com. That primary domain must be allowed but a page in that domain must not be blocked, like https://xyz.com/page1.php? . I could find that after allowing the primary domain the firewall is creating a session, hence not blocking any URI path further. Correct me if I am wrong. Also please provide an way to implement the URI block (or) HTTP method block (or) using any other method, but the primary domain should be blocked. Thanks.

FortiGate

yashwani

Staff

You can use static URL filter in Web Filter profile to allow a specific URL instead of the domain. You can also use wildcard/regex to match a specific pattern. Example shown in the attached image. Mark it solved if it answered your query.

KishAuthor

New Member

Hi Yashwani,

Thanks for your reply. I have tried this but the problem is,

The main domain must be allowed ie. https://xyz.com
After a user login to that particular website xyz.com, an allow session is created in firewall session table. Also a cookie is created by that website to maintain persistence.
Next in that website there is a particular page https://xyz.com/Page1.php, and that particular page has to be blocked.
Since the main domain is allowed already by the firewall, I am unable to pick the URI of that domain and create a filter policy for that particular page.

Please suggest me if there is any way to work on this.

yashwani

Staff

You can use regular expression to exclude the specifc page and allow all other instead of the full domain (https://xyz.com)

hermann

Explorer

Do you use deep packet inspection for this encrypted traffic?

KishAuthor

New Member

Thanks for your reply. Yes Hermann. I have tried deep packet inspection with default ca certificate. Not not working. Even tried content inspection with some website content in block list. But no use.

hermann

Explorer

Deep packet inspection is a MUST to enable any control of sub-URLs in the content filters. Without DPI the Fortigate is not able to see any content in encrypted packets. The host name could be visible, though, if it is a part of the SSL/TLS handshaking.

KishAuthor

New Member

I have tried Deep Packet Inspection. My doubt is, will FortiGate look in to sub-url / path after creating the Statefull session entry for the particular destination. Firewall is doing man-in-the-middle process, but I am not sure whether it is checking the requesting sub-url / path for that domain every time. Is there anything to deal with cookie.

hermann

Explorer

afaik you should not be worried about TLS 1.2 and before, each packet will be inspected. I have no idea if UTP works smoothly with TLS 1.3, although.

Sign up

Login with SSO

Login to the community

Login with SSO