Technical Tip: How to block WhatsApp via FortiClient EMS

[david_pereira]

Description	This article describes how to block WhatsApp communication via FortiClient EMS through Security Profiles.
Scope	FortiClient EMS v7.0+, v7.2+.
Solution	Access the EMS GUI and then go to Endpoint Profiles -> Firewall, then edit the desired profile: There are two options to block WhatsApp: Blocking the entire category, 'Collaboration' category. Blocking only the application to allow access to other apps at the same category. In this example, the 'Collaboration' category will be allowed and an application override will be created to only block WhatsApp. At the desired profile, scroll down to 'Application Override', and then, select 'Add' as shown in the figure below: A new window named 'Firewall Application Signatures' will be shown. Select the filter to search for the WhatsApp: Type the app name. in this case 'WhatsApp', and some options will appear: To block the entire app communication, select the first option. Select then the option to block, at the left side of the 'Add' button, and select 'Add'. Select 'Save', to save the config: With the configurations saved, wait around 1 minute for the changes to be replicated to the endpoints that use the profile. When the user attempts to open the WhatsApp application, a warning message will appear informing that the app is blocked: It is also possible to see the warning at the 'Notifications' tab in the FortiClient as shown below: The WhatsApp access attempts can also be viewed from the EMS GUI: To see the events above go to Endpoints -> All Endpoints, search for the device, and select 'Firewall Events'. The WhatsApp application is blocked and all attempts to access will be recorded.