Description
This article describes how to block ChatGPT file uploads using an application control profile.
Scope
FortiGate.
Solution
Step1 : Create Firewall Policy:
- Navigate to Policy & Objects and select 'Create New'.
- Configure respective policy field as shown in image below.
- Make sure inspection Mode: Proxy-based and SSL inspection: deep-inspection .
Note:
Refer to this article to install a certificate into end-user system: Technical Tip: How to enable deep inspection and import a certificate in the browser
Step 2: Applying application security profile to policy:
- Enable 'Application control' profile and select 'Create new'.
- Set name to Application Profile and add below 'Application Signature' as mentioned in the image, and select 'OK'.
Verification:
Logs from Logs&Report: Forward traffic logs :
date=2025-07-11 time=16:09:19 eventtime=1752230359403514941 tz="+0530" logid="0000000013" type="traffic" subtype="forward" level="notice" vd="root" srcip=172.29.6.50 srcname="PHOTON-KVM01" srcport=58431 srcintf="port1" srcintfrole="lan" dstip=104.18.43.204 dstport=443 dstintf="wan1" dstintfrole="wan" srccountry="Reserved" dstcountry="United States" sessionid=3763396 proto=6 action="timeout" policyid=37 policytype="policy" poluuid="f02c59d4-5bbc-51f0-63a4-7b0ac45eed0b" policyname="AI_ file upload block" service="HTTPS" trandisp="snat" transip=10.5.128.102 transport=58431 appid=56684 app="OpenAI.ChatGPT_File.Upload" appcat="GenAI" apprisk="low" applist="Clone of IT App Control1" appact="drop-session" duration=164 sentbyte=40855 rcvdbyte=34613 sentpkt=46 rcvdpkt=64 vwlid=0 utmaction="block" countapp=6 sentdelta=0 rcvddelta=0 durationdelta=0 sentpktdelta=0 rcvdpktdelta=0 devtype="Unknown" osname="Windows" srcswversion="10" mastersrcmac="00:70:68:6f:01:01" srcmac="00:70:68:6f:01:01" srcserver=0 utmref=65484-1034
date=2025-07-11 time=18:34:12 eventtime=1752239052829923941 tz="+0530" logid="1059028705" type="utm" subtype="app-ctrl" eventtype="signature" level="warning" vd="root" appid=56684 srcip=172.29.6.50 srccountry="Reserved" dstip=104.18.43.204 dstcountry="United States" srcport=62463 dstport=443 srcintf="port1" srcintfrole="lan" dstintf="wan1" dstintfrole="wan" proto=6 service="HTTPS" direction="outgoing" policyid=37 poluuid="f02c59d4-5bbc-51f0-63a4-7b0ac45eed0b" policytype="policy" sessionid=4123725 applist="chatgpt_block" action="block" appcat="GenAI" app="OpenAI.ChatGPT_File.Upload" hostname="files.oaiusercontent.com" incidentserialno=76555117 url="/file-14hZNqkJ8WvsWyGxvQcrik?se=2025-07-11T13%3A08%3A28Z&sp=cw&sv=2024-08-04&sr=b&sig=mL8gxzge8rO1rAe7K1ULfjpks2hi0rqQg4iHl8LszFs%3D" agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36" httpmethod="PUT" referralurl="https://chatgpt.com/" msg="GenAI: OpenAI.ChatGPT_File.Upload" apprisk="low"
