Technical Tip: How to block domain name using Domain Name Threat Feed

fsilva · ‎11-22-2023

Description

This article describes how to block malicious domain names using a threat feed list.

Scope

When it is necessary to use a domain name threat feed to block access to malicious websites using DNS UTM.

Solution

For this demonstration, create a local file that includes a list of domains. It is important to note that the domains used in this example, such as Google and Facebook, are not actually malicious. They are included just for demonstration purposes.

If it is wanted to use a public URL that provides a list of domains containing examples of malicious URLs, here is one for reference.

In this example, use IIS on a Windows Server to publish the URL:

Screenshot 2023-11-21 174045.png

Create a Domain Name Threat Feed under Security Fabric -> External Connectors:

10.0.100.2 is the IIS local server and the blocked.txt is the file shown in step 1, which contains the example domains.
Validate that FortiGate can see the domain names, select under View Entry:

Since it is possible to see both domains, FortiGate is now able to use this list as a domain name treat feed.
Use a UTM DNS, to apply the custom domain list under Security Profiles -> DNS Filter.

Now it is possible to see under remote categories the domain list: 'right-click' and select redirect to a block portal.
Create a policy to apply the DNS UTM.

Is Mandatory to have Deep Inspections under SSL Inspection.

Config under CLI:

config firewall policy
edit 6
set name "blocked domains"
set uuid 11c01bc2-8891-51ee-3067-546b448ba38c
set srcintf "port3"
set dstintf "port1"
set action accept
set srcaddr "all"
set dstaddr "all"
set srcaddr6 "all"
set dstaddr6 "all"
set schedule "always"
set service "ALL"
set utm-status enable
set inspection-mode proxy
set ssl-ssh-profile "deep-inspection"
set dnsfilter-profile "default"
set nat enable
next
end
From a PC try accessing the blocked domain.

It is possible to see a warning from the browser related to the certificate or a blocked page:

Select Certificate is not valid to confirm the blocking from the FortiGuard SDNS Blocked page:

Here is another example without the certificate warning on Firefox: