Description
This article describes how to block an end user from using third-party VPN services.
Scope
FortiOs.
Solution
To block the third-party VPNs, set the category 'Proxy' and the signatures, 'IKE' and 'ISAKMP' to Block in application control, this should block most VPNs.
PPTP, L2TP signature falls under proxy category so it will cover VPN using those protocols.
Also make sure to use deep inspection in the firewall policy.
Find the configuration to be done on the FortiGate:
- Firewall Policy.
From the GUI:
From the CLI:
config firewall policy
edit 1
set name "Internet-Access"
set uuid 6759f40a-1672-51ed-ecd6-6344b9113347
set srcintf "port2"
set dstintf "port1"
set action accept
set srcaddr "all"
set dstaddr "all"
set schedule "always"
set service "ALL"
set utm-status enable
set ssl-ssh-profile "deep-inspection"
set application-list "default"
set logtraffic all
set nat enable
next
end
- Application control profile:
- If the VPN APP changes frequently how it connects it may be categorized as "Unknown Applications", in those cases this category should also be blocked.
- SSL inspection considerations:
- Some VPNs use different ports then default ones, in other for FortiGate to be able to inspect the traffic for those arbitrary ports 'Inspect all ports' should be enabled.
- Enable the following features can help make sure the deep inspection feature will effectively be used for all connections:
- Enforce SSL cipher compliance.
- Enforce SSL negotiation compliance.
- Create a top rule to block traffic to a known Internet Service Database (ISDB) - (Optional):
- ISDB can be used as top rule to block right out the bat before doing deep inspections by verifying the known destinations and ports list on a known database.
- Refer to this article: Technical Tip: Blocking Potential threats over Internet service database.
- General guidance on ISDB: Administration Guide - Internet Services.
Related links:
For an explanation of the reasons for using deep inspection, refer to the FortiGate documentation's 'Deep inspection' section.
How to import CA certificates into Android devices: Technical Tip: How to import FortiGate CA certificates into Android devices
Technical Tip: Extended logging for SSL traffic.
If any of the VPN signature is not available in the application control signature list, it is then also possible to use a custom application signature. How to implement custom application signature:
Creating IPS and application control signatures
Blocking applications with custom signatures - FortiGate administration guide
