FortiGate
FortiGate Next Generation Firewall utilizes purpose-built security processors and threat intelligence security services from FortiGuard labs to deliver top-rated protection and high performance, including encrypted traffic.
samandeep
Staff
Staff
Article Id 360335
Description This article explains a step-by-step guide on how to block remote access software for client connections.
Scope FortiGate.
Solution

Blocking remote applications can be achieved in multiple ways.

  1. Application control:
 

app control.png

 

To block remote access-related applications, follow these steps:

  1. Navigate to Application Control: Go to Security Profiles and select Application Control.
  2. Select the Profile: Choose the desired profile (for example 'default' as shown in the screenshot).
  3. Block Remote Access: Under Categories, select Block for Remote Access. This will block all applications matching remote access-related signatures.
  4. Example Application Signatures: Refer to the list of application signatures for examples of blocked applications.

    app 2.png
  5. Save Changes: After making these changes, press OK to save and apply them under the Firewall policy.

 

Important Note: For some application signatures, enabling Deep SSL Inspection is necessary for effective blocking. This feature allows for the inspection of encrypted traffic, ensuring the signature can be properly detected and blocked.

 

For Web filtering: Web Filter is more focused on controlling web access based on URLs and categories, while Application Control is geared towards managing and securing specific applications running on the network.

 

  1. Using Internet Service Database(ISDB):

     

 

Internet service databases can be used when specific software or websites need to be blocked without using security profiles/UTMs. 

 

Below is a screenshot illustrating how to Deny (Application/Website) traffic using a firewall policy with the Internet Service Database as the destination.

 

isdb1.png

 

If a remote access software lacks an ISDB or Application signature, consider the following alternatives:

  1. FQDN-Based Firewall Policy: Use the tool's Fully Qualified Domain Name (FQDN) in your Firewall policy to control access.
  2. Request a New AppControl Signature: Submit a request for a new AppControl signature through the FortiGuard website: Application Control Submission Form.