Troubleshooting Tip: Blocking all file uploads via web browser using FortiGate: a specific use case

[mhemambika]

Description	This article describes a specific use case for blocking all file uploads through a web browser using FortiGate.
Scope	FortiGate.
Solution	Blocking all types of file uploads through a web browser on FortiGate can be achieved by using a combination of Application Control and a custom signature configured to detect and prevent file upload activity. In most cases, blocking all HTTP uploads is not fully achievable. Try this in two ways: Create a custom application control signature: Select 'Create New' to add a custom application control signature. Define a signature pattern that detects characteristics commonly associated with file uploads, such as patterns in HTTP headers related to file transfer activity. Configure the application control profile: In the 'General' settings, create or modify an application control profile. Include the previously created custom signature within the profile. Apply the application control profile in a security policy: Go to 'Policy & Objects' and choose the relevant security policy for the targeted traffic. Modify the policy and, under the 'Security Profile' section, apply the configured application control profile. Configure the web filter profile: Within the 'General' settings, create or modify a web filter profile. Configure categories and actions according to specific requirements, with particular focus on categories associated with file uploads, such as 'File Sharing' or 'Cloud Storage'. Set the action to block uploads: Within the web filter profile, configure the actions for the relevant categories to 'Block' or 'Deny'. Apply the web filter profile in a security policy: Access 'Policy & Objects' and select the security policy relevant to the traffic being managed. Edit the policy and, in the 'Security Profile' section, apply the configured web filter profile. Note: Use firewall policy inspection-mode in the proxy. Navigate to Security Profiles: In the menu on the left side, go to 'Security Profiles'. Create a new DLP profile: Select 'Data Leak Prevention' and then 'Create New'. Configure the DLP profile: Within the DLP profile settings, configure rules and conditions to block file uploads. Conditions can be based on file types, keywords, or patterns indicative of sensitive data. Attach the DLP profile to a relevant security policy for enforcement. Go to 'Policy & Objects' and choose the appropriate security policy for the targeted traffic. Edit the policy and, in the 'Security Profile' section, apply the configured DLP profile. Verify the DLP actions to ensure correct handling of detected file uploads. Configure the DLP profile to take appropriate actions when a violation is detected. Common actions include 'Block', 'Quarantine', or 'Monitor'. Related articles: Technical Tip: Block upload or download of PDF files larger than a specific size using DLP Technical Tip: DLP Configuration to Block by file-type and Troubleshooting Technical Tip: Configure Data Leak/Loss Prevention (DLP)