Address or Url filter

[#1]

What are the differences in these two locations on a fortiwifi 60AM. Lets say that I put a FQDN (www.example-website.com) as an address and add it to a group that is then used in a policy as a Destination. OR I create a URL Filter that includes example-website.com (simple expression/allow). This URL Filter is then referenced by a scan profile. Does one supersede the other? What is the best practice for creating approved sites for user behind the firewall?

[doshbass]

Hi Teddy, The FQDN option will always take precedence as effectively this is an IP address (or a number of IP addresses depending n DNS). This will be a dstination in a firewall policy so if matched then th eprocessing will go no further. Because this is an IP address you are not looking at the URL, so you will be permitting all sites and all URLs that reside on the server with that IP (or servers with those IPs).

[nsumner]

Just to expand on this. We used to have a everything allowed via FQDN (we white list where most users can browse to). We had problems where many sites that we didn' t want to allow were inadvertantely allowed due to shared web-hosts (or more specifically due to akamai which we shall call much the same for simplicity sakes). By using instead a web-filter I can be much more specific. My final rule in the web-filter is a regex to catch everything and block it. Hence I have a white list that basically works 100% as I want it. As the case actually is, I suppose if you wanted to do one better you would have both rules defined together. The web-filter has the following attack possibility. I could go find the IP of www.blockedsite.com, then edit my hosts file and make www.allowedsite.com point to that IP (If you users have those permissions on their computers). Then provided the web-host is not using name based virtual hosts, I could type into my browser www.allowedsite.com it will be allowed through the Fortigate and I get to the blockedsite. If I combined both rules the FQDN would do it' s own DNS lookup of www.allowedsite.com, therefore this attack will fail as the IP of www.blockedsite.com will never have been allowed. But my users aren' t that advanced, and anyways they don' t have permissions to touch their hosts file anyhow.

[ede_pfau]

U-oh, I bet your users are clever enough to type an IP into their browser! who touches the hosts file these days... The Fortigates have a variety of protection features to filter web traffic, from simple URL filters to website categories, regex' s to block TLDs and, last but not least, firewall policies. It depends on your intention what you' ll apply. In many cases you' d want to protect your systems from malware, blocking web links in SPAM mails. Users can click on links faster than their brain can yell ' Stop' . But if they really wanted to evade a blacklist they could. BTW, maintaining a white list seems a lot of work to me. Google brings in interesting new sites (hundreds of) every day. You cannot possibly keep up with your users at that pace without resorting to some medieval scheme of censorship. That' s why Fortinet developed the Fortiguard webfilter service. It might be useful to have a look into it.