Allowing only certain URL' s

[#1]

I need to block all web access for certain users EXCEPT for certain job related URL' s (i.e. weather.com) The users are allowed full access during certain times of the day (breaks, lunch, etc.) I was successful in configuring multiple policies to achieve this, but am looking to allow specific URL' s while blocking everything else. Can this be done with FortiOS and how? Thanks for any assistance.

[Hracio]

mmm, im having some trouble with url filters &regex stuff What to achieve: https://one.domain.com/user ---> Allow https://one.domain.com/everythingelse --->deny https://one.domain.com --->deny What i' v done: From Inet--> DMZ URL one.domain.com/user Type Simple Action Allow Enable URL xx\.x\.xxx\.220 (my ip) Type Regex Action Block Enable Enabled the URL filtering for http & https, but its not working, it allows me to access to every url on https:443. But if i enable this one.. every url is blocked URL one.domain.com Type Simple Action Deny Enable

[UkWizard]

why is your IP in the block entry? URL blocking looks in the header, so it doesnt match the client IP (to my knowledge anyway). just put in one.domain.com for the block rule and that should suffice.

[UkWizard]

yep it does. i use it often for unix scripting.

[Hracio]

URL xx\.x\.xxx\.220 (my ip)

I meant my server IP.. to avoid access via ip/url Can' t make it work yet...

^.*

correct, it blocks all, should be used with exemption actions, also says that https looks on the certificate for blocking... now reading : Mastering Regular Expressions, 3rd Edition By Jeffrey E. F. Friedl Ugghhh... was not on my plans... (if any1 wants it, pm me.)

[UkWizard]

all you need in life is wikipedia..... http://en.wikipedia.org/wiki/Regular_expression

[Hracio]

yes, however.. it doesn' t work (as it should) url filtering on https urls... xxx.xx.xxx.220/webmail --->public IP Type Simple Action Allow Enable xxx.mydomain.xxx/webmail --public Domain Type Simple Action Allow Enable xxx\.xx\.xxx\.xxx --Public IP Type Regex Action Block Enable xxx\.mydomain\.xxx -->Public domain Type Regex Action Block Enable This should allow access only to mydomain/webmail & mypublicip/webmail and block everything else... but its blocking everything even the allowed urls. Regards.-!

[UkWizard]

try putting in just your ip and your domain without the /webmail part. as simple entries and see what happens.

[Hracio]

Hi there.. with the last two url filters using simple format or regex, i always get the The URL you requested has been blocked. URL = xxx.mydomain.xxx It Always blocks the root domain, no matter what " allows" i have before... Could be a certificate problem ?¡.. FortiGate Administration Guide, Page 462.

HTTPs URL formats Type a top level domain name for HTTPs URL filtering, for example, www.example.com. HTTPs URL filtering works by extracting the CN from the server certificate during the SSL negotiation. Because the CN only contains the domain name of the site being accessed, HTTPS web filtering can only filter by domain names.

That doesnt make any sense..(practical sense) so i can block the whole domain or nothing at all ? Regards

[UkWizard]

yes it could be. https is a bit hit and miss i believe, but havent seen any customers who have had big issues with it.

[Hracio]

yup, Iam one of those customers.. Posted a supp ticket on 6/25/2008... still running...