Application detection for a proxy destined traffic

[rajamanickam]

Hi,

  I have a query.. whether fortigate firewall can detect the application in proxy traffic. In our Fortinet SDWAN topology,  My endclient from a spoke location uses a proxy server at hub location for any internet access. In the firewall policy at hub location I have configured firewall policy with Application control default profile enabled. I could see that partially some of the applications like Gmail are getting detected but few other sites aren't detecting. I can understand that its based on Application control database, the applications are getting detected. But my query is, For Fortigate this traffic destination will be proxy with destination port number 8080, with this situation how is it detecting Gmail application?, Is it due to application control sensor?. Until now, my thought was application inside  these kind of proxy destination traffic cant be detected by Fortigate.  

Can someone explain in detail to understand the functionality of application control sensor for proxy traffic

We have enabled flow-based policy only..

Regards

Raja

[saneeshpv_FTNT]

Hi @rajamanickam,

The traffic from your Client is Destined to your Proxy IP when using Explicit proxy, then the client's request includes the URL's of the desired destination resource in the HTTP connect/get method it uses to instruct the proxy where to connect to.

FortiGate application control should be able to parse this information in the Client request to determine the application in the initial few packets itself which are not encrypted. This will block the application entirely for example blocking access to entire GMAIL completely, but if your requirement is to block a specific portion of GMAIL for example Gmail Chat, won't be possible with this method and this would require FortiGate to perform Deep inspection. 

Hope this clarifies.

Best Regards,

[rajamanickam]

Thanks for your reply, so in short we can say like Fortigate application control sensor will be able to detect the application inside the packet which is destined for Proxy.. As of now, I am not looking to do any block, we are only monitoring it but want to be sure that all my proxy destination traffic are getting detected by application control sensor. This will be useful for my reporting purpose so that I can identify which applications are getting used through proxy. I hope all application signatures defined in the application database can be detected in this scenario or is there any exception? because many of the traffics are getting detected as Proxy.http , So I am assuming that these proxy.http traffics are not known application in the application control database.. Whether my understanding is correct?

[saneeshpv_FTNT]

Hi @rajamanickam ,

There is no specific exception to this if I am not wrong, but detection is more accurate when you have FortiGate performing Deep inspection of the Encrypted traffic. But in this case, it is purely based on the unencrypted portion of your traffic date with which FortiGate identify the application.

Proxy.http application- How FortiGate is detecting them is explained in below article and what you said is right maybe it is not able to detect as any particular application but instead matching as Proxy.http.

https://www.fortiguard.com/appcontrol/12429 

Best Regards,

[rajamanickam]

Thanks for your reply. Since the proxy traffic runs on 8080 its not encrypted, so effectively fortigate will be able to deduct all possible applications/websites (As available in Application control database). Our primary objective is to have these applications in the reporting and we are not looking for any traffic steering in SDWAN based on application destination...

[pminarik]

Just to warn you in advance: Application-based steering in SD-WAN rules will not work for proxied traffic.

Application-based SD-WAN rules are essentially dynamically created temporary ISDB entries: Identify traffic to <IP>:<port> as <app-x> ⇒ create temporary ISDB entry "<IP>:<port> = <app-x> ⇒ new sessions routed with respect to this new entry. Since all of this proxied traffic will be to the IP:port of the explicit proxy, steering won't work properly. The IP:port will only ever match one application (I don't recall if it's the first or the most recent identification)

[rajamanickam]

Thanks for your reply.  Our primary objective is to have these applications in the reporting and we are not looking for any traffic steering in SDWAN based on application destination. So the takeaway from this post is, an endclient when accessing any website using a proxy server in port 8080 and fortigate at the branch can detect the application/websties the endclient is trying to access. In this way, we will be sure that these applications get detected and reported in our Fortianalyzer for any analytical purpose..

[uchimaru8]

Yes, great point. I think this is a good beginner's view. After that, one could try a rooted Android phone with an app to force the proxy, or a more traditional MITM analyzing the packets.

[ScoopHunter]

When it comes to those elusive sites not getting detected, it could be due to a few factors. One possibility is that these sites might be using less common ports or protocols that aren't as easily recognizable to Fortigate's application control. Also, considering the rise of mobile proxies like 4G/LTE/5G, there's a chance that the traffic might behave differently, throwing a curveball in the detection process. It's interesting how technologies like mobile proxies can influence traffic patterns. With the increasing use of mobile proxy, especially in dynamic environments, traditional detection methods might face some challenges. So, navigating through these nuances could require a bit of tweaking and fine-tuning in your firewall policies.