I need to use Azure Front Door as a WAF up front to on-premis Fortigate
and with the FrontDoor_Header_Check - used to Application Control function block whole traffic except FrontDoor ID
and i'm not sure how to create/which parameters to used to custom app signature for this traffic
i have only X-Azure-FDID number, i can't find anythink corrent in to Azure documentation
https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-apply-and-validate-a-custom-applica... is not really legible
does someone have any experience with this and can give me any direction?
Solved! Go to Solution.
Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
Hi Jacekg,
Ok Thank you for the feedback. It is limited support on such matter apologies for the inconvenience.
Thank you,
saleha
Hi,
Thank you for reaching out. I am not sure if this is possible on a FortiGate as there is no option to integrate Azure front door specifically to the fortigate. I only found document under FortiSOAR:
Based on the article you provided on the ticket I assume that the FortiGate would have to be the edge device to Azure Front Door and you are just looking for an application signature for the Azure application. If this is the case then I recommend creating a support ticket and request the customer application signature. We do have a dedicated application and IPS signature team that can respond to such requests if applicable.
Thank you,
saleha
that's why i ask here because in to this article is a line: "Note that the Fortinet Technical Support department does not offer technical assistance in customizing application control signatures."
that's why i ask here because in to this article is a line: "Note that the Fortinet Technical Support department does not offer technical assistance in customizing application control signatures."
Yes as far as TAC support customer signatures are not offered however we can submit it internally to the IPS signature team to check if they can offer such signature. The reason support is not offered because of the variable elements that goes into creating such signature. I still recommend submitting the support ticket at least to check if this can be accomodated.
Thank you,
saleha
i have reply from TAC support, as they mention in article - they do not support custom app signature
Hi Jacekg,
Ok Thank you for the feedback. It is limited support on such matter apologies for the inconvenience.
Thank you,
saleha
So you're trying to match traffic that has the X-Azure-FDID header with a specific value?
If so, then I suppose the signature could be as simple as this:
F-SBID( --name "my-custom-signature"; --service HTTP; --flow from_client; --pattern [!]"X-Azure-FDID: YOURIDHERE"; --context HEADER; --app_cat <ID>; )
Explanation:
This assumes that the header is present in every single HTTP request sent from clients.
If you set this signature to block-action, any HTTP request that does not contain this header should then in theory be blocked by AppControl.
Signature syntax doc: https://docs.fortinet.com/document/ipsengine/7.4.0/custom-ips-and-application-control-signature-synt...
Use with care.
No guarantees.
No refunds. :)
hmm? is this correct or i'm doing somethinks wrong? after click ok i got error. this is modification current custom signature
inks wrong?
I had some formatting errors in there. Try this, it saved successfully in my test:
F-SBID( --name "my-custom-signature"; --service HTTP; --flow from_client; --pattern [!]"X-Azure-FDID: YOURIDHERE"; --context HEADER; --app_cat <ID>; )
(fixing this in the original reply as well)
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
User | Count |
---|---|
1669 | |
1082 | |
752 | |
446 | |
226 |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.