Azure Front Door on-premis Fortigate

[jacekg]

I need to use Azure Front Door as a WAF up front to on-premis Fortigate

and with the FrontDoor_Header_Check - used to Application Control function block whole traffic except FrontDoor ID

and i'm not sure how to create/which parameters to used to custom app signature for this traffic

i have only X-Azure-FDID number, i can't find anythink corrent in to Azure documentation

https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-apply-and-validate-a-custom-applica... is not really legible

does someone have any experience with this and can give me any direction?

[saleha]

Hi,

Thank you for reaching out. I am not sure if this is possible on a FortiGate as there is no option to integrate Azure front door specifically to the fortigate. I only found document under FortiSOAR:

https://docs.fortinet.com/document/fortisoar/1.0.0/azure-front-door-waf/679/azure-front-door-waf-v1-...

Based on the article you provided on the ticket I assume that the FortiGate would have to be the edge device to Azure Front Door and you are just looking for an application signature for the Azure application. If this is the case then I recommend creating a support ticket and request the customer application signature. We do have a dedicated application and IPS signature team that can respond to such requests if applicable.

Thank you,

saleha

[jacekg]

that's why i ask here because in to this article is a line: "Note that the Fortinet Technical Support department does not offer technical assistance in customizing application control signatures."

[jacekg]

that's why i ask here because in to this article is a line: "Note that the Fortinet Technical Support department does not offer technical assistance in customizing application control signatures."

[saleha]

Yes as far as TAC support customer signatures are not offered however we can submit it internally to the IPS signature team to check if they can offer such signature. The reason support is not offered because of the variable elements that goes into creating such signature. I still recommend submitting the support ticket at least to check if this can be accomodated.

Thank you,

saleha

[jacekg]

i have reply from TAC support, as they mention in article - they do not support custom app signature

https://community.fortinet.com/t5/Customer-Service/Technical-Tip-Technical-support-on-customization-...

[saleha · Accepted solution]

Hi Jacekg,

Ok Thank you for the feedback. It is limited support on such matter apologies for the inconvenience.

Thank you,

saleha

[pminarik]

So you're trying to match traffic that has the X-Azure-FDID header with a specific value?

If so, then I suppose the signature could be as simple as this:

F-SBID( --name "my-custom-signature"; --service HTTP; --flow from_client; --pattern [!]"X-Azure-FDID: YOURIDHERE"; --context HEADER; --app_cat <ID>; )

Explanation:

• Searches/matches only HTTP (including HTTPS if decrypted) traffic
• Searches for the pattern X-Azure-FDID: YOURIDHERE"
• Match is valid if the pattern is NOT present ("[!]")
• Does the search only in the HTTP header
• Checks only packets sent from client (~ HTTP requests)
• Puts the signature into the <ID> application category (pick a category you like)

This assumes that the header is present in every single HTTP request sent from clients.

If you set this signature to block-action, any HTTP request that does not contain this header should then in theory be blocked by AppControl.

Signature syntax doc: https://docs.fortinet.com/document/ipsengine/7.4.0/custom-ips-and-application-control-signature-synt...

Use with care.

No guarantees.

No refunds. :)

[jacekg]

hmm? is this correct or i'm doing somethinks wrong? after click ok i got error. this is modification current custom signature
inks wrong?

[pminarik]

I had some formatting errors in there. Try this, it saved successfully in my test:

F-SBID( --name "my-custom-signature"; --service HTTP; --flow from_client; --pattern [!]"X-Azure-FDID: YOURIDHERE"; --context HEADER; --app_cat <ID>; )

(fixing this in the original reply as well)