- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Azure Front Door on-premis Fortigate
I need to use Azure Front Door as a WAF up front to on-premis Fortigate
and with the FrontDoor_Header_Check - used to Application Control function block whole traffic except FrontDoor ID
and i'm not sure how to create/which parameters to used to custom app signature for this traffic
i have only X-Azure-FDID number, i can't find anythink corrent in to Azure documentation
https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-apply-and-validate-a-custom-applica... is not really legible
does someone have any experience with this and can give me any direction?
Solved! Go to Solution.
- Labels:
-
Application control
-
FortiGate
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi Jacekg,
Ok Thank you for the feedback. It is limited support on such matter apologies for the inconvenience.
Thank you,
saleha
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi,
Thank you for reaching out. I am not sure if this is possible on a FortiGate as there is no option to integrate Azure front door specifically to the fortigate. I only found document under FortiSOAR:
Based on the article you provided on the ticket I assume that the FortiGate would have to be the edge device to Azure Front Door and you are just looking for an application signature for the Azure application. If this is the case then I recommend creating a support ticket and request the customer application signature. We do have a dedicated application and IPS signature team that can respond to such requests if applicable.
Thank you,
saleha
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
that's why i ask here because in to this article is a line: "Note that the Fortinet Technical Support department does not offer technical assistance in customizing application control signatures."
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
that's why i ask here because in to this article is a line: "Note that the Fortinet Technical Support department does not offer technical assistance in customizing application control signatures."
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Yes as far as TAC support customer signatures are not offered however we can submit it internally to the IPS signature team to check if they can offer such signature. The reason support is not offered because of the variable elements that goes into creating such signature. I still recommend submitting the support ticket at least to check if this can be accomodated.
Thank you,
saleha
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
i have reply from TAC support, as they mention in article - they do not support custom app signature
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi Jacekg,
Ok Thank you for the feedback. It is limited support on such matter apologies for the inconvenience.
Thank you,
saleha
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
So you're trying to match traffic that has the X-Azure-FDID header with a specific value?
If so, then I suppose the signature could be as simple as this:
F-SBID( --name "my-custom-signature"; --service HTTP; --flow from_client; --pattern [!]"X-Azure-FDID: YOURIDHERE"; --context HEADER; --app_cat <ID>; )
Explanation:
- Searches/matches only HTTP (including HTTPS if decrypted) traffic
- Searches for the pattern X-Azure-FDID: YOURIDHERE"
- Match is valid if the pattern is NOT present ("[!]")
- Does the search only in the HTTP header
- Checks only packets sent from client (~ HTTP requests)
- Puts the signature into the <ID> application category (pick a category you like)
This assumes that the header is present in every single HTTP request sent from clients.
If you set this signature to block-action, any HTTP request that does not contain this header should then in theory be blocked by AppControl.
Signature syntax doc: https://docs.fortinet.com/document/ipsengine/7.4.0/custom-ips-and-application-control-signature-synt...
Use with care.
No guarantees.
No refunds. :)
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
hmm? is this correct or i'm doing somethinks wrong? after click ok i got error. this is modification current custom signature
inks wrong?
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I had some formatting errors in there. Try this, it saved successfully in my test:
F-SBID( --name "my-custom-signature"; --service HTTP; --flow from_client; --pattern [!]"X-Azure-FDID: YOURIDHERE"; --context HEADER; --app_cat <ID>; )
(fixing this in the original reply as well)