Hi,
I just wondered the best way to block BBC Iplayer and none of the other BBC content, looking at it i'm not sure if application control will work alone. As this is HTTPS content i think we would need to use SSL deep inspection in proxy mode?
Thanks
Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
Hi and welcome to the Forums. Yes, you're right. For this case you need app control with deep inspection. You should also distribute the Forti CA certificate to the clients to avoid ssl errors (if you use the default Forti SSL Inspection Cert).
Best
________________________________________________________
--- NSE 4 ---
________________________________________________________
Thank you for the prompt response. I see there is 2 inspection types
- SSL certificate inspection
- full SSL inspection
Can we not use SSL certificate inspection here or does it have to be full SSL inspection?
Thanks
To achieve what you need you're going to have to set up full ssl inspection. Be carefull and add the proper exeptions, since its illegal to perform full inspection on medical and financial data for example.
Just to be clear here we want to block 2 parts
- someone using the IPlayer app which i think App control can detect and block
- https://bbc.co.uk/iplayer which app control cannot see to detect after some testing as this is being typed in a browser as a URL.
Can you confirm the best way to try and block people from browsing just ipayer and keep the rest of the bbc website accessible?
Thanks
So, to be 100% sure that the fortigate will always detecte the Iplayer application, you'll need full ssl inspection and an app control profile blocking the app signature.
As fas as the url goes, since its under the News and Media category, you could create and static url entry for "https://www.bbc.co.uk/iplayer" and set the action to block or override it to a blocked category. You'll probably need ssl full inspection for this as well, since the certificate is issued to de bbc domain.
Hope it helps.
regards,
tioeudes
It seems the site uses the same security certificate that is used on BBC's other sites, so if you are not using full SSL inspection, you'll likely only see the domain or FQDN name on the connection. You might have better luck via using FortiView->sources then pick the device that is streaming via the BBC iplayer - hopefully you should see the actual video stream connection and hopefully the domain is distinct enough for you to block it. (You may need to enable Device Detection on the internal network interface.)
NSE4/FMG-VM64/FortiAnalyzer-VM/6.0 (FWF30E/FW92D/FGT200D/FGT101E/FGT81E)/ FAP220B/221C
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.