BBC Iplayer

[jhoggard]

Hi,

I just wondered the best way to block BBC Iplayer and none of the other BBC content, looking at it i'm not sure if application control will work alone. As this is HTTPS content i think we would need to use SSL deep inspection in proxy mode?

Thanks

[Markus]

Hi and welcome to the Forums. Yes, you're right. For this case you need app control with deep inspection. You should also distribute the Forti CA certificate to the clients to avoid ssl errors (if you use the default Forti SSL Inspection Cert).

Best

[jhoggard]

Thank you for the prompt response. I see there is 2 inspection types

- SSL certificate inspection

- full SSL inspection

Can we not use SSL certificate inspection here or does it have to be full SSL inspection?

Thanks

[tioeudes]

To achieve what you need you're going to have to set up full ssl inspection. Be carefull and add the proper exeptions, since its illegal to perform full inspection on medical and financial data for example.

[jhoggard]

Just to be clear here we want to block 2 parts

- someone using the IPlayer app which i think App control can detect and block

- https://bbc.co.uk/iplayer which app control cannot see to detect after some testing as this is being typed in a browser as a URL.

Can you confirm the best way to try and block people from browsing just ipayer and keep the rest of the bbc website accessible?

Thanks

[tioeudes]

So, to be 100% sure that the fortigate will always detecte the Iplayer application, you'll need full ssl inspection and an app control profile blocking the app signature.

As fas as the url goes, since its under the News and Media category, you could create and static url entry for "https://www.bbc.co.uk/iplayer" and set the action to block or override it to a blocked category. You'll probably need ssl full inspection for this as well, since the certificate is issued to de bbc domain.

Hope it helps.

regards,

tioeudes

[Dave_Hall]

It seems the site uses the same security certificate that is used on BBC's other sites, so if you are not using full SSL inspection, you'll likely only see the domain or FQDN name on the connection.  You might have better luck via using FortiView->sources then pick the device that is streaming via the BBC iplayer - hopefully you should see the actual video stream connection and hopefully the domain is distinct enough for you to block it.  (You may need to enable Device Detection on the internal network interface.)