Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
jhoggard
New Contributor

BBC Iplayer

Hi,

 

I just wondered the best way to block BBC Iplayer and none of the other BBC content, looking at it i'm not sure if application control will work alone. As this is HTTPS content i think we would need to use SSL deep inspection in proxy mode?

 

Thanks

6 REPLIES 6
Markus
Valued Contributor

Hi and welcome to the Forums. Yes, you're right. For this case you need app control with deep inspection. You should also distribute the Forti CA certificate to the clients to avoid ssl errors (if you use the default Forti SSL Inspection Cert).

 

Best


________________________________________________________
--- NSE 4 ---
________________________________________________________

________________________________________________________--- NSE 4 ---________________________________________________________
jhoggard

Thank you for the prompt response. I see there is 2 inspection types

 

- SSL certificate inspection

- full SSL inspection

 

Can we not use SSL certificate inspection here or does it have to be full SSL inspection?

 

Thanks

tioeudes

To achieve what you need you're going to have to set up full ssl inspection. Be carefull and add the proper exeptions, since its illegal to perform full inspection on medical and financial data for example.

 

 

jhoggard

Just to be clear here we want to block 2 parts

 

- someone using the IPlayer app which i think App control can detect and block

- https://bbc.co.uk/iplayer which app control cannot see to detect after some testing as this is being typed in a browser as a URL.

 

Can you confirm the best way to try and block people from browsing just ipayer and keep the rest of the bbc website accessible?

 

Thanks

tioeudes

So, to be 100% sure that the fortigate will always detecte the Iplayer application, you'll need full ssl inspection and an app control profile blocking the app signature.

 

As fas as the url goes, since its under the News and Media category, you could create and static url entry for "https://www.bbc.co.uk/iplayer" and set the action to block or override it to a blocked category. You'll probably need ssl full inspection for this as well, since the certificate is issued to de bbc domain.

 

Hope it helps.

 

regards,

tioeudes

Dave_Hall
Honored Contributor

It seems the site uses the same security certificate that is used on BBC's other sites, so if you are not using full SSL inspection, you'll likely only see the domain or FQDN name on the connection.  You might have better luck via using FortiView->sources then pick the device that is streaming via the BBC iplayer - hopefully you should see the actual video stream connection and hopefully the domain is distinct enough for you to block it.  (You may need to enable Device Detection on the internal network interface.)

 

 

NSE4/FMG-VM64/FortiAnalyzer-VM/6.0 (FWF30E/FW92D/FGT200D/FGT101E/FGT81E)/ FAP220B/221C

NSE4/FMG-VM64/FortiAnalyzer-VM/6.0 (FWF30E/FW92D/FGT200D/FGT101E/FGT81E)/ FAP220B/221C
Announcements

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Labels
Top Kudoed Authors