Best service/method to block/allow based on wildcard FQDN

[kidgradius]

Folks,

fireware: 5.6.4

I am trying to understand the Fortigate documentation; however, I have been finding mix resources.

I need to create an allow list for only specific domain names and wildcard FQDN entries. I noticed I can create these entries in the Policy & Objects; however, I have found other resources saying to create DNS Filter or Web Filter.

Which method is better and which method would be recommended?

[sw2090]

Hiho,

the Fact that you need Wildcards in your FQDN in my opinion limits you to one option: url-filter.

Whitelisting in Rating-Overrides of the Webfilter does not support wildcards!

The URL Filter does support wildcards. So you could  either create a bunch of blocking rules to block sites or 

do one block everything rule and then add allowing rules (have to be set to exempt then!) _above_ it.

[kidgradius]

sw2090 wrote:

Hiho,

the Fact that you need Wildcards in your FQDN in my opinion limits you to one option: url-filter.

Whitelisting in Rating-Overrides of the Webfilter does not support wildcards!

The URL Filter does support wildcards. So you could  either create a bunch of blocking rules to block sites or 

do one block everything rule and then add allowing rules (have to be set to exempt then!) _above_ it.

Let me see if I understand you correctly - firewall be default should block everything unless you allow, which is what I need. However, my requirements require specific domains, and possibly sub-domains. Due to the latter, the requirements are based on DNS. If IP addresses were used, then DNS records might change, and rules applied will no longer work.

DNS method for domains and sub-domains is the best concept to be used.

Security Profiles > Web Filter > Static URL Filter

or

Security Profiles > Static Domain Filter > Domain Filter

Do a 'reg. Expression' or a 'Wildcard' type filter with an Action of Allow. Just not sure which method is the best to use. So instead of using the Policy & Object engine - leverage the Web Filter or DNS filter engine.

[sw2090]

First please do not use allow if you have rules below this rule (which you have - at least the block all rule). In this case you must use exempt to have the filter stop once the allow rule is hit. Allow would not stop the filter so it would first allow the site and then block it because the block all rule is hit too!

And yes I'd use static url filter in webfilter profiles.

Oh and yes - because you mentioned that - static url filter does support regular expressions too!

One hint for everyone: if you use a FortiManger with FortiOS 5.4.x to manage your Filter Profiles you cannot set this up correctly because 5.4.x has a bug (confirmed by FortiNet TAC on my Ticket!) that keeps moving your "block *" rule from bottom up to top and makes your filter completely useless...

You could use security profiles (once you enabled them on cli) if you need a different setup for different policies with more then one filter. If youo just need webfilters you could create different filter profiles once you enbale that in the feature overview.

[kidgradius]

sw2090 wrote:

First please do not use allow if you have rules below this rule (which you have - at least the block all rule). In this case you must use exempt to have the filter stop once the allow rule is hit. Allow would not stop the filter so it would first allow the site and then block it because the block all rule is hit too!

So the ALLOW rule does not stop the engine from processing? in the DNS and Web Filter engine?

[sw2090]

At least in static URL Filter: yes allow does not stop the engine from processing on. Exempt does.

[kidgradius]

sw2090 wrote:

At least in static URL Filter: yes allow does not stop the engine from processing on. Exempt does.

Thank you - I did not know that. I do have an official ticket open, so when I get an answer I will update the forum.

[kidgradius]

Looking over the documentation - it appears EXEMPT is not the best solution in my case, since it does not do AV policy.

http://help.fortinet.com/fos50hlp/54/Content/FortiOS/fortigate-security-profiles-54/Web_Filter/Stati...