Block a protocol in a deny rule

[mhdganji]

Hi,

I need to set a rule to deny any one RDP to a server, not just TCP 3389 but on any port.

I know this can be done using IPS security profiles but there is a problem:

When I set the rule to deny, no IPS profile may be selected and in the rule I can only choose RDP service which is TCP 3389. IPS profiles and exceptions within can only be selected when the rule is an Allow type. So?

In short, I need a rule to deny RDP protocol with any port (default or non-default) to be blocked toward a specific destination.

Regards,

[pminarik]

Action=deny is a block performed at "layer 4" - based on IP addresses, IP protocols, and ports - hence why you cannot select any UTM profile when action=deny.

If you would like to permit general traffic towards the server and specifically deny only RDP using IPS, what you should do instead is set the policy to action=allow, and then add an IPS profile that contains your desired RDP signature(s) set to action=block.

[mhdganji]

Hi ,

i don't want to allow any traffic to the server. I need to block all RDP connections via any port to many servers, let's say all of them. Any accepted traffic will be decided by the next rules. So, I simply need a rule blocking all RDP based connections to all/many servers.

[pminarik · Accepted solution]

FortiGates have two main modes of operation when it comes to firewall policies and UTM: System Settings > NGFW mode: Profile-Based & Policy-Based

Profile-based (default)

In this mode, you cannot do what you are asking for. The initial firewall policy match is done only up to layer4 (TCP/UDP ports).

Only after this policy match is decided, the UTM profiles from that policy are applied. UTM then either drops or allow the traffic.

There is no fallback to re-evaluate the traffic against other firewall policies below the matched one, so if you wanted to include additional blocks or permissions for a given source&destination, you would need to implement that together with the RDP block within one policy.

Policy-Based

In this mode you first configure "basic firewall policies" that handle the initial layers & central SNAT & which SSL inspection to apply. In a separate table you can configure "Security Policies", where you can directly target specific application signatures, URL categories, etc.

Here's a link to the documentation about the Profile vs Policy mode differences 

Based on your description, policy-based mode would be the best fit to implement a policy that matches your description the closest. However, keep in mind that this is not the default mode of operation and is not used as much. If you already have everything configured in profile-based mode, you would need to set things from scratch if switching to policy-based mode (the switch wipes all firewall policies), so this may or may not be worth the effort...

[mhdganji]

Thanks a bunch 

Based on your experience and general facts, which one suits better when the device is used as data center firewall containing numerous servers in which controlling and blocking ports is desired (some necessary accept rules and then deny everything) meanwhile enabling basic and default IPS/AV security profiles? 

[pminarik]

I do not usually design deployments, but my personal impression would be as follows: While the newer policy-based style may be able to more precisely match your goal, we should also keep in mind that the default profile-based is used much more often. This has implications: Administrators are more used to and comfortable with it, MSPs are more used to it, support teams are more used to it. If going through the path of least resistance is a relevant concern, I would lean towards profile-based.

[mhdganji]

Hi

i don't want to allow any traffic to the server. I need to block all RDP connections via any port to many servers, let's say all of them. Any accepted traffic will be decided by the next rules. So, I simply need a rule blocking all RDP based connections to all/many servers.