Block application based on Hostname that has spaces

[michellem812]

I'm looking for a way to block applications based on the "Hostname", but the "Hostname" has a space in it. For example, there is a Just Proxy VPN that is getting through our firewall. If I filter the Application Control log, the Application is SSL_TLSv1.2, and in the details, the Hostname is "Just Proxy VPN" and the URL is "/", and the Category is Network.Service. It uses different IP addresses and ports, so I can't block using those.

I can't block all of SSL_TLSv1.2, but I want to block any application using hostname= "Just Proxy VPN". I can filter for it in the logs, but I can't seem to setup a block for it. Is there a way to create an Application using this information to then block it?

Here is a detail log for one instance: 

itime=2017-04-10 20:44:54 vd=root app=SSL_TLSv1.2 date=2017-04-10 dstip=139.59.64.226 apprisk=medium group=FSSO_NoNetscape service=tcp/7624 proto=6 eventtype=app-ctrl-all devid=FG1K5D3I15800570 dstintf=port25 applist=BlockYouTube msg=Network.Service: SSL_TLSv1.2, dstport=51229 type=utm dtime=2017-04-10 20:44:54 devname=HA-Group dstname=139.59.64.226 appid=41540 sessionid=847504567 profiletype=applist user=NWEA-DT srcintf=port28 srcip=10.4.48.48 level=information url=/ appcat=Network.Service srcport=49567 logid=1059028704 subtype=app-ctrl time=20:44:54 action=pass itime_t=1491875094 hostname=Just Proxy VPN policyid=83

Thanks,

Michelle

[hmtay_FTNT · Accepted solution]

Hello Michelle,

The --pattern syntax parses space, " ", like any other char. A custom Application Control signature for your case is:

F-SBID(  --name "JustProxy.VPN.Custom"; --protocol tcp; --app_cat 6; --weight 10; --service SSL; --pattern "Just Proxy VPN"; --context host; --no_case; ) 

This is one way to block VPNs that use SSLVPN with their self-signed certificates. We try to cover as completely as we can the VPNs that can be downloaded and used to bypass our signatures. One case that is not as easy to cover is VPNs that use self-signed certificates. The reason is there are infinite possibilities when it comes to a self-signed certificate - certificate generators can create a certificate with completely random values within the constraints of the framework of a SSL Certificate.  

The best solution (might not be plausible in your environment) is to block Untrusted SSL Certificates. Just want to let you know of the possible solutions for your case. Thanks!

HoMing

[michellem812]

Thank you!! I'm going to add this and see if that starts blocking it. This helps me understand better how to create custom signatures too.

[michellem812]

I added that one and a couple more that were getting through - I mistakenly thought that because I set the app_cat to 6 ("Proxy") which is already a blocked category that would be enough. But I had to explicitly add that custom signature to my Application policy...and then the "Application" changed from "SSL_TLSv1.2" & pass to "JustProxy.VPN.Custom" and "block".

I did that for api.phantom.avira-vpn.com which was also showing up as "HTTPS.BROWSER", and YogaVPN...I know it's a losing battle in the end since there are so many, but the more I can knock down here the more we can concentrate on using our internet for actual educational use instead.

[hmtay_FTNT]

Hi Michelle,

Yes, you have to add custom signatures explicitly even though it has the app_cat set to 6. We received your email and have replied to you about Avira and JustProxy. With regards to YogaVPN, we are in the process of adding a signature for it. We have a signature for it but it has some False Positive risk and therefore we have not release it out. We are still working on it. If you would like a signature for it now, here's the custom signature:

F-SBID( --name "yoga.tcp.custom"; --protocol tcp; --flow from_client; --src_port 10000:; --data_size 23; --pattern !"|00 00|"; --context packet; --pattern !"HTTP"; --no_case; --context packet; --pattern !"|16 03|"; --context packet; --distance 0,context; --within 2,context; --seq =,1,relative; --app_cat 6; --weight 20;) HoMing

[michellem812]

This worked for a while...but then it seemed to break my HA so I removed them. I switched from Active-Active to Active-Passive until I can get upgraded to 5.6 to see if that helps my HA (waiting on Fortianalyzer 5.6 firmware). 

In the meantime, I took out my custom VPN signatures, but I have to add them again. There are just too many proxy VPN sites that our students are finding that I need to block, which aren't known by Fortinet yet. 

Your custom pattern for YogaVPN doesn't appear to list the hostname anywhere. How does that custom signature know to block the YogaVPN instead of another hostname?

[hmtay_FTNT]

Hi Michelle,

>>This worked for a while...but then it seemed to break my HA so I removed them. I switched from Active-Active to Active-Passive until I can get upgraded to 5.6 to see if that helps my HA (waiting on Fortianalyzer 5.6 firmware). 

Did you check with support to see if they could diagnose the problem? 

>>Your custom pattern for YogaVPN doesn't appear to list the hostname anywhere. How does that custom signature know to block the YogaVPN instead of another hostname?

YogaVPN uses a different protocol. It uses a HTTPS connection to get some servers and it has a list of hardcoded servers in the binaries. Therefore, the custom signature I provided you do not have the hostname. We have pushed new signatures for YogaVPN into the official database. It is going through the beta stage and should be released this week.

>>In the meantime, I took out my custom VPN signatures, but I have to add them again. There are just too many proxy VPN sites that our students are finding that I need to block, which aren't known by Fortinet yet. 

Do you have the names of the VPNs? In my previous reply, I told you about blocking Untrusted SSL Certificates. Is that solution possible for the policies for the students? 

HoMing