Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
VR
New Contributor

Blocking all traffic to server except one URL https connection, Fortigate 90e

Hi there guys, we are a company that develops software for a small company. We have developed an app that makes a connection to a box server in the company using Domino Access services. It is a REST API https connection. The app is making a GET request and server sends back data in JSON format. Our app is hosted in IBM Cloud and it has public url it uses for communication. The IT security of the company is managed by a different IT technical support company and they are using FortiGate 90e firewall. The person configuring this firewall was unable to quickly have a suitable solution on how to restrict EVERYTHING else from communicating with server except that one app that has dedicated URL. We tried to block connection based on IP, but since the app is hosted in the cloud IPs can change, we were given IP ranges by IBM, but they don't even match the IP of request of the app. So we are thinking on restricting everything except these https requests from an app that was given URL by IBM cloud in the form of: "myFancyApp.mybluemix.net." Can anyone please kindly guide us through making that nice helpful person through configuring his Fortigate 90e firewall to allow our app to communicate through firewall with that server and block everything else in the world ? We will appreciate any links to "cookbooks" and advice, thank you most kindly in advance. 

2 Solutions
Deepakkhw
New Contributor III

Hi,

You can make it possible with static URL filter option in FortiGate. 

1. First Line: First Simply allow the Simple URL (Your static URL)

2. Second Line: Block "mybluemix.net" with the wildcard.

 

http://help.fortinet.com/fos50hlp/54/Content/FortiOS/fortigate-security-profiles-54/Web_Filter/Stati...

 

 

View solution in original post

DingDong
New Contributor II

Hi

 

WIth the IPv4 policy it still should be possible, given that either a) you know the IP address or range the http get request comes from or b) you can limit the origin of the http get request to an FQDN (or a number of them) and do not need to use a wildcard FQDN. This way you don't need to use a web filter at all. The policy would look something like the attached picture (you still can add multiple FQDNs to the source but not a wildcard FQDN).

 

By the way, I am just thinking, maybe it would be possible with the application control feature, but I'm not enough into it to tell you that exactly.

 

See if that works for you!

View solution in original post

12 REPLIES 12
DingDong
New Contributor II

Hi

 

WIth the IPv4 policy it still should be possible, given that either a) you know the IP address or range the http get request comes from or b) you can limit the origin of the http get request to an FQDN (or a number of them) and do not need to use a wildcard FQDN. This way you don't need to use a web filter at all. The policy would look something like the attached picture (you still can add multiple FQDNs to the source but not a wildcard FQDN).

 

By the way, I am just thinking, maybe it would be possible with the application control feature, but I'm not enough into it to tell you that exactly.

 

See if that works for you!

VR
New Contributor

Oh, we will explore this option ASAP with the firewall admin, thank you most kindly for your explanation and setting screenshot example.

Mandla
New Contributor

I am so frustrated....i just bought huawei router....i work with a lot of clients, when i visit some client sites....i find them blocked....how on earth do i disable this thing....it is tempering with my ability to deliver....so frustrated PLEASE help me mndsibanda@gmail.com

Announcements

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Labels
Top Kudoed Authors