Create a rule using URLs for web traffic (and NOT FQDNs)

[albaker1]

Is it possible to configure a firewall rule using URLs and not FQDNs? I know how to configure FQDN, but the problem is that the wildcard FQDNs for Microsoft and Windows updates don't resolve all the proper IP addresses and traffic gets blocked from our WSUS server to the actual update site. FTG is running 7.2.4.

Thanks

[abarushka]

Hello,

It is not supported for the moment. Can you please elaborate whether wildcard FQDNs generally don't work or only in this particular case?

[albaker1]

I've not had any wildcard FQDNs work at all. I know there is an Internet Service for Microsoft or Windows updates, but if I ccrated a wildcard FQDN for *.microsoft.com, I can pretty much bet you that windowsupdate.microsoft.com and *.windowsupdate.microsoft.com will not match these. We have some vendors that I can't find Internet Services for, and wildcard FQDNs don't resolve most of the IPs. 

[Christian_89]

To configure a firewall rule using URLs in FortiGate running firmware version 7.2.4, you can follow these steps:

1. Create a Custom Web Filter URL Category:

   • Go to Security Profiles > Web Filter > URL Filter.
   • Click on "Create New".
   • Enter a name for the URL category (e.g., "Custom_Updates").
   • In the "URL Pattern" field, enter the specific URLs you want to allow or block (e.g., "http://.microsoft.com/").
   • Configure any other settings as per your requirements.
   • Save the URL category.

2. Create a Firewall Policy:

   • Go to Policy & Objects > IPv4 Policy (or IPv6 Policy for IPv6 traffic).
   • Click on "Create New".
   • Configure the source, destination, and service settings as needed.
   • In the "Web Filter" section, select the previously created URL category (e.g., "Custom_Updates").
   • Set the desired action (allow or block) for the URL category.
   • Configure any other settings required for the firewall policy.
   • Save the policy.

By creating a custom URL category and using it in a firewall policy, you can define specific URLs to allow or block traffic. This approach allows you to bypass the limitations of wildcard FQDNs and ensure that the traffic from your WSUS server to the actual update sites is not blocked.

[pavankr5]

Hello 

To can create a firewall rule that uses URLs instead of FQDNs.

+ Go to Security Profiles > Web Filter.
+ Create a new profile or edit an existing one.
+ Under "URL Filter", select "Enable URL Filter" and click "Create New".
+ In the "Pattern" field, enter the URL or URL pattern that you want to allow or block. You can use regular expressions to specify complex patterns.
+ Choose whether you want to allow or block traffic to the specified URLs, and click "OK".
+ Save the web filter profile.

+ Go to Firewall > Policy and create a new policy or edit an existing one.
+ In the "Security Profiles" section, select the web filter profile that you just created.
+Specify the source and destination addresses, ports, and protocols for the firewall rule.
+ Save the firewall policy.

Note: This method may be less efficient than using FQDNs, as the firewall will need to perform a DNS lookup for each URL.

Thanks

[albaker1]

pavankr5, I'm not sure I follow the logic. If I create a url filter for "https://*.vendor.com", I do this because I don't know all the subdomains associated with that wildcard FQDN. In the bottom section, I'm supposed to create a  policy with destination addresses. That was the purpose for my question. I have no idea what addresses to put in, and I'm tired of manually entering them. I seem to be missing something in your response, but I'd sure like to understand this better. Thank you for your time.

[Yurisk]

Hi,

trying to catch all IPs/domains/subdomains of the Microsoft the giant is an exercise in frustration, may I add. Have you tried using ISDB addresses instead? That is how I usually open access to all kinds of cloud services (Gmail/Whatsapp/Facebook/Windows Updates) and it works fine.

Regards

[albaker1]

"Internet Services" was referenced on the 9:58 post (CST) earlier, so we're already using ISDB for Microsoft. We have some vendors that I can't find a matching ISDB service for, which is the reason for the initial question. We are adding child domains and specific IPs as we find them out, but I was hoping to automate this.