Is it possible to configure a firewall rule using URLs and not FQDNs? I know how to configure FQDN, but the problem is that the wildcard FQDNs for Microsoft and Windows updates don't resolve all the proper IP addresses and traffic gets blocked from our WSUS server to the actual update site. FTG is running 7.2.4.
Thanks
Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
Hello,
It is not supported for the moment. Can you please elaborate whether wildcard FQDNs generally don't work or only in this particular case?
I've not had any wildcard FQDNs work at all. I know there is an Internet Service for Microsoft or Windows updates, but if I ccrated a wildcard FQDN for *.microsoft.com, I can pretty much bet you that windowsupdate.microsoft.com and *.windowsupdate.microsoft.com will not match these. We have some vendors that I can't find Internet Services for, and wildcard FQDNs don't resolve most of the IPs.
To configure a firewall rule using URLs in FortiGate running firmware version 7.2.4, you can follow these steps:
Create a Custom Web Filter URL Category:
Create a Firewall Policy:
By creating a custom URL category and using it in a firewall policy, you can define specific URLs to allow or block traffic. This approach allows you to bypass the limitations of wildcard FQDNs and ensure that the traffic from your WSUS server to the actual update sites is not blocked.
Hello
To can create a firewall rule that uses URLs instead of FQDNs.
+ Go to Security Profiles > Web Filter.
+ Create a new profile or edit an existing one.
+ Under "URL Filter", select "Enable URL Filter" and click "Create New".
+ In the "Pattern" field, enter the URL or URL pattern that you want to allow or block. You can use regular expressions to specify complex patterns.
+ Choose whether you want to allow or block traffic to the specified URLs, and click "OK".
+ Save the web filter profile.
+ Go to Firewall > Policy and create a new policy or edit an existing one.
+ In the "Security Profiles" section, select the web filter profile that you just created.
+Specify the source and destination addresses, ports, and protocols for the firewall rule.
+ Save the firewall policy.
Note: This method may be less efficient than using FQDNs, as the firewall will need to perform a DNS lookup for each URL.
Thanks
pavankr5, I'm not sure I follow the logic. If I create a url filter for "https://*.vendor.com", I do this because I don't know all the subdomains associated with that wildcard FQDN. In the bottom section, I'm supposed to create a policy with destination addresses. That was the purpose for my question. I have no idea what addresses to put in, and I'm tired of manually entering them. I seem to be missing something in your response, but I'd sure like to understand this better. Thank you for your time.
Hi,
trying to catch all IPs/domains/subdomains of the Microsoft the giant is an exercise in frustration, may I add. Have you tried using ISDB addresses instead? That is how I usually open access to all kinds of cloud services (Gmail/Whatsapp/Facebook/Windows Updates) and it works fine.
Regards
"Internet Services" was referenced on the 9:58 post (CST) earlier, so we're already using ISDB for Microsoft. We have some vendors that I can't find a matching ISDB service for, which is the reason for the initial question. We are adding child domains and specific IPs as we find them out, but I was hoping to automate this.
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
User | Count |
---|---|
1698 | |
1092 | |
752 | |
446 | |
228 |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.