Facebook blocked and not blocked with same policy

[Ambush4261]

Hello,

I have a mystery on a Fortigate.

I have a security group that block Facebook using application control and webfilter categories.

My users told by that they still can use Facebook. I checked the log and I see that most of the traffic linked to Facebook is blocked, but, I have some line with allowed traffic to facebook, using the same firewall policy. it's unbelievable, my own rules which block Facebook is also allowing it.

How this is possible ?

[adambomb1219]

What does your rule actually look like?  Are you using Application Control?  ISDB?  Something else?  Also why would you block Facebook on a guest network?

[Ambush4261]

Hi,

I'm using a firewall policy, flow-based,  which use a "security profile group" which use "web filter and "application control".

I block the social media category in the application control profile and also in the web filter filter profile.

[AEK]

Hello

SSL deep inspection is required to recognize most facebook traffic.

Try on of the below:

• Either enable deep inspection
• Or you can always try filtering by ISDB

[Ambush4261]

I am using "certificate inspection" not the deep one because of the complexity of deploying the router certificate on the users smartphone. 

What do you mean by ISDB, the categories in the fortigate ?

[AEK]

Create a "deny" policy and add the related fb services as destination.

Please see the below guide:

https://docs.fortinet.com/document/fortigate/6.2.15/cookbook/179236/using-internet-service-in-policy

[fricci_FTNT]

Hi @Ambush4261,
If you are using certificate inspection, the issue you are experiencing might be due to the fact that your client is using "Encrypted Client Hello" (ECH) [https://blog.cloudflare.com/announcing-encrypted-client-hello | https://datatracker.ietf.org/doc/draft-ietf-tls-esni/ ].
When ECH is in use, the client TLS handshake uses an outer certificate that does contain a moked/trivial domain name and not the real website that the client wants to visit (so FortiGate would allow it) and an inner certificate (encrypted) that contains the real domain name visited by the client (i.e. Facebook). As it is encrypted the FortiGate would not be able to read it.  Some CDN provider (Cloudflare/Akamai) are adopting ECH and it is not a trivial problem to resolve when using certificate inspection. A solution would be adopting deep inspection which is not applicable to every scenario (like yours for example).

Please try to create a deny firewall policy for Facebook services as suggested by AEK. If that does not work, try to sniff traffic or investigate if your clients are using ECH.

Best regards,

[Ambush4261]

okay, well understood, I will try with the new rule and the fb related service, good idea.

Thanks for support!

[Ambush4261]

Just tested with the ISDB, it block some of the traffic but a lot is not blocked.

[AEK]

Are you using policy based mode? (check in System > Setting)

Can you also check the ISDB signatures date? (check in System > FortiGuard)