How Application Control Work

[HS08]

Hello,

Yesterday i facing issue where from client not able access to Azure MSSQL, then i found some information from Azure team that deploying MSSQL on azure have 2 kind of connections policy such is :

1. Proxy : With this policy the client only need connect to one single port for MSSQL TCP/1433
2. Redirect : With this policy, the connection need other port range from 110000 - 11999 beside TCP/1433

The issue yesterday is on our Fortinet application control the MSSQL is already allowed but the client still not able to connect because the MSSQL using redirect mode which is need open port range from 11000-11999.

On the log i also can see there is MSSQL is blocked and also I can see the port used is 11050.

Here i want to know how application can knowing this port 11050 is belong to MSSQL?

[ozkanaltas]

Hello @HS08 ,

Application control is not interested in the application port. It just interested application communication pattern. When I reviewed your logs, this traffic was not blocked by application control. Because control action is just detected not blocked or dropped. 

Can you share the full log with us? This way we can more easily understand why it was blocked.

[HS08]

i posting the log here twice and my post is disappears. Now the log i paste the log as pic here

[ozkanaltas]

Hello @HS08 ,

That is interesting. Do you have any other security profile on  IT policy? 

[HS08]

Here my rule

[ozkanaltas]

Hello @HS08 ,

Can you remove all security profiles except app control? After removing it, can you try to access the SQL service? 

[HS08]

Still can't access even only have app control in the rule.

[ezhupa]

Hello, 

In Forward Logs you should be able to see the "Security" part of the log. There it should be stated what exactly is blocking the website. 

Hope this helps.
Enea