- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
How Application Control Work
Hello,
Yesterday i facing issue where from client not able access to Azure MSSQL, then i found some information from Azure team that deploying MSSQL on azure have 2 kind of connections policy such is :
- Proxy : With this policy the client only need connect to one single port for MSSQL TCP/1433
- Redirect : With this policy, the connection need other port range from 110000 - 11999 beside TCP/1433
The issue yesterday is on our Fortinet application control the MSSQL is already allowed but the client still not able to connect because the MSSQL using redirect mode which is need open port range from 11000-11999.
On the log i also can see there is MSSQL is blocked and also I can see the port used is 11050.
Here i want to know how application can knowing this port 11050 is belong to MSSQL?
- Labels:
-
FortiGate
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hello @HS08 ,
Application control is not interested in the application port. It just interested application communication pattern. When I reviewed your logs, this traffic was not blocked by application control. Because control action is just detected not blocked or dropped.
Can you share the full log with us? This way we can more easily understand why it was blocked.
NSE 4-5-6-7 OT Sec - ENT FW
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
i posting the log here twice and my post is disappears. Now the log i paste the log as pic here
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hello @HS08 ,
That is interesting. Do you have any other security profile on IT policy?
NSE 4-5-6-7 OT Sec - ENT FW
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Here my rule
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hello @HS08 ,
Can you remove all security profiles except app control? After removing it, can you try to access the SQL service?
NSE 4-5-6-7 OT Sec - ENT FW
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Still can't access even only have app control in the rule.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hello,
In Forward Logs you should be able to see the "Security" part of the log. There it should be stated what exactly is blocking the website.
Hope this helps.
Enea
