Restrict 80/443 conflicting - any ideas?

[jasetcs]

I have two types of traffic using the same ports but need to filter in different ways and not sure exactly on the best way to do this. I will explain below:

What I want to achieve

Web browsing (80/443) should be restricted to a specific site (bbc.co.uk for example)

Citrix Reciever (80/443) should be restricted to certain IP Addresses 

This applies to all pcs on network 

Where I'm at

[ul]

I have a IPv4 policy with web filtering for specific site allowing all HTTP/HTTPS traffic (as the sites IP changes regularly)

I have a second IPv4 policy allowing traffic on 80/443 if going to specific IP Addresses[/ul]

For some reason application control does not seem to work as thats what I initially tried and Ive tried the policies in different orders to see if that fixes it but understand they will be conflicting but there must be a way i'm missing?

[ede_pfau · Accepted solution]

1- you could use a FQDN destination address in the first policy.

2- you should check which traffic hits which policy and whether that corresponds to your intention. Either look it up in FortiView (easy), or watch the 'count' fields in the policy table (GUI), or use debug commands to follow the traffic ('diag debug flow').

[jasetcs]

I didnt know much about FQDN addresses and that seems to be the solution i was looking for - thanks

[sw2090]

You could strike point one by applying url filter to the policy that is hit by all traffic from the client to internet.

Set url filter to exempt bbc.co.uk (or *.bbc.co.uk even - wildcards are supported here) and afterwards block anything.

The Order of the rules in url filter is hereby importand. The block anything rule MUST be the last one and the other one hase to be exempt because allow won't stop the url filter here which would block the site then since allow means that url filter will process on through all other rules and exempt means it will stop once one exempt rule hits in.

The second thing is how to figure out what traffic from Citrix Receiver is. Does it have a specific source port? Or a specific destination Ip? If there is something that allows it to 100% correctly determine which is traffic from Citrix Receiver then use that to create a policy for allowing this and just make sure it is set in front of the above one.

Since Policies are processed sequentially top down + policies are always so to say exempt then the traffic from Citrix Receiver will hit the first coming citrix plolicy and will be allowd and all other traffic will hit the other one and will have to go through the url filter as above.

The only problem here is that nailing the citrix traffic by destination host/fqdn/ip will also allow any other acces to it. So using service here would be better.

If you could nail citrix by destination url you could skip the extra policy and add that to your url filter in the first one (before the block anything) rule.

Just as info: such url filter settings will not work if you manage your FGT via a FortiManager <= 5.4 due to a bug in the Fortimanager OS that affects the order of the url filter rules. This is aknowledged by Fortinet but still not fixed in 5.4 but it is fixed in 5.6.

[emnoc]

The block anything rule MUST be the last one and the other one hase to be exempt because allow won't stop the url filter here which would block the site then since allow means that url filter will process on through all other rules and exempt means it will stop once one exempt rule hits in.

What do you mean by all other rules, if it allowed by that fw.policyid , processing of any other fw.policy is finished

Ken

[sw2090]

as far as fw.policy is concerned you are correct Ken.

I meant the rules inside the url filter. 

If you have this in url filter:

1. allow bbc.co.uk

2. deny anything

that means the url filter will process 1. and 2. with the result that bbc.co.uk is blocked.

if you have this:

1. exempt bbc.co.uk

2. deny anything

that means the url filter will finish processing after 1. when you access bbc.co.uk and you get there and anything else will hit 2. because it doesn't hit 1. and get blocked