Security policy to allow some services only for servers behind multiple wildcard urls?

[tanr]

Hi All,

I just worked around the fact that FortiOS (5.4.7 anyway) doesn't let you specify wildcard URLs for security policies.  I get the issue of the possible performance hit, but wanted to check to see if people can suggest a better way to do this than what I've done.

Situation is a small subset of users, on their own vlan, that I need to allow to connect out to some specific external game servers.  The two problems are:

1. There are a lot of game servers which are under multiple wildcard urls in multiple countries.

2. The connections need to allow a wide swath of tcp and udp ports, which I can't allow the use of to most external IPs.

So, I have a separate rule for these users, with a destination specified as the CIDR ranges owned by the company running the game servers, which allows both their normal service and all the tcp/udp ports needed for the game servers.

This works, but will break if the company buys a new set of IPs or outsources their servers.

Is there a cleaner way to do this with App Control or Web Filters?  Note that the apps connecting to the game servers are not currently listed under App Control, and that I don't want to allow those ports to be used *anywhere* except to those game servers.

Thanks.

[jsaab05]

Hello.

You can use FQDN Object in the destination field on Firewall policy to allow access the user_gamers to games servers.

[tanr]

Can't do it with wildcards, I'm afraid.  Something like *.company.com isn't allowed.  And as the company keeps generating new servers, and has hundreds already active, even if I wanted to enter all the FQDNs (like us-gameserver-0161.company.com) that rule would still break down when they add more servers to the list.

[dmcquade]

Use a webfilter. Block the categories you don't want your users to visit and make exceptions via the URL Filter within the profile. For example you can create a wildcard entry "*somewebsite.com" and set to exempt or allow.

HTH

d

[tanr]

My understanding is that Web Filtering is primarily looking at the destination for HTTP/HTTPS requests, and isn't designed to be applied for specific services beyond that.

Also, Web Filter specifies what is not allowed, instead of what is.  For this case, I need to specify that these particular services are only allowed if going from certain users out to specific servers. Those services are not allowed for any other users or to any other servers.

[romanr]

Hi,

using Wildcards on Server Names can only work in eg http(s) or on protocol level running it in a proxy.

As the Fortigate just cannot dump a DNS Zone it is not possible to look up all the entries in there - as long as your DNS security works properly ;)

If this game service is a well known public provider, you can try to convince Fortinet to take their IP and Service definitions into the internet service database. With FortiOS 5.6 you can easily use the isdb feature in a policy.

Besides that you will need to work with ipv4 adressing and create either a custom internet service or standard address groups...

Br,

Roman

[tanr]

We're not on 5.6 yet, but good to know that the internet service database might be an option once we move over.

I don't see much documentation on creating a custom internet service in 5.6, so maybe I should get some examples from TAC.

[dmcquade]

Your statement "Web Filter specifies what is not allowed, instead of what is." is incorrect. Say for example you block the category "Games". You can then enable the URL filter and specify a specific domain categorized as "Games" and set to allow. This overrides the category block just for the specified site.

Clients often request me to configure the firewall so servers cannot browse the Internet. Sometimes a server needs access to a specific URL or set of URLs. For this configuration I create a rule before all other browsing rules, set the server as the source and apply a specific webfilter that blocks all categories, enable the URL filter and create entries for the specific URL(s) set to allow. A web filter is used because sometimes the site is a wildcard domain.

It is also a nice clean way to maintain external web access for servers. Each server or set of servers can have its own rule using this model followed by a rule for all remaining servers that block all web access preventing a user from logging on to that server and having the ability to browse from the server directly.

HTH

d