Spotify block through override not taking effect

[jesse_fletcher]

I'm having an odd issue with Application Control (Blocking Spotify) on an outgoing client policy on 6.2. Wondering if anyone would have any insight to what I may be missing?

The application control profile has Spotify added as an override with Block as the action. When I check the logs and filter Spotify it appears with pass as the action.

I've confirmed through these records that it is the correct policy which has the profile with the override in it that is being applied to that traffic.

Is there anything else in the app control profile that needs to be done other than adding the override block in order for that to work?

Screenshots linked below. Thanks.

https://www.dropbox.com/s/nomrodlithgsvnf/spotify1.PNG?dl=0

https://www.dropbox.com/s/1mlqf5g15kddmgi/spotify2.PNG?dl=0

https://www.dropbox.com/s/d0s0arkt5e4qeod/spotify3.PNG?dl=0

https://www.dropbox.com/s/hjgz9ml98ipzerb/spotify4.PNG?dl=0

[binnyrog]

Enable "Network Protocol Environment" option  from this screenshot. https://www.dropbox.com/s/1mlqf5g15kddmgi/spotify2.PNG?dl=0

It'd help you. 

[jesse_fletcher]

hubertzw wrote:

You need the policy with Application Control with action 'block'. I see your policy 27 has action 'pass'.

I just test it and it works fine on 6.2:

date=2019-06-24 time=23:46:49 logid="1059028705" type="utm" subtype="app-ctrl" eventtype="app-ctrl-all" level="warning" vd="root" eventtime=1561445209 appid=17405 srcip=10.0.1.10 dstip=104.154.127.47 srcport=49642 dstport=443 srcintf="port3" srcintfrole="undefined" dstintf="port1" dstintfrole="undefined" proto=6 service="HTTPS" direction="outgoing" policyid=1 sessionid=1917 applist="spotify-test" appcat="Video/Audio" app="Spotify" action="block" hostname="www.spotify.com" incidentserialno=1399263240 url="/" msg="Video/Audio: Spotify," apprisk="medium"

See below 2 screenshots which have the override as blocks. Surely the IPv4 Policy "27" isn't meant to be action of "DENY"?

https://www.dropbox.com/s/1mlqf5g15kddmgi/spotify2.PNG?dl=0

https://www.dropbox.com/s/d0s0arkt5e4qeod/spotify3.PNG?dl=0

[hubertzw]

Yes, my mistake, the firewall policy action can be 'allow' of course. The one scenario I tested is like your one and in my case it works fine:

FortiOS v6.2.0 build0866 (GA)

config firewall policy
    edit 1
        set name "Full_Access"
        set uuid b11ac58c-791b-51e7-4600-12f829a689d9
        set srcintf "port3"
        set dstintf "port1"
        set srcaddr "LOCAL_SUBNET"
        set dstaddr "all"
        set action accept
        set schedule "always"
        set service "ALL"
        set utm-status enable
        set logtraffic all
        set fsso disable
        set application-list "spotify-test"
        set ssl-ssh-profile "custom-deep-inspection"
        set nat enable
    next
end
 

edit "spotify-test"
        set comment ''
        set replacemsg-group ''
        set extended-log disable
        set other-application-action pass
        set app-replacemsg enable
        set other-application-log enable
        set enforce-default-app-port disable
        set unknown-application-action pass
        set unknown-application-log disable
        unset p2p-black-list
        set deep-app-inspection enable
        set options allow-dns
        config entries
            edit 1
                set application 17405
                set action block
                set log enable
                set log-packet disable
                set rate-count 0
                set session-ttl 0
                set quarantine none
            next
 

 

[YouAss]

Hi! I just wonder how's it going now

[michael5253]

i wonder how's it going now