I have a webfilter active with some URL's
URL Type Action Status
*.123.domain1.com Wildcard Allow Enable
*.123.domain2.com Wildcard Allow Enable
*.123.domain3.com Wildcard Allow Enable
*.* Wildcard Block Enable
If i do a telnet> telnet www.xyzdomain.com 443
In my opinion this should be blocked, but it shows:
HTTP/1.1 400 Bad Request
Server: nginx/1.17.7
Date: Thu, 18 Feb 2021 14:19:24 GMT
Content-Type: text/html
Content-Length: 157
Connection: close
<html> <head><title>400 Bad Request</title></head>
<body>
<center><h1>400 Bad Request</h1></center>
<hr><center>nginx/1.17.7</center>
</body>
</html>
Does this expose a security risk for PC contacting a Malware site.
Regards,
Henk
Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
Your test is not good for this - URL Filtering looks at URLs in a valid browser<->web server connection, your telnet session cannot emulate this and will be closed (as you see in the output) by the web server as invalid. To verify, try browse to the domain.
Also make sure you don't have other rules that would allow outbound access to port 443 without Web Filtering applied.
Hello Yurisk,
Yurisk wrote:Your test is not good for this - URL Filtering looks at URLs in a valid browser<->web server connection, your telnet session cannot emulate this and will be closed (as you see in the output) by the web server as invalid. To verify, try
browse to the domain.
Bold Eagle:
I know, but what if my system was infected with malware, and the website has code injected for this malware and will react on the malware request, then it is still not blocked by the Fortigate Webfilter. Or is this technically impossible?
Also make sure you don't have other rules that would allow outbound access to port 443 without Web Filtering applied.
Bold Eagle: no other rules with port 443 exist.
BTW The last rule in your URL FIlter should have action Block not Allow which makes URL filter to permit Any website.
Regarding the broader question of how to prevent potentially present in LAN malware to contact outside world, it is too broad of a question as this depends on malware, whether you are using Deep SSL inspection, whether you are using AppControl in addition to URL filtering. Or on a totally different side - are you using host based measures like EDR/Endpoint Protection?
You should formulate for yourself exact threats you are trying to prevent and do analysis of existing state of your security controls, then you will be able to answer "given this threat with these security measures already in place, what are chances of stopping this malware and what can be done to better those chances?".
Yurisk wrote:BTW The last rule in your URL FIlter should have action Block not Allow which makes URL filter to permit Any website.
[Bold Eagle]
There was a mistake in my overview, the last is a Block, I've corrected my question.
Regarding the broader question of how to prevent potentially present in LAN malware to contact outside world, it is too broad of a question as this depends on malware, whether you are using Deep SSL inspection, whether you are using AppControl in addition to URL filtering. Or on a totally different side - are you using host based measures like EDR/Endpoint Protection?
[Bold Eagle]
We also have Symantec SEP/SES in place as Endpoint protection, so we have several layers of safety nets.
You should formulate for yourself exact threats you are trying to prevent and do analysis of existing state of your security controls, then you will be able to answer "given this threat with these security measures already in place, what are chances of stopping this malware and what can be done to better those chances?".
[Bold Eagle]
Clear, thanks for your explanation.
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
User | Count |
---|---|
1517 | |
1013 | |
749 | |
443 | |
209 |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.