Webfilter blocking URI (Page) after allowing the Host Address (Domain)

[Kish]

Hi All, We have a Fortigate 30E and I have a requirement to block certain page in a particular domain. 

Ex.) There is a domain https://xyz.com. That primary domain must be allowed but a page in that domain must not be blocked, like https://xyz.com/page1.php? .  I could find that after allowing the primary domain the firewall is creating a session, hence not blocking any URI path further. Correct me if I am wrong. Also please provide an way to implement the URI block (or) HTTP method block (or) using any other method, but the primary domain should be blocked.  Thanks.

[yashwani]

You can use static URL filter in Web Filter profile to allow a specific URL instead of the domain. You can also use wildcard/regex to match a specific pattern.  Example shown in the attached image.  Mark it solved if it answered your query. 

[Kish]

Hi Yashwani,

Thanks for your reply. I have tried this but the problem is,

•            The main domain must be allowed ie. https://xyz.com
•            After a user login to that particular website xyz.com, an allow session is created in firewall session table. Also a cookie is created by that website to maintain persistence.
•            Next in that website there is a particular page https://xyz.com/Page1.php, and that particular page has to be blocked.
•            Since the main domain is allowed already by the firewall, I am unable to pick the URI of that domain and create a filter policy for that particular page.

Please suggest me if there is any way to work on this.

[yashwani]

You can use regular expression to exclude the specifc page and allow all other  instead of the full domain (https://xyz.com) 

[Kish]

Let me try this and update you, Thanks.

[hermann]

Do you use deep packet inspection for this encrypted traffic?

[Kish]

Thanks for your reply. Yes Hermann. I have tried deep packet inspection with default ca certificate. Not not working. Even tried content inspection with some website content in block list. But no use.

[hermann]

Deep packet inspection is a MUST to enable any control of sub-URLs in the content filters. Without DPI the Fortigate is not able to see any content in encrypted packets. The host name  could be visible, though, if it is a part of the SSL/TLS handshaking.  

[Kish]

I have tried Deep Packet Inspection. My doubt is, will FortiGate look in to sub-url / path after creating the Statefull session entry for the particular destination. Firewall is doing man-in-the-middle process, but I am not sure whether it is checking the requesting sub-url / path for that domain every time. Is there anything to deal with cookie.

[hermann]

afaik you should not be worried about TLS 1.2 and before, each packet will be inspected. I have no idea if UTP works smoothly with TLS 1.3, although.