Slow Facebook down to " dial up speed"

[winonawhiley]

We have a FWF40c (v4.0, build4054,111202 (MR3)) , we don’t have any of the Fortiguard services. All internal IP’s are static and we are not running Active Directory, just simple Windows authentication. There are a few people who are wasting time using Facebook during work hours. We cannot block the Internet, as these folks have to use the Internet to perform their jobs. Furthermore the boss does not want to block FB entirely, he wants to slow it down to dial up speed so people will get frustrated on their own and just stop using it, his thoughts not mine, but he’s the boss. So my mission is come up with a way to do this. Unfortunately I am a newbie in the networking world. Not sure where to start. My understanding is that Application Control only works with a subscription. Therefore, I was thinking of creating an IP Pool of 128.10.0.[201-209] these are the offenders. Create a FW Object for Facebook.com as a FQDN, then create a policy to shape traffic associated with the FW Object. Am I on the right track? Or can my boss’s assignment even be accomplished without subscriptions?

[Dave_Hall]

Therefore, I was thinking of creating an IP Pool of 128.10.0.[201-209] these are the offenders. Create a FW Object for Facebook.com as a FQDN, then create a policy to shape traffic associated with the FW Object. Am I on the right track? Or can my boss’s assignment even be accomplished without subscriptions?

This will work except you will need to create at least three FW FQDN objects (1) www.Facebook.com, 2) Facebook.com, 3) static.ak.fbcdn.net). (A Google seach or check the site info for a complete list of fqdns or IP block range that should be blocked.) For the traffic shaping, set the direction for both ways.

[winonawhiley]

Thanks Dave I haven’t blown you guys off I have been just swamped. Thanks for the direction. Here’s where I’m at with the FQDN option… I set up the Facebook Firewall Objects as FB1= www.facebook.com, FB2=Facebook.com and FB3=static.ak.fbcdn.nett. then tried to add them as members of a group called Facebook in an attempt to minimize policies. I kept getting “Blank or incorrect address entry” so I went to plan B, use the IP ranges for FB vs the FQDN. However, I ran into syntax issues with that. I know how to range the last octet i.e. 128.10.0.[201-209] but not the last two octets. FB’s first of four IP ranges - 66.220.144.0 - 66.220.159.255. I couldn’t figure out what the os wanted for a proper syntax, I had to run before I could really figure that one out and I' m just now sitting down to try again. Application control is the way to go in my situation or so I thought. I tried it, tested it with Per-IP in traffic shaping and my result was I slowed down internet access for all sites on that computer, not just FB. Maybe I hosed up the config. So I called my reseller rep and she told me that Application Control is part of a UTM bundle and the only way to use it was to buy the bundle. So I accepted that as gospel and started looking for another solution…again, not knowing if I had an invalid config because I am a rookie with security appliances or it simply doesn’t work with out a subscription. I don’t know. But sure seems that app control would be the easiest way to go. Status: I haven’t solved this yet. Any help with the syntax for an address range listed above would be most helpful. And thanks again for trying to help the new kid

[g3rman]

My suggestion would be to use a policy based on application detection. That' s probably more reliable than FQDN. E.g. Source: Any Destination: Any App: Facebook Action: Rate Limit

[rwpatterson]

ORIGINAL: g3rman My suggestion would be to use a policy based on application detection. That' s probably more reliable than FQDN. E.g. Source: Any Destination: Any App: Facebook Action: Rate Limit

Doesn' t this require a subscription? He doesn' t have one at this time, but I agree with your post.

[g3rman]

As far as I am aware App Control works without a subscription. AV/IPS is what you need to license, App Control is built into the OS itself. I' d say give it a shot and let us know :)

[Matthijs]

Your problem with the appliation filter was an error in the config i think. You should not apply the traffic shaping on the firewall policy but in the application filter. You can then shape the traffic for Facebook and not for all other applications.

[ede_pfau]

You can specify an address range by supplying a matching network mask in the address object. 66.220.144.0 - 66.220.159.255 will be covered by 66.220.144.0/20

[winonawhiley]

Thanks for the input, I just got a chance to sit down and drink in the information you folks have kindly provided. So now to work on my problem some more… Subnetting, /20 I knew that, Not! I have so much to learn. And I sucked at math, that’s why I just fixed pc’s I’m just a pc person tossed into Networking. I love it but so much to learn. I will keep ya’ll posted – thanks again

[ede_pfau]

I know that this will cut my reputation a bit...but I confess I googled for " subnet calculator" and used the first web site that came up to determine the matching subnet mask. Practise over studying, I guess. I' m glad that it makes sense to you. You' ll get it up working 100% soon.