FortiGate Web Filtering (Static URL)

You can lookup which Web Category a website falls under using the FortiGuard Web Filter tool. In the example, I lookup: youtube.com and it's under the Category: Streaming Media and Download.

 

To configure a Static URL Filter, go to Security Profiles > Web Filter > Create New.

 

Notice there are system default profiles created.

 

Type a Name: LAB_URL_FILTER > enable URL filter (toggle) > click Create New.

Type URL: *.facebook.com > select Type: Wildcard > select Action: Block > click OK.

Create Static URL Filter for cisco.com and youtube.com > click OK.

The next step is to apply the Web Filter Profile in a Firewall Policy. Go to Policy & Object > Firewall Policy > select FG_LAN_INTERNET > click Edit (or just double-click).

Go under Security Profiles.

Under Security Profiles > enable Web Filter (toggle) > select LAB_URL_FILTER > click OK.

I tried to access the websites from 172.16.1.100 (Windows 7 VM) but got a Web Page Blocked error.

To view the FortiGate Web Filter logs, go to Log & Report > Web Filter.

Select a log > click Details.

 

Notice the Action: blocked and Web Filter Profile Name: LAB_URL_FILTER were applied to the HTTP traffic.

 

Fortigate SSL/TLS Inspection

SSL (TLS) deep inspection on outbound traffic allows FortiGate to inspect encrypted Internet-bound traffic (outbound) and apply Security Profiles (UTM). The FortiGate acts as a Man-In-The-Middle to inspect traffic and apply the Security Profiles such as Antivirus, Web Filter and Application Control.

 

To configure SSL Inspection, go to Security Profiles > SSL/SSH Inspection.

 

Notice there are default inspection profiles created. Select custom-deep-inspection > click Edit (or just double-click).

Under Common Options > select Invalid SSL certifications: Allow > click OK.

The next step is to enable SSL Inspection in a Firewall Policy. Go to Policy & Objects > Firewall Policy > select FG_LAN_INTERNET > click Edit (or just double-click).

Under Security Profiles > select SSL Inspection: custom-deep-inspection > click OK.

Notice there's a warning near the SSL Inspection. Hover to view it.

I tried to access https://www.cnn.com but was presented with a warning: There is a problem with this website's security certificate.

The Fortigate includes a system default SSL certificate called Fortinet_CA_SSL, which can be used for full SSL inspection. You can avoid the web browser certificate warning by downloading and installing the Fortinet_CA_SSL certificate in your machine.

 

To download the FortiGate SSL certificate, go to System > Certificates > select Fortinet_CA_SSL > click View Details.

 

Click Download > Save File.

To install the Fortinet_CA_SSL in Internet Explorer, go to Tools > Internet Options > Content > Certificates.

Under Trusted Root Certificate Authorities > click Import.

Run the Certificate Import Wizard > click Next.

Browse for the Fortinet_CA_SSL.cert > click Next.

Select the default Place all certificates in the following store: Personal > click Next.

Click Finish.

Click Yes.

Click OK.

Select the newly installed Fortinet SSL certificate > click View.

I accessed again https://www.cnn.com but this time there's no certificate error being presented.

To view FortiGate logs, go to Log & Report > Forward Traffic. 

Notice the log with the Application Name: SSL.

Select the SSL log > click Details.

FortiGate Logging and Antivirus Security Profile

To enable logging on the Firewall Policy, go to Policy & Objects > Firewall Policy.

 

Select FG_LAN_INTERNET > click Edit (or just double-click).

 

Under Security Profiles > enable (toggle): Antivirus, Application Control, IPS.

 

Under Logging Options > enable (toggle) Log Allow Traffic > All Sessions > click OK.

 

You can create a new profile or edit the existing Security Profiles.

To view the FortiGate traffic logs, go to Log & Report > Forward Traffic.

Select a specific log > click Details.

 

Notice the Application Name: Facebook, Category: Social Media, Security Action: Allowed and Policy ID: FG_LAN_INTERNET.

 

 

You can narrow down thesearch by clicking Add Filter.

 

In this example, I choose the Application Name: Youtube.

 

The FortiGate displayed Forward Traffic logs related only to Youtube.

The Chrome web browser has a built-in security feature, so I used Internet Explorer instead to test the Antivirus Security Profile. Go to wicar.org to download a test malware.

Notice it displayed a High Security Alert when a virus was detected.

To view Antivirus log, go to Log & Report > Antivirus. 

Select a specific Antivirus log > click Details.

 

Notice the Threat Level: Critical which has a Threat Score: 50.

 

You can also view the FortiGate top talkers in the Dashboard > FortiView.