AppCtrl protocol enforcement check
Protocol enforcement allows you to configure networking services (e.g. FTP, HTTP, HTTPS) on known ports (e.g. 21, 80, 443). For protocols which are not whitelisted under select ports, the IPS engine performs the violation action to block, allow, or monitor that traffic.
This feature acts upon the following two scenarios:
- When one protocol dissector confirms the service of network traffic, protocol enforcement can check whether the confirmed service is whitelisted under the server port. If it is not, then the traffic is considered a violation and IPS can take the action specified by config (e.g. block).
- When there is no confirmed service for the network traffic, the traffic is considered a service violation if IPS dissectors rule out all of the services enforced under its server port.
CLI configuration
In an applicable profile, a default-network-service list can be created to associate well known ports with accepted services.
To setup protocol enforcement in the CLI:
| config application list
edit “protocol-GUI” set other-application-log enable |
|
| set control-default-network-services {enable | disable} of protocols over select ports. | # Enable/Disable enforcement |
| config default-network-services entries
edit 1 |
# Default network service |
| set port 80 integer value from <0> to <65535> | # Port number, port Enter an |
| set services http
ssh, telnet, ftp, dns, smtp, pop3, imap, snmp, nntp and https next edit 2 set port 53 set services dns |
# Network protocols: http, |
| set violation-action { pass | monitor | block } when non-DNS traffic run over port 53
next end next end GUI Configuration |
# Pass, or Log, or block |
A new table is displayed when the Network Protocol Enforcement toggle is set to the On position. Enforced entries can be created, edited, or deleted to configure network services on certain ports and determine the violation action.
To setup protocol enforcement in the GUI:
- Go to Security Profiles > Application Control.
- Enable Network Protocol Enforcement.
- Click Create New.
- In the New Default Network Service window:
- Enter a Port
- Select the Enforced protocols.
- Choose the Violation action.
- Select OK.
Having trouble configuring your Fortinet hardware or have some questions you need answered? Check Out The Fortinet Guru Youtube Channel! Want someone else to deal with it for you? Get some consulting from Fortinet GURU!