AppCtrl protocol enforcement check

AppCtrl protocol enforcement check

Protocol enforcement allows you to configure networking services (e.g. FTP, HTTP, HTTPS) on known ports (e.g. 21, 80, 443). For protocols which are not whitelisted under select ports, the IPS engine performs the violation action to block, allow, or monitor that traffic.

This feature acts upon the following two scenarios:

  • When one protocol dissector confirms the service of network traffic, protocol enforcement can check whether the confirmed service is whitelisted under the server port. If it is not, then the traffic is considered a violation and IPS can take the action specified by config (e.g. block).
  • When there is no confirmed service for the network traffic, the traffic is considered a service violation if IPS dissectors rule out all of the services enforced under its server port.

CLI configuration

In an applicable profile, a default-network-service list can be created to associate well known ports with accepted services.

To setup protocol enforcement in the CLI:

config application list

edit “protocol-GUI”

set other-application-log enable

      set control-default-network-services {enable | disable} of protocols over select ports. # Enable/Disable enforcement
      config default-network-services entries

edit 1

# Default network service
           set port 80 integer value from <0> to <65535> # Port number, port Enter an
           set services http

ssh, telnet, ftp, dns, smtp, pop3, imap, snmp, nntp and https          next

edit 2

set port 53

set services dns

# Network protocols: http,
           set violation-action { pass | monitor | block } when non-DNS traffic run over port 53


end    next end

GUI Configuration

  # Pass, or Log, or block

A new table is displayed when the Network Protocol Enforcement toggle is set to the On position. Enforced entries can be created, edited, or deleted to configure network services on certain ports and determine the violation action.

To setup protocol enforcement in the GUI:

  1. Go to Security Profiles > Application Control.
  2. Enable Network Protocol Enforcement.
  3. Click Create New.
  4. In the New Default Network Service window:
    1. Enter a Port
    2. Select the Enforced protocols.
    3. Choose the Violation action.
    4. Select OK.

Having trouble configuring your Fortinet hardware or have some questions you need answered? Check Out The Fortinet Guru Youtube Channel! Want someone else to deal with it for you? Get some consulting from Fortinet GURU!

Don't Forget To visit the YouTube Channel for the latest Fortinet Training Videos and Question / Answer sessions!
- FortinetGuru YouTube Channel
- FortiSwitch Training Videos