Hot!Mobile deny for specific network

Author
Alxndr3
New Member
  • Total Posts : 5
  • Scores: 0
  • Reward points: 0
  • Joined: 2018/03/08 04:22:31
  • Status: offline
2018/03/08 05:04:30 (permalink)
0

Mobile deny for specific network

Hi!
I would like to deny the access to the internet for smarphones.
I've created a device based rule, for while to block the access from all networks, however it's not working.
 

Attached Image(s)

#1

10 Replies Related Threads

    EMES
    Silver Member
    • Total Posts : 95
    • Scores: 10
    • Reward points: 0
    • Joined: 2014/12/19 07:34:18
    • Status: offline
    Re: Mobile deny for specific network 2018/03/09 07:37:02 (permalink)
    0
    Do you have device detection enabled on the interface facing your users? also how is your network layed out, is the fortigate the gateway for the subnet where the mobile users reside?
    #2
    Alxndr3
    New Member
    • Total Posts : 5
    • Scores: 0
    • Reward points: 0
    • Joined: 2018/03/08 04:22:31
    • Status: offline
    Re: Mobile deny for specific network 2018/03/09 09:47:50 (permalink)
    0
    Yes, it`s enabled, the gateway is a core switch.
    I have only one fortigate`s interface (lan) connected to that swich.
    #3
    Dave Hall
    Expert Member
    • Total Posts : 1243
    • Scores: 116
    • Reward points: 0
    • Joined: 2012/05/11 07:55:58
    • Location: Canada
    • Status: online
    Re: Mobile deny for specific network 2018/03/09 13:57:40 (permalink)
    0
    Hi Alexandre.
     
    Can't tell from your screenshot if you have set the action to deny on those polices nor able to tell if you have set a schedule.  Are there any firewall polices above those policies in question that may be allowing general device traffic through.?

    FMG-VM64/FortiAnalyzer-VM/4.0/5.0/5.2/5.4 (FWF40C/FW92D/FGT200B/FGT200D) / FAP220B/221C
    #4
    Alxndr3
    New Member
    • Total Posts : 5
    • Scores: 0
    • Reward points: 0
    • Joined: 2018/03/08 04:22:31
    • Status: offline
    Re: Mobile deny for specific network 2018/03/12 07:26:15 (permalink)
    0
    Hi Dave, Thanks for your response.
    Yes I've set the deny, but no for the schedule, above these rules there are two active ones.


    Attached Image(s)

    #5
    Dave Hall
    Expert Member
    • Total Posts : 1243
    • Scores: 116
    • Reward points: 0
    • Joined: 2012/05/11 07:55:58
    • Location: Canada
    • Status: online
    Re: Mobile deny for specific network 2018/03/12 11:38:07 (permalink)
    0
    I suggest reviewing the address values for Sevidor Camera, DISPAR - Rede Portaria, and Rede DATACenter.  If these firewall addresses are single IP4 addresses, the subnet mask should be /32 rather than /24 (unless that is what you want).
     
     

    FMG-VM64/FortiAnalyzer-VM/4.0/5.0/5.2/5.4 (FWF40C/FW92D/FGT200B/FGT200D) / FAP220B/221C
    #6
    Alxndr3
    New Member
    • Total Posts : 5
    • Scores: 0
    • Reward points: 0
    • Joined: 2018/03/08 04:22:31
    • Status: offline
    Re: Mobile deny for specific network 2018/03/12 13:03:28 (permalink)
    0
    Thank you, I'll review.
    Any suggestions about the mobile-deny?
    #7
    Dave Hall
    Expert Member
    • Total Posts : 1243
    • Scores: 116
    • Reward points: 0
    • Joined: 2012/05/11 07:55:58
    • Location: Canada
    • Status: online
    Re: Mobile deny for specific network 2018/03/12 14:07:42 (permalink)
    0
    A few questions in the back of my head, but was wondering if you had created a "wildcard" address firewall label by mistake for your source address(es) in policy #18. 
     
    What is the default gateway address assigned to your mobile devices? 
    Have you confirmed these mobile devices are able to access the Internet?
    Have you drilled down to individual traffic sessions for any of these mobile devices?
    Have you checked the routing monitor and/or confirmed the proper routes are in place?
    Do you have any routing policies in place that may be affecting your mobile devices traffic?
    Are your mobile devices connection(s) on a separate VLAN?

    FMG-VM64/FortiAnalyzer-VM/4.0/5.0/5.2/5.4 (FWF40C/FW92D/FGT200B/FGT200D) / FAP220B/221C
    #8
    tanr
    Gold Member
    • Total Posts : 467
    • Scores: 18
    • Reward points: 0
    • Joined: 2016/05/09 17:09:43
    • Status: offline
    Re: Mobile deny for specific network 2018/03/12 15:31:24 (permalink)
    0
    What version of FortiOS are you running?
     
    I've struggled quite a bit with device identification with 5.4.8.  It has regularly failed to identify iOS devices allowing those devices to fall through to other firewall rules.
     
    I've worked around this in three ways as I experimented with it:
    1. Created specific custom devices for known iOS devices and made rules just for them
    2. Have a wifi ssid interface just for the mobile devices I want to limit
    3. Require that all non-mobile users authenticate and use group membership 
     
    #9
    Alxndr3
    New Member
    • Total Posts : 5
    • Scores: 0
    • Reward points: 0
    • Joined: 2018/03/08 04:22:31
    • Status: offline
    Re: Mobile deny for specific network 2018/03/13 07:49:19 (permalink)
    0
    Dave
    A few questions in the back of my head, but was wondering if you had created a "wildcard" address firewall label by mistake for your source address(es) in policy #18. No wildcard for police 18 addresses
     
    What is the default gateway address assigned to your mobile devices? My core switch 10.241.10.253, which forwards all packages to fortigate's lan interface 10.241.10.1
    Have you confirmed these mobile devices are able to access the Internet? Yes, they can access the internet
    Have you drilled down to individual traffic sessions for any of these mobile devices? I think so, there is no traffic interruption for any specific device. 
    Have you checked the routing monitor and/or confirmed the proper routes are in place? Routes in place
    Do you have any routing policies in place that may be affecting your mobile devices traffic? The trafic flows no problem
    Are your mobile devices connection(s) on a separate VLAN? Yes, I have a separated vlan for theses devices e.g. DISPAR - Rede Portaria 60.x from police 18 is vlan 60 10.241.60.0/24 and the mobiles vlan 100 is 10.241.100.0/22
     
    I've followed the followind procedures to set up that police:https://docs.fortinet.com/uploaded/files/2013/allowing-network-access-based-on-schedule-and-device-type.pdf
    It's supposed to work, isn't it?


    Tanr
    My FortiOS version is  v5.6.3 build1547 (GA)

    #10
    Dave Hall
    Expert Member
    • Total Posts : 1243
    • Scores: 116
    • Reward points: 0
    • Joined: 2012/05/11 07:55:58
    • Location: Canada
    • Status: online
    Re: Mobile deny for specific network 2018/03/14 09:39:59 (permalink)
    0
    I don't now enough about 5.6.x nor know if using "any" for source interface includes "vlan" sub-interfaces.  For policy #31 you may need to specific the mobile vlan sub interface as source interface.  Anyone else care to confirm/shed light on this. 

    FMG-VM64/FortiAnalyzer-VM/4.0/5.0/5.2/5.4 (FWF40C/FW92D/FGT200B/FGT200D) / FAP220B/221C
    #11
    Jump to:
    © 2018 APG vNext Commercial Version 5.5