FQDN Filter Profile

FQDN filtering helps in restricting access to external websites to a set of resources (VM/App instances). You can set it up such that only Instances tagged as Dev can go out to Social Networking and other sites but Instances tagged as Prod cannot go to those sites.

Create a FQDN Filter Profile to block/allow FQDNs. We will start with individual FQDNs and then add Categories of URLs. From the earlier traffic sessions, we verified curl commands fetch all the websites.

Step 1: Create Profile with Default Deny

Create a FQDN Profile to allow a specific FQDN and block all others

1. Navigate to Manage -> Profiles -> FQDN Filtering
2. Click Create
3. Provide a name (e.g fqdn-tutorials)
4. In the FQDN Lists table add www.example.com in the FQDNs/Categories text box
5. Choose Allow Log in the Policy dropdow
6. Change policy of the last row (FQDN ANY) to Deny Log
7. Click Save

We will be using this FQDN Filtering Profile throughout this tutorials

Step 2: Attach FQDN Profile to Policy

1. Click Manage -> Security Policies -> Rules
2. Find the ruleset name that's associated with the Egress Gateway
3. Click the ruleset name
4. From the earlier sections there are 2 rules in the ruleset:
   1. any-egress-http
   2. any-egress-https
5. We will be testing the FQDN profile with TLS (https) traffic
6. Click the table row any-egress-https and click Edit
7. In the editor panel, select the FQDN Filter Profile fqdn-tutorials and click Save to save the rule
8. Click Save to save the ruleset
9. The rule shows fqdn-tutorials as a profile in the rules table

Step 3: Traffic Test for Default Deny

1. SSH to the EC2 instance created in the spoke1-vpc
2. curl https://www.google.com
3. Note there is no response. You will see an error message like TCP reset
4. In the FQDN Filter Profile we explicitly allowed only www.example.com and the default action is set to Deny No Log
5. Try curl -Ikv https://www.example.com
6. You will see a successful response as FQDN Filter Profile allows this FQDN
7. Check the certificate details for the issuer, subject and notice that the certificate is issued by Valtix
8. Navigate to Investigate -> Flow Analytics -> FQDN Filtering
9. You will see logs for the denied requests to www.google.com and allowed requests to www.example.com

Step 4: Default Allow

1. Navigate to Manage -> Profiles -> FQDN Filtering
2. Select the FQDN Profile fqdn-tutorials and Edit
3. Change the default policy action to Allow Log (The last row in the profile with ANY FQDN)
4. Save the profile

Step 5: Traffic Test for Default Allow

1. SSH to the EC2 instance created in the spoke1-vpc
2. curl -Ikv https://www.google.com
3. You will see a successful response as FQDN Filter Profile allows this FQDN due to default match
4. Try curl -Ikv https://www.example.com
5. You will see a successful response as FQDN Filter Profile explicitly allows this FQDN
6. Check the certificate details in both the cases for the issuer, subject and notice that the certificate is issued by Valtix

Step 6: Decryption Exception

In the above examples you notice that the traffic was decrypted and the external host's certificate is impersonated and signed by Valtix using the self-signed certificate used in the proxy service definition. There are cases where you may not want Valtix to decrypt and inspect the traffic with common scenarios being finance, healthcare, government websites. In such cases you enable decryption exception for those FQDNs.

1. Go to Manage -> Profiles -> FQDN Filtering
2. Select the FQDN Profile fqdn-tutorials and Edit
3. Select the Decryption Exception checkbox for www.example.com
4. Save the profile

Step 7: Traffic Test for Decryption Exception

1. SSH to the EC2 instance created in the spoke1-vpc
2. Try curl -Ikv https://www.example.com
3. Note a successful response as FQDN Filter Profile explicitly allows this FQDN
4. Check the certificate details and notice that the issuer is NOT valtix and the subject does not mention Valtix

5. Here is the certificate before and after Decryption Exception

   Certificate before Decryption Exception (signed by Valtix)

   * Server certificate:
   *   subject: CN=www.example.com,OU=NetSec,O=Valtix Inc.,L=SantaClara,ST=California,C=US
   *   start date: Dec 14 23:29:06 2020 GMT
   *   expire date: Dec 15 23:29:06 2021 GMT
   *   common name: www.example.com
   *   issuer: O=Valtix
   

   Certificate after Decryption Exception (original certificate)

   * Server certificate:
   *   subject: CN=www.example.org,O=Internet Corporation for Assigned Names and Numbers,L=Los Angeles,ST=California,C=US
   *   start date: Nov 24 00:00:00 2020 GMT
   *   expire date: Dec 25 23:59:59 2021 GMT
   *   common name: www.example.org
   *   issuer: CN=DigiCert TLS RSA SHA256 2020 CA1,O=DigiCert Inc,C=US
   

Step 8: Explicity Deny

1. Navigate to Manage -> Profiles -> FQDN Filtering
2. Select the FQDN Profile fqdn-tutorials and Edit
3. Change the policy for www.example.com to Deny Log
4. Decryption Exception does not come into play as the traffic is denied. So checking/un-checking does not matter
5. Leave the default (for FQDN ANY) to Allow Log
6. Save the profile

Step 9: Traffic Test for Explicit Deny

1. SSH to the EC2 instance created in the spoke1-vpc
2. Try curl -Ikv https://www.example.com
3. Check that this gives an error message as it explicitly matches an FQDN with a deny policy
4. Try curl -Ikv https://www.google.com
5. Note a successful response as the default policy allows FQDNs that do not match anything else in the list
6. Navigate to Investigate -> Flow Analytics -> FQDN Filtering and check the logs for both the actions

Step 10: FQDN Categories

So far in the examples here we have been using a specific FQDN. Valtix supports using FQDN categories (sourced from BrightCloud). You can use the categories to block a set of FQDNs matching a given category (e.g Social Network). All the features (Decryption Exception, explicit Deny/Allow) are applicable to the Categories also.

1. Navigate to Manage -> Profiles -> FQDN Filtering
2. Select the FQDN Profile fqdn-tutorials and Edit
3. Remove www.example.com from the text box
4. In the text box type Social Network and select it
5. Change the policy to Deny Log
6. Decryption Exception does not come into play as the traffic is denied. So checking/un-checking does not matter
7. Leave the default (for FQDN ANY) to Allow Log
8. Save the profile

Step 11: Traffic Test for Category Deny

1. SSH to the EC2 instance created in the spoke1-vpc
2. Try curl -Ikv https://www.facebook.com
3. Note this gives an error message as it explicitly matches an FQDN Category with a deny policy
4. Navigate to Investigate -> Flow Analytics-> FQDN Filtering and check the logs for both actions

Error

The first time you execute curl, the request may go through as the Valtix Gateway tries to cache the Categories and the URLs. Try again a 2nd time and it should block the request