Version:

Version:


Table of Contents

Download PDF
Copy Link

Blocking removable devices by class ID 6.4.2

You can define multiple rules to block, monitor, or allow removable devices, such as the following:

  • Human interface devices
  • Windows portable devices
  • Bluetooth devices
  • CD-ROM drive
  • Smart card reader
  • USB device
  • Camera device

You can configure rules using device properties including the class, manufacturer, vendor ID, product ID, and revision. You can enter regular expressions in PERL or simple format (exact match). One profile supports multiple rules. FortiClient EMS ignores empty fields. If FortiClient detects an existing removable device's properties matches a rule, it applies the configured action (block, allow, or monitor).

You can find the hardware properties of a removable device using Hardware Manager or USBDeView.

To configure Removable Media Access:
  1. In EMS, go to Endpoint Profiles > Manage Profiles.
  2. On the Malware tab, enable Removable Media Access.
  3. Configure the following:

    Options

    Description

    Show bubble notifications

    Display a bubble notification when FortiClient takes action with a removable media device.

    Action

    Configure the action to take with removable media devices connected to the endpoint that match this rule. Available options are:

    • Allow: Allow access to removable media devices connected to the endpoint that match this rule.
    • Block: Block access to removable media devices connected to the endpoint that match this rule.
    • Monitor: Log removable media device connections to the endpoint that match this rule.

    Description

    Enter the desired rule description.

    Type

    Select Simple or Regular Expression for the rule type.

    When Simple is selected, FortiClient performs case-insensitive matching against classes, manufacturers, vendor IDs, product IDs, and revisions.

    When Regular Expression is selected, FortiClient uses Perl Compatible Regular Expressions (PCRE) to perform matching against classes, manufacturers, vendor IDs, product IDs, and revisions.

    Class

    Enter the device class.

    Manufacturer

    Enter the device manufacturer.

    Vendor ID

    Enter the device vendor ID.

    Product ID

    Enter the device product ID.

    Revision

    Enter the device revision number.

    Remove this rule

    Remove this rule from the profile.

    Add a new rule

    Add a new removable media access rule.

    Move this rule up/down

    Move this rule up or down. If a connected device is eligible for multiple rules, FortiClient applies the highest rule to the device.

    Default removable media access

    Configure the action to take with removable media devices that do not match any configured rules. Available options are:

    • Allow: Allow access to removable media devices connected to the endpoint that do not match any configured rules.
    • Block: Block access to removable media devices connected to the endpoint that do not match any configured rules.
    • Monitor: Log removable media device connections to the endpoint that do not match any configured rules.
  4. Click Save.

The FortiClient GUI currently does not display all defined removable media rules. It only displays the default action, which is applied if the removable device does not match all defined rules.

To view endpoint removable media events:
  1. In EMS, go to Endpoints and go to the desired endpoint.
  2. Click the endpoint, then select the USB Monitor Events tab.

Blocking removable devices by class ID 6.4.2

You can define multiple rules to block, monitor, or allow removable devices, such as the following:

  • Human interface devices
  • Windows portable devices
  • Bluetooth devices
  • CD-ROM drive
  • Smart card reader
  • USB device
  • Camera device

You can configure rules using device properties including the class, manufacturer, vendor ID, product ID, and revision. You can enter regular expressions in PERL or simple format (exact match). One profile supports multiple rules. FortiClient EMS ignores empty fields. If FortiClient detects an existing removable device's properties matches a rule, it applies the configured action (block, allow, or monitor).

You can find the hardware properties of a removable device using Hardware Manager or USBDeView.

To configure Removable Media Access:
  1. In EMS, go to Endpoint Profiles > Manage Profiles.
  2. On the Malware tab, enable Removable Media Access.
  3. Configure the following:

    Options

    Description

    Show bubble notifications

    Display a bubble notification when FortiClient takes action with a removable media device.

    Action

    Configure the action to take with removable media devices connected to the endpoint that match this rule. Available options are:

    • Allow: Allow access to removable media devices connected to the endpoint that match this rule.
    • Block: Block access to removable media devices connected to the endpoint that match this rule.
    • Monitor: Log removable media device connections to the endpoint that match this rule.

    Description

    Enter the desired rule description.

    Type

    Select Simple or Regular Expression for the rule type.

    When Simple is selected, FortiClient performs case-insensitive matching against classes, manufacturers, vendor IDs, product IDs, and revisions.

    When Regular Expression is selected, FortiClient uses Perl Compatible Regular Expressions (PCRE) to perform matching against classes, manufacturers, vendor IDs, product IDs, and revisions.

    Class

    Enter the device class.

    Manufacturer

    Enter the device manufacturer.

    Vendor ID

    Enter the device vendor ID.

    Product ID

    Enter the device product ID.

    Revision

    Enter the device revision number.

    Remove this rule

    Remove this rule from the profile.

    Add a new rule

    Add a new removable media access rule.

    Move this rule up/down

    Move this rule up or down. If a connected device is eligible for multiple rules, FortiClient applies the highest rule to the device.

    Default removable media access

    Configure the action to take with removable media devices that do not match any configured rules. Available options are:

    • Allow: Allow access to removable media devices connected to the endpoint that do not match any configured rules.
    • Block: Block access to removable media devices connected to the endpoint that do not match any configured rules.
    • Monitor: Log removable media device connections to the endpoint that do not match any configured rules.
  4. Click Save.

The FortiClient GUI currently does not display all defined removable media rules. It only displays the default action, which is applied if the removable device does not match all defined rules.

To view endpoint removable media events:
  1. In EMS, go to Endpoints and go to the desired endpoint.
  2. Click the endpoint, then select the USB Monitor Events tab.