Block HTTPS upload traffic that includes Visa or Mastercard information using evaluation through logical expression

This example will allow users to create a subset of the existing DLP data type, credit-card. It can be very beneficial for an organization that wants to prevent only certain types of credit cards and not all.

This configuration will block HTTPS traffic that includes Visa or Mastercard information. Two dictionary entries with DLP data-type regex are created with custom patterns to match Visa and Mastercard numbers respectively, and a third dictionary entry is created with pre-defined data type credit-card. All three entries are used in the sensor using evaluation via logical expression to further supplement the detection.

In the CLI, evaluation via logical expression can be defined using the command match-eval. It is a tool used to combine multiple entries to define an accurate DLP sensor.

Sample topology

In this example, a Microsoft Office document with Visa credit card information is sent securely to the receiver using the HTTP POST method. The FortiGate intercepts the traffic using deep inspection and blocks the traffic as it matches the DLP profile configured on this FortiGate.

To block HTTPS upload traffic that includes Visa or Mastercard credit card information in the GUI:

1. Configure the DLP dictionary:

   1. Go to Security Profiles > Data Loss Prevention, select the Dictionaries tab, and click Create New.

   2. Create an entry for Visa:

      1. Enter a name (Finance_Credit_Card_Visa).

      2. In the Dictionary Entries section, click Create New.

      3. Set the Type to regex.

      4. Set Pattern to 4[0-9]{12}(?:[0-9]{3}) and click OK.

      5. Click OK to save the dictionary.

   3. Create an entry for Mastercard:

      1. Enter a name (Finance_Credit_Card_Mastercard).

      2. In the Dictionary Entries section, click Create New.

      3. Set the Type to regex.

      4. Set Pattern to (?:5[1-5][0-9]{2}|222[1-9]|22[3-9][0-9]|2[3-6][0-9]{2}|27[01][0-9]|2720)[0-9]{12} and click OK.

      5. Click OK to save the dictionary.

   4. Create an entry for Credit Card:

      1. Enter a name (CC_Number).

      2. In the Dictionary Entries section, click Create New.

      3. Set the Type to credit-card and click OK.

      4. Click OK to save the dictionary.

2. Configure the DLP sensor:

   1. Go to Security Profiles > Data Loss Prevention, select the Sensors tab, and click Create New.

   2. Enter a name (Finance_Credit_Card_High).

   3. In the Sensor Entries section, click Create New.

   4. Set the Dictionary to Finance_Credit_Card_Visa and click OK.

   5. Repeat the previous step twice to add Finance_Credit_Card_Mastercard and CC_Number in this order.

   6. Click OK to save the sensor.

   7. Edit the newly created sensor.

   8. Set the Logical relationship to Evaluate.

   9. In the Evaluated by field, enter (dict(1) > 0 && dict(3) > 0) || (dict(2) > 0 && dict(3) > 0).

   10. Click OK to save the sensor.

       For the DLP sensor with the Logical relationship set to Evaluate, Count and Status of any sensor entry will be ignored.

3. Configure the DLP profile:

   1. Go to Security Profiles > Data Loss Prevention, select the Profiles tab, and click Create New.

   2. Enter a name (cc-block).

   3. In the Rules section, click Create New.

   4. Configure the following settings:

      Name	1
      Sensors	Finance Credit Card High
      Severity	Critical
      Action	Block
      Type	File
      File type	builtin-patterns
      Protocol	HTTP-POST, HTTP-GET

   5. Click OK.

   6. Click OK to save the profile.

4. Add the DLP profile to a firewall policy:

   1. Go to Policy & Objects > Firewall Policy and click Create New.

   2. Set the Inspection Mode to Proxy-based.

   3. In the Security Profiles section, enable DLP Profile and select cc-block.

   4. Set SSL Inspection to deep-inspection to inspect HTTPS traffic.

   5. Configure the other settings as needed.

   6. Click OK.

When a Visa or Mastercard credit card is included in HTTP GET or POST traffic, the file is blocked and a DLP log is generated. See the Sample log for details on how to test this configuration.

To block HTTPS upload traffic that includes Visa or Mastercard credit card information in the CLI:

1. Configure the DLP dictionary:

   config dlp dictionary
       edit "Finance_Credit_Card_Visa"
           config entries
               edit 1
                   set type "regex"
                   set pattern "4[0-9]{12}(?:[0-9]{3})"
                   set repeat enable
                   set comment "Visa"
               next
           end
       next
       edit "Finance_Credit_Card_Mastercard"
           config entries
               edit 1
                   set type "regex"
                   set pattern "(?:5[1-5][0-9]{2}|222[1-9]|22[3-9][0-9]|2[3-6][0-9]{2}|27[01][0-9]|2720)[0-9]{12}"
                   set repeat enable
                   set comment "Mastercard"
               next
           end
       next
       edit "CC_Number"
           config entries
               edit 1
                   set type "credit-card"
               next
           end
       next
   end

   To use "?" in a regex pattern, see CLI basics. This method only supports direct console connection and SSH. It does not support the CLI console in the GUI.

2. Configure the DLP sensor:

   config dlp sensor
       edit "Finance_Credit_Card_High"
           config entries
               edit 1
                      set dictionary "Finance_Credit_Card_Visa"                 
               next
               edit 2
                   set dictionary "Finance_Credit_Card_Mastercard"
               next
               edit 3
                   set dictionary "CC_Number"
               next
           end
           set match-type match-eval
           set eval "(dict(1) > 0 && dict(3) > 0) || (dict(2) > 0 && dict(3) > 0)"
       next
   end

3. Configure the DLP profile:

   config dlp profile
       edit "cc_block"
           set feature-set proxy
           config rule
               edit 1
                   set name "1"
                   set severity critical
                   set proto http-get http-post
                   set filter-by sensor
                   set file-type 1
                   set sensor "Finance_Credit_Card_High"
                   set action block
               next
           end
       next
   end

4. Add the DLP profile to a firewall policy:

   config firewall policy
       edit 1
           set srcintf "port2"
           set dstintf "port3"
           set action accept
           set srcaddr "all"
           set dstaddr "all"
           set schedule "always"
           set service "ALL"
           set utm-status enable
           set inspection-mode proxy
           set ssl-ssh-profile "deep-inspection"
           set dlp-profile "cc_block"
           set nat enable
       next
   end

When a Visa or Mastercard credit card is included in HTTP GET or POST traffic, a replacement message appears because it is blocked. A DLP log is generated. See the Sample log for details on how to test this configuration.

Sample log

From Windows, the following command can be used to generate a sample log via HTTP POST traffic, using the cURL tool to post data, which contains a sample Visa credit card number. See sample-data for sample credit card numbers.

# curl –k -d 4024007149133315 https://192.168.10.13/cc.doc -o?

1: date=2023-03-17 time=15:37:41 eventtime=1679092660998869199 tz="-0700" logid="0954024576" type="utm" subtype="dlp" eventtype="dlp" level="warning" vd="root" ruleid=1 rulename="1" dlpextra="builtin-patterns;Finance_Credit_Card_High" filtertype="sensor" filtercat="file" severity="critical" policyid=1 poluuid="26540ed0-ae54-51ed-80eb-89af8af4d53f" policytype="policy" sessionid=14854 epoch=570215534 eventid=0 srcip=172.20.120.13 srcport=58012 srccountry="Reserved" srcintf="port2" srcintfrole="undefined" srcuuid="3342cb44-9140-51ed-5dbe-8e0787bedeec" dstip=192.168.10.13 dstport=443 dstcountry="Reserved" dstintf="port3" dstintfrole="wan" dstuuid="3342cb44-9140-51ed-5dbe-8e0787bedeec" proto=6 service="HTTPS" filetype="msoffice" direction="incoming" action="block" hostname="192.168.10.13" url="https://192.168.10.13/cc.doc" agent="curl/7.83.1" httpmethod="POST" filename="cc.doc" filesize=12288 profile="cc-block"