Domain fronting protection NEW
FortiOS can protect against domain fronting in both explicit proxy and proxy-based firewall policies. In both cases, FortiGate checks whether the domain of the request matches the host domain in the HTTP header, and then allows, blocks, or monitors the traffic. This feature enhances security by preventing unauthorized access that could result from domain mismatches.
config firewall profile-protocol-options
edit protocol
config http
set domain-fronting {allow | block | monitor}
next
end
end
|
set domain-fronting {allow | block | monitor} |
Configure HTTP domain fronting (default = block).
|
|
Domain fronting protection supports HTTP/1.1 but not HTTP/2. |
Example
In this example, the server name indication (SNI) in the request is httpbin.org, and the host header in the request is google.com.
When FortiGate has an explicit proxy policy configured with set domain-fronting block, traffic is blocked and logged when the request domain does not match the HTTP header domain.
-
Example traffic log:
1: date=2024-06-11 time=10:38:23 eventtime=1718127503650731465 tz="-0700" logid="0000000013" type="traffic" subtype="forward" level="notice" vd="vdom1" srcip=10.1.100.77 srcport=41548 srcintf="port2" srcintfrole="undefined" dstip=3.211.196.247 dstport=443 dstintf="port3" dstintfrole="undefined" srccountry="Reserved" dstcountry="United States" sessionid=1542161161 proto=6 action="deny" policyid=1 policytype="proxy-policy" poluuid="01352fb2-1370-51ef-8ac3-c46f77827b80" service="HTTPS" trandisp="noop" duration=0 sentbyte=0 rcvdbyte=0 sentpkt=0 rcvdpkt=0 appcat="unscanned" utmaction="block" countweb=1 msg="Traffic denied because of domain fronting" utmref=65498-0
-
Example Web filter UTM log:
1: date=2024-06-11 time=10:38:23 eventtime=1718127503650663438 tz="-0700" logid="0320013318" type="utm" subtype="webfilter" eventtype="domain-fronting" level="notice" vd="vdom1" policyid=1 poluuid="01352fb2-1370-51ef-8ac3-c46f77827b80" policytype="proxy-policy" sessionid=1542161161 transid=1 srcip=10.1.100.77 srcport=41548 srccountry="Reserved" srcintf="port2" srcintfrole="undefined" dstip=3.211.196.247 dstport=443 dstcountry="United States" dstintf="port3" dstintfrole="undefined" proto=6 httpmethod="GET" service="HTTPS" hostname="google.com" agent="curl/7.83.1" profile="protocol" action="blocked" reqtype="direct" url="https://google.com/" sentbyte=860 rcvdbyte=5470 direction="outgoing" msg="Domain fronting detected" rawdata="HTTP Host <google.com> does not match SNI <httpbin.org>"
When FortiGate has a transparent proxy policy configured with set domain-fronting monitor, traffic is passed and logged when the request domain does not match the HTTP header domain.
-
Example traffic log:
1: date=2024-06-11 time=11:14:22 eventtime=1718129661884640964 tz="-0700" logid="0000000010" type="traffic" subtype="forward" level="notice" vd="vdom1" srcip=10.1.100.77 srcport=44250 srcintf="port2" srcintfrole="undefined" dstcountry="United States" srccountry="Reserved" dstip=3.211.196.247 dstport=443 dstintf="port3" dstintfrole="undefined" sessionid=2024 service="web" proxyapptype="web-proxy" proto=6 action="accept" policyid=22 policytype="proxy-policy" poluuid="05d56dfc-1370-51ef-5315-e0ee922dd3b5" trandisp="snat" transip=172.16.200.2 transport=44250 duration=0 wanin=15331 rcvdbyte=15331 wanout=578 lanin=777 sentbyte=777 lanout=12868 appcat="unscanned" utmaction="allow" countweb=1 utmref=65496-0
-
Example Web filter UTM log:
1: date=2024-06-11 time=11:14:22 eventtime=1718129661808321505 tz="-0700" logid="0320013318" type="utm" subtype="webfilter" eventtype="domain-fronting" level="notice" vd="vdom1" policyid=22 poluuid="05d56dfc-1370-51ef-5315-e0ee922dd3b5" policytype="proxy-policy" sessionid=2024 transid=1 srcip=10.1.100.77 srcport=44250 srccountry="Reserved" srcintf="port2" srcintfrole="undefined" srcuuid="e3659a44-136f-51ef-2b98-b3a63e02baed" dstip=3.211.196.247 dstport=443 dstcountry="United States" dstintf="port3" dstintfrole="undefined" dstuuid="e3659a44-136f-51ef-2b98-b3a63e02baed" proto=6 httpmethod="GET" service="HTTPS" hostname="google.com" agent="curl/7.83.1" profile="protocol" action="passthrough" reqtype="direct" url="https://google.com/" sentbyte=746 rcvdbyte=5470 direction="outgoing" msg="Domain fronting detected" rawdata="HTTP Host <google.com> does not match SNI <httpbin.org>"