Customized SaaS application and user activity

In this example, a custom SaaS application is created (pc4) with a custom user action. When a user accesses pc4.qa.fortinet.com/virus, they are redirected to pc4.qa.fortinet.com/testweb/testweb.htm.

To configure a customized inline CASB profile in the GUI:

1. Configure the inline CASB profile:

   1. Go to Security Profiles > Inline-CASB and click Create new.

   2. Enter a Name, such as custom_test.

   3. In the SaaS Applications table, click Create new. The Create SaaS Application Rules pane opens.

   4. In the Application dropdown, click the + to create a custom entry. The Create Inline-CASB SaaS Application pane opens.

   5. Enter the Name (pc4) and Domains (pc4.qa.fortinet.com), then click OK.

      

   6. Select pc4 and click Next.

   7. Configure the custom control and action:

      1. In the Custom Controls table, Create new. The Create Custom Control pane opens.

      2. Enter a Name, such as pc4-virus_test_replace.

      3. Set Apply when HTTP packet matches to All of the following.

      4. Enable URL path and enter /virus.

         

      5. In the Application-Defined Controls table, Create new. The Create Custom Control Action pane opens.

      6. Enter a Name, such as virus_replace_operation.

      7. Set the Control Type to Edit URL path.

      8. Set the Action to Replace path with value.

      9. Set the Path to /virus.

      10. Set the Value to /testweb/testweb.html.

          

      11. Click OK to save the custom action.

      12. Click OK to save the custom control.

   8. Click OK to save the application rule.

   9. Click OK to save the inline CASB profile.

2. Configure the firewall policy:

   1. Go to Policy & Objects > Firewall Policy. Edit an existing policy, or create a new one.

   2. Set the Inspection Mode to Proxy-based.

   3. In the Security Profiles section, enable Inline-CASB and select the custom_test profile.

   4. Set the SSL Inspection profile to one that uses deep inspection.

   5. Configure the other settings as needed.

   6. Click OK.

To configure a customized inline CASB profile in the CLI:

1. Configure the CASB SaaS application:

   config casb saas-application
       edit "pc4"
           set domains "pc4.qa.fortinet.com"
       next
   end

2. Configure the CASB user activity:

   config casb user-activity
       edit "pc4-virus_test_replace"
           set application "pc4"
           set category other
           config match
               edit 1
                   config rules
                       edit 1
                           set type path
                           set match-value "/virus"
                       next
                   end
               next
           end
           config control-options
               edit "virus_replace_operation"
                   config operations
                       edit "virus_replace_operation"
                           set target path
                           set action replace
                           set search-key "/virus"
                           set values "/testweb/testweb.html"
                       next
                   end
               next
           end
       next
   end

3. Configure the inline CASB profile:

   config casb profile
       edit "custom_test"
           config saas-application
               edit "pc4"
                   config custom-control
                       edit "pc4-virus_test_replace"
                           config option
                               edit "virus_replace_operation"
                               next
                           end
                       next
                   end
               next
           end
       next
   end

4. Configure the firewall policy:

   config firewall policy
       edit 10
           set name "casb_test_custom"
           set srcintf "port1"
           set dstintf "port3"
           set action accept
           set srcaddr "all"
           set dstaddr "all"
           set schedule "always"
           set service "ALL"
           set utm-status enable
           set inspection-mode proxy
           set ssl-ssh-profile "ssl"
           set casb-profile "custom_test"
           set nat enable
       next
   end

To test the configuration:

1. Open a browser and go to pc4.qa.fortinet.com/virus.

2. Access is redirected to pc4.qa.fortinet.com/testweb/testweb.htm.

   

Sample log:

1: date=2023-08-21 time=08:31:06 eventtime=1692631866382806917 tz="-0700" logid="2500010001" type="utm" subtype="casb" eventtype="casb" level="information" vd="vdom1" msg="CASB access was allowed although it contained activity." policyid=10 sessionid=3139 srcip=10.1.100.195 dstip=172.16.200.44 srcport=56774 dstport=80 srcintf="port1" srcintfrole="undefined" dstintf="port3" dstintfrole="undefined" proto=6 url="http://pc4.qa.fortinet.com/testweb/testweb.html" action="bypass" profile="custom_test" saasapp="pc4" useractivity="pc4-virus_test_replace" activitycategory="other"