Block AI Tools on FortiGate Firewalls

# Create a web filter profile that blocks AI tool domains
# Uses the external threat feed as a URL filter source

config webfilter profile
    edit "Block-AI-Tools"
        set comment "Blocks AI tool domains via external threat feed"
        set log-all-url enable
        set web-content-log enable

        # Enable FortiGuard category-based filtering (keep existing categories)
        config ftgd-wf
            config filters
                edit 1
                    set category 2
                    set action block
                next
            end
        end

        # Add the external AI blocklist as a URL filter
        config url-extraction
            set status enable
        end

        config web-filter-referer-log
            set status enable
        end
    next
end

# Create a firewall policy that applies the web filter profile
config firewall policy
    edit 10
        set name "Block-AI-Tools-Policy"
        set srcintf "internal"
        set dstintf "wan1"
        set srcaddr "all"
        set dstaddr "all"
        set action accept
        set schedule "always"
        set service "HTTP" "HTTPS"
        set utm-status enable
        set webfilter-profile "Block-AI-Tools"
        set ssl-ssh-profile "deep-inspection"
        set logtraffic all
    next
end

# Configure SSL deep inspection profile for AI tool traffic
# Intercepts and inspects HTTPS connections to AI domains

config firewall ssl-ssh-profile
    edit "AI-Deep-Inspection"
        set comment "Deep inspection for AI tool traffic - enables DLP and content logging"

        config ssl
            set inspect-all deep-inspection
            set untrusted-cert block
            set min-allowed-ssl-version tls-1.2
        end

        config https
            set status deep-inspection
            set ports 443
            set proxy-after-tcp-handshake enable
        end

        # Exempt domains that break with MITM (banking, healthcare portals)
        config ssl-exempt
            edit 1
                set type wildcard-fqdn
                set wildcard-fqdn "*.bank.example.com"
            next
            edit 2
                set type wildcard-fqdn
                set wildcard-fqdn "*.healthcare-portal.example.com"
            next
        end

        set server-cert-mode replace
        set caname "Fortinet_CA_SSL"
    next
end

# Download the CA certificate for endpoint deployment
execute vpn certificate ca export "Fortinet_CA_SSL"

# FortiAnalyzer log queries for AI tool blocking reports
# Run these in FortiAnalyzer CLI or use as SQL queries in custom reports

# Query: Top 20 blocked AI domains in the last 24 hours
execute sql-report run
    SELECT hostname, COUNT(*) AS block_count
    FROM webfilter_urlfilter
    WHERE action = 'blocked'
      AND profile = 'Block-AI-Tools'
      AND log_time > NOW() - INTERVAL 24 HOUR
    GROUP BY hostname
    ORDER BY block_count DESC
    LIMIT 20

# Query: Users with the most AI tool access attempts
execute sql-report run
    SELECT user, srcip, COUNT(*) AS attempts
    FROM webfilter_urlfilter
    WHERE action = 'blocked'
      AND profile = 'Block-AI-Tools'
      AND log_time > NOW() - INTERVAL 7 DAY
    GROUP BY user, srcip
    ORDER BY attempts DESC
    LIMIT 50

# Query: Daily trend of AI tool block events
execute sql-report run
    SELECT DATE(log_time) AS day, COUNT(*) AS daily_blocks
    FROM webfilter_urlfilter
    WHERE action = 'blocked'
      AND profile = 'Block-AI-Tools'
      AND log_time > NOW() - INTERVAL 30 DAY
    GROUP BY DATE(log_time)
    ORDER BY day ASC

# Verification commands — run on the FortiGate CLI

# 1. Confirm the external threat feed is loaded and populated
diagnose sys external-resource list

# Expected output:
# Name: AI-Tools-Blocklist
# Type: url-list
# Status: up
# Last-refresh: 2026-07-09 02:00:15
# Entry-count: 42387

# 2. Check if a specific domain is in the loaded feed
diagnose sys external-resource entry-list "AI-Tools-Blocklist" | grep "openai.com"

# 3. Test web filter matching for a domain
diagnose webfilter url-filter test "https://chat.openai.com"

# 4. Monitor real-time block events
diagnose debug application urlfilter -1
diagnose debug enable

# 5. Review recent web filter log entries
execute log filter category 4
execute log filter field action block
execute log display