config dlp filepattern
edit 4
set name “blockMP3”
config entries
edit “MP3”
set filter-type type
set file-type mp3
next
end
next
end

config dlp sensor
edit “MP3block”
config filter
edit 1
set proto http-get http-post ftp
set filter-by file-type
set file-type 4
set action block
next
end
next
end

config firewall policy
edit 138
set srcintf “Dialup3”
set dstintf “VDOM_EXT”
set action accept
set srcaddr “all”
set dstaddr “all”
set schedule “always”
set service “ALL”
set utm-status enable
set ssl-ssh-profile “deep-inspection”
set dlp-sensor “MP3block”
set logtraffic all
set nat enable
next
end

config file-filter profile
edit “MP3block”
config rules
edit “MP3typeblock”
set protocol http ftp smtp
set action block
set file-type “mp3”
next
end
next
end

config firewall policy
edit 9
set uuid 6d0debbe-1755-51ef-ca7d-d938a76591a0
set srcintf “Peer1P1”
set dstintf “NV5000-EXT”
set action accept
set srcaddr “Peer1pool”
set dstaddr “all”
set schedule “always”
set service “ALL”
set utm-status enable
set inspection-mode proxy
set ssl-ssh-profile “deep-inspection”
set dlp-profile “BlockSSNCCprofile”
set file-filter-profile “MP3block”
set logtraffic all
set nat enable
set users “yurisk1”
next
end

config dlp data-type
edit “g-credit-card”
set pattern “\b([2-6]{1}\d{3})[- ]?(\d{4})[- ]?(\d{2})[- ]?(\d{2})[- ]?(\d{2,4})\b”
set verify “built-in”
set look-back 20
set transform “\b\1[- ]?\2[- ]?\3[- ]?\4[- ]?\5\b”
next
edit “g-hex”
set pattern “built-in”
next
edit “g-keyword”
set pattern “built-in”
next
edit “g-mip-label”
set pattern “^[[:xdigit:]]{8}-[[:xdigit:]]{4}-[[:xdigit:]]{4}-[[:xdigit:]]{4}-[[:xdigit:]]{12}$”
set transform “built-in”
next
edit “g-regex”
set pattern “built-in”
next
edit “g-ssn-us”
set pattern “\b(\d{3})-(\d{2})-(\d{4})\b”
set verify “(?<!-)\b(?!666|000|9\d{2})\d{3}-(?!00)\d{2}-(?!0{4})\d{4}\b(?!-)”
set look-back 12
set transform “\b\1-\2-\3\b”
next
end

config dlp dictionary
edit “SSNCCdict”
config entries
edit 1
set type “g-credit-card” <– BUILT-INs SEE ABOVE
next
edit 2
set type “g-ssn-us”
next
end
next
end

config dlp sensor
edit “blockSSNCC”
set match-type match-any <– THIS DEFAULT SO WILL NOT APPEAR
config entries
edit 1
set dictionary “SSNCCdict”
set count 1 <– DEFAULT SO WILL NOT APPEAR
next
end
next
end

config dlp profile
(profile) $ edit BlockSSNCCprofile
new entry ‘BlockSSNCCprofile’ added

(BlockSSNCCprofile) $ set
comment Comment.
feature-set Flow/proxy feature set.
replacemsg-group Replacement message group used by this DLP profile.
dlp-log Enable/disable DLP logging.
extended-log Enable/disable extended logging for data leak prevention.
nac-quar-log Enable/disable NAC quarantine logging.
full-archive-proto Protocols to always content archive.
summary-proto Protocols to always log summary.

(BlockSSNCCprofile) $ config rule

(rule) $ edit 0
new entry ‘0’ added

(0) $ set
name Filter name.
severity Select the severity or threat level that matches this filter.
type Select whether to check the content of messages (an email message)
or files (downloaded files or email attachments).
proto Check messages or files over one or more of these protocols.
filter-by Select the type of content to match.
file-size Match files this size or larger (0 – 4294967295 kbytes).
file-type Select the number of a DLP file pattern table to match.
action Action to take with content that this DLP profile matches.

(0) $ set action
allow Allow the content to pass through the FortiGate and do
not create a log message.
log-only Allow the content to pass through the FortiGate, but write
a log message.
block Block the content and write a log message.
quarantine-ip Quarantine all traffic from the IP address and write a log message.

(0) $ set action block
(0) $ set type file // OR message FOR EMAILS

(0) $ set filter-by
sensor Use DLP sensors to match content.
encrypted Look for encrypted files.
none No content scan.

(0) $ set filter-by sensor
(0) $ set sensor “blockSSNCC”

config dlp profile
edit “BlockSSNCCprofile”
config rule
edit 1
set proto http-get http-post ftp
set filter-by sensor
set sensor “blockSSNCC”
set action block
next
end
next
end

config firewall policy
edit 9
set srcintf “Peer1P1”
set dstintf “VMVDOM-EXT”
set action accept
set srcaddr “Peer1pool”
set dstaddr “all”
set schedule “always”
set service “ALL”
set utm-status enable
set ssl-ssh-profile “deep-inspection”
set dlp-profile “BlockSSNCCprofile”
set logtraffic all
set nat enable
set users “yurisk1”
next
end