Controlling iChat communications

[#1]

Article

Description	Blocking iChat communications.
Components	FortiGate 2.8 - all units iChat and iChat AV
Steps or Commands	You can control iChat communications by blocking or allowing the ports iChat uses when transmitting information. iChat AV traffic uses UDP except for ports 5190 and 5298, which are used for both TCP and UDP traffic. For details on the ports iChat uses, see the Apple Support article Using iChat AV with a firewall or NAT router. To control iChat communications, add a new Service entry to the FortiGate unit and add a firewall policy to deny the service. To create iChat services Go to Firewall>Service>Custom. Select Create New. Enter the name of the service. Select the protocol of UDP. Specify the Source Port number range by entering the low and high port numbers. For a single port number, enter this number in both the low and high fields. Specify the Destination Port number range by entering the low and high port numbers. For a single port number, enter this number in both the low and high fields. Select OK Repeat for TCP ports. You can add as many as required. Because iChat uses UDP and TCP ports, create a Service Group, and include all iChat services for the various ports. To create a service group Go to Firewall>Service>Group. Select Create New. Enter the group name Add the iChat services from the Available Services and move them to the Members column. Select OK. Add a firewall policy for the iChat service group to control communications through this service. To add a firewall policy Go to Firewall>Policy. Select Create New. Configure the Source, Destination and Schedule. Select the iChat service group. Select the Action as Deny or Accept. Select OK. Note: iChat users can also communicate with AIM users. For further control, you can also prevent or allow AIM communications. To block AIM users Go to IPS>Signature. Scroll to the IM signatures and select the blue arrow to expand the list. Select Edit for AIM. Select Drop for the Action Select OK Note: You need to enable the signature in a protection profile, which you can select within the aforementioned firewall policy. For more information on Firewall policies and protection profiles, see the FortiGate Administration Guide.