topic URL Filtering to block Facebook in Next-Generation Firewall Discussions

URL Filtering to block Facebook

Momoj — Thu, 12 Oct 2023 04:32:53 GMT

Hi all,

I been testing to do URL filtering with whitelist approach (allow some URL and block everything) and also create SSL decrypt policy. As I was checking, it seems like not working to block facebook. I check in the test a site, Facebook fall under social-networking. When I check the log, there is no log under URL filtering that is hitting facebook.

I also made some custom url category(attach it to URL filtering for blocking facebook), but still not hitting the custom url category:

*.facebook.com

connect.facebook.net/*

*.xx.fbdcdn.net/

Anybody have any idea on how to block facebook by URL filtering? The security rule is from trust to untrust and I set it allow, and attach the URL filtering.

Re: URL Filtering to block Facebook

LAYER_8 — Fri, 01 Dec 2023 02:12:35 GMT

Is facebook showing up in the logs of allowed traffic? If not, FB could be using QUIC

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClarCAC

Re: URL Filtering to block Facebook

Momoj — Fri, 01 Dec 2023 04:15:33 GMT

Hi,

Actually, there is CASB client intercept the traffic for Saas Based traffic so we couldn't do anything from firewall side. The blocking need to do from CASB itself. Beside that, it seems like the url filtering is working other than SaaS based traffic.

Re: URL Filtering to block Facebook

Adrian_Jensen — Mon, 04 Dec 2023 18:05:38 GMT

We use the following custom URL category for selectively allowing/blocking Facebook:

fb.com/

*.fb.com/

facebook.com/

*.facebook.com/

facebook.net/

*.facebook.net/

fbcdn.net/

*.fbcdn.net/

Either as a category in URL filtering, or as a modifier for specific destinations in a Security Policy. You can usually do overall blocking without SSL decryption (with just the SNI), but doing all SSL decryption leads to far better pattern matching.