topic Re: Block All Internet Web-Browsing But Allow MS_UPDATES in Panorama Discussions

Block All Internet Web-Browsing But Allow MS_UPDATES

MTaylor22 — Fri, 18 Nov 2022 00:57:17 GMT

For our isolated network I need to block all devices from using the internet but I need to access services like ms updates, sophos etc that require SSL for a couple servers. When applying policies with the required application these require SSL/web-browsing.

We are having trouble finding a work around.

The IP's are dynamic so nailing down the exact IP's seem futile. We tried to apply the url's or wildcard addresses for these services in a URL group in the policy, but this still allows internet to these servers.

Any suggestions are appreciated.

Using Panorama 10.1.6 with firewall PA-440 and other sites with PA-410

Re: Block All Internet Web-Browsing But Allow MS_UPDATES

Metgatz — Fri, 18 Nov 2022 04:16:34 GMT

Hello, you can create a Policy, allow apps ssl, web-browser, and microsoft update app ( Microsoft Update use port 80/443 ) and create a custom category URL, with allowed microsoft update subdomains, put in the URL category in the secure policy.

microsoft update subdomains/FQDN:

https://learn.microsoft.com/en-us/windows-server/administration/windows-server-update-services/deploy/2-configure-wsus#:~:text=Your%20first%20WSUS%20server%20must%20have%20outbound%20access%20to%20ports%2080%20and%20443%20on%20the%20following%20domains%3A

Whit that only allow ssl/https and microsft update app to the destination for the Microsoft update services. You can doit the same for Sophos.

Of course it will allow access to the servers to the Internet, but only at the level of the destination in the URL custom category, and nothing else. Additional to protect add profile security policy. And then with another rule close all the rest of the servers access, a total deny of all the rest and above/free the policy of ms-update, web-browser, ssl only to the URLs in question (ms-update and sophos).

Cheers

Re: Block All Internet Web-Browsing But Allow MS_UPDATES

MTaylor22 — Fri, 18 Nov 2022 13:14:12 GMT

Thank you for the quick reply. I will be working on this today and let you know how it goes. Thank you!

Re: Block All Internet Web-Browsing But Allow MS_UPDATES

MTaylor22 — Mon, 21 Nov 2022 13:18:19 GMT

Worked great! Much appreciated.