topic Re: Layer7 Filtering - Bad Bots in General Topics

Layer7 Filtering - Bad Bots

AmyTyler — Mon, 17 Jun 2013 20:16:22 GMT

Hi all,

I'm new to PAN OS and working on a project to migrate from a Cisco ASA to a PA 5020.

With the migration I need to bring over a policy that drops http traffic with a user-agent header matching on a regx.

I've created a custom vulnerability (see attached), but don't really have a way to test it out.

Is a custom Vulnerability the best approach to this type of layer 7 filtering, or is a custom application the better way to go? Other recommendations?

Also, does my pattern match look correct in the attached?

Thank you.

Re: Layer7 Filtering - Bad Bots

Retired Member — Mon, 17 Jun 2013 20:57:48 GMT

Hi,

I think custom application will be better.

Also check this for information

https://live.paloaltonetworks.com/message/25949#25949

Re: Layer7 Filtering - Bad Bots

ericgearhart — Mon, 17 Jun 2013 21:10:07 GMT

Why can't you test it? Couldn't you use Firefox with User Agent Switcher and a custom user agent to "pretend" to have the user agent you're trying to block?

Re: Layer7 Filtering - Bad Bots

AmyTyler — Tue, 18 Jun 2013 12:46:15 GMT

Thanks for the tip, egearhart. I'll research using Firefox to do that. I am also looking into what I can do with "wget" for testing

Re: Layer7 Filtering - Bad Bots

ericgearhart — Tue, 18 Jun 2013 14:18:17 GMT

OK, no problem, glad I could help!

Re: Layer7 Filtering - Bad Bots

AmyTyler — Wed, 19 Jun 2013 19:29:03 GMT

Created a custom application and it appears to be working for me.

Thanks for the tip.