topic Re: Block internet access using Opera Mini in General Topics

Block internet access using Opera Mini

homicidedart — Sat, 16 Aug 2014 10:57:38 GMT

Hi Gents,

I would like to configure palo Alto to block internet access via opera web browsers, as this browser can bypass my web-filter.

my Palo Alto License is only for Antivirus, Anti-Spyware, and Anti Vulnerability.

Regards,

Re: Block internet access using Opera Mini

pulukas — Sat, 16 Aug 2014 11:26:39 GMT

Palo Alto web filtering does not rely on any browser configuration. Instead you would need to place the firewall in the final path that the traffic must cross on the way to the internet. If the traffic crosses the firewall then a web filtering policy can be applied to the appropriate rule for the users.

The browser in use is not relevant, the web browsing traffic will be filtered per the configured rule.

Re: Block internet access using Opera Mini

kfindlen — Mon, 18 Aug 2014 16:57:51 GMT

There is an app, opera-mini, which will detect the Opera Mini browser. Opera mini operates by using a proxy server over SSL to retrieve all content. Enabling SSL decryption will break the connection so layer 7 inspection of this traffic is not possible. To block access just create a security policy with the opera-mini application and set the action to deny.

This application also covers the desktop Opera browser when used in the offroad mode.

Re: Block internet access using Opera Mini

homicidedart — Tue, 19 Aug 2014 10:45:54 GMT

Thanks mate, great work.

it works very well.

Re: Block internet access using Opera Mini

SDorsey — Wed, 20 Aug 2014 00:37:45 GMT

In addition.. food for future thought.

When a web browser connects to any website, it sends what the browser is and version in the HTTP headers. You may be able to create a custom application which matches on that information and blocks it. You would want to test thoroughly but it may be possible.

You could also use the regex in the dlp engine to attempt this.