topic Re: Filter activesync in General Topics

Filter activesync

jochristian — Tue, 28 Feb 2012 17:26:00 GMT

Hello,

I wonder if the following is possible. (Question from a potential customer).

They want to filter/DENY MAIL from the activesync traffic to mobile devices (users in the organzation using phones that are not approved because of security).

But they want to ALLOW calendar sync and contacts sync.

We already have configured inbound-ssl decryption on this traffic, but there does not exist any sub-applications of activesync.

So my question is.

Is this possible? Is it possible to write our own filter for mail sync or is this MicroSoft protocol a special one?

Jo Christian

Re: Filter activesync

rmonvon — Wed, 29 Feb 2012 00:52:28 GMT

Hi...We cannot filter activesync traffic as described to allow only mail & calendar sync. It may be possible to write custom signature(s) to match and then control them. You will have to do some pcaps and inspect the payload. Thanks.

Re: Filter activesync

mikand — Wed, 29 Feb 2012 09:06:25 GMT

You can request app enhancement from the Apps and Threats Research Center.

http://www.paloaltonetworks.com/researchcenter/tools/

From there you can click on Submit an app and provide details there.