topic Browser User-Agent string detection/blocking/logging? in General Topics

Browser User-Agent string detection/blocking/logging?

apc050 — Wed, 13 Jul 2011 19:59:30 GMT

Hello,

Is it possible for the Palo Alto to natively identify, detect, block and/or log the browser user-agent information if the application is "web-browsing"?

Thanks,

-Paul

Re: Browser User-Agent string detection/blocking/logging?

mderksen — Thu, 14 Jul 2011 08:06:20 GMT

Hi Paul,

we are not able to detect the User-agent string. What you can do is make a definition to search for specific user-agents. See this post:

https://live.paloaltonetworks.com/docs/DOC-1503

Marcel

Re: Browser User-Agent string detection/blocking/logging?

apc050 — Wed, 20 Jul 2011 16:23:40 GMT

Thanks. Would it be possible to add this as a feature request? Should be able to identify, log, report and block based on user-agent string for relevant applications.

Re: Browser User-Agent string detection/blocking/logging?

RNC — Thu, 21 Jul 2011 09:11:09 GMT

For those who care, http://www.useragentstring.com/pages/All/ contains a decent list of UA strings. Notice that there are a lot of customised versions of IE out there. It is also possible to create custom app-id's to recognise different browsers, although I doubt this would be a good strategy (you care more about the content than the accessor).

Re: Browser User-Agent string detection/blocking/logging?

migration — Fri, 16 Sep 2011 07:49:25 GMT

Hi All,

I have created a custom application to detect Firefox as an app, this seems to be working well as it is detecting it in the traffic logs.

We have a requirement to block Firefox as it enables the users to bypass the proxy setting set in the GPO in AD.

The problem:

I have a test rule to block firefox at the top of my policy set but it seems to only be active on news-media catagorized web sites like bbe,cnn etc

When browsing to Google or anyother site it hits my general access rule at the bottom of my policy list.

Any ideas? Have i created the app incorrectly ?

see attached appid

Many Thanks

Marc

Re: Browser User-Agent string detection/blocking/logging?

James — Fri, 16 Sep 2011 08:05:10 GMT

Hi Marc,

Looks OK.

Did you try looking at a PCAP and seeing if the User Agent is indeed there in the format entered in the custom app signature? Or there is an extension to Firefox called Live Headers that should give this info.

Thanks

James

Re: Browser User-Agent string detection/blocking/logging?

migration — Fri, 16 Sep 2011 08:39:53 GMT

Hi James,

Live headers is what I am using to get the detail from, ill need to investigate this a little further as it is only news-media catagories being blocked and yet I have no URL filtering enabled for those rule to block url's

Cheers

Marc

Re: Browser User-Agent string detection/blocking/logging?

RNC — Fri, 16 Sep 2011 09:49:02 GMT

It would also be possible to define this as a custom threat id, which may be a better model, as you consider the software a threat. It would log more clearly. To my mind the App-ID is a protocol recognition engine, even though it does support some well known web sites (to which site-specific protocols are inextricably linked).

FF users can obscure their User-Agent string, so it would be worth watching for hits on the addons.mozilla.org site.

Re: Browser User-Agent string detection/blocking/logging?

migration — Fri, 16 Sep 2011 09:52:36 GMT

Thanks for the help,

Ill give it a go as I already see that the ACC is reporting firefox which is a bit missleading.

Regards

Marc

Re: Browser User-Agent string detection/blocking/logging?

DavidMaas1 — Thu, 13 Jul 2023 17:34:06 GMT

How did you input this into the firewall or panorama?