topic Re: How would I block social networking but allow a single Facebook page? in General Topics

How would I block social networking but allow a single Facebook page?

ClintL — Tue, 08 Jul 2014 19:33:45 GMT

I have a URL filtering policy set to block the social networking category which of course includes Facebook. I need to allow the users that are assigned to this filtering policy access to a single Facebook page along with the pages that correspond to this single page. I tried the link below with no success and of course I tried to add the specific URL to the allow list in the filtering policy which also did not work. The weird thing is I never see an actual response page when I have the page blocked. I get the following error:

Secure Connection Failed

An error occurred during a connection to www.facebook.com.

SSL received a record that exceeded the maximum permissible length

(Error code: ssl_error_rx_record_too_long)

For the security policy itself I have dns, http (filter) and ssl allowed (I've also had web-browsing, with the http(filter) removed, and facebook listed as well) under application and services set to application-default. Do I have something configured incorrectly? I feel this should be something simple that I am missing.

How to Allow a Single Facebook, YouTube or Twitter Page

Re: How would I block social networking but allow a single Facebook page?

kadak — Tue, 08 Jul 2014 19:49:34 GMT

Hello clint.leatherman,

Could you provide me the link of the particular facebook page you are trying to allow.

Thanks and regards,

Kunal Adak

Re: How would I block social networking but allow a single Facebook page?

ClintL — Tue, 08 Jul 2014 19:55:43 GMT

Hello Kunal,

The two pages are:

www.facebook.com/SmartStartLA/

www.facebook.com/pages/Smart-Start-Inc/143047259157628/

Re: How would I block social networking but allow a single Facebook page?

HULK — Tue, 08 Jul 2014 20:52:24 GMT

Hello Sir,

I have checked into a test PAN firewall, and please find below mentioned steps: ( Since, facebook is working on HTTPS[ssl], it would be better to have a decryption policy for the same, otherwise traffic will be categorized based on certificate name)

Step:-1

Step-2:

I hope, Google chrome, has been enhanced their security feature in chrome, with IE it's working fine. ( You may clear the URL cache once, to confirm the same). I am still trying to make it work with chrome and please allow me some more time.

Hope this helps.

Thanks

Re: How would I block social networking but allow a single Facebook page?

HULK — Tue, 08 Jul 2014 21:04:47 GMT

Hello clint.leatherman,

After clearing the cache, it started working in Google chrome as well ( with SSL decryption in place):

Thanks

Re: How would I block social networking but allow a single Facebook page?

ClintL — Tue, 08 Jul 2014 21:21:06 GMT

Hey Hulk,

I believe my lack of a SSL decryption policy is the root cause (which probably also explains the SSL error I am getting). This is my first Palo Alto (and my first NGFW) so I'll have to read up on how to implement that. I appreciate the help on this and your thorough testing.

Re: How would I block social networking but allow a single Facebook page?

HULK — Tue, 08 Jul 2014 21:29:45 GMT

You are always WELCOME.

Thanks