topic Re: block flash in General Topics

block flash

felixn — Thu, 03 Nov 2011 22:33:04 GMT

When I "deny" application "flash" - flash is not blocked, do I have it all wrong or?

Thanks

Re: block flash

jleung — Fri, 04 Nov 2011 16:53:45 GMT

Hi,

May I know how you test the flash blocking? Have you seen the traffic log showing flash as the app? If yes, what is action shown for flash?

Regards,

Jones

Re: block flash

FlexyZ — Tue, 08 Nov 2011 08:42:10 GMT

http://www.dr.dk -> contains a lot of flash objects, and none of those get blocked when I deny "flash" in the policies.

Traffic looks like "web-browsing" and no flash, but maybe this is not possible at all?

Thanks

Re: block flash

gswcowboy — Tue, 08 Nov 2011 09:45:17 GMT

What PANOS and App-Version are you running?

Re: block flash

FlexyZ — Tue, 08 Nov 2011 09:58:37 GMT

I am running 4.1.0

Thanks

Re: block flash

gswcowboy — Tue, 08 Nov 2011 10:00:27 GMT

Thanks but what app-version is running on your Palo Alto?

Re: block flash

gswcowboy — Tue, 08 Nov 2011 10:11:52 GMT

Just ran the test on my end and I see that I'm blocking flash on that site previously mentioned.

802 flash DISCARD FLOW NS 192.168.85.134[4960]/L3-Trust/6 (10.30.6.85[10147])vsys1 195.137.194.128[80]/L3-Untrust (195.137.194.128[80])

Running 4.1 and app-version 274. Here's my top deny rule for the app which is followed by allow policy.

rkalugdan@lab-85-PA2050> show running security-policy
rule1 { from L3-Trust; source any; source-region any; to L3-Untrust; destination any; destination-region any; user any; category any; application/service flash/any/any/any; action deny;}

Src_NAT { from L3-Trust; source any; source-region any; to L3-Untrust; destination any; destination-region any; user any; category any; application/service any/any/any/any; action allow;

Re: block flash

FlexyZ — Tue, 08 Nov 2011 10:14:37 GMT

Is this what you are looking for

panupv2-all-contents-274-1169
panup-all-antivirus-607-821

Thanks

Re: block flash

gswcowboy — Tue, 08 Nov 2011 10:19:03 GMT

I was able to block flash per my previous comment and we're running the same content and panos version. I'd recommend calling Support or your Reseller to investigate as to why you're unable to block flash. Need to debug a littlte further.

Re: block flash

FlexyZ — Tue, 08 Nov 2011 10:25:27 GMT

I just inserted this top-rule

rule1 {
        from trust-dev;
        source any;
        source-region any;
        to untrust;
        destination any;
        destination-region any;
        user any;
        category any;
        application/service flash/any/any/any;
        action deny;
}

rule4 {
        from trust-dev;
        source any;
        source-region any;
        to untrust;
        destination any;
        destination-region any;
        user any;
        category any;
        application/service any/any/any/any;
        action allow;
}

Or is my order wrong? - because flash objects is still shows on http://www.dr.dk

Thanks

Re: block flash

gswcowboy — Tue, 08 Nov 2011 10:31:03 GMT

are you not seeing any flash sessions being discarded when you generate the traffic?

Re: block flash

FlexyZ — Tue, 08 Nov 2011 10:39:45 GMT

I only see "rule4" allow "web-browsing" for that site - nothing blocked (is my rules ok or?)

Thanks

Re: block flash

gswcowboy — Tue, 08 Nov 2011 10:46:06 GMT

Try this site.

http://waterlife.nfb.ca/

Re: block flash

FlexyZ — Tue, 08 Nov 2011 11:04:36 GMT

that seems blocked, but http://www.dr.dk still shows flash i crome, in IE it seems to be blocked.

can u try http://www.dr.dk in crome? and where can I see what is blocked?

Re: block flash

gswcowboy — Tue, 08 Nov 2011 11:13:58 GMT

I'm able to block flash content on FF, Chrome and IE for that site in question

Re: block flash

FlexyZ — Tue, 08 Nov 2011 11:18:11 GMT

wierd, so it looks like I configured it right, but there is something wrong right?

Thanks

Re: block flash

gswcowboy — Tue, 08 Nov 2011 11:19:20 GMT

For your issue, I'd contact your Reseller or PAN Support to get a more in depth debug session going to determine root cause.