topic Whitelist Java Traffic in General Topics

Whitelist Java Traffic

Kevin_Holleran — Mon, 14 Jan 2013 17:59:23 GMT

Good morning,

I am relatively new to the PA's, but was wondering if there was a way to have a list of URL's & domains to whitelist Java traffic & block everything else? And if so, can I then write any kind of regex to match specific java versions, say if we have an older version of Java that is required for a specific app for a specific site (or if its only internal and I want to block that specific older version for everyone?)?

Thanks for your help.

Kevin

Re: Whitelist Java Traffic

mharding — Mon, 14 Jan 2013 18:57:56 GMT

You can do that with the custom URL categories and data/file blocking profiles.

The only problem is the Java spec is written so that JAR files may look like ZIP files.

Re: Whitelist Java Traffic

Kevin_Holleran — Mon, 14 Jan 2013 19:41:26 GMT

Thanks. So I create a custom URL Category called Allow_Java and then I create a Data Block rule for blocking .JAR files. How do I tie bypass the Data Block rule just for Allow_Java sites?

Thank you.

Re: Whitelist Java Traffic

mharding — Mon, 14 Jan 2013 20:06:16 GMT

It would be two rules. One rule to allow Java on the Allow_Java category and then a second rule to block the JAR files from everywhere else (but you might still have that ZIP file problem).

After reading about the attack (Malware Intelligence Lab from FireEye - Research & Analysis of Zero-Day & Advanced Targeted Threats:Zero-Day Season is Not Over Yet) you might want to look at the Drive-By Download feature. And make sure you're updated to Content Release 349.

Message was edited by: Matthew Harding

Re: Whitelist Java Traffic

Kevin_Holleran — Mon, 14 Jan 2013 20:22:02 GMT

Thanks, I will look into that as well. For our long term Java strategy, part of it is going to be only allowing Java to known sites we need to interact with so the blocking is helpful too.

So, sorry to need continued direction, but I have created a File Block for JAR files & a Custom URL Category for allowed sites. I then create a rule allowing traffic to the allowed sites over HTTP & HTTPS, then I create a second rule for everything and link the File Block to it - is that correct?

Thanks.

Kevin

Re: Whitelist Java Traffic

mharding — Mon, 14 Jan 2013 21:44:09 GMT

Correct, but make sure your allow rule is above your blocked rule.

So it would kind of look like:

Allowed Java Traffic over HTTP/HTTPS

Blocked Java Traffic over HTTP/HTTPS

And if you aren't using SSL Decryption, the file blocking might not work on the HTTPS traffic.

Re: Whitelist Java Traffic

Priya_soni — Sat, 12 Feb 2022 15:31:47 GMT

If you need to allow more through , tweak a base whitelist with:

addTags(java. lang. String...)
addAttributes(java. lang. ...
addEnforcedAttribute(java. lang. ...
addProtocols(java. lang.

For More Visit :- Java