topic Re: Dealing with Drop Box in General Topics

Dealing with Drop Box

payntonm — Fri, 12 Aug 2011 15:16:15 GMT

Hi,

Can some one help as we are new to this.

We want to blook and application call Drop box, Our users use this application to pull data from external networks wich we want to allow but we want to block drop box sharing our data off our network. could some one help me do this?

Re: Dealing with Drop Box

jleung — Sat, 13 Aug 2011 05:37:24 GMT

Hi,

We can identify dropbox as an app, and you have two options to control it:

1. deny all dropbox traffic by policy

2. allow dropbox, and use file blocking profile to deny file upload out of all of our supported file types (over 50 types now, including common office doc, common compressed file format such as zip and rar, and also encrypted compressed file format such as encrypted rar and zip) for dropbox.

Approch 2 should be more suitable to your scenario. Though 100% what you want to do, but should be very close.

Re: Dealing with Drop Box

snowcrash — Wed, 02 May 2012 02:10:02 GMT

Just an update to the discussion thread.

Dropbox is currently using a certificate which is not compatible with the PAN firewall (the PAN firewall conforms highly to the SSL RFCs). As a result, Dropbox SSL traffic cannot be decrypted, and its file operations cannot be detected. Dropbox's certificate is added to the ssl-decrypt exclude-cache list.

The following is a KP article listing sites which we are unable to perform SSL decryption on, and Dropbox.com is one of them.

<https://live.paloaltonetworks.com/docs/DOC-1423>

In general, these sites cannot be decrypted because they deviate from SSL encryption standards in one form or another (i.e. use proprietary encryption, require a specific type of certificate, etc).

The status of the Dropbox SSL certificate can be verified by looking at the ssl-decrypt exclude-cache file on the firewall using the following CLI command - it is shown as an unsupported cert:

admin@PA-200> show system setting ssl-decrypt exclude-cache | match 199.47.216.171
1 199.47.216.171:443 ssl 40874 CERT_UNSUPPORTED undecided

In summary, currently dropbox can be allowed or denied, but cannot selectively allow downloads while blocking uploads. This may change in the future if/when dropbox uses a compatible certificate.

Regards,

Tony