topic Re: Proxy avoidance Issue in General Topics

Proxy avoidance Issue

homicidedart — Sat, 08 Mar 2014 12:38:44 GMT

Hello Gents,

We are facing an Issue with Palo Alto 5050, since we found some web proxies not seen by the Appliance, like

https://incloak.com/

and most of the dynamic proxies in this website are working

https://proxy.org/

Regards,

Maher

Re: Proxy avoidance Issue

jvalentine — Sat, 08 Mar 2014 20:54:44 GMT

They seem to be blocking on my Palo Alto Networks firewall. Do you have the "proxy-avoidance-and-anonymizers" category set for block?

Re: Proxy avoidance Issue

homicidedart — Sun, 09 Mar 2014 04:34:31 GMT

Hi Jared,

I don't have URL license, I'm using only application filters. So I blocked all proxy and encrypted tunnels applications. and it doesn't work.

Regards,

Maher

Re: Proxy avoidance Issue

jvalentine — Sun, 09 Mar 2014 05:30:10 GMT

Do you have an SSL Decryption policy configured and in use? Without decryption the application will be viewed as ssl, which I assume is permitted in your security policy.

Re: Proxy avoidance Issue

homicidedart — Sun, 09 Mar 2014 11:08:49 GMT

Yes, I've decryption policy in use that decrypts all the traffic.

Appreciated.

Maher

Re: Proxy avoidance Issue

Retired Member — Sun, 09 Mar 2014 14:16:33 GMT

You can use fqdn objects (in destination ip) for these two url and deny any traffic.So sites will not work even you use or do not use decryption.

Re: Proxy avoidance Issue

homicidedart — Sun, 09 Mar 2014 15:39:14 GMT

Hi panos,

thanks for your support, but it's not allowed to use FQDN in the destination IP.

Regards,

Maher

Re: Proxy avoidance Issue

Retired Member — Sun, 09 Mar 2014 15:44:20 GMT

You should first create these as fqdn object like below

Then you can use these objects inside policy

Re: Proxy avoidance Issue

Retired Member — Sun, 09 Mar 2014 17:12:02 GMT

Alternatively

if you use decryption you can easly use custom url objects and Url filtering profile without URL license.

you don't need a license for that.Just select this url profile for the realted traffic's policy.

Re: Proxy avoidance Issue

homicidedart — Sat, 15 Mar 2014 08:18:21 GMT

Thanks panos,

all is going very well now.

Appreciated.

Maher