topic Block Vpn in General Topics

Block Vpn

sib2017 — Tue, 15 Mar 2016 01:08:44 GMT

Hi,

How to block ssl vpn and ipsec vpn going from trust to untrust .

I suspect few users are using like free vpn services like tunnel beer and hola vpn .

How can i search those users from palo alto log.

Some users are connected from inside to outside world (for official purpose ) using cisco anyconnect (ssl ) and ipsec .And i don't want revoke their permission . ( I need only monitor those users )

Thanks

Re: Block Vpn

reaper — Tue, 15 Mar 2016 08:58:00 GMT

Hi Sib

as it's pretty difficult to differentiate between good and bad ipsec, i would recommend creating security policy based on user instead so you can allow certain users to have vpn tunnels while denying everyone else

please take a look at this article: Getting Started: User-ID

To be able to identify the different applications used you will need to enable ssl decryption: SSL decryption resource list

lastly, to control all vpn/encrypted tunnel applications, you can create a behavior based application group (called an application filter) which will automatically contain all applications that create encrypted tunnels, and use that in a security policy to control access to these applications

Re: Block Vpn

pulukas — Tue, 15 Mar 2016 10:14:15 GMT

You should consider deploying a url filter that has the category for proxy avoidance/ anonymizers blocked. This category is designed to block the activity you describe.