topic Re: Block http traffic to numeric URLs in General Topics

Block http traffic to numeric URLs

adminatspace — Fri, 17 Jun 2016 15:39:01 GMT

Hi,

I was ordered to block all http and hhtps traffic to addresses without a dns name. In other words user have to put in a network name in the browser and are not allowed to type an IP address in the address field.

As the thinking behind is blocking malware communication I have to block this traffic at the firewall and not at the browser. So I tried to setup a custom URL category with a site in the regexp form:

([0-9])+([0-9])?([0-9])?\.([0-9])+([0-9])?([0-9])?\.([0-9])+([0-9])?([0-9])?\.([0-9])+([0-9])?([0-9])?

but this doesn't seem to work, although this was declared in the Data Patterns section of the online help ( ..PAN_help/en/wwhelp/wwhimpl/js/html/wwhelp.htm#href=security.05.5.html )

Is there any smarter way to block access to numeric addresses without setting up more the 4 billion entries in a list?

thank You in advance

Peter

Re: Block http traffic to numeric URLs

pankaku — Fri, 17 Jun 2016 16:16:41 GMT

We can try doing by creating custom vulnerability profile. Here in pattern we can specify regex

Re: Block http traffic to numeric URLs

adminatspace — Fri, 17 Jun 2016 16:38:26 GMT

Thank You for the fast answer, I will have to look at this in detail on beginning of next week. I will give feedback if i was successful.

Peter

Re: Block http traffic to numeric URLs

BenjAudy.MTL — Fri, 17 Jun 2016 18:49:34 GMT

Hi,

Websites accessed using the IP address end up in the "unknown" URL category, so you could just block that category. You will also block uncategorized URLs, but those are often malware sites anyway.

Benjamin

Re: Block http traffic to numeric URLs

adminatspace — Tue, 21 Jun 2016 09:17:01 GMT

today I tried to set up a Custom Vulnerability Signature, like pankaj.kumar said, but I didn't succeed. I got the following error message:

Operation failed

threats -> vulnerability -> 41000 -> signature -> standard -> RY_Numeric_IP_Sign -> and-condition -> And Condition 1 -> or-condition -> Or Condition 1 -> operator -> pattern-match -> pattern '([0-9])+([0-9])?([0-9])?\.([0-9])+([0-9])?([0-9])? \.([0-9])+([0-9])?([0-9])?\.([0-9])+([0-9])?([0-9])?' is invalid. pattern must be at least 7 bytes
threats -> vulnerability -> 41000 -> signature -> standard -> RY_Numeric_IP_Sign -> and-condition -> And Condition 1 -> or-condition -> Or Condition 1 -> operator -> pattern-match -> pattern is invalid

I will also take a look at the "unknown" category, but I'm a bit afraid this will give a lot false positives.

Re: Block http traffic to numeric URLs

clewis1 — Tue, 21 Jun 2016 10:19:11 GMT

In regards to the 'unknown' blocking, it can create false positives but a lot of the time it is not work related traffic in our enviroment. We have implimented about a 75% block on 'unknown traffic by dropping 'unknown' url traffic to countries we do not typically do businesss with or where we feel it has been mostly malicious. Initially this left us with two countries which we are allowing 'unknown' url to. Howerver, we now have started to slowly block these countries by taking small internal ip blocks and monitoring this traffic looking for legit traffic (which somitimes is ip based urls) and recatergorizing or adding to a custom allow url profile. We have had a couple where users had to log a call to have us look at them but for the most part it has been a pretty smooth implementation other than being a bit slow.

Re: Block http traffic to numeric URLs

Raido_Rattameister — Tue, 21 Jun 2016 12:13:35 GMT

We block unknowns also.

If some new business related site pops up and users need access now not in 3-5 days when Palo has picked it up from Passive DNS monitoring then I just add this new site to custom url category and send url recategorization request to Palo.

Usually in 24 hours site is categorized and I can remove exclusion from custom url category.