topic Re: Ultrasurf again - still getting through, how to block? in General Topics

Ultrasurf again - still getting through, how to block?

mtizani — Mon, 15 Aug 2016 06:37:28 GMT

Hi,

Even though the PA firewalls is detecting the traffic is Ultrasurf, the application is still working.

I've got a security rule to block by application 'Ultrasurf', and we have SSL decryption as well.

thanks

Re: Ultrasurf again - still getting through, how to block?

mtizani — Mon, 15 Aug 2016 06:51:06 GMT

Can see the traffic log here.

Re: Ultrasurf again - still getting through, how to block?

Hithead — Mon, 15 Aug 2016 12:28:38 GMT

first ssl and web-browsing allowed the traffic until ultrasurf could be detected...

i would suggest to block the url category proxy-avoidance-and-anonymizers

Re: Ultrasurf again - still getting through, how to block?

Brandon_Wertz — Mon, 15 Aug 2016 14:54:42 GMT

Yeah, like @Hithead said the application wasn't allowed, your logs state the connection was reset once Palo was able to identify the traffic as Ultrssurf.

In most cases Palo will "allow" the traffic to pass, then an application shift occurs and once that shift happens the traffic is stopped.

How long was the total session (packets)? From your screen shot, to me 3 seconds wouldn't be long enough to really get passed your security policy.