Hot shield proxy- PA unable to block

Javith_Ali — Sun, 23 Apr 2017 06:45:07 GMT

we have created the application filter for proxy based apps-140+ apps are in that proxy filter which includes IKE, IPSec, Hot-shield etc except SSL.

This proxy-based app filter is called in the security policy (with block action). In addition to that, I have added the unknown-TCP, UDP and teredo, etc apps in same security policy.

All the traffic from test machine is decrypted.

Observation:

1, when I open the hot-shield proxy app in test PC, it is not getting connected.

2, But when I uninstall the hot-shield app and tried to connect again. its getting connected.

when I add the SSL app to block policy, point no.2 is not happening. I.e., hot-shield permanently blocked.

But i cant block the SSL traffics in my network, I have allowed SSL then tried to block hot-shield through URL categories. which is again not possible. Its keep on changing URL and going by Computer and Internet info URL category.

Please suggest how can i block Hot-shield proxy.

Re: Hot shield proxy- PA unable to block

tac.in — Tue, 25 Apr 2017 11:34:34 GMT

Hi Javith,

Proxies can be completely blocked only by decrypting SSL traffic . Please refer the below articles to enable decryption.

https://live.paloaltonetworks.com/t5/Configuration-Articles/How-to-Implement-and-Test-SSL-Decryption/ta-p/59719

https://live.paloaltonetworks.com/t5/Configuration-Articles/How-to-Configure-SSL-Decryption/ta-p/65073

Thanks,

Ram

topic Re: Hot shield proxy- PA unable to block in General Topics

Hot shield proxy- PA unable to block

Re: Hot shield proxy- PA unable to block