Block web browsing but allowing other apps.

inderjit21 — Mon, 08 May 2017 00:09:18 GMT

I need to block webbrowsing but allow other apps which has web dependency.

Trust to untrust - all allowed. But when I deny webbrowsing from trust to untrust other apps like skype stops working.

Requirement is only web-proxy ip is allowed webbrowsing from trust to untrust.

How do we overcome this issue.

Re: Block web browsing but allowing other apps.

Raido_Rattameister — Mon, 08 May 2017 03:04:22 GMT

You can't allow apps that depend on web-browsing and block web-browsing at the same time.

There are few exeptions. One example is Facebook. Based on SSL certificate Palo can identify it and let it through even if web-browsing is blocked.

But usually HTTP GET follows TCP 3way handshake and based on server reply traffic is identified as web-browsing. Exact application is identified later when more traffic is seen.

Year ago when I troubleshot Captive Portal issue I saw that Skype sent HTTP GET to conn.skype.com (there might be more but this is what Skype was hammering when Captive Portal was blocking traffic) so if you look where your apps connect to you might be able to create custom URL category and permit only those limited sites.

topic Block web browsing but allowing other apps. in General Topics

Block web browsing but allowing other apps.

Re: Block web browsing but allowing other apps.