topic Re: URL Filtering doesn't work with Google-base/quic/google-docs in General Topics

URL Filtering doesn't work with Google-base/quic/google-docs

SOC_CSG — Thu, 31 Aug 2017 15:24:29 GMT

Hi Everybody

I have a customer who whant to block this page "goo.gl/forms/NeclIZETrjUiyFBT2" (seems to be used as malware). We include it in "block list" in the Url Filtering Security Profile but it doesn't block it.

In monitor tab, the session doesn't appear in Url Filtering, it appears in Traffic, the paloAlto detects the flow as application "quic" or "google-base" o "google-docs" not as "web-browsing"

Is it possible to block this page or application BUT only for certains pages?

best regards

Re: URL Filtering doesn't work with Google-base/quic/google-docs

Remo — Thu, 31 Aug 2017 15:48:07 GMT

In order to do url filtering you need to block application quic or allow web acces only on 80 and 443/tcp.
Quic is a relatively new udp based TLS protocol and so far it is not possible to do tls decryption on this udp based connections. So paloalto is only able to see this application, but thats all.

Re: URL Filtering doesn't work with Google-base/quic/google-docs

SOC_CSG — Fri, 01 Sep 2017 09:46:36 GMT

What apps are checked by URL Filtering? Those which are classified as GeneralInternert->InternetUtility->Browser Based?

Is it possible to edit URL_Filtering to add more apps to be checked?

I also tried to create a new app based on web-browsing and create a AppOverride profile but this app is not check by the UrlFiltering.

Best regards

Re: URL Filtering doesn't work with Google-base/quic/google-docs

Raido_Rattameister — Fri, 01 Sep 2017 13:51:30 GMT

Web browsing is checked against URL filtering.

If it is HTTPS traffic then HTTP GET goes inside encrypted payload so Palo can get URL only from certificate.

To get and block full URL you need to decrypt traffic.

Chrome supports quic that can't be decrypted and must be blocked in firewall to force Chrome to fall back to regular SSL that can be decrypted.

Re: URL Filtering doesn't work with Google-base/quic/google-docs

SOC_CSG — Mon, 04 Sep 2017 11:41:20 GMT

Blocking "quic" force PaloAlto to use SSL to navigate to the page and applies the URL Filtering. But I'm having now problems to block the URL

The URL is "goo.gl/forms/NeclIZETrjUiyFBT2" if I put it in blocklist it doesn't works. It only block it if put the only "goo.gl"

is it possible to block an specific web-page instead than a whole domain?

best regards

Re: URL Filtering doesn't work with Google-base/quic/google-docs

BPry — Mon, 04 Sep 2017 23:21:43 GMT

@SOC_CSG,

I take it you are not decrypting traffic?

Re: URL Filtering doesn't work with Google-base/quic/google-docs

SOC_CSG — Tue, 05 Sep 2017 07:57:19 GMT

i'm not using any decryption profile.

best regards

Re: URL Filtering doesn't work with Google-base/quic/google-docs

BPry — Fri, 08 Sep 2017 14:53:59 GMT

@SOC_CSG,

That's why you are running into the issue. You can only get the cert information on encrypted traffic so you can block domains pretty easily but trying to block traffic destined for such a specific URL isn't going to work. Either you fully decrypt this traffic and disable quic or you won't be able to block that specific form with URL filtering.