topic How to Block specific HTTPS Sites? in General Topics

How to Block specific HTTPS Sites?

PhLang — Thu, 15 Mar 2018 14:17:07 GMT

Hello,

I'm struggling to block some internal https sites.

I have to block various sites/urls of a server from a specific zone, while I have to keep some others open

The urls look like:

https://servername.suff.dom:8443/aaa/bbb/ccc/ddd/eeeee_ff_application1

Now I have to block application1 to application 4, while keeping 5 to xx open. Btw I dont know how many applications there are on this host, because it is managed by another team.

So the goal is to keep the access open and block specific application-urls

What I have done so far and didnt work out:

Created a custom URL category with the urls to block in it and added it to a deny rule

Created an URL Filter setting all categories to allow and added the urls to the block list

Tried various url substrings:

servername.suff.dom:8443/aaa/bbb/ccc/ddd/eeeee_ff_application1

aaa/bbb/ccc/ddd/eeeee_ff_application1

/aaa/bbb/ccc/ddd/eeeee_ff_application1

Do you have any ideas how to do that?

Kind regards,

philip

Re: How to Block specific HTTPS Sites?

BPry — Thu, 15 Mar 2018 14:29:28 GMT

@PhLang,

Are you decrypting HTTPS traffic, because if not then 'abandon all hope ye who enter here'.

Re: How to Block specific HTTPS Sites?

PhLang — Thu, 15 Mar 2018 14:35:16 GMT

Of course I have an decryption policy otherwise I couldnt check the full url.

kind regards,

Philip

Re: How to Block specific HTTPS Sites?

BPry — Thu, 15 Mar 2018 14:42:41 GMT

@PhLang,

That's what I wanted to check, some thing that the firewall can see the full URL regardless of whether or not they decrypt the traffic.

Re: How to Block specific HTTPS Sites?

PhLang — Thu, 15 Mar 2018 14:50:40 GMT

Hi,

thanks for the help! Maybe I was working too much today 🙂 Found the fault, regardless it was mine - there was a typo in the fqdn of the object....

kind reagards,

Philip

Re: How to Block specific HTTPS Sites?

BPry — Thu, 15 Mar 2018 14:50:55 GMT

@PhLang,

I was trying to think of reasons why it wasn't working and couldn't really come up with any. Glad that you found the typo!