topic Re: Url filtring in General Topics

Url filtring

Karim_CHERRATI — Mon, 15 Oct 2018 14:19:54 GMT

Hello all,

Actualy we have 2 PA 3020 firewall in our company, we have some issue with the option URL filtring.

we have a policy block all user to acces to the web page with category (ex: games ...)

in the monitor, I find the users who are bloked but i can't find who are allowed.

there are some users working with proxy (web plugin), how can i identify them .

thank you for your support.

Re: Url filtring

LukeBullimore — Mon, 15 Oct 2018 14:23:35 GMT

You won't see URL log filtering entries if your configuration for that category is set to "Allow", is this currently set? If so, change the action to "alert" which will give you log entries.

Re: Url filtring

BPry — Mon, 15 Oct 2018 15:39:44 GMT

@Karim_CHERRATI,

In addition to what @LukeBullimore mentioned, if someone is using a proxy you won't see the URL of the proxied site. The whole point of using a proxy like that is to hide the traffic, in which case it's fairly effective. I would recommend that you simply block the 'proxy-avoidance-and-anonymizers' category so that the firewall will actively attempt to block these proxy sites.

Re: Url filtring

Karim_CHERRATI — Tue, 16 Oct 2018 08:47:13 GMT

Hello,

The problem is that the category proxy-avoidance-and-anonymizers is already blocked, but there are some persone installe proxy plugin in the navigator ex (kproxy, hoxx ...)

i can find a list with all proxy used, but there is no logs in the monitor.

Re: Url filtring

OGMaverick — Tue, 16 Oct 2018 14:48:12 GMT

You'll see those in the traffic or unified logs, not URL as it's an application and not URL category.

Re: Url filtring

BPry — Tue, 16 Oct 2018 17:15:49 GMT

@Karim_CHERRATI,

So you're looking at two different things in your screenshots.

One would be applications with the sub-cateogry of 'proxy'; so you could deny the applications. The other is simply a URL category that would stop the user from accessing proxy websites or services by URL.

Personally if you are trying to block all of the proxies that someone could be attempting to use, I would both both the URL cateogry and setup an application filter to block any of the app-ids that align with the proxy services. Just make note however that proxies are generally something that you'll never get more then 'best effort' on, as they pop up constantly.