topic Re: Allow application facebook before denying application facebook-chat in General Topics

Allow application facebook before denying application facebook-chat

MP18 — Fri, 26 Oct 2018 02:22:06 GMT

Need to block facebook chat and allow Facebook for some user group.

i was reading this

Allow application facebook before denying application facebook-chat

Does it mean block facebook chat first then allow application facebook?

Re: Allow application facebook before denying application facebook-chat

JW6224 — Fri, 26 Oct 2018 20:19:34 GMT

I think it will depend on how you're allowing facebook.

https://applipedia.paloaltonetworks.com/

If you look for "facebook", that collection encapsulates facebook-chat. So if you have a rule that allows "facebook", you will allow chat, and if you want to block it, the deny rule needs to be a higher order rule above that. If you allow "facebook-base", then you can deny facebook-chat in a rule below it. By default, interzone traffic will be denied unless you have an implicit-allow rule in your policy.

One other approach is to look at controlling Facebook by using an Application Filter - Facebook is specifically described as the example:

https://live.paloaltonetworks.com/t5/Community-Blog/What-are-the-recommended-applications-for-internet-access/ba-p/153835

Re: Allow application facebook before denying application facebook-chat

MP18 — Fri, 26 Oct 2018 21:57:10 GMT

Thanks for replying to the post

Can you please confirm below

Allow application facebook before denying application facebook-chat

Does it mean block facebook chat first then allow application facebook?

Re: Allow application facebook before denying application facebook-chat

JW6224 — Mon, 29 Oct 2018 12:39:39 GMT

Yes. To remove confusion, let's see if I can get a picture that demonstrates.

I think this would do what you're wanting to do - let me know if this helps clarify:

That would deny anyone on "inside" from traffic identified as Facebook-Chat, but any other Facebook traffic would be allowed.

Re: Allow application facebook before denying application facebook-chat

MP18 — Mon, 29 Oct 2018 13:56:14 GMT

Thanks for confirming that.

Wording was little tricky.