topic Re: how to block shortened links? in General Topics

how to block shortened links?

SThatipelly — Mon, 30 Sep 2019 15:05:40 GMT

How can I effectively block shortened links on firewall? I can't figure a wildcard url format for them.

Please advise.

Re: how to block shortened links?

BPry — Mon, 30 Sep 2019 21:25:37 GMT

@SThatipelly,

Due to the limitations in place on the firewall, it's actually best to do this on your DNS servers.

Re: how to block shortened links?

SThatipelly — Tue, 01 Oct 2019 12:56:31 GMT

do you know how to block them on DNS servers? is there a standard way to do it?

Re: how to block shortened links?

OtakarKlier — Wed, 02 Oct 2019 19:10:57 GMT

Hello,

One way is to sinkhole then on your dns. Meaning have them resolve to an IP that goes no where or that you block on the PAN. That way the dns never resolves and the user never gets there.

Cheers!

Re: how to block shortened links?

BPry — Wed, 02 Oct 2019 19:13:02 GMT

@SThatipelly,

The standard way would be to create a DNS entry for the domain on your internal DNS servers; the entry would reference an IP that, as @OtakarKlier mentioned, you've either blocked or setup specifically as a sinkhole host.

Re: how to block shortened links?

SThatipelly — Wed, 02 Oct 2019 19:15:07 GMT

thank you @BPry @OtakarKlier . I'm doing DNS sinkhole on many domains but the issue I'm facing with shortened links are they don't have a specific identifiers/domain names.

Re: how to block shortened links?

OtakarKlier — Wed, 02 Oct 2019 19:17:27 GMT

Hello,

Gotcha, however the shortened links should resolve to the full ones at some point and the PAN should be able to block those via categories.

Regards,

Re: how to block shortened links?

SThatipelly — Wed, 02 Oct 2019 19:28:39 GMT

True. Shortened URLs in emails really cause issues to both admins and users . We train our users to look at the link before clicking them but these links are giving them hard time. so, I was looking at blocking them in the initial stage itself.

I wish Palo has a url category called 'shortened links'