topic Re: Allow downloading from Akamai or other CDNs in General Topics

Allow downloading from Akamai or other CDNs

SARowe_NZ — Tue, 12 Nov 2019 00:33:30 GMT

PANOS 8.1

Hi all - I have ongoing issues with trying to control downloading of files from CDNs. An easy example is .cab files used by Microsoft Office templates. When you download a template it goes off to a page off: templatesmetadata.office.net, but the actual file is stored in an Akamai cache.

I have a policy matching a custom URL category, allowing that (I've also tried *.office.net), URL. This policy has no file blocking profile.

This does not seem to work. However, if I exclude *.office.net from decryption it works around the issue and allows the download.

I don't understand why it would match for the no-decrypt policy, but not the URL category policy.

What is the correct and manageable way to allow downloads from CDNs where the container URL is known and trusted?

Thanks,
Shannon

Re: Allow downloading from Akamai or other CDNs

S.Cantwell — Tue, 12 Nov 2019 09:05:40 GMT

Good Day

I am just thinking out loud here, yet if you created a policy that allowed outbound traffic and used the URL filtering as a security profile (instead of using your custom url category as a matching condition) you may have some better luck (I believe)

I typically use an application such as web-browsing and ssl in combination of a URL matching condition in my policies.

Maybe, if you find out what the application that is being used, when accessing the Akami, you could give this a shot.

But I still believe the category should be used in your URL filtering profile, even if you need to create a custom rule/category/profile for your downloads.

Hope this makes sense to you. 😛

Re: Allow downloading from Akamai or other CDNs

SARowe_NZ — Tue, 12 Nov 2019 18:48:43 GMT

Thanks Steve!