topic Re: How to block Internet Explorer in General Topics

How to block Internet Explorer

SThatipelly — Tue, 21 Jan 2020 18:43:04 GMT

I am trying to block Internet Explorer traffic going out to the internet from my internal users. I have decryption in place and followed this article: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClEdCAK

I am seeing some websites being blocked but some of them are not despite decryption. Has anyone tried blocking IE?

Please let me know.

TIA

Re: How to block Internet Explorer

BPry — Tue, 21 Jan 2020 22:26:38 GMT

@SThatipelly,

I find it slightly odd that the article is essentially just looking for Trident/ and isn't specifying the actual User-Agent string by itself. You could do something like below to limit this to just the User-Agent string, which is where this should be in the header anyways.

User-Agent:.+Trident\/

Also, keep in mind that the actual User-Agent string is easy to modify, so this is by far not going to be a fail-proof method of blocking IE.

Re: How to block Internet Explorer

SThatipelly — Wed, 22 Jan 2020 14:26:57 GMT

@BPry Thank you so much for your response.

I followed your suggestion and am blocking some sites. but, I can google search any webpage with no issue. I checked the user-agent string for the searches and they match my application but is still being allowed. I made sure decryption is turned on for google search and included all url categories in deny rule.

( user_agent contains 'Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko' )

Re: How to block Internet Explorer

BPry — Wed, 22 Jan 2020 14:48:24 GMT

@SThatipelly,

So to verify, the application signature that you have created for Internet Explorer is being matched when you are using IE? If the application is being identified correctly and the order of operations is correct in the security rulebase than this should be working without issue.

Re: How to block Internet Explorer

SThatipelly — Wed, 22 Jan 2020 14:50:22 GMT

@BPry Yes the application is matching IE traffic but not matching google searches although they are decrypted.

Re: How to block Internet Explorer

BPry — Wed, 22 Jan 2020 14:55:16 GMT

@SThatipelly,

Can you explain a bit more on what exactly you are trying to do here?

The custom app-id that you created, by default, will stop searching for further applications; so if I have a custom app-id internet-explorer for example, I would need to explicitly check the 'Continue scanning for other Applications' checkbox under the app-id's characteristics so that the firewall knows you want it to continue searching for additional signatures.

Re: How to block Internet Explorer

SThatipelly — Wed, 22 Jan 2020 15:03:41 GMT

@BPry Sorry for my poor explanation. As you might already know, there is a critical zero day bug discovered in IE browser and Mircosft hasn't come up with patch yet. So in the meantime, I would like to block all access to internet from IE browsers. After following your suggestion, I am able to block around 60% of the decrypted traffic. But for some sites like twitter, google etc, application still shows twitter-base and google-base although the user-agent string matches my custom IE application and are being allowed. I made sure they are decrypted.

Re: How to block Internet Explorer

BPry — Wed, 22 Jan 2020 15:12:28 GMT

@SThatipelly,

Okay, well the good news is that actually makes things easier. This simply means that for whatever reason that signature isn't matching for those sites, that's an easy thing to verify on my lab equipment and see if it's an actual application signature issue or something else.

What software version are you running at the moment?

Re: How to block Internet Explorer

SThatipelly — Wed, 22 Jan 2020 15:16:02 GMT

8.1.10. Thank you for your time testing this in your lab. 🙂

Re: How to block Internet Explorer

pkathiria — Sun, 26 Jan 2020 21:08:02 GMT

Just a suggestion, Can you block IE though GPO?

Re: How to block Internet Explorer

RobinClayton — Mon, 27 Jan 2020 10:31:11 GMT

If they are anything like us, we have some bespoke 3rd party applications that only play nicely with I.E...

Rob

Re: How to block Internet Explorer

SThatipelly — Mon, 27 Jan 2020 13:36:49 GMT

yes, we have some internal apps that work only with IE.

Re: How to block Internet Explorer

Remo — Mon, 27 Jan 2020 21:03:45 GMT

Probably the most secure way is to distribute a local firewallpolicy by GPO that blocks outbound access for the internet explorer process. This way you can still allow the access to internal websites or also specific websites in the internet (as long as they have static IPs).